Skip to main content

Unanswered questions

13
Veeresh
VeereshNew Member
 Google Threat Intelligence
Degree of Domain Reputation and Suspensions

There has been a process in the GCP system that it is failing to accurately validate the reputation of the domain, and terminating the accounts automatically based on the single false positive reporting.There is absolutely no accountability taken neither by Firebase or GCP Team. Please share some details or stories about its resolution.

251
ErikaB
Community Manager
PanosMtln
PanosMtlnBronze 1
 Google Security Operations
Metric fields are likely normalized in a different format that the actual udm values

Hello Team,Recently I tried using Chronicle's `metrics.auth_attempts_success` function to analyze successful login activity by country for a specific user over the past 30 days. My goal was to dynamically filter the metric using the country from the incoming event like this:    $ip_country = principal.ip_geo_artifact.location.country_or_region    $historical_threshold_country_success = max(metrics.auth_attempts_success(      period: 1d,      window: 30d,      metric: event_count_sum,      agg: sum,      target.user.userid: $targetAccountId,      principal.ip_geo_artifact.location.country_or_region: $ip_country))Surprisingly, this returned 0 for all users, even though I could confirm there were successful logins from countries like Germany and the UK.After some debugging, I discovered that hardcoding the country like this worked:    principal.ip_geo_artifact.location.country_or_region: "Germany"So it seems the metric function is case-sensitive and expects exact string values for dimensi

90
PanosMtln
Keerthana K
Keerthana KNew Member
 reCAPTCHA
Clarifications required for reCAPTCHA classic key migration to GCP

We are currently using a reCAPTCHA v3 Classic key for form submissions in our application. As per Google's recommendation, we are planning to migrate this key to the Google Cloud Platform (GCP).Before proceeding, we would like to clarify the following questions:Our current implementation references the script:https://www.google.com/recaptcha/api.js After migrating the Classic key to GCP, is it mandatory to update this reference to:https://www.google.com/recaptcha/enterprise.js? If we continue using the existing api.js reference after the migration, will the integration remain functional? Will the existing site key value change after migration? Or will the same key continue to be used? Will there be any change in the format or structure of the key itself (e.g., length, prefix) after the migration to GCP?

30
Keerthana K
jetheridge
jetheridgeNew Member
 Google Security Operations
On Demand Machine Isolation for Defender

Hey all, I’ve noticed that the Microsoft Defender ATP SOAR Integration has “Create Isolate Machine Task” and accompanying unisolate machine task actions. However, these find the host directly from the alert. I want to be able to have isolate and unisolate actions that can take in a hostname/hostid as an input so that they can be ran ad-hoc. Any ideas?

201
_eo
SaDaVF
SaDaVFNew Member
 Google Security Operations
Creating case level automations for ITSM integration?

Hello. My company has recently adopted Google SecOps alongside our current ITSM tool in-which we use to conduct case management and handling. We would like to have SecOps automatically create and updates cases in our ITSM tool, however I don’t see any automated functionality to run things at case level.Could some advice be provided on how to move forward particularly with the following:Have cases created in ITSM when analyst change the case state to incident.  Have new alerts added to our ITSM when alerts are added to cases in secops with incidents already raised. Have new alerts removed to our ITSM when alerts are removed from cases in secops with incidents already raised.I already have actions and integrations for our ITSM that work for these purposes, but I now need a trigger to automate them which I cannot find in SecOps.

190
SaDaVF
A
af27Bronze 1
 Google Security Operations
issue with siemplify.get_attachment(attachment_id)

Hi,I have wrote a custom actions that gets attachments from the case wall and creates a html table, allowing the user to click a button to download the attachment. This had been working okay but we have now been experiencing this following error:  File "/opt/siemplify/siemplify_server/bin/Scripting/PythonSDK/SiemplifyBase.py", line 170, in validate_siemplify_error raise Exception("{0}: {1}".format(e, response.content))Exception: 500 Server Error: Internal Server Error for url: http://server:80/v1alpha/projects/project/locations/location/instances/instance/legacySdk:legacyAttachmentData?attachmentId=3157&format=snake: b'{"errorCode":2000,"errorMessage":"An error has occurred. Search for Log identifier c55c79701e3341e380d50c8167df02c9 in the Google Cloud Logs Explorer.","innerException":null,"innerExceptionType":null,"correlationId":"c55c79701e3341e380d50c8167df02c9"}'This is happening when calling siemplify.get_attachment(attachment_id), although not entirely consistent but it s

50
A
Veeresh
VeereshNew Member
 reCAPTCHA
Webrisk API Reliability

The reliability and accuracy of Webrisk API response is going bad and out of sync with the response to the malicious urls when browsed on the chrome.Is there any plan or initiative to address these issues?

242
kentphelps
Staff
Aphex2in
Aphex2inNew Member
 Google Security Operations
Sent Batch Error For FORTINET_FORTINDR

Hi all, I’m having issues ingesting FortiNDR logs into Google SecOps using cfproduction docker forwarder here is the details: Any thoughts why this happen? 

