Unanswered questions

We're looking to ingest IRU and Kandji logs into our Google SecOps environment but can't find any related documentation. What's the recommended approach for this integration?

Is there any way we can integrate Emerging Threats with SOAR so that if an IOC match is found it creates a SOAR case?

At present, playbooks can only be triggered based on information available at the time a case is created, such as initial case fields or other creation‑time metadata. This is a significant limitation, as it prevents triggering playbooks based on later context, including alert data from additional systems, case stage changes, enrichment results, or information added manually by an analyst.As a result, it’s difficult to design playbooks that respond dynamically as a case evolves, which is a common requirement in real‑world SOC workflows.Based on the discussion in Unable to trigger playbook when case is set to notify (linked above), it sounds like expanded triggering capabilities are planned for Q2 this year. Is there any additional clarity on what functionality this feature will include, and whether there is a more specific timeframe for its release?In the meantime, is there a recommended workaround from Google to address this limitation, or is manually attaching playbooks to cases curre

Hi All,First may I apologise for the incorrect place for this topic - but right now I feel completely out of options.Our production SOAR instance became unresponsive yesterday around 13:45BST (503 errors from a number of API’s meaning we can’t authenticate into the system at all)- I raised a support ticket (Ref 70050003) which I was told due to technical reasons could be no higher than a Priority 2, and right now the only outcome I have received between yesterday and today (22 hours) is “We’re still looking for an engineer”.I am completely dismayed, that a production service outage has not only been left to placeholder SLA matching updates, but there is a complete lack of information, timelines and indeed any form of troubleshooting or breakfix been applied.I have asked a number of questions which have been met with silence, and this reflects on us as this then translates to the only updates we can give customers.I’ve been a proponent of SIEMplify/Chronicle SOAR/Google SecOps for over

I have an Azure log that contains multiple policy validations. Each validation generates an object inside an array with rule_name and result.All this information is parsed in SecOps as security_result, so now I have a security_result field with two or more objects.For example: security_result: (2)0:rule_name: "rule_1"result: "success"1:rule_name: "rule_2"result: "notApplied"How can I, in Search and YARA-L, perform a validation where rule_name = "rule_1" and the result of that policy is "notApplied", without using a predefined index? The position of rule_name = "rule_1" can change depending on the log.

I need to create Google Chronicle API instance using workload identity but I am getting permission denied error  “unable to acquire impersonated credentials”.iam.serviceAccountTokemCreator has already been provided.Still getting the error.Request more insights 

Hi everyone,We are looking for Terraform templates, gcloud scripts, or proven configuration snippets suggested by GCP to optimize our GCP Cloud Armor setup. We want to avoid manual, granular signature allowlisting, as it isn't scalable and risks broadening our attack surface.Current Setup & Threats: Running standard OWASP rules (sqli-v33-stable, xss-v33-stable) and rate limiting. Actively targeted by (and needing protection from) scanners, credential stuffing, and SQLi/XSS probes. The Problems We're Facing: False Positives on APIs: Our legitimate traffic relies on complex API endpoints and large nested JSON payloads with special characters, which frequently trigger WAF blocks. Postman Blocked: Our Dev/QA teams use Postman for internal testing, but Cloud Armor consistently blocks these requests (likely flagging the User-Agent, missing browser headers, or payload structure). What We Need (IaC/Script Examples): We want to distinguish attackers from legitimate API/QA traffic. Does

Hi, I have created the datatables, one field is ip ranges which is values and its data type is string and another filed is its respective sitename Query :case.alerts.entities.type = "ADDRESS"$ip = case.alerts.entities.identifier$ip in %Test.ValueMatch:    case.priorityoutcome:    $Count = count(case.name)how to fetch the sitename along with its matching IP in the datatables in secops dashboard queryNote: When I check the logs, sitename is found in the udm filed deviceGroupName and also in deviceGroupDescriptionthank you!

