Immersive Labs- Create a detection rule - Google SecOps
a { text-decoration: none; color: #464feb; } tr th, tr td { border: 1px solid #e6e6e6; } tr th { background-color: #f5f5f5; } Hello everyone, I hope you can help me. I am currently taking the "Google SecOps Fundamentals: Demonstrate Your Skills" course, and I am stuck on Task 12, where I need to create a detection rule. I have already created the rule, but the lab is not recognizing it or marking the task as completed. The instructions say that I need to create a rule that detects communication with one of the specified domains. I have configured the following rule, but I'm not sure if it is correct. I am not very experienced with Chronicle/Google SecOps, so I am having trouble understanding what I might be missing. Does anyone know what could be wrong or what additional configuration is required for the task to be validated? Any guidance would be greatly appreciated. Thank you! This is the rule I created: rule lumma_c2_iocs { meta: author = "Diana Quezadas" description = "Detect DNS queries to known Lumma C2 IOC domain." severity = "HIGH" events: $e.metadata.event_type = "NETWORK_DNS" $ioc_url = $e.network.dns.questions.name re.regex( $ioc_url, `(?i)^forbidstow\.site$` ) outcome: $domain = array_distinct($ioc_url) $risk_score = 85 condition: $e }
Microsoft Sentinel Deployment & Log Ingestion: Ingesting Platform Logs via Diagnostic Settings
Hello Immersive Labs community, I’ve been working through the lab tasks and successfully completed tasks 1 through 6. However, I’m stuck on task 7, which asks: "A storage account has been deleted. What would be the data type of the generated log?" The task seems oddly described, and I can’t find any clear hints in the lab briefing or online resources. I’ve tried querying various data types like AzureActivity, AuditLogs, StorageBlobLogs, StorageFileLogs, and others, but none seem to fit correctly. Could anyone provide guidance or confirm which data type is actually relevant for this scenario? Are there any specific tips or resources I might be missing? Thanks in advance for your help!insufficient permissions for the lab "IAM and EC2: Instance Profiles"
I am working on the lab "IAM and EC2: Instance Profiles" and in section 4 it requires launching an EC2 instance. The problem is that following all the steps, it returns the following error: Instance launch failed You are not authorized to perform this operation. User: arn:aws:iam::250176780079:user/aBCbsrMbk6Um5GQlxs7G is not authorized to perform: ec2:RunInstances on resource: arn:aws:ec2:us-east-1:250176780079:volume/* with an explicit deny in an identity-based policy. Encoded authorization failure message: ktHE_tnENT_yEI9xSX3pGA8Rv36ZXZirDZ_QIdV4cyWE9UtT_w-drjPxlGAyZIXfOUOKRgN42SjowCSdb5GLXvXfzYF0VLxOAtrmhyJcQOVwkXSuRrRVJ5-Bov1rX_uAt4E-VWR07oGDsl1LnJvKoNxgyVRV0fDUMgvzFcnskDDn_toD2yrFQeaQZLeVEA8dnk0IvNVtsXRp_KB3Mbc6kIkpbkCDzrAZMswqUI92w04__Hm2GATKTNr4Ok7ryj3fX9pqNmL4GxWxnamQitqaWyuQo45WD-4IMqu1OPVfxixHJ9OcDYFFWlFkc6w8-lXwwLzk5O5SvAhHbMPjM8JYpE9ECvZL1UDnTy8L39hOB8QS-p2YIayS4AbcUK4GXCzVqUrUYL5p5Jid9DrboEgXgMhgRg87YQX_H_4fiiGibLN_3N7-64hKyGPgKTsfXv1Yq7Zl-wJ0ckgo4QfQyxNNdb6iqRUm8WFtShWidZujtE3GdMXsqeSUKYsx2rDVEaX2qlFF7M6EDErOvhVa2Ify8X9VKkkgcEP6kkwiO-WLz7nHEnnNj8lCzNadkkc6tXsBWTerF6Q7kdO0lqczi3-c3nUSAH7q79GCX49IfvTHU6AOT59VWJCCKw7XjAYReMHXpeH9yUDQee6JlnAQ2qeuX09TTpC9LcZWMbgtr_cDd7rTJmhwdUTLkN3sSyzw0KuU3n9kgu0bHZWkm0P7X4y7E0mOXSZ2BGOni9OyEy_D8DYV9Y8f3JJ8XBT5_jzNInxSo0hogSginKSnH9xZUq_wuyxCPu1L2znbcM7KFrW1wkivq8OoGek Am I doing something wrong or is there actually a lack of permissions to complete it? Thank you very much for your help.
Guardduty: configuration and understanding findings lab not generating findings
I am working on this lab Guardduty: configuration and understanding findings lab, finished all the first 8 steps successfully. For the last two steps, it was mentioned in step 8 "Note: This lab is generating findings live. If you don't immediately see the findings referenced in the questions below, wait a couple of minutes for them to generate." I waited more than 15 minutes and the number of findings stayed at 0. I tried the lab yesterday and then this morning, same thing.
Microsoft Sentinel: SOAR Demonstrate your skills
Hello all, I am struggling on question 6 where I feel like I have the Condition portion setup correctly but it won't say that it is completed. The condition is supposed to be within the For Each loop correct? The Condition parameters is: AND - Body Risk = High
