Unanswered questions

Is there a way to search the SecOps community content (user threads, KBs, blogs, etc) and use a time filter?I was just trying to lookup some info about making dashboards and found a lot of stuff from last year using the legacy dashboards and was otherwise out of date thx

We are testing the action “Send Chat Message” and “Send Message” for case escalation notifications to Microsoft Teams.When composing messages with new lines — using either \n, \r\n, or even manual line breaks (pressing Enter) — the Teams message still appears as a single continuous line, and the literal escape characters (\n or \r\n) are displayed in the message instead of actual line breaks. Is there an officially supported way to send messages from Google SecOps SOAR to Teams with preserved line breaks?

I’m currently leveraging curated Dashboard: Data Ingestion and Health to get insight on our daily volume ingestion. I modified a few queries there to make it suitable for our case. It occurred to me to leverage some of these data and create a simple daily/ weekly alert check if we have exceeded our daily ingestion allowance. example:events: $event.ingestion.component = "Ingestion API" //$Log_Type = $event.ingestion.log_type //$Log_Type != "" $date = timestamp.get_date($event.ingestion.end_time)match: $event,$date over 24houtcome: $Total_Size_Bytes = sum(if($event.ingestion.component = "Ingestion API", $event.ingestion.log_volume, 0)) $Total_Logs = sum(if($event.ingestion.component = "Ingestion API", $event.ingestion.log_count, 0))condition: $Total_Size_Bytes >= [removed by moderator] It turns out that the Yara-L rule editor complains the field ingestion does not exits. parsing: getting field descriptors: accessing field "udm.ingestion": field "ingestion" does not exist, valid fi

Hi, I want to verify that Cloud Armor logs are indeed visible in Chronicle through the Load Balancer logs.From what I understand, Cloud Armor events are included in the external load balancer logs and should appear in Chronicle withevent_type = "NETWORK_CONNECTION". When I filter the logs in secops ingestion, I currently use:OR log_id("loadbalancing.googleapis.com/external_regional_requests")OR log_id("requests") Is this filter sufficient to capture all relevant Cloud Armor activity (such as allowed or blocked requests),or are there additional log_id values that I should include to ensure full coverage of Cloud Armor logs in Chronicle? Thank you! 

I want to assign a department name to each feed ID using a data table.I want to assign a department name to the Department variable for each feed_id used for import.The data table contains a combination of feed_id and department name for each row. For example, when the feed_id is "86d50640-a952-4723-8001-fbbc22e7c446", I want the Department variable to be set to "C".Is this possible?I tried creating the following query, but it didn't work.---------ingestion.log_type = "CISCO_MERAKI"$Department = if(ingestion.feed_id in %imano_feed_id.feed_id,%imano_feed_id.department ,"other")match:$Departmentoutcome:$Volume = math.round(sum(ingestion.log_volume) / (1000), 2)order:$Volume desc---------The error message is as follows:compilation error compiling query: validating query: unsupported Data Table field imano_feed_id as argument in function IfThenElse line: 4 column: 1-97 : invalid argumentIf the above is difficult, is it possible to manually set the department and only compare the feed_id fr

Log Parsing Issue in Restricted Pipeline (Chronicle/CBN/Logstash) We are encountering persistent syntax and parsing errors in a highly restricted log processing pipeline (likely based on Logstash/Grok, possibly within Google Chronicle or CBN). We need help structuring the code to handle the strict syntax and mixed log types without using advanced conditional logic. 1. Environment and Constraint  Environment: Highly restricted log parsing pipeline (cannot use standard Logstash features). Confirmed Constraints (Key Failures): NO if/else conditionals (if [field] fails, if "tag" in [tags] fails). NO semicolons (;) allowed anywhere in the config. Field names must use snake_case (e.g., host_name).  2. The Core Problem: Mixed Log Types Our pipeline receives two distinct log formats that crash the system when we try to parse the second one, or when we encounter simple syntax errors.Log Type Sample Log (Raw) Envoy Access Log (Primary Goal) <166>2025-10-22T14:00:00.095

I have been trying to deploy and run a simple Firebase Cloud Function. Every attempt fails due to what appears to be a fundamental issue with service account creation and authentication context in my project.Symptoms:When calling the function, the context.auth object is always null or undefined, even when the client sends a valid, verified ID token. The function logs show The function must be called while authenticated. During deployment, I am now receiving the error: Error: Error generating the service identity for pubsub.googleapis.com.We have already verified the following:The project is linked to an active billing account. All necessary APIs are enabled (Cloud Functions, Cloud Build, Run, Artifact Registry, IAM, etc.). We have tried manually adding IAM service accounts and toggling the Cloud Functions API off and on. We have removed all restrictions from the browser API key.The project seems unable to correctly manage its own service identities and pass authentication context to it

In the old legacy SOAR dashboard I was able to create widgets which showed me average handling time of stages. For average transition time between stages, I was using the ROI template.  However, in the new dashboard I am not able to replicate this. Gemini did not help either. Does anyone has a tip?

For SCCE customers, there’s a a SOAR SCC Enterprise Response Integration that can be used for ingesting Toxic Combination findings and syncing their status. What should I use if I have SCCP and SecOps? I can’t find the SCC Enterprise integration on the Marketplace. I can’t also import it from another instance. A detection rule in SIEM would be the easiest way to go but it looks like a new log is written in SIEM every time the toxic combination finding is updated by SCC engine. Any suggestions?

How can I track month over month stats in my dashboard? Would a multi stage query work for this? For example, how would I take the curated dashboard query:$event.ingestion.component = "Ingestion API"$Log_Type = $event.ingestion.log_type$Log_Type != ""match:    $Log_Typeoutcome:    $Count = sum($event.ingestion.log_volume)order:    $Count desclimit:    50 and modify it to return stats for each log type - one that looks at current 30 days and one the 30 days before that and calcs the difference?

