Skip to main content

Google Security Operations

Your Security Operations conversation starts here. Ask questions. Share insights. Tell us what you've learned. Or tell us what you're working on. We want to hear about it!

  • 2,107 Topics
  • 6,713 Replies
2108 Topics
ylandovskyy
Staff
ylandovskyyStaff
posted in Google Security Operations
How to use new Data Tables Actions in Google Chronicle Response Integration - Full Guide

Hey folks! In Q3, it was announced that Data Tables are now officially GA and alongside of it, Google Chronicle integration was updated with new actions that allow you to interact with them. In this guide, I will go through all relevant actions and explain how they work. If you are not familiar with Data Tables, please check this documentation. ❗❗Important Note: Data Table actions are only supported for Chronicle API. Backstory API doesn’t support it. To change the integration to work with Chronicle API, you need to adjust the API Root in the integration configuration. Keep in mind that this will affect the whole integration and some action outputs are slightly different, if executed with Chronicle API.❗❗ Initial StateTo make it easier to follow the guide, I am going to create an initial state of a Data Table, which will be used as a reference across the guide:  Get Data Tables ActionThe purpose of this action is to allow you to fetch information about available Data Tables (including

770
ylandovskyy
Staff
phlucas
phlucasNew Member
asked in Google Security Operations
Error "SOAR data source not supported" when querying Cases and Alerts in Native Dashboard

Hi everyone,I'm trying to run queries in the Google SecOps (Chronicle) Native Dashboard using SOAR-related data sources such as Cases, Alerts, Playbooks, and Case History, following the official documentation:Sample YARA-L queries – Cases and AlertsSOAR data in the Native DashboardHowever, when running queries like the one below, I get the following error:Querymatch: case.status outcome: $count=count(case.name) Error{ "error": { "code": 400, "message": "generic::invalid_argument: SOAR data source not supported: invalid argument", "status": "INVALID_ARGUMENT", "details": [ { "@type": "type.googleapis.com/google.rpc.ErrorInfo", "domain": "chronicle.googleapis.com" } ] } }I've verified that I'm using the documented data sources and fields correctly.
Is there any prerequisite to enable SOAR data sources in the Native Dashboard? Or is this feature not yet generally available?Any insights would be appreciated.Thanks in advance!

72
babu_k
Staff
ericv-ava
ericv-avaNew Member
asked in Google Security Operations
Setting up and using SQS v2 via Federated IDs to ingest logs to GSecOps

I’m aware there is a new Feature: SQS V2 to ingest logs to Google SecOps using Federated ID as stated in this update.https://cloud.google.com/chronicle/docs/release-notes#May_26_2025 At the moment I’m using SQS and static keys and I’m interested in moving over to Federated IDs.  However,   I can’t seem to figure out how STS play a role here. Current documentation assumes  STS its already present.    Do I need to set STS before I can migrate over? if so how can I set up to ingest into my current Google SecOps instance.    I’ve opened a support ticket, look for docs to help me get this going.    Seems support its lost and so I’m. I can’t find clear docs on this.Has anyone use STS + SQSv2 yet?  and or also looking into this? Thanks in advance for any pointers in the right direction.   

213
kentphelps
Staff
R
russell_pfeiferBronze 5
asked in Google Security Operations
Change Timestamp In SecOps Search from UTC to PDT

Good morning -- Is there a way within SecOps search to return the PDT timestamp rather than the default UTC (Z)?

20
R
JoshepKoh
JoshepKohNew Member
asked in Google Security Operations
Google SecOps Gemini summary speed

Hi AllHow fast is Google SecOps' Gemini Summary? When a case was first created and a summary is generated, the speed at which Gemini Summary is generated varies depending on the situation, ranging from as fast as 1 minute to over 5 minutes. Is this normal? How about others?Also, why does Gemini not generate a summary immediately when a case is created, but instead requires the user to click to perform the summary? If Gemini generated the summary immediately, we wouldn't have to worry about this. Regards. 

