I realise this is possible sacrilegious, but here goes. We're looking to move all our Splunk stuff over to Google Chronicle. We used an app on Splunk cloud that is no longer supported, so this needs to be done as quickly as possible. Eventually we will replace the Splunk forwarders with an agnostic solution, but until then I figure we might just be able to use the current heavy forwarder and direct it to the Chronicle instance. Is it as simple as this sounds, or am I really oversimplifying? ... View more

Hi all. We currently use Alert manager to annotate apps, and for several of them we have a drilldown that inputlookups a lookup table, edits it, then outputlookup it after. This means the team can use drilldowns to verify activity from users or suppress notifications for example. Due to a small (but inevitable) incident where a lookup table was erased, we are now looking to utilise the Lookup Editor app so as to have some sort of version control. However looking at it, it seems that version control is only maintained if the table is edited in the Lookup Editor app itself? Does this mean that drilldowns will not cause a backup to be made, and instead we'll have to have a link to this table in the app instead?  If so thats fine, but can values from an alert be parsed through to edit fields already? Or would any modifications to the tables have to be copy/pasted? Thanks in advance ... View more

Hi all. This rule has been driving me crazy for a while now, and the teams working on it too. Just looking for a way to track standard commands for user and/or group modifications. I tried using the built in syslog keys [index="*" (sourcetype="syslog" (key=user_modification OR key=group_modification OR key=etcgroup OR key=etcpasswd)] and while this works, it throws up so many false positives such as users whose password is changed by CyberArc.  Has anyone had a similar issue and how did you best fix/monitor it? ... View more