About Tonio

Hello everybody!A client requested to inject "Sharepoint" into their SIEM instance so, as usual, the first thing I have done was to check with the supported log type list. Here I can find, as supporter but not available: "Microsoft SharePoint - SHARE...

Hello everyone,I am trying to develop a new integration/action, and from the IDE documentation I see the 'SiemplifyAction' library, much useful to extrapolate and work with info from the case/alerts. From these pages I see details on its modules but ...

04-10-2024

Hello everyone,I am having a quite hard time trying to parse a MalwareByte logs in CEF + KV format, since the kv pairs are separated by a simple space and several values contains spaces as well. Here a (reconstructed) example: <13>Apr 8 14:59:06 cerc...

03-26-2024

Hello everyone,I am in the process of finalizing a parser, trying to debug the validation errors I recive when adding themutate {merge => {"@output" => session "event"}} Here I encountered a strange behavior of the response: it keeps changing, even t...

Many thanks @manthavish!May I ask you also some more insights about this? Since I have no familiarity with this product, how much should I concern myself about not-auditing logs? Would I find relevant security-related info also in those? Thanks again...

Those are quite the good hints. Thanks Moseis, I will definitely dive in them.A

04-10-2024

That's great @mikewilusz! thanks so much for the fast solution. So it cames out that the capturing group functions are available, do you confirm? I must have misread about it!Many thanks again! A

03-07-2024

That's just the customer request. I am kind of understanding that's the best way to go by a long shot, so I will try to push it.Still, it would be good to know if there is a different way, as a general knowledge.thanksA

03-03-2024

Hello,I am reopening this because I have some Windows servers (AD, DNS, DHCP) that needs to send logs to Chronicle Forwarder on-prem (docker on windows VM), and NXLog is not an option for us. We tried following this guide to setup subscriptions from ...

My Stats

Tonio's Bio

Badges Tonio Earned

Recent Activity

Sharepoint parser or not?

Is there any SiemplifyAction library classes/objects list?

Parsing CEF format or other fields containing separator character within

Parser validation random responses??

Re: Sharepoint parser or not?

Re: Is there any SiemplifyAction library classes/objects list?

Re: Parsing CEF format or other fields containing separator character within

Re: Ingesting Windows logs into Chronicle

Re: Ingesting Windows logs into Chronicle