About meshorer

meshorer · ‎03-29-2025

Hi @richgalloway , could you explain how it affects the amount of data returning from the insexers to the SH? I know that the command says which fields should be discarded or retained, but if the field specified is not an indexed field and I didnt use "rex", meaning that I refer to an "interesting field" which according to my understanding is extracted in the SH, how can it affect the amount of data? unless you are saying that using "fields" command indirectly tells the indexers to extract those fields.

meshorer · ‎03-29-2025

Hi @richgalloway , thank you. 1. by saying that indexers also perform search-time field extraction, you mean that the "interesting fields" can be extracted by the indexers? my thinking is that those fields need to be seen in at least of 20% of the events, and this kind of calculation can be performed at the search head. 2. by specifying a field using "fields" command (which is not an indexed field or field extracted with 'rex'), will it be extracted on the on the search head or on the indexers (assuming it fits for distributable streaming)? Overall I am trying to understand if using 'fields' command by specifying a regular field (and not an indexed one) it affects the amount of data returning from the indexers to the search head.

meshorer · ‎03-28-2025

Hello all, I am trying to understand the type of fields command. Documentation says it is a "distributable streaming" which means it can be run on the indexer, which improves processing time. If I use fields command to specify fields which are extracted in the search head (using field discovery for example) , how can it still considered as distributable streaming? If I am not mistaken, field extraction on the indexers is possible using rex command or with indexed fields. Thank you in advance!

meshorer · ‎12-12-2024

hello all, I see that SOAR sends a mail every time a Container re-assigned takes place. I wish to disable SOAR from sending that email, but under Administration -> Email Settings I only manage to change the template of the email. is there a way to stop it? thank you in advance 🙂

meshorer · ‎10-29-2024

Hello all, I configured an app and in the asset conf, I added an environment variable "https_proxy", but somehow I see that the action still go out via the proxy, but tries to go directly to the destination address, I opened the app code to see the referring to this variables, but I couldn't find it. Can anyone shed light and explain how can I check the referring to those variables? in other apps I manage to use the proxy variable successfully, it only happens to me with AD LDAP app

meshorer · ‎06-03-2024

Hello All, I enabled my indicators feature with "/opt/phanton/bin/phenv set_preference --indicators yes" I have two pronlems that might be connected: 1. I only enabled three fields in the Indicators tab under Administarion, but still SOAR created many indicators on fields that configured as disabled. 2. I see that enabling the indicators feature consuming all my free RAM memory, and I have a lot of RAM so I unserstand that there is a problem with this. anyone can say why and how to solve?

meshorer · ‎05-29-2024

@phanTom ok so maybe there is a way to use IN operator on values in custom fields? For exmple custom field key is department, and i want to sort for values buisness, HR

meshorer · ‎05-29-2024

Hello, is there a way to use a rest api and search for containers that contain the word computer or the word process in the container name? I only manage to filter for “contains” or the filter “in”, , but i failed to use both.

meshorer · ‎05-21-2024

Hi all, in the past I used a CLI command to disable indicators feature. do you know how can I enable it back?

meshorer · ‎04-15-2024

Hello, 1. Is there an option (built in or manually built) for a container to view history of the older containers with the same artifacts and details ? It can make an analyst work easier to see notes and how the older case was solved. 2. by enabling “logging” for a playbook, where opt logs are stored to access later on (beside vie debugging in the UI..) thank you in advance!

meshorer · ‎04-04-2024

thank you, is there a remediation for that issue? I mean ok I monitored and an alert was fired, now what?

meshorer · ‎04-04-2024

hello all, I noticed that timestamp in activity log is in UTC, and also while using timer app and in the event name adding "$now()" ,the timestamp is also UTC. it is not the time zone I defined in the user settings nor in the administration/company settings. is there a way to change the time zone from UTC to different time?

meshorer · ‎03-27-2024

Hi, I have an app that ingest offenses from a SIEM system (qradar). One time there were a few thousands offenses to ingest at the same time, and it caused to an error in the app ingestion. But none of the offenses were ingested for a few hours. Is there a way to alert when there is an ingestion error for an app, and maybe a way to fix it?