70
Aphex2in
mikelmi01
mikelmi01New Member
 Google Security Operations
Create multiple alerts in the same case from a SecOps job

Hi everyone,I'm trying to send multiple alerts via a webhook to Chronicle SecOps and have them be grouped under the same case. However, when I use my job (see code below), even though both alerts are sent together and share common fields, they always end up in separate cases.import sysimport jsonimport requestsfrom urllib3.util import parse_urlfrom SiemplifyJob import SiemplifyJobfrom SiemplifyUtils import output_handler# ====================# Embedded Constants# ====================PROVIDER_NAME = "HTTP V2"INTEGRATION_NAME = "HTTPV2"API_REQUEST_METHODS_MAPPING = { "GET": "GET", "POST": "POST", "PUT": "PUT", "PATCH": "PATCH", "DELETE": "DELETE", "HEAD": "HEAD", "OPTIONS": "OPTIONS",}AUTH_METHOD = { "BASIC": "basic", "API_KEY": "api_key", "ACCESS_TOKEN": "access_token", "NO_AUTH": None,}DEFAULT_REQUEST_TIMEOUT = 120ACCESS_TOKEN_PLACEHOLDER = "{{integration.token}}"# ====================# Internal Classes# ====================class HTTPV2DomainMismatchExc

50
mikelmi01
mikelmi01
mikelmi01New Member
 Google Security Operations
Creating Multiple Alerts in the Same Case via Webhook — Always Creates Separate Cases

Hi everyone,I'm trying to send multiple alerts via a webhook to Chronicle SecOps and have them be grouped under the same case. However, when I use my job (see code below), even though both alerts are sent together and share common fields, they always end up in separate cases. import sysimport jsonimport requestsfrom urllib3.util import parse_urlfrom SiemplifyJob import SiemplifyJobfrom SiemplifyUtils import output_handler# ====================# Embedded Constants# ====================PROVIDER_NAME = "HTTP V2"INTEGRATION_NAME = "HTTPV2"API_REQUEST_METHODS_MAPPING = { "GET": "GET", "POST": "POST", "PUT": "PUT", "PATCH": "PATCH", "DELETE": "DELETE", "HEAD": "HEAD", "OPTIONS": "OPTIONS",}AUTH_METHOD = { "BASIC": "basic", "API_KEY": "api_key", "ACCESS_TOKEN": "access_token", "NO_AUTH": None,}DEFAULT_REQUEST_TIMEOUT = 120ACCESS_TOKEN_PLACEHOLDER = "{{integration.token}}"# ====================# Internal Classes# ====================class HTTPV2DomainMismatchEx

50
mikelmi01
preeeya
preeeyaNew Member
 Google Security Operations
SIEM Dashboard Creation: To Case History

Hi everyone,I'm working on building a dashboard in Google SecOps where I want to implement a user-based filter. The idea is: when filters a specific username, the dashboard should dynamically display:That user’s login detailsPrevious cases/incidents the user was involved inLast login region(Any other relevant user metadata)I'm looking for suggestions or best practices on how to structure this kind of dashboard, particularly:What data sources should be connected or joined?How to design the filter to retrieve and reflect all these details for a selected user?Any recommended tools or integrations within GCP that simplify this?Thanks in advance for any guidance or examples!

442
preeeya
Seethaar
SeethaarNew Member
 Cloud Security Foundation
Insecure practice of uploading TLS certificate private keys in to Certificate Manager

I am really surprised (rather appalled) to know GCP wants users to upload TLS Certificates and their private keys in to the Certificate Manager for being referenced by the services such as Application Load Balancers. Though its secured with encryption at rest, there are chances of unnecessary exposure by human error in handling the private keys at the first place and as a responsible CSP, I would expect GCP to do something about this. At its face, it appeals to be a not-so-secure practice. I can understand even if the requirement is to upload PFX and password or even better an option to generate a CSR, that can be signed by an External CA and only the signed certificate need to be uploaded. I want to hear the story on the side of GCP Engineering on their choice for users to upload private keys directly. Though Certificate Manager is not a security product, I hope I can attract the attention of the Security Experts in contributing to this question.

100
Seethaar
mogriffs
mogriffsBronze 1
 Google Security Operations
Enrichment breaks rule logc

Hi,I’ve got a rule logic that has been working great for a while, but recently some of my hosts have been tagged with IPv6 addresses in the context/metadata. This may or may not be accurate (not sure where it’s come from yet) but it’s broken my alert rule logic, but not the search logic. this inconsistent behaviour is really confusing.Here is my (slightly redacted rule logic)    $e.metadata.log_type = "NIX_SYSTEM"    $e.metadata.event_type = "USER_LOGIN"    $e.network.application_protocol = "SSH"      $e.security_result.description = "Accepted password"    $e.target.user.userid in %Privileged_Accounts    not $e.principal.ip in cidr %Trusted_Jump_ServersIn the Search field this produces no results. But the same logic with no other qualifiers in the detection engine has ~10,000 hits so far today.The issue appears to be the final  “not $e.principal.ip in cidr %Trusted_Jump_Servers” which ignores SSH connections that originate from trusted sources (which is the point of the rule, to find c

283
mogriffs

Badge winners

  • Authored Posts 5
    leodashas earned the badge Authored Posts 5
  • Authored Posts 5
    delstonhas earned the badge Authored Posts 5
  • Authored Posts 1
    SaDaVFhas earned the badge Authored Posts 1
  • Authored Posts 5
    hzmndthas earned the badge Authored Posts 5
  • Solution 10
    hzmndthas earned the badge Solution 10
Show all badges
Terms & ConditionsCookie settings
Privacy Policy Terms of Service Gen AI Policy Community Guidelines Cookie Settings

© 2025 Google. All rights reserved.