Recently active topics

The title :)

The alert included in the case has a product field.In "SOAR Reports legacy", the product field is available. Where can I find this field when using Dashboards and the "Cases and alerts" data source? https://cloud.google.com/chronicle/docs/reference/soar-data-dashboard#cases-and-alertsI reviewed all the fields, but I didn’t find any product field. Anyone would know?   

Hello team, do you have any guidance on developing a risk analytics rule that identifies when an entity exhibits a sudden spike in risk score? In the rule below, I can generate an alert when an entity’s risk score on the Risk Analytics dashboard exceeds a defined threshold. However, I’m more interested in detecting a sudden spike in the entity’s risk score rather than relying on a static benchmark.i have two use cases one is to alert when any user’s risk score in analytic dashboard crosses a benchmark and the other one to detect on sudden spikeAlso, for Risk Analytics, I could not find a UDM field that represents a normalized risk score. I only see the raw risk_score and the delta_risk_score fields.Which of these fields would be the most appropriate to use for the rule? 

I am trying to find API list for SIEM but unable to get it.I have SOAR Swagger API, but not able to find SIEM. Please let me know if anyone has any idea.

I’m excited to share a custom solution I’ve developed that will make our Bindplane Agent monitoring process much easier and more efficient. With this setup, agent status can now be monitored in real time directly from Google SecOps, eliminating the need to repeatedly check the Bindplane console.What This Solution DoesIntegrates Bindplane API with Google SecOps SOAR. Automates ingestion of agent status logs into Google SecOps SIEM. Triggers alerts whenever an agent becomes inactive. Provides a single pane of glass for the SOC team to monitor agent health.Key ComponentsBindplane API. SOAR IDE script to fetch and ingest agent data. SIEM rule to detect inactive agents and generate alerts.Benefits✔ Real-time monitoring without manual console checks.✔ Automated alerts for inactive agents.✔ Streamlined workflow within existing security tools.PrerequisitesBefore you begin, ensure you have:Access to Bindplane with permissions to generate an API key Access to Google SecOps SOAR (IDE) Access to G

Hello guys! Got a few questions regarding the new reCAPTCHA changes done by Google.I did receive the email "We’re writing to inform you that all Google reCAPTCHA keys will need to be migrated to a Google Cloud project by the end of 2025..." as most of you probably already did.So far based on my research I am aware of the following, but you can confirm my questions please: 1. The existing V2 Checkbox, V2 Invisible and V3 keys will continue to work even after this change, however, Google is not specifying is they will automatically migrate the keys themselves, or what happens if the user does not migrate all the keys.  Will they still be available/working on the sites used? From my understanding, they are suggesting to migrate otherwise, the sites may loose protection if the reCAPTCHA service surpasses more than 10.000 requests (which is the Free tier limit).2. I noticed that when using the new Cloud view, the user can now create reCAPTCHA keys whi

Risk Analytics is a crucial feature within Google SecOps SIEM designed to help security teams identify unusual behavior and quantify the potential risk that various entities pose to the enterprise. It empowers analysts to move beyond basic alert triage and focus on the entities that represent the most significant threat. Key Components of the Risk Analytics Dashboard The central hub for this feature is the Risk Analytics dashboard, which provides a holistic view of entity risks, accessible to users with global scope in RBAC systems. Behavioral Analytics: This section lists entities (such as user accounts, servers, or laptops) based on their calculated Google Security Operations Entities risk scores. This allows tracking an entity's risk over time and serves as a metric for detection use cases. Watchlist: This section highlights entities based on internal enterprise risk calculations, complementing the behavioral analysis with organization-specific context. Risk Calculation Window:

Hi,I have installed Logstash in few of my servers and trying to send the raw logs to my Google SecOps platform (legacy version). My Google SecOps is a google-managed one.I have shared the Integration API Key from Google SecOps with my application team who is setting up the Logstash in the servers. They are stuck with authentication issue in the logstash pipeline when they tried to send the data via Google SecOps Ingestion API.I would like to understand how logstash will be connected with Google SecOps. I couldnt find any official documentation to follow the setup as well. Thanks.