I’m trying to configure the GSuite Integration in SOAR:I have created a service account and granted the SecOps “soar-python” service account access with the Service Account Token Creator. I delegated domain-wide authority to this service account using the client ID and scopes from this guide: https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/google-workspace#search_user_activity_events I also created an admin custom role in GWS Admin Console and assign it to a new user, as described in the guide. I configured the GSuite Integration in SOAR and I’m still getting the following error when using the Test button:```{'error': 'unauthorized_client', 'error_description': 'Client is unauthorized to retrieve access tokens using this method, or client not authorized for any of the scopes requested.'}```I understand that most of the time, the issue here are the scopes assigned to the Client ID in Admin Console, that’s why I checked them multiple times and made sure they are cor

I'm looking for a way to identify Google SecOps SOAR cases where one or more playbook executions have failed. My goal is to programmatically retrieve a list of these cases, ideally using methods available within the Siemplify SDK (Python), so I can process them further in custom jobs or actions Is there a specific Siemplify SDK method, API endpoint, or recommended approach to filter cases based on the success/failure status of their associated playbook runs? I'm trying to avoid manually checking the playbook monitor for each case.Thanks!

I’m trying to use the Chronicle SOAR integration from a SecOps instance to work with Data Tables.The integration works when tested and with actions like UDM queries, Enrich, etc but fails with the following error when using the Data Tables actions: ```Permission chronicle.dataTables.get' denied on resource //chronicle.googleapis.com/projects/REDACTED/locations/europe-west1/instances/REDACTED/dataTables/Test' (or it may not exist).``` Who should I assign these permissions to? 

I am working on an integration for which the SDK is available on GitHub, but it is not registered on PyPI. I wanted to check whether I can use that SDK to create my integration.I am able to add custom .whl files to my integration in the SecOps SOAR IDE, but I want to make sure that it’s allowed to use such libraries and include custom .whl files when submitting the integration to the marketplace. Any feedback is appreciated.Thanks.cc: ​@talshapir ​@ylandovskyy ​

If I have to disable a human user on the Google Workspace using the Google SecOps SOAR, what is the integration I should use for the Google Workspace.

when we run a test in a rule editor, and we get a list of few test detections, is it possible to create a case out of them to test or refer for the playbook creation ?

I have 2 question that needs to be addressed how to move cases from” default” to another environment. is there a way to associate a detection rule when alerts created tied to specific environment other than default? is it possible to move cases from default to another environment via playbook? what action I need to use?

Hi, I’m building a dashboard (v2) but the fields I want to dashboard use IDs instead of names. I want some of the IDs to point to the same name too. I’m not sure what feature of YARA-L to use to achieve this. Here’s an example with dummy data:I want IDs 52a11631-8a6d-42be-aeb9-a6f8754e186c and 9a50ae9f-11e5-4475-88de-0ba55d8d6745 to be displayed as a single item named “XSS” while fcfc4231-21cf-4eec-b542-14687225b1b4 and 106886e1-e52d-4254-b57a-54b550db1602 to be displayed as a single item named “SQLi” in a bar chart in the dashboard It doesn’t look like the dashboard interface is capable of doing this so I’m thinking I need to build out a YARA-L query. I want to create query that looks similar to the following but I’m not sure how to do it within the constraints of the YARA-L syntax supported by the new dashboards engine:metadata.product_name = "WAF" AND security_result.action = "BLOCK"$Rule_ID = security_result.rule_idif($Rule_ID = ((“ID-string-1”,”ID-string-2”),$Rule_name = “XSS”)if(

Any way to easily identify/query the specific entity that alerts have grouped on? All I can see is a comment applied in the case wall but this is not easy to view at scale.For example, I would like to see which are the common entity types that are causing alerts to be grouped on, to inform alert grouping rules in SOAR settings.Additionally, I would be interested to see the values of these entities so that I can tune out common false positives in Blocklists (e.g. root account).I understand how to make these changes, but do not have the underlying information to be informed on what changes require to be made - I would like to create a dashboard to list the common entity types and values that my tenant’s alerts are grouping on.

How can I provide feedback for GTI when it has misleading, confusing, or inaccurate assessments of IOcs.E.g. Comcast v4 IP addresses are indicated as IOCs. We’re testing some GTI-related rules in the SIEM and the results by volume are mostly nonsense. So filtering on our side is needed.This is to be expected but some IOCs are obviously misleading,

Hi everyone,I’m currently working on designing and implementing a Peer Review process.I’ve created a scheduled task that runs weekly, and a playbook that is attached to this case.However, I’m struggling to find a way to automatically pull a closed case for an analyst to review — for example, a case related to an attack in Azure — using specific filters.Has anyone implemented something similar or found an efficient way to filter and assign closed cases for peer review?Thanks in advance for your help!Shalev

Hello,For each environment we have an instance that we need to change the secret since it is expiring. How can we do that using a script instead of doing it manually?I didn’t see an endpoint for updating instances in swagger api. There is an endpoint for creating instances but doesn’t let you configure parameters.Any ideas? 

We have multiple customers and each has their own environment. Each environment has it’s own integration instances configured.I am planning to create a job that processes cases from different environments. How can I be able to select which integration instance the script should use depending on the case environment?

In this lab I am having problem with “Task 4 Create and deploy the reCAPTCHA session token and test site key”. I did every steps and successfully but when I click in “check my progress” I receive “Please configure the HTML files as mentioned in the instructions”… Who can help me please with 

Hi All, Is it possible to get the PDF document for SecOPs Enterprise  configuration guide along with the license packaging details.