Unanswered questions

We were recommend to post here re. case #10394319, Project number [removed by moderator] and as belowPlease could you highlight for attentionThanksRyan We are writing to appeal the suspension of our Firebase Hosting project dg-style-chooserThis is a false positive. Our application is a legitimate business tool, not phishing.What our application does:We operate LiveStory and DamnGood, two digital magazines that feature content creators.Our web application allows potential creators to browse visual style preferences and submit applications to be featured in our publications.The form collects standard contact information (name, email, Instagram handle) that creators voluntarily provide to apply for partnership opportunities.Why this is NOT phishing:We are a registered business operating at joindamngood.com and joinlivestory.com.We do not impersonate any other brand or service.We do not ask for passwords, financial information, or any sensitive credentials.The data collected is used solely

Hello Commmmmunity, I am attempting to implement the detection rule below in SecOps but keep getting an error message when I test or attempt to save the rule.“parsing: error with token: ":" expected '=' between meta assignment key and value line: 11 column: 12-13” rule MAL_Dropper_NetSupportRAT { meta: author = "Sam" description = "Detects a dropper that delivers a decoy ChaGPT Installer and NetSupport RAT" hash = "d86f647f3dfa6a53de7b531cb590636331f83afcea60d4b3d44de5ea3b7d33af" malware = "NetSupport" malware_id = "TWOU5d" category = "MALWARE" strings: //dropped files $d1 = "ChatGPT Installer.exe" $d2 = "setup.exe" //netsupport strings $n1 = "NetSupport" nocase $n2 = "install_netsupport_manager_silently" $n3 = " [removed by moderator] " condition: uint16(0) == 0x5A4D and all of ($d*) and 2 of ($n*)} I’m getting similar error messages for rules that have “strings:” in them. What could be wrong?

Hi,  I have a rule created that is to see the users that have used vpn after business hours for the day adn this is for informational purposes only and i want this to be triggered only once per day at a certain time. Eg: 12 AM. how can i set this timei have made the metch section to be 24 hours, but i want to know how i can set a specific time like 12 am for the rule to be triggered. 

Hello all, I need to create some automate TAGs depend con the value of the hostname. Example if a host is from Belgium: BEL-XXX, if its from Brazil: BRA-XXX. Well i thought about the funcion on SOAR casa data→ TAGS. Teh proble here, is i have more than 1 product in incoming alerts, and in one alert the entity is saved in host_name entity, in other deviceDNSname...etc… So, is there any solution or best practice for this?  Thanks!

Hi,The reCAPTCHA that we were planning to migrate automatically has apparently been migrated automatically the other day.As a result, we have received an email from Google Cloud titled “Action Required: Accept Your Invitation to Manage reCAPTCHA on Google Cloud”.If we approve this, we currently have only one project that has an active reCAPTCHA contract—after clicking Accept/Approve, will the keys that were automatically migrated this time appear in that project?

Do you know when the APIVoid integration in Google SecOps (SOAR) will support the new APIVoid v2 APIs? The current integration (linked below) references the older v1 endpoints:https://docs.cloud.google.com/chronicle/docs/soar/marketplace-integrations/apivoid APIVoid has announced that v1 APIs will be deprecated on Feb 28, and v2 introduces breaking changes. From the APIVoid v2 API documentation, requests now use POST with a JSON payload, for example: curl -X POST "https://api.apivoid.com/v2/ip-reputation" \ -H "Content-Type: application/json" \ -H "X-API-Key: YOUR_API_KEY_HERE" \ -d '{"ip": "80.82.77.139"}' Additionally, the response structure has changed. Previously (v1), responses were wrapped under data or data.report, e.g.: { "data": { "report": { "ip": "80.82.77.139", "blacklists": { "engines": { ... In v2, the response is now flat, for example: { "ip": "80.82.77.139", "version": "IPv4", "blackl

I am creating a new integration, and for that I copied the pyproject.toml file from an existing integration. To generate the uv.lock file, I am using the uv sync command as mentioned in the Content Hub install and build steps.Once the uv.lock file is created, I use the mp build --integration <integration_name> command to generate the build, and I can see the output in the Out folder. After that, I change IsCustom to true, generate the ZIP file, and try to install it. However, I encounter an error. Upon investigation, I found that the issue is related to dependencies.I had some working integrations on my instance. I exported those integrations and copied it’s dependences and replaced them in the Out folder, and after doing that, the installation worked.To reproduce this issue, I tried generating a build for an already available integration in Content Hub (InfobloxNIOS). First, I ran the build command to generate the build and installed it on my instance, and it worked correctly. T

Hello Community,I am trying to clearly understand the design and deployment model of Google SecOps SOAR Remote Agents, specifically when the target systems (for example, FortiGate firewalls or other on-prem security tools) are hosted inside a private customer network. I would like clarification on the following points: Hosting Model Do we need to create a VM in the customer private network to host remote agent? Is the Remote Agent always expected to run on a dedicated VM or server inside the customer’s private network? Is this the recommended and supported architecture for interacting with internal devices such as firewalls, AD, or other non-internet-exposed systems? Allowing Access for Remote Agent to Google Publisher and Firewall

HI everyone, I’m trying to find a documentation of the SOAR api, but I’m unable to find an API that lets me retrieve playbook results per alert.I want to be able to retrieve the data from query enrichments that I’ve created. Has anyone been successful at doing this? 

