Skip to main content

Unanswered questions

80
defcesco
defcescoBronze 2
 Google Security Operations
Usage of 3D Scatterplot Visualization & Time-Terrain-Behavior (TTB)

Hi SecOps Community,  I am attempting to reproduce this superb blog post:https://dispatch.thorcollective.com/p/cant-hide-in-3d The blog post is written for Splunk, utilizing the resources here:Code Repository  TTB Implementation SPL Code - GitHub TTB_BOTS_v2 GitHub TTB Framework Evolution  MITRE TTP-Based Hunting Paper (2019) MITRE's 11 Strategies for a World-Class SOC (2022) MAD20 Course Materials (2024) Splunk Threat Hunter's Cookbook (2025) BOTS v2 Dataset  Splunk Boss of the SOC v2 Dataset BOTS v2 Scenario Documentation Technical Implementation  Splunk 3D Scatterplot Visualization  How can SecOps security engineers utilize datasets like BOTS?  How do we utilize 3D scatterplot visualization in Chronicle?  I dug through John Stoner’s New to Chronicle series, and David French’s posts, and I’d like to see a practical technical demonstration of these potent threat detection techniques, specifically TTB and utilizing community detection datasets like BOTS. 

130
defcesco
jaymin
jayminBronze 5
 Google Security Operations
Facing Issues with Native Dashboard Filters, Drill-Down Time Ranges

Hello Everyone,I am working on building native dashboards in Google SecOps and came across multiple issues related to global filters and drill-downs.1. Additional Field Filters for EntityI need to create a global filter on a native dashboard using graph.additional.fields["key"]. Has anyone been able to use Entity additional fields as filters in native dashboards? Example: graph.additional.fields["key"] = "value" 2. Time Range Filter Not Working as ExpectedI applied a global filter using graph.metadata.interval.start_time across all charts in a native dashboard. When applied, no data is returned. But when editing an individual panel and applying the same time range, data is shown correctly. 👉 Question: Does the panel time filter actually use graph.metadata.interval.start_time, or is it mapped to another field internally? If so, which one?Global FIlterPanel Filter 3. Drill-Down Default Time RangeI configured a drill-down on a column in a native dashboard. When I click drill-down, it

371
kentphelps
Staff
spanuganti
spanuganti
 Google Security Operations
Multi Event Rule --Bruteforce_with_4624_and_4625--Rule

meta:   author = "XXX XXX"    description = "Detects a successful logon immediately following multiple failed logon attempts from the same IP or user, using specific Windows Event IDs."    severity = "High"    priority="High"    mitre = "T1110.001"    yara_version = "YL2.0"    tactic = "Credential Access"    technique = "Brute Force"   events:    // Event 1: Failed authentication attempts from Windows logs (4625).    $fail.metadata.event_type = "LOGIN_FAILED" and    $fail.principal.asset.ip = $ip_address and    $fail.target.user.userid = $user_id        // Event 2: A single successful authentication from the same IP (Windows 4624).    $success.metadata.event_type = "LOGIN_SUCCESS" and    $success.principal.asset.ip = $ip_address and    $success.target.user.userid = $user_id    match:    $ip_address, $user_id over 5m   outcome:    $failed_attempts = count($fail)    $alert_type = array_distinct("Successful Brute Force Attack via Event IDs 4624/4625")   condition:    $success and $fail an

458
spanuganti
keiS
keiSBronze 3
 Google Security Operations
Google Chronicle Connector Auto Updates

Occasionally, we are experiencing an issue where a case is not created even though an alert is detected by a rule.When we contact support about this issue, we are usually told to update the Google Chronicle connector to the latest version. Updating often resolves the issue, but is it possible to create some kind of system that will automatically update when the latest version is released?If automatic updates are difficult, we would like to create a system that will notify us when an update is available.We look forward to your response.Best regards 

575
_K_O
Sarthakd25
Sarthakd25New Member
 Google Security Operations
How to Parse Nested Complex Objects from CEF Keys with Array Indices (e.g. mitre1.enterprise.10.techniques.5.techniqueID) in Logstash Filter Block

I want to build a Logstash parser to handle CEF-format logs where the field keys resemble nested structures with array indices. The CEF format includes key-value pairs, which I can extract using: kv {   source => "cef_event_attributes"   field_split => "|"   value_split => "="   target => "cef_fields" } Here are a few example key-value pairs: mitre1.enterprise.10.techniques.5.techniqueID = T1047 mitre1.enterprise.10.techniques.4.techniqueID = T1021 mitre1.enterprise.9.techniques.3.techniqueID = T1059 user = abc123 These are flattened field names. For example,mitre1.enterprise.10.techniques.5.techniqueID represents a path-like structure and can be interpreted (conceptually) as:mitre1[0].enterprise[10].techniques[5].techniqueID — though I don't need to construct a nested object, just treat the key as a full string.✅ What I’m Looking For:Is there any Logstash-native way to: Dynamically iterate over all key-value pairs in cef_fields? Skip a known field like user (which I can

