About mccrilb

mccrilb

Does anyone use the SSH integration through the remote agent?when I try to run even just a basic command the IDE spins and finally times out. I suspect it is because the key needs to be accepted, but there doesn't seem to be an option to add the key ...

mccrilb · 04-04-2024

How many of us will be at Google Next? I will be, and one of the items that I would like us to do as a community is to share our rules. Why do we all work in a vacuum? I am sure some people have some killer rules that they could share. We are in the ...

mccrilb · 04-04-2024

I have been writing several of my own IDE integrations. I have not had issues with the ones that require just an action and a simple response. However, I have not figured out how to get the JSON output to work where I can use the JSON picker with the...

mccrilb · 03-08-2024

I have two feature requests if anyone is interested. Also the API is pretty well documented if you don't want to wait. All info is below.Integration: URLhaushttps://issuetracker.google.com/issues/328715673Description:URLhaus provides a database of ma...

mccrilb · 07-03-2023

I can't believe that I am the only one that finds themselves constantly doing this.I am working with a new function in Crowdstrike (Submit URL) and sure enough, it fails if there is more than one input. I have lost count of the number of applications...

mccrilb

I do this with the CrowdStrike integration. But you should also be able to do it with the UDM, but without knowing what your logs sources are it is hard to say. If you can figure out the query in the SIEM with your log sources to return the data that...

mccrilb

I have been using the Set and Get Scope Context Value in the Siemplify Functions. You can create a variable with the playbook that can be set to be Alert, Case or Global in context. And then use that output as input into your other playbooks.

mccrilb

I also do this and I can't say I have seen this issue, but I can't say that it is the very next step in the playbook.Verify that you are setting the Entity as your playbook is expecting?Maybe try using the Entity Selection under the Flow in the Actio...

mccrilb

I found a function in the Tools that will allow me to do this in a playbook. Buffer that will take a sting input and format it to JSON.

mccrilb

Thanks!I am using the Run command on a remote machine function from the IDE.I am trying to run a single command to start with"conf t"when I run, it will spin for several minutes and then stop with no output returned. I have confirmed that I have conn...

My Stats

pierce999's Bio

Badges mccrilb Earned

Recent Activity

SSH Integration

Google - Next - Content Development - SIEM

SOAR IDE and JSON Output

URLhaus and SPAMhaus

Integration Frustration

Re: Get Hostname from IP address

Re: Array string

Re: Entity Is_Internal Not Being Reflected

Re: SOAR IDE and JSON Output

Re: SSH Integration