I am looking to build a dynamic asset inventory in Chronicle SIEM to map AWS Account IDs to their respective OUs.My environment has a lot of accounts and CloudTrail logs lack OU context. My plan is to create a Chronicle Data Table with a bulk export of current accounts and then use a YARA-L detection rule to catch CreateAccount events (which contain the OU name). This rule would trigger a SOAR playbook to automatically append the new Account ID and OU mapping to the Data Table. What is the best practice for my problem?Which YARA-L rule and playbook should I create for this solution?Thanks

Hi Folks,I’m new to SecOps and still getting familiar with the platform’s functionality. Apologies if this is a basic question, but I believe it will be helpful not only for me but also for others who are beginning their SecOps journey. I’m looking for guidance on how to search logs in SecOps for the following requirement:We have onboarded Windows servers via Bindplane, and I want to run a query to list all logs coming from a specific Windows server.Currently, we are using a query similar to the one below (Partial query) :metadata.log_type = "WINEVTLOG"$host = strings.coalesce(principal.asset.hostname, principal.hostname)However, we are observing an issue where we have onboarded only 50 Windows servers, but the query returns more than 50 host values. Upon initial review, these additional hosts appear to be introduced during parsing (exact cause not yet confirmed).In Splunk, we typically rely on the host field to retrieve all logs from a specific server/device. Could someone please advi

I have this nested JSON: "jsonPayload": {"message": "\"id2\":{\"timestamp\":\"2026-01-19 03:15:20\", \"app_name\": \"test1234\", \"client_port\": \"2233\", \"client_host\": \"hostName\"},}I wrote this code snippet but it doesn't work, can you tell me why?filter { mutate { replace => { "client_port" => "" } } grok { match => { "jsonPayload.message" => ["client_port=(?P<client_port>[0-9]+)"] } overwrite => ["client_port"] on_error => "client_port_not_present" } statedump{} mutate { rename => { "client_port" => "event.idm.read_only_udm.principal.port" } } mutate { convert => { "event.idm.read_only_udm.principal.port" => "integer" } } mutate { merge => { "@output" => "event" } }} I want to extract the value of the client_port field and map it to the UDM principal.port fieldThanks in adva

Hi All,In our environment, we are using the Bindplane OP Console. As part of our logging and monitoring requirements, we need to forward the Bindplane OP Console Audit logs to the SecOps console for centralized visibility and analysis. Could someone please guide us on the recommended approach to send or integrate Bindplane OP Console logs into SecOps? Currently I am referring the link https://docs.bindplane.com/integrations/sources/bindplane-audit-logs  and performed the below changes. I created an API key at the Bindplane project level and configured a source using Bindplane Audit Logs, with the destination set to our SecOps console. However, I’m not seeing any logs in SecOps. In other configurations, we usually need to attach agents to a configuration for logs to flow. In this case, since it’s SaaS-based, how are these changes supposed to be applied or pushed from the Bindplane OP console? Any documentation, configuration steps, or best practices would be greatly appreciatedThanks in

I have noticed a delay regarding how quickly data about changes on cases in the SOAR UI propagates to the SecOps Dashboards datasets, “case” and ”case_history”.Currently, it takes almost an hour for the database used by the dashboards to update with the latest changes made to cases in the SOAR UI. (e.g. a case going from OPEN > CLOSED).Is this the intended/expected behavior?

I have a panel in a dashboard. When I click on three dots on the top right corner, I get these options: On clicking on ‘View Query’, the following box opens: When clicking on ‘Run in Search’, a new window opens showing the output in UDM Search for the same query written for the panel: When I hover over three dots adjacent to any row, I get following options: On clicking ‘Run UDM Query’, the following window opens: The issue here is that the value inside the square bracket vanishes on clicking ‘Run UDM Query’.principal.labels["orig_ip_bytes"] != ""  —>  principal.labels != "”How can I resolve this issue? Can someone please guide me?Do we have any alternative solution for this?

