This website uses Cookies. Click Accept to agree to our website's cookie use as described in our Privacy Policy. Click Preferences to customize your cookie settings.
I have a situation where I need to advise some clients and users that
the default `Unix System` parser will parse N event types from the Unix
System log source. This leads me down a path of investigating from the
documentation on what that actually w...
Hey Folks, I ran into a situation today where I wanted to delete a
reference list but couldn't figure it out. Does anybody know how to
delete a reference list from the Chronicle SIEM console or via the API?
For context, here are the reference list do...
If your environment has ingested an entity, you can query that entity
(such as an IP). On the overview page of the UDM search, you will then
get the entity information, for example an IP will show you the IP, it's
prevalance, etc. At the bottom-right...
Google or an MSP are the only ones that I know of which are allowed to
deploy the instance. Once the instance is deployed, they will give you a
`nonce` or a `one time activation code` which you tie into your new
Chronicle project via the SecOps page.
Another good bit of information to know is that the parsers leverage
Logstash so if the Google documentation runs into a dead-end, you can
try to search for "Logstash " and it should get you going a
bit further. There are the Logstash forums which al...
I was advised by a Chronicle Engineer that the ops agent shouldn't be
used for Linux as it was not supported by the parser. I know it can ship
it but there were some issues happening. We were advised to use the
forwarder/collector instead. This was o...