meshorer · ‎03-14-2024

@phanTom yeah I got confused with the escaped "{} ". you are the best!

meshorer · ‎03-14-2024

@phanTom thak you so much! could you also tell me how to add two fields in the same action?

meshorer · ‎03-14-2024

hello all! I am trying to add field to an artifact with "update artifact" action (phantom app). i am trying to add a 'message parameter' in the 'value' at the cef_json field: for example: {"new_field": {0}} but unfortunately I get "key_error" and the action failed. how can I solve it?

meshorer · ‎02-13-2024

hello all, I have an app that to perform an action I cant insert the required parameter as a list. but as a string. this is a bit issue because I am using data value from action results as the parameter to insert, for example: "my_App_action:action_result.data.*.device_id" and as far as I understand, action_result.data collection is always an array. so I can not use directly this action results returned parameter as a parameter to insert to my action. the only workaround I found is to add a code block that gets the datapath-parameter as input, and outputs the value_name[0]. is there a better workaround for this?

meshorer · ‎02-04-2024

hi @scelikok , understood, thank you. I would love to hear from you how you recommend to monitor system health. I thought of rest call "health" in a playbook to run every few minuets. if you have another idea, please do tell 🙂

meshorer · ‎02-04-2024

hi @scelikok so what happens when I reach the size limit in my server?

meshorer · ‎02-03-2024

hello all! is there a default time that events (containers/cases) are stored in the SOAR server to approach to? and if so, can I change the time? @phanTom Thank you in advance

meshorer · ‎01-21-2024

thank you for your answer, @jenniandthebets I did not want the playbook to run at at all but I see that there is no way out of it. if that is the case, why is there an option to choose tags when creating a playbook? 2. as for the datapath, I believe the filter should be [in] and not "==". anyway it did not work well for me all the time, I found that if I first create a simple code block that only gets the "container:tags" as input at outputs it as a variable, only then the filter works well. am I the only one it happens to?

meshorer · ‎01-18-2024

thank you @Carloszavala121 but I am not talking about labels, I am talking about tags. for me the labels with the “operate on” is great as I use a label called offense. but within the offense label, I categorize my offenses to tags. And there is an playbook that I want to automate to specific offenses with that tag

meshorer · ‎01-18-2024

Hello all, is there a way to automate playbook to work only on events with specific tag? I saw in playbook settings an option to choose tag but it stills run on every event thank you in advance @phanTom @SOARt_of_Lost

meshorer · ‎01-09-2024

Hi @phanTom my version is 6.1.1

meshorer · ‎01-09-2024

Hi, attached is a screen shot to show you what I mean is there a way to change the color if the text or the background in the console output? @inventsekar @phanTom

Posts	45
Solutions	0
Karma Given	1
Karma Received	3
Member Since	‎10-23-2023

Online Status	Offline
Date Last Visited	‎03-29-2025 02:17 PM

Type of Fields command

How to stop soar from sending emails for Container...

accessing the asset's environment variables in the...

Issues with Indicators feature

Rest api filtering

Enable indicators feature

View history of same containers

how to change timestamp in activity log from UTC?

Ingestion stuck due to overload

can't add artifact field with message parameter

Re: Type of Fields command

Re: Type of Fields command

Type of Fields command

How to stop soar from sending emails for Container...

accessing the asset's environment variables in the...

Issues with Indicators feature

Re: Rest api filtering

Rest api filtering

Enable indicators feature

View history of same containers

Re: Ingestion stuck due to overload

how to change timestamp in activity log from UTC?

Ingestion stuck due to overload

Re: can't add artifact field with message paramete...

Re: can't add artifact field with message paramete...

can't add artifact field with message parameter

get datapath variable as a string rather then a li...

Re: for how much time events are stored in the ser...

Re: for how much time events are stored in the ser...

for how much time events are stored in the server?

Re: Run playbook on specific tag events

Re: Run playbook on specific tag events

Run playbook on specific tag events

Re: can't see results with dark theme

Re: can't see results with dark theme

Are you a member of the Splunk Community?