Hi Community,We are currently working on UDM-based SIEM saved searches in Google SecOps and are running into an inconsistency across different SecOps instances.Issue DescriptionWhen we paste the same UDM saved search query (using the Graph data model) into a new Saved Search, we receive the error:“Invalid data source provided”However, the exact same query works successfully on a different Google SecOps instance.What We’ve Verified The query uses the Graph data model, which is documented as a supported data source for Saved Searches. We are following the exact same steps in both instances. The issue reproduces consistently on one instance and never on the other. Observed DifferenceThe only noticeable difference between the two environments is the UDM Search UI: One instance has a newer UI layout (with options shown at the top). The other instance shows Search Manager and related options near the Run Search button. This led us to suspect a possible SIEM search version / UI version

Hi All,In the Microsoft Graph Mail integration, there is an action called “Delete Mail.” If this action is executed via Google SecOps SOAR, will the email be permanently deleted, or is there any option to restore or release it back afterward? 

Hello team,I’m trying to ingest GCP Monitoring alerts into SecOps using a Pub/Sub push subscription. To do this, I created an alert policy for “agent goes silent” and configured a notification channel using a Pub/Sub topic. That topic is attached to a push subscription that forwards events to the endpoint.I am receiving email notifications (since email is also configured in the notification channel along with the pubsub topic), but the alerts are not being pushed to SecOps from the Pub/Sub topic.I have given the pubsub publisher  permission to the topic My alerts are not getting acknowledged by secops endpointIs there any documentation I can refer to for correctly pushing GCP Monitoring alerts to SecOps?

I’m using reCAPTCHA v3 with Contact Form 7.The form is not submitting while captcha is enable. Existing forms submit successfully, but newly created forms fail with no visible error. It shows an error in orange box.Removing reCAPTCHA immediately resolves the issue.

I’m running mysql 8.0.26-google cloudsql instancecloudsql_iam_authentication flag = ONBUT the authentication_iam plugin is not getting loaded.when I run SELECT PLUGIN_NAME, PLUGIN_STATUSFROM INFORMATION_SCHEMA.PLUGINSWHERE PLUGIN_NAME LIKE '%iam%';I getgcp_iam_authgcp_iam_group_auth According to ChatGPT, these are Postgresql plugins, not mysql.   

Analysts are executing an action that I put on a Playbook which requires manual selection from a dropdown list.Main problem is they are sometimes doing it without choosing an option.So I have to prevent this happening, I cant simply blame random analysts.We have only 2 options when i create a manual action from dropdown list. You make that required parameter as MANDATORY. Then you have to give a DEFAULT VALUE when you are implementing it. If you give default value then when it is live, its showing that, action in playbook already filled with your default parameter, just like below image, and you can just press EXECUTE button as an analysts without choosing it. Which we dont want. You make that required parameter as NON-MANDATORY Then when its live playbook will gonna show you a dropdown list, that has “Choose” placeholder on top of it by default.(no real picture but it is just like at “Assign to” option below) Bc the parameter is NOT MANDATORY, then it means it is executable without ch

Hi community, I am working on YARA-L detection rules in Google Chronicle to identify suspicious self-equality assignments (tautologies) in SQL logs. These patterns, like "1=1" or "test=test", are often used in SQL injection attempts to bypass filters or force true evaluations. Goal: Detect patterns where the left side of "=" exactly matches the right side, such as: test=test 1=1 time=time status = status flag=flag admin=admin bypass=bypass enabled=enabled id=id version=version But not detect mismatches like: 1=2 a=B (and similar non-tautologies) Challenges in Chronicle: I Tried regex -> ([A-Za-z0-9'-]+)\s*=\s*\1 were i used /1 #BackReference, but unfortunately backreference is not supported in YARAL, so using re.regex to directly check for equal values on both sides of "=". Then i used were grouping issue => The Chronicle re.capture() function only returns the first match in the text, and it supports only 0 or 1 capture group. If the regex contains 0 capture groups, Chronicle ret

Dashboard reports (Non-legacy) have no email delivery . Unable to schedule reports like the legacy ones. Is this feature out yet ? How do we schedule daily report to be sent to an email address

Hi Community,I'm building a bidirectional integration between Google SecOps and Jira for our SOC operations and would appreciate any guidance, tutorials, or examples from those who've implemented similar workflows. I didn’t find any good tutorial to create a playbook.

Hi Team, I’m reaching out regarding an issue with our Nozomi Guardian integration in Google SecOps. Even though the connection shows as successful in the Nozomi Console, we are not seeing any logs being ingested into Chronicle, even under UDM log type. We have given URI as “https://malachiteingestion-pa.googleapis.com” and Customer ID. We downloaded the service account from collection agents console and the connections shows successful in Nozomi console but logs are not getting into Google SecOps. Please let us know if anyone able to find what the issue is here. This is the documentation we followed: https://technicaldocs.nozominetworks.com/products/n2os/topics/administration/settings/data-integration/c_n2os_admin_settings_data-integration_google-chronicle-2.html Thanks in advance!