40
Sarthakd25
Cook942
Cook942New Member
 Google Security Operations
Excluding Tags from dashboard query withoutexcluding the linked cases

So I am creating a dashboard that is breaking down events by event types, we are handling event types with tags within SecOps, however tags are also being used in multiple other areas.What I am trying to create is a dashboard showing all cases with some defined tags in a pie chart, but I only want it to display THOSE defined tags, not any other tags that may be attached to the same cases.Excluding those tags in the query also excludes those cases they are attached to which is no useIs there a way for a defined output list in the query that will only show the required tags (This was possible in the legacy Dashboarding but I cannot seem to do it in the new Dashboarding)

80
Cook942
AlexScoble
AlexScobleNew Member
 Google Security Operations
Automatic Case Creation In Specific Environments From Curated Detection Rules

Hi All, I’ve looked high and low in search of a solution here, so hopefully, someone here can help us. We provide access to specific cases and event data based on environments, but I cannot figure out how to have cases created by curated alerts automatically assigned to the correct environment based on feed. If anyone has documentation or can provide guidance on how this can be done, it would be much appreciated. We have ingestion label of Org set up on specific feeds with the org names set as values, but it’s unclear how we use this to have cases automatically created in the correct environments. If feed namespaces are the better method for this, cool, please let us know how we would go about doing that. Solution doesn’t seem to be at the playbook level, since there’s no action to move cases to specific environments based on conditions. Thanks, [removed by moderator]

121
bsalvatore
masaya.gotou
masaya.gotouBronze 1
 Google Security Operations
Seeking Advice: Best Approach for Feed-Level Monitoring & Alerting in Chronicle SecOps

Hello,I’m looking for advice regarding the operation of Chronicle SecOps.Currently, we’re managing multiple Feeds (log ingestion sources) in SecOps, and our goal is to detect issues such as ingestion failures or delays on a per-Feed basis as early as possible and trigger alerts accordingly.At the moment, we haven’t decided on any specific implementation method. We’re considering various approaches, including built-in SecOps or Cloud Monitoring features, API integrations, or other cloud services, but we’re not sure which would be the most effective or practical.If anyone has experience implementing Feed-level ingestion monitoring and alerting in Chronicle SecOps, I’d appreciate your recommendations, tips, or any lessons learned.Thank you!

715
masaya.gotou
N
NoxurgeNew Member
 Google Security Operations
Data conversion - Enum to String

Hello Everyone! I trying to build some widgets in my dashboard, but I’ve some problems with my query. I trying to show severity for my custom rule detections and the curated detections in just one field. My problem resume to can’t use field detection.detection.severity in my if condition, because this field is “enum” data type, and another field is string data type. Query → $dynamic_severity = if(detection.detection.severity = “UNKNOWN_SEVERITY”, detection.detection.outcomes["severity"], detection.detection.severity) detection.detection.outcomes["severity"] → This is severity of my custom rules (string data). Feel free to send me another logics for this query!

180
N
Walker_81
Walker_81Bronze 1
 Google Security Operations
Data Tables use for Event and Entity Enrichment

Based on available documentation I created a data table with data about my assets (hosts). I mapped columns to entity.asset.hostname, entity.asset.software.version etc. and I was expecting that this is enough to see this data being used to enrich entities and events. Unfortunately, I’m not seeing any effect neither in entity nor events. I’m running following search to confirm the there is a match between the events and data table (principal.hostname = "my_hostname" and principal.hostname in %my_datatable.Hostname) and I’m getting results, but the enriched data is just not there. I do realize that stitching enrichment takes place once every 24h, but I checked after a few days.User that I have is RBAC based with Chronicle API Admin rights level. What troubleshooting can I do to fix this issue?

311
kentphelps
Staff
Rached1996
Rached1996Silver 2
 Google Security Operations
dashboard based on data table / filter question

i have a question if you can help me i have a dashboard : contains 3 columns 1: ip , cidr 2: region , string3: country : string i have put in my query principal.ip in %datatable.cidr and i want to add a condition where i filter on the ips related to a specific country and get that as outpout ( the principal ip in india country only for example ) but i was not able to do that can you help please ?  