291
vaskenh
Staff
Jez_K
Jez_KNew Member
asked in Google Security Operations
Are custom IOC feeds kept private inside my SecOps instance

If I attempt to integrate a custom IOC threat feed from a private closed source, are those indicators kept inside my own tenant or are they used with all customers/instances of secops?

121
kentphelps
Staff
MCoelho10
MCoelho10New Member
asked in Google Security Operations
GoogleChronicle - Execute UDM Query delay of 30/40minutos to find new recent events

Hi,Currently creating a playbook where its needed to do a UDM query to find a events that are created around the same time of the events of the case.When the case starts runs the playbook and the GoogleChronicle - Execute UDM Query action, where it doesnt find the specfic event. i even made sure that the time range is correct and its not missing the event for a couple minutes by generating the start time and end time based on the timestamp of the events of the case using the action “Functions - Convert Time Format”, start time being 2 months before and the end time being 2 DAYS AFTER.The action run but doesnt return any result, but if i do the EXACTLY same query directly on the SIEM, it is able to find that event.I realize that after 30/40 minutos after the case being created, i can run(or rerun i guess) that action and its able to find the event.I could fix the playbook just by adding a delay on the start of it of 1 hours or something and the action would run well and find the events

384
MCoelho10
Vaishnoodevi
VaishnoodeviBronze 1
asked in Google Security Operations
Dynamic Whitelist - Sentinel Connector on the Google SecOps SOAR

Hi All, I have added few use case name to the dynamic whitelist on the Sentinel connector at the Google SecOps SOAR,but some of these alerts are not getting ingested as a SOAR case even though a security incident is created at Sentinel

173
ylandovskyy
Staff
Mike
MikeNew Member
asked in Google Security Operations
 Sending auditd Logs to Chronicle via Syslog on RHEL 8/9

 Hi everyone,We're using Chronicle (Google SecOps) as our SIEM, with a log forwarder configured to receive syslog data (on UDP port 10519) — including auditd logs (on UDP port 10518).We now want to reliably forward auditd logs to syslog on RHEL 8 and RHEL 9 systems, so they can be ingested by Chronicle through the forwarder.What We FoundWe’ve reviewed the official documentation:https://cloud.google.com/chronicle/docs/ingestion/auditdHowever:It focuses on Debian/Ubuntu systems onlyMost other tutorials we found are outdated or rely on deprecated components like audispd-pluginsOur GoalUse the native auditd configuration on RHEL 8/9Forward audit logs to rsyslog, which then sends them to ChronicleAvoid deprecated or unnecessary plugins if possibleWhat We’re AskingWhat’s the recommended way on RHEL 8/9 to forward auditd logs to rsyslog?Should we still use audisp-syslog, or is there a more modern alternative?Is there any validated or community-tested setup specifically for RHEL systems?Thanks

311
kentphelps
Staff
keiS
keiSBronze 2
asked in Google Security Operations
I want to create an exclusion condition for an alert based on the values of multiple fields using YARA-L and a data table

I need to create an exclusion setting based on the values of multiple fields in a YARA-L rule.I've been trying and erroring using a data table, but I'm not getting anywhere so I'd appreciate any advice.○What I want to doIf principal.user.email_addresses is aaa@sample.com and principal.ip is x.x.x.x, do not send an alert.(I want these two fields to be an and condition, not an or condition)If this cannot be done with a data table, could you tell me if there is another way to do it?I look forward to your reply. rule sample_rule { meta: author = "sample" description = "testrule" severity = "MEDIUM" events: $e.metadata.log_type = "GCP_CLOUDAUDIT" ($e.principal.user.email_addresses != %sample_rule.useremailaddresses or $e.principal.ip != %sample_rule.ip) $user_id_for_match = $e.principal.user.userid match: $user_id_for_match over 1h condition: $e} 

856
keiS
T
Tejaswini139Bronze 1
posted in Google Security Operations
Iterate through json output of table(rows and columns) resulted from query

