About Tonio

Tonio

Hello everyone!We are receiving logs containing, among others, a responseBody from API calls. The log generator has a limiter of 2000 chars per field, which is fine for most of the cases, but a specific API calls always generates longer responseBody....

Tonio · 06-26-2024

Hello, I have just found a number of collaborators accounts on our SOAR platform been disabled. Since nobody from my team did this, I suppose some kind of conditions were matched, like long absence or similar.Is there a way to know what these conditi...

Tonio · 06-21-2024

Hello everyone,We activated most of the curated detection rules that are available within SecOps SIEM (about 150 of them), but we are receiving close to none alerts from them (only one or two have been triggered so far). For how much I whish to think...

Tonio · 05-27-2024

Hello everybody!A client requested to inject "Sharepoint" into their SIEM instance so, as usual, the first thing I have done was to check with the supported log type list. Here I can find, as supporter but not available: "Microsoft SharePoint - SHARE...

Tonio · 05-13-2024

Hello everyone,I am trying to develop a new integration/action, and from the IDE documentation I see the 'SiemplifyAction' library, much useful to extrapolate and work with info from the case/alerts. From these pages I see details on its modules but ...

Tonio

Dear all, in the attempt to be helpfull, I am posting a first code draft I have done to manage truncated JSONif [JSON_field] != "" { json { source => "JSON_field" target => "response" array_function => "split_columns" on_error => "_error_responseBody...

Tonio

Thanks @manthavish, I thought about that too, but I was hoping on some other feature available, since for/while loops are not supported I will try working on that, thanks A

Tonio

I see! Thanks for your replies everyone!A 

Tonio · 05-27-2024

Many thanks @manthavish!May I ask you also some more insights about this? Since I have no familiarity with this product, how much should I concern myself about not-auditing logs? Would I find relevant security-related info also in those? Thanks again...

Tonio · 05-21-2024

Those are quite the good hints. Thanks Moseis, I will definitely dive in them.A

My Stats

Keno's Bio

Badges Tonio Earned

Recent Activity

Parsing truncated JSON logs

What are the triggers that automatic disable SOAR accounts?

Better understanding of curated detection rules

Sharepoint parser or not?

Is there any SiemplifyAction library classes/objects list?

Re: Parsing truncated JSON logs

Re: Parsing truncated JSON logs

Re: What are the triggers that automatic disable SOAR accounts?

Re: Sharepoint parser or not?

Re: Is there any SiemplifyAction library classes/objects list?