453
Rached1996
Ravi0410
Ravi0410New Member
 Google Security Operations
SLA Configuration

Hi Everyone,I’m working on setting up SLA rules in Chronicle SOAR for cases, and I’ve run into some challenges that I’d like to get your input on. Here’s the scenario:Requirements: First response SLA: Starts when a case is created and stops when the case is assigned or moves out of the Triage stage and period 1 hours. Update SLA: Starts after the case moves out of Triage and resets whenever there’s an update in the case wall and duration is specific to Severity. Stops when the case is closed. The challenge is chronicle doesn’t appear to have a direct SLA reset mechanism to restart timers whenever there’s a casewall update. using the "Get Case Communications" Siemplify Action Module be a viable workaround to detect updates and restart SLA timers dynamically? Has anyone successfully implemented something similar? Timer Start for SLA:   The response SLA starts when the case is created, but the Update SLA needs to start when the case exits the Triage stage. How can I configure these sep

161
bsalvatore
Berges
BergesNew Member
 Google Security Operations
Ingesting 3rd Party Threat Intel feeds

Guys  i want to fetch 3rd party threat intel data in my google secops and make its list which will get updating every 24 hour.can any 1 guide.

343
cmorris
Staff
ericv-ava
ericv-avaNew Member
 Google Security Operations
Microsoft Defender for Cloud and curated detections discrepancy

We just finished setting up ingestion of MS Cloud Defender alerts into our Google SecOps instance.Using the following docs:https://cloud.google.com/chronicle/docs/ingestion/default-parsers/ms-defender-cloud-alerts#overview Alerts are flowing just fine. Next step is to create alerts if any fired.  I’ve tried leveraging the Curated detections, but noticed that the event type referenced in the curated detections is different, so they wont fire.    My event type beign ingested are comingmetadata.log_type = "MICROSOFT_DEFENDER_CLOUD_ALERTS" Looking at the curated detections logic, I see completely different log_type. metadata.log_type = "MICROSOFT_GRAPH_ALERT" Whats “microsoft Graph Alert” to start and why  are the curated detection for Cloud Defender using this log_type?    How can I edit the curated detections to fix this? I would hate having to deploy all rules on my own. Any advice? Thanks in advance. 

362
ericv-ava
hisoofun
hisoofunNew Member
 Google Security Operations
Custom alerting for IOC Match

Someone please help how to set up custom alerting to get alerts for the IOC Matches shown in Dashboard

651
vaskenh
Staff
L
laxmikant_nagarkarNew Member
 Google Security Operations
Column manager change view to older (NonSecopps)

Hi,Is there any way i can switch the UI of column manager to the old view i.e before it converted to SecOps. Having trouble to export the events as per the requirement.Old view was simple and easy to remove /add columns and export them.In new UI after export of the data for each exported field name column the value is in JSON format and not able to process/consume it as desired Regards,Laxmikant 

70
L
L
liamhvNew Member
 Google Security Operations
Incorporating UEBA Techniques in Detection Rules

Hi there,I’m trying to incorporate user behavior patterns (UEBA techniques) into SecOps rules. For example, let’s say I want to create a rule that triggers an alert whenever a user clears Windows event logs. I only want that to trigger an alert if the user has not previously ran similar commands in the last 30-90 days. If they haven’t ran those commands previously, then that is considered ‘anomalous’ and an alert will be triggered. I took a look at using metrics but only certain functions are supported.Is this possible? I figured with playbooks in SOAR it is, but was hoping to accomplish this within the rule itself.Thanks!

742
L
jeff62
jeff62New Member
 Google Security Operations
Is a Remote Agent required when using GitSync PowerUp

I am looking a syncing our SOAR environment to BitBucket. I have setup GitSync and configured it on the System Default Instance. When I run the test it works.I get the following errorReading configuration from Server [2025-08-27,22:18:30,000 ERROR] General error performing Job Push Job [2025-08-27,22:18:30,000 ERROR] 400 Client Error: Bad Request for url: http://server:80/v1alpha/projects/project/locations/location/instances/instance/legacySdk:legacyIntegrationConfiguration?identifier=GitSync&format=snake: b'{"errorCode":2000,"errorMessage":"Integration settings for [Identifier: GitSync] could not be found because the integration instance is missing.","innerException":null,"innerExceptionType":null,"correlationId":"2152256c2dce41c1ad3bb15d6c390181"}' I have looked at ticket which is the same error, I have configured and tested multiple times and all successful but not when I am using the IDE or trying to create a Job 

413
ylandovskyy
Staff
MikelSA
MikelSABronze 1
 Google Security Operations
Missing Transferred Bytes/Traffic Size in FAZ to SOAR API Alerts

Good morning,At one of our clients we are sending alerts from FAZ to the SOAR via API. After reviewing the events/logs closely, I noticed that the fields related to transferred bytes or megabytes in the connections are not being included.Is there any way to add these fields — perhaps through a configuration option or similar?I saw the "Search logs" option under FAZ integration, but it doesn’t seem to be working.Any ideas? Thanks in advance.

