About krunalm

02-07-2024

Hi all,I'm trying to see if there's a way to fetch AI generated investigation notes within Case Overview in a playbook. The idea is to help provide a brief summary generated by the AI feature within Chronicle SOAR. Any ideas to do this would be helpf...

11-14-2023

Hello,I'm using alert grouping for Microsoft defender cases and so multiple alerts get grouped based on the Incident ID being the same for all. However, each one individually gets a playbook running and I'm not sure if there's a way to have all other...

09-03-2023

Has anyone been able to use "filter" function within the JSON result pop-up? I've tried multiple times but I'm getting error saying invalid key, not found. Any working examples would be much appreciated! Thanks!

08-27-2023

With current features, is there a way we can control number of simultaneous playbook runs per environment? For example, we're facing issues where multiple playbooks run if multiple cases are ingested for a single environment and that skews our playbo...

08-14-2023

Is there a JSON function so that we can get a count for certain field and group them by distinct values. So the JSON result have the following response: { name: John, name: Kevin, name: John, name: Sara, name: John } The output should be - John(3), K...

11-16-2023

That's a great idea Louis - I'll definitely try and implement this logic and see what can be done. Although I'm surprised this is not just done out of the box by an action since "Alert Grouping" is such an important USP in Chronicle SOAR.Thanks again...

09-11-2023

Can it have a placeholder from alert data? For example, return JSON node where "entity" = "source IP" (from alert data)

09-11-2023

Can it return a specific field based on the value of a different field? So in your example case, it could be returning all case.Name where priority=P4?

09-03-2023

Yup exactly this but using the filter function from the right-side menu

08-27-2023

They aren't necessarily duplicates but share certain common entities that could compile them into a single escalation. Our playbooks look for the commonality and decide whether or not they get escalated commonly.

My Stats

krunalm's Bio

Badges krunalm Earned

Recent Activity

Fetch AI generated Investigation notes

Handle playbook runs with Alert grouping

Has anyone been able to use "filter" function within the JSON result pop-up?

Is there a way to control the number of simultaneous playbook runs per environment?

Is there a JSON function that we can get a count for certain field/group them by distinct values.

Re: Handle playbook runs with Alert grouping

Re: Has anyone been able to use "filter" function within the JSON result pop-up?

Re: Has anyone been able to use "filter" function within the JSON result pop-up?

Re: Has anyone been able to use "filter" function within the JSON result pop-up?

Re: Is there a way to control the number of simultaneous playbook runs per environment?