Visually distinguish SecOps tenants

Enterprise organizations, managed detection and response providers, and nation-states often operate multiple instances of Chronicle SecOps. This post introduces the URLColors Chrome plugin, which enables users to visually distinguish between their Chronicle SecOps instances, enhancing organizational efficiency and security.

Avoid making a change on the wrong tenant using URLColors

URLColors

I’ve previously shared some of the Chrome extensions and Chrome features I use with Chronicle SecOps (link below). However, I’ve been asked to share more about one extension I use, which was recommended by a great Chronicle Partner.

Chrome Extensions for Chronicle SIEM

A Chrome extension called URLColors offers a simple yet powerful feature that allows you to customize the appearance of specific websites, including Chronicle SecOps instances.

After installing the extension, click the URLColors icon in Chrome. For each Chronicle SecOps instance (Unified UI), add an entry of:

• <URL>, <Color>

You can customize the border width and opacity to your preference. A clear border helps visually distinguish between multiple tenants without impeding day-to-day usage.

Must remember to not break things on Red instances

The extension offers additional features, such as flashing borders, adding timers, or customizing border and opacity settings for each instance. To enable these features, simply add more columns to the CSV entry on each row.

GitHub - fej-snikduj/URLColors: Chrome Extension to highlight the body of a webpage with colored…

Summary

For those managing multiple Chronicle SecOps instances, the method described above provides a simple yet effective visual aid to prevent accidentally modifying the wrong tenant 😊

Please note that this extension is not an official Google product but a third-party extension. As always, carefully review and vet any extensions you install in Chrome.