Bronze 4
Since ‎04-26-2024
2 weeks ago

My Stats

  • 19 Posts
  • 0 Solutions
  • 6 Likes given
  • 11 Likes received

chrisd2's Bio

Badges chrisd2 Earned

View all badges

Recent Activity

Hello guys,I noticed that for some API endpoints, the URL path is : https://chronicle.googleapis.com/v1alpha/{api_version}/projects/{project_id}/locations/{region}/instances/{instance} (instances.get), but I could not figure out what the api_version ...
Hello everyone,I wrote a parser extension ("code" mode) for a log_type in order to add a couple fields that were not handled by the default parser.I mapped a couple raw fields to UDM fields under security_result in the parser ext.Problem: I noticed t...
Hello guys,Context :I'm working on some custom parsers for some logs that cannot be made native-SecOps-parsers-compliant. Once the parser is done, I need to validate it against a large number of logs. In order to do so, I export a few tens of thousan...
Hello all,I just came across the v1alpha API endpoint "logTypes.create" (link)I thought it had to be requested and then provided by Google.Does it mean that SecOps customers are autonomous for custom log_type creation ?If so, what is Google advice fo...
Hello guys,Let's say I have a YARA-L rule I want to tune. I have a host-based whitelist and a username-based whitelist. I don't want any alert if the user in the log is in the username-based whitelist or if the host in the log is in the host-based wh...