Notifications
Clear all
Topic starter
18/07/2026 3:15 am
Hey folks! Been deep in our Chronicle setup and noticed our EDR was firing on things Chronicle didn't flag, and vice versa. Made manual correlation a real pain.
So I threw together a Python script that pulls the last 24 hours of alerts from both, compares hostnames and timestamps, and spits out a simple diff report. It's been a game-changer for spotting gaps in our coverage. You can easily tweak it for different time windows or fields. Happy to share if anyone wants to try it—just let me know!
kate
Automate all the things.