Welcome to part two of this series where we’re learning how to leverage data tables in Google Security Operations (SecOps). In part one, I explained how to create data tables and use them to filter events in rules. In today’s post, I’m going to demonstrate how to write values to a data table from a YARA-L rule. Populating data tables with relevant information allows security operations teams to more readily implement a variety of detection and threat hunting scenarios. To provide some inspiration, below are a few use cases that will hopefully spark some creative ideas on how you can leverage data tables in your own environment. Tracking cloud console login events over time. Relevant metadata about login events may include user ID, IP address, geolocation information, and whether or not Multi-Factor Authentication (MFA) was used for authentication. Profiling notable or potentially suspicious file executions, network connections, or DNS queries over time. This metadata can be used in do

I am looking to setup SSO with Okta for our Google Secops tenant and following the google doc: https://docs.cloud.google.com/chronicle/docs/soar/admin-tasks/saml-soar-only/saml-configuration-for-okta but this just mentions SOAR.Is that how the SecOps SSO works and moreover, there is no External authentication option under SOAR Setting → Advanced → External Authentication.I also found this doc which mentions about the SSO setup with Okta: https://medium.com/@thatsiemguy/linking-okta-to-chronicle-secops-platform-c88ca530a515 which one should I really follow, would appreciate any responses on this? 

I set up a few months ago a long ingestion for slack audit via S3 bucket. It was working fine up until a few days ago that i went to search for logs and couldnt find the log type or log source or literally anything related to this feed. I checked the S3 side to make sure everything is working as intended, didnt find any discrepancy there, checked the feed to see when was the last time it received logs from the S3 bucket and its actively receiving it. However, where are the logs going? I’m not seeing anything when i try to search it and i dont know how to troubleshoot this issue? is there a last chance source that i can look in? (splunk has something like this) or is there a way to search what may be the issue? i am going to look into the log explorer in gcp console to see if there’s anything i can find on it there. Please help? suggestions? tips appreciated!

I am attempting to parse the following log by using UDM mapping but I am facing the following error:generic::unknown: pipeline.ParseLogEntry failed: LOG_PARSING_CBN_ERROR: "generic::invalid_argument: failed to convert raw output to events: failed to convert raw message 0: field \"idm\": index 0: recursive rawDataToProto failed: field \"read_only_udm\": index 0: recursive rawDataToProto failed: field \"security_result\": index 0: recursive rawDataToProto failed: field \"action\": failed to make strategy: received non-slice or non-array raw output for repeated field" This is the log piece:{"threatType": "General Malware","status": "Blocked"}and this is the parsing code:json { source => "message" array_function => "split_columns" on_error => "error_not_json" } if [status] == "Allowed" { mutate { replace => { "security_result.action" => "ALLOW" } } } else if [status] == "Blocked" { mutate { replace => { "security_result.action" => "BLOCK" } } } if [

Hi!We are trying to exclude the MS XDR portal from showing up as a entity in our cases. Tried these 3 variants, but it does not filter it out..What is the correct formatting? (The entities in cases are urls to incidents, so I need to catch all variants of the URL with a wildcard.  

Hi Team, We have integrated CrowdStrike via remote agent. For ‘Submit File’ action we need to give the file path. What is the process of submitting file- is it possible to attach the file to case wall and then pass that file to CrowdStrike for analysis?For Analyst, they only have access to case wall, they don't have access to remote agent server. File may be malicious, is it safe to upload such files on case wall?

Hello Google Support Team,I am the owner and developer of the website: https://www.bawoumarket.com (and the hosting URL: [suspicious link removed]).I recently deployed this website using Firebase Hosting. It is a legitimate e-commerce project currently under development. I added a login.html page for user authentication, and immediately after deployment, Google Chrome started flagging my site as "Dangerous / Deceptive Site Ahead".This is a false positive. The site is clean, safe, and does not contain any phishing or malicious content. It is simply a new project with a login form.I have verified my ownership in Google Search Console.Please review the site and remove the red warning screen so I can continue my development.Thank you.

I’m trying to build a dashboard for SOAR Case Data.I couldn’t find a field in the `case_history` object that will allow me to filter by the environment name. Any suggestions?

