About NEIO

NEIO · 07-19-2024

Hi Team,I require assistance with fine-tuning the rule: ["recon activity detected from internal host"] to minimize false positives and optimize its performance. Your support in this matter would be greatly appreciated.PFA. rule recon_activity_detecte...

NEIO · 07-11-2024

Hi Team,There is an ongoing Vulnerability Assessment and Penetration Testing (VAPT) activity involving port scanning. However, no alerts are being generated in Chronicle SIEM for this activity.Could you confirm if the following rules are appropriate ...

NEIO · 07-10-2024

Hi Team,We have successfully integrated several supported Threat Intelligence (TI) platforms. However, we need guidance on properly configuring these integrations within our Security Orchestration, Automation, and Response (SOAR) system to ensure the...

NEIO · 06-12-2024

Hi All,I wanted to know if we can embed chronicle SIEM data source to Google Looker so that it helps us to create dashboards and reports in chronicle SIEM.Thanks,Neha.H

NEIO · 06-10-2024

Hi All,I wanted to know if we can embed chronicle SIEM data source to Google Looker so that it helps us to create dashboards and reports in chronicle SIEM.Thanks,Neha.H

NEIO

Hi @SoarAndy ,I agree with your point that the entities aren't being enriched because there's no malicious activity associated with them—this is likely the case. Now I understand that we need to analyze the entities more thoroughly and select the sco...

NEIO

Hi @SoarAndy ,As you mentioned, can i try selecting the option as "External Entities" ? And one more thing to add in here, to avoid the error message specific to certain entities i have selected "All Entities" .Still getting the same issue.Can you su...

NEIO · 08-19-2024

Hi @kirk2 ,We have integrated and made sure that it fits all the requirement. But still we are getting error for the same TI platform stating that all the entities are not enriched.Sharing you the screenshot for the reference.Thanks,Neha.H

NEIO · 07-24-2024

Hi @SoarAndy ,Thank you for your guidance. Greatly appreciated.Thanks,Neha.H

NEIO · 07-21-2024

Hi @jstoner ,Instead of defining single IP's from multiple subnets, can we create a group and define in the rule.PFA the range of IP's we have blocked.Thanks,Neha.h

My Stats

NEIO's Bio

Badges NEIO Earned

Recent Activity

Optimizing the rule Recon activity

Finetuning Rules

Integration of Threat Intelligence Platform in Chronicle secops

How to embed data source from chronicle SIEM to Google Looker.

How to embed data source from chronicle SIEM to Google Looker.

Re: Integration of Threat Intelligence Platform in Chronicle secops

Re: Integration of Threat Intelligence Platform in Chronicle secops

Re: Integration of Threat Intelligence Platform in Chronicle secops

Re: Integration of SMTP email in Chronicle SOAR

Re: Optimizing the rule Recon activity