458
MikelSA
Daniel_Jr
Daniel_JrNew Member
 Google Security Operations
Case segmentation in SecOps by Custumer Environment

Hi everyone,We’re currently implementing SecOps and I’m struggling with a specific scenario where I couldn’t find clear documentation. At the moment, we have a single environment that centralizes all open cases. Our requirement is to segment these alerts so that, for example, firewall events are separated by client, in different environments, based on criteria such as IP addresses, domain names, or even email addresses.My questions are: What would be the best way to automatically assign these cases to the right environment? Should this be handled with rules, or is it better to use playbooks for this type of segmentation? If anyone has faced a similar situation or can share best practices, I’d really appreciate your input.

401
samryanturner
devashishsingh
devashishsinghBronze 2
 Google Security Operations
Read .eml file in Google secops SOAR

Hello team,We are looking to enhance our phishing response process using our SOAR platform. Currently, when users report potential phishing emails, the alerts are generated with the suspicious email included as a .eml attachment.Our goal is to create a fully automated, end-to-end triage playbook.

221
bsalvatore
Omskirt
OmskirtBronze 2
 Google Security Operations
aggregation to another aggregation

Hi, is it possible to aggregate another aggregation? My goal is to get the average time for the maximum and minimum time. But since there’s a limitation I’m not getting the correct result. Is there any workaround to get avg? 

612
AymanC
yasinmnk
yasinmnkBronze 2
 Google Security Operations
Alert Priority

Hi,I need to create a playbook that creates Jira tickets based on alert priorities. If an alert's priority is high, it should create a high-priority ticket and so on. However, my condition doesn't match anything, and the playbook always chooses the last step. How should I create the condition to make that work correctly?"

191
G
CampaignDev
CampaignDevNew Member
 Cloud Security Foundation
OAuth App Verification Stuck on "Pending developer action" - No Email Received

Hello,Our application (Project ID: smtp-campaignbutler) is currently in the "Pending developer action" state in the Verification Center.The console instructed us to "Reply to your email thread with our Trust and Safety team". However, we have not received this email, after thoroughly checking all inboxes and spam folders for our registered developer contact email addresses.We have already resolved the two issues that were required:1. The homepage domain has been verified in Google Search Console.2. A link to our Privacy Policy has been added to the homepage footer.Since we cannot find the email to reply to, and our current support plan does not allow us to open a direct tech support case, we are hoping someone from the community or a Googler can advise on how to notify the Trust & Safety team that our fixes are complete.How can we move forward with the review process?Thank you for your help.

90
CampaignDev
rafarauber
rafarauberNew Member
 Security Validation
[URGENTE] Conta presa com erro 429 na API do Gemini - Cota gratuita não está sendo aplicada

Olá, comunidade,Estou enfrentando um problema  e preciso muito de ajuda. Sou estudante e estou tentando usar uma API do Gemini, mas minha conta parece estar bloqueada.Resumo do problema: Estou aceitando um erro "429 - Quota Exceeded" na primeira requisição que faço para a API do Gemini, mesmo em um projeto totalmente novo e configurado do zero.O que já foi feito (sem sucesso): 1. Meu código Python está correto e só faz uma requisição por vez (não está em loop). 2. Criei uma conta de faturamento e o vinculei corretamente ao meu projeto ativo. 3. Confirme que a "Generative Language API" está ATIVADA no projeto. 4. Criei mais de um projeto e chaves de API novas; o erro persiste em todos eles. Tudo indica que a cota padrão gratuita da API do Gemini não foi provisionada corretamente para minha conta Google Cloud. Não importa o que eu faça, meus projetos herdam esse status de "cota zero".Alguém do Google poderia, por favor, investigar o provisionamento da minha conta? O ID do meu último proj

151
ErikaB
Community Manager

Badge winners

  • Comments Posted 5
    spanugantihas earned the badge Comments Posted 5
  • Authored Posts 1
    Cook942has earned the badge Authored Posts 1
  • Comments Posted 25
    bsalvatorehas earned the badge Comments Posted 25
  • Comments Posted 1
    masaya.gotouhas earned the badge Comments Posted 1
  • Comments Posted 5
    keiShas earned the badge Comments Posted 5
Show all badges
Terms & ConditionsCookie settings
Privacy Policy Terms of Service Gen AI Policy Community Guidelines Cookie Settings

© 2025 Google. All rights reserved.