Now that multi-stage queries are available as pre-GA, is it possible to create a dashboard KPI for MTTX using case_history data? An easy example would be a measure of the avg time cases were in Triage before going to Investigation.My organization has been trying various yara-l approaches but to no avail.  The examples in the multi-stage documentation do not seem to be related to this type of use case. Thanks

The Chronicle re.capture() function only returns the first match in the text, and it supports only 0 or 1 capture group. If the regex contains 0 capture groups, Chronicle returns the first full substring that matches the expression. If the regex contains 1 capture group, it returns only the first captured value from that match. Chronicle never scans beyond the first match and cannot return multiple matches like extracting all regex on the statement. If the regex contains two or more capture groups, Chronicle throws a compiler error.Used Regex : (?:%3A%3A|::)?[?&][^=]+=([A-Za-z0-9+/]{8,}(?:={0,2})|[0-9]{1,3}(?:\.[0-9]{1,3}){3})Error : compilation error compiling query: generating predicates: regex passed to capture() must have 0 or 1 capture groups, but got: 4 capture groups line: 7 column: 59-127 : invalid argument Because Chronicle stops at the first match, SQL statements containing multiple comparisons—such as 0=1 followed later by 1=1—will only match the earliest = expression in

Hello,I have a bindplane configuration that collects logs from Active Directory and Windows Events. However, I noticed that some events are not being sent to the blindplane, but are generated on the server.For example, event 4740. I can see this event in the event viewer, but at no point is it consumed by the bindplane.What could be causing these events not to be brought in?

Over the past month or so, we’ve slowly broadened our use of Google Security Operations (SecOps) rule engine to build composite rules. Today’s blog applies the concepts we’ve covered to date but now we are going to leverage risk calculations from the underlying rules and their detections to generate an alert focused on a user or asset’s activities. Risk Score Let’s start with the risk score. Long time readers of this blog series may recall that we have discussed risk scores in the past. It’s called in the outcome section of a YARA-L rule and can be used with conditional statements to generate a value. We then extended the use of a risk score to Risk Analytics within Google SecOps. What you may not know about risk scores is that because rules could be created without a risk score, rules wouldn’t always have a risk value in them, which makes it a bit difficult to quantify risk. So, in an effort to leverage risk scoring in detections and alerts, we’ve added a default risk score. This defa

Hi All,I have a use-case to list out the cases where SLA’s were breached and I am trying to use the dashboard to achieve this.Due to limitations with customising SLAs in chronicle with both case priority and  case stage I cannot use the default SLA definition settings.The idea is to get the handling time of each stage and list down the case IDs which breaches the required conditions in the dashboards. Does anyone know how I can get the handling time per case in the new native dashboards? Or should this be tried another way?

Hey all! We are trying to get a two-way sync between MSXDR (microsoft 365 defender) and SecOps cases. We have the 365 defender integration configured, and we get secops cases created based on MSXDR incidents.  However, we need the following:Secops case closed > XDR incident is set to resolvedXDR incident is resolved (in XDR) > Secops case is closed The need here is:The analyst does not need to close a case in two portals (secops and XDR portal) XDR sometimes does merging or autoclosing, this incident status change should reflect in Secops 

Hi everyoneI’m currently testing log ingestion from a Linux VM to Google SecOps (Chronicle) using Bindplane (no Chronicle Forwarder, only the Bindplane agent and gRPC).In the Bindplane destination, I’m using: Protocol: gRPC Endpoint: malachiteingestion-pa.googleapis.com Auth: json, with the Ingestion Authentication File from SecOps Correct Customer ID But on the VM, the Chronicle exporter always shows:"error": "upload to chronicle: Permanent error: 403 Forbidden" Any idea what can cause a 403 in this case, or anything that must be enabled/checked on the SecOps side?Thanks!

Hi All,Would like to know if there is a possibility to monitor the changes made to a reference list such as adding / deleting a value from the reference list? As we have for changes made to rules from GCP console. Thanks!

Hey Community, I'm working on configuring a detection rule in SecOps to monitor and generate an alert when a file owned/signed by my company is uploaded to VirusTotal. Has anyone worked on a similar task in the past?