What is the difference between collecting the CrowdStrike Falcon logs vs the CrowdStrike FalconStream logs? I notice there are parsers for both, but was wondering whether one provided any particular advantage over the other? We are after the logs which provide the most detail about the environment, and are also looking at using Bindplane. Any insight would be appreciated! 

 Hi everyone,I’m currently in the process of setting up my Google Cloud environment and awaiting my monthly innovator credits. In the meantime, I’m not letting the grass grow under my feet! I’m kicking off my first security-focused project: The Automated IAM "Least Privilege" Auditor.The Goal: I want to build a tool (using Python and Cloud Functions) that audits IAM policies across a project and flags any identities holding the primitive "Owner" or "Editor" roles where a more granular predefined role would suffice.While I wait for my credits to clear, I’m focusing on: Mapping out the service account hierarchy. Writing the logic to parse IAM policy JSON objects. Designing a dashboard layout for security alerts. My Questions for the Experts: For a project like this, do you recommend pulling data via the Cloud Asset Inventory API or directly through IAM Policy calls? Are there specific "hidden" permissions you've seen cause the most trouble in production environments? I’m excited to

Hi All,Is there a way to monitor a windows directory and ingest the logs into Sec Ops ?I have explored some part of bindplane but that is giving me an option to ingest Application, Security or Sysmon logs

Hello Community, Looks like DUO will be discontinuing the support for older version of duo_client/Client.py and i have not seen an update that upgrades that file to 5.5.0. Is there any guidance and has anyone tested this using a custom IDE. If so have you ran into any issues with the integration. 

I’m trying to authenticate to the new Chronicle API using PowerAutomate. It’s been working using the old API, but I’m not sure how to set it up for the new API. Has anyone done it or have any advice? The issue is the authentication methods I see all involve client libraries or the CLI, but in PowerAutomate there is not a pre-built integration that I see, so I’m just using HTTP requests.  Previous MethodURL: https://REMOVED.siemplify-soar.com/api/external/v1/cases/CreateManualCaseAuthentication Method: AppKey New MethodURL: https://us-chronicle.googleapis.com/v1alpha/projects/REMOVED/locations/us/instances/REMOVED/legacyCases:createManualCaseAuthentication Method: ? I’ve tried API keys (https://docs.cloud.google.com/docs/authentication/api-keys-use#rest) but got an error: Action 'Using_API_Keys' failed: API keys are not supported by this API. Expected OAuth2 access token or other authentication credentials that assert a principal. See https://cloud.google.com/docs/authentication If you

Is it possible to trigger a playbook based on a new case being created? I’m working on building a case notification system that alerts a security analyst when a new case is created.The intended workflow is:Send an initial notification when a new case is created After a delay, allow a triage phase so all related alerts can be grouped into the case Send a follow-up “case summary” notification that includes all relevant case details to help the analyst determine whether the case is a true or false positiveThe issue I’m running into is that when multiple alerts hit the SOAR system at the same time, multiple playbook executions occur, which results in duplicate notifications.

Hello everyone, I am trying to ingest mimecast v2 api logs into googlesecops, however integration available in content hub expects app id, V2 API does not have app id, Can anyone help me on this please. 

Hi, I am trying to install reCaptcha on my site but when I copy and paste that snippet of code with my site key, I get a submit button that appears at the top of my website. (Not the checkbox I was going for). 

n our SecOps platform, we are currently in the process of moving all our reference lists to data tables since lists are on a deprecation path. We currently have a couple of reference lists “known Malicious hashes” which contains 2 lakhs hashes divided into two lists(1 lakh hashes each).  Reference list allow 1 lakhs entries per list. Whereas, Data tables allow only 10,000 entries per table so I have created 20 data tables and somehow moved all of them. I would like to know if there’s anyway we can fix this portion first. This was a time-consuming task to move just 2 lists to 20 tables due to the limitation.Next up, when I try to use those data tables in a rule, I hit a limitation again “The number of in statements is more than max allowed limit(10). Can you help?Attached error message 

