Hi,Does anyone have any experience with creating a YARA-L rule that looks for a particular event such as a vulnerability detected on a particular host but if that same vulnerability is detected in an event on the same host again within 24 hours, then...

Hi,Has anyone got any experience with creating a YARA-L rule that detects when a log source drops ingesting? I was hoping for a possible quick win here instead of using a dashboard.Thanks

Hi, My reading suggests otherwise but wanted to ask on here whether anyone had successfully managed to create a rule that looks up an external list i.e an external URL which holds a list of known Cobalt Strike IP addresses. My reading suggests this i...

Is there anyway of querying via a UDM search to find alerts that have triggered?Thanks

Hi all, I am having an issue with the error message in the title field and some help would be really appreciated. I have wrote a YARA-L rule in Chronicle which captures various matching powershell command and decodes the successful match using the st...