Hello,I am experiencing an issue related to the use of Data Tables for data enrichment in SOAR. Currently, we have several tables containing IP addresses along with their corresponding hostnames (and in some cases, additional information such as VLAN or other attributes).The goal is to query these tables using the “Is Value In Data Table” action, so that when searching for an IP address, the associated values from the corresponding columns are returned. However, a limitation arises because we need to query three different Data Tables simultaneously, each with different structures and fields.The expected output would be something like:IP (hostname, vlan) if associated information exists IP only, if no match is foundAdditionally, we encounter issues when multiple IPs are present in the same alert. The output does not preserve the relationship between each IP and its corresponding hostname, instead returning an aggregated result such as:ip1, ip2, ip3, hostname1, hostname2, hostname3, whic

When building playbooks for Chronicle SOAR, I often run into a limitation around looping logic. Specifically, there doesn’t appear to be a supported way to create nested loops (a loop within another loop).This becomes an issue in fairly common use cases. For example:Iterating over all entities of a specific type in a case, and then looping through the values of a particular field for each entity. Looping through all alerts associated with a case, and within that loop, iterating through each alert’s entities or a specific type of entity.These types of nested iterations are typical in automation workflows, so I’m curious about the rationale behind the current limitation. Is there a design or technical reason nested loops aren’t supported today, and is this functionality something Google plans to add in the future?

n our SecOps platform, we are currently in the process of moving all our reference lists to data tables since lists are on a deprecation path. We currently have a couple of reference lists “known Malicious hashes” which contains 2 lakhs hashes divided into two lists(1 lakh hashes each).  Reference list allow 1 lakhs entries per list. Whereas, Data tables allow only 10,000 entries per table so I have created 20 data tables and somehow moved all of them. I would like to know if there’s anyway we can fix this portion first. This was a time-consuming task to move just 2 lists to 20 tables due to the limitation.Next up, when I try to use those data tables in a rule, I hit a limitation again “The number of in statements is more than max allowed limit(10). Can you help?Attached error message 

Hello,My GCP project (id: vaulted-zodiac-491122-f0) has been suspended for a week and I appealed immediately but still no response. I have no clue why I violated Google’s policy. It has greatly affected my work. I hope you can escalate my case for review.ThanksC

Hello, I am working on a parent-child multitenant solution.  Child alerts are pulled by the Parent SOAR and a new case is created, however the original case ID (the one created by the Child) is missing.  Is there any way to find the original case ID (ID created by the Child) in the Parent SOAR?  Thank you!

Hi All, I need some guidance to map ontology at product level with an example so i can follow with regex or transformation usage 

Microsoft Intune Context Log Feed — ingesting via GCS instead of Azure Blob Storage?Product: Google SecOps (Chronicle) Log type: Microsoft Intune Context Log FeedHi everyone,Following up on a previous thread where @hzmndt confirmed that cloud storage ingestion is the correct method for Intune Context logs (and that there's an open feature request for Third Party API support: https://issuetracker.google.com/issues/369896058 and previous post here:).We've implemented exactly that a Cloud Function that collects Intune data and writes it to Google Cloud Storage, which is then picked up by a SecOps feed. This was a deliberate choice because we have no Azure infrastructure and wanted to keep our pipeline entirely within GCP.The setup works, and we currently maintain a custom parser to handle the data. However, when we asked Google Support for guidance on aligning our log format with the default "Microsoft Intune Context" parser schema, the recommendation was to switch to the standard Azure B

Hi Community,Our team is looking to build a unified dashboard in Google SecOps (Chronicle) that enables analysts to search for Indicators of Compromise (IOCs) across all available data sources from a single interface.Use Cases:Username search: Enter a username and retrieve all events associated with that user across all ingested data sources within a configurable time range (e.g., last X days). IP address search: Query an IP address and see all related network activity, authentication events, alerts, etc. Hash value search: Look up a file hash and identify all occurrences across endpoint, proxy, and other relevant log sources.Essentially, we're looking for a centralized IOC pivot dashboard that aggregates results from multiple log types and presents a consolidated view for faster investigation and threat hunting.