Hi team,I want to run "Execute custom query" from Microsoft365Defender Integration. query is:EmailEvents | where Subject contains "testvalue".This query returns result table which has rows and columns in json format.for example,row1 {col1:val1, col2:val2,..}, row2{col1:val1, col2:val2,..},row...DeliveryLocation is one of the column names from the json result.I need to check whether DeliveryLocation=Inbox/folder and for each row where this condition is met, should remediate those mails accordingly.I exported the json result of this action and imported it in the IDE for this integration.How can I iterate through each row from json result and fetch DeliveryLocation. In the placeholder of the condition, check for DeliveryLocation and remediate particular emails in every row where DeliveryLocation=Inbox/folder.Thanks,Tejaswini  

114
samryanturner
K
kasundsscNew Member
posted in Google Security Operations
Google Chronicle Slient Log Source Monitoring

Is there a way for Google Chronicle Enterprise customers to monitor and receive notifications about silent log sources through Google Chronicle?

1916
palevelmode
_eo
_eoBronze 1
asked in Google Security Operations
SOAR Dashboards Data

I’m looking to get SOAR playbook data across multiple tenants. Is there a way to get the data that populates the dashboards via API or access all of the data from one location? 

494
_eo
malzahnOptiv
malzahnOptivBronze 3
asked in Google Security Operations
Detection Rule Test

Hello,An associate of mine ran a SIEM search and got 4 results. They then ran a test of a YARA-L rule with the same logic and got 2 of those 4 results.  10 minutes later it showed 3 of the results.  30 minutes later it showed all 4 results.  Is there a known lag when using the “RUN TEST” feature in the Detection Rules?  The logic used to search was straightforward -- just filtering on 4 UDM fields. No match section. Thanks,Eric

564
cmmartin_google
Staff
nelson_prenga
nelson_prengaNew Member
asked in Google Security Operations
How can you use placeholders for actions with 'List' type arguments?

I don’t see a way to use placeholders on an action parameter that is a List. I have found out that you can duplicate the action, and change the parameter type, but that is not very convenient.Can this be looked at? Anybody else have this issue?

453
ylandovskyy
Staff
C
chronicleDDsrBronze 3
posted in Google Security Operations
SOAR Playbook actions to process case wall/comments

Hi team,We are working on developing playbooks from scratch and was wondering what would be the best way to read a case wall note/comment and process specific data and pass it as input to another action?Ex: Lets say we have a servicenow action configured in playbook workflow - 1, which would fetch a record details based on place holder values given and now i want to pass a specific value from JSON output returned (which i can see in the case wall tab) from servicenow action within workflow 1as input to another workflow -2 or to same workflow - 1Any insights would be helpful to address this problemThanks.

77
C
Jez_K
Jez_KNew Member
asked in Google Security Operations
Are custom IOC feeds kept private inside my SecOps instance

If I attempt to integrate a custom IOC threat feed from a private closed source, are those indicators kept inside my own tenant or are they used with all customers/instances of secops?

144
Jez_K
vanitharaj1208
vanitharaj1208Silver 2
posted in Google Security Operations
Prevalence of entity using HTTP request

Im using this endpoint https://cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances/summarizeEntitybut the issue not able to figure out  the URL Params valuesI tried like this {"timeRange": { "start_time": "2025-07-10T00:00:00Z", "end_time": "2025-07-12T00:00:00Z" }, "pageSize": 10, "returnPrevalence" : true, "entityId" : "xxxxxxxxxxxxxxxxxx" }Also how to pass entity and entity type and how to get entityid? 

83
ylandovskyy
Staff
Sudheerzscaler
SudheerzscalerNew Member
asked in Google Security Operations
Action for Rasterizing or creating image of the HTML text 

is there any Action for Rasterizing or creating image of the HTML text 

152
ylandovskyy
Staff
delston
delstonBronze 1
asked in Google Security Operations
Case / Widget Refresh Rate

Does anybody know what the Case / Widget Refresh Rate is?After an analyst has responded to a Playbook action it can take an age for the Widget “Pending Actions” to get updated and they find themselves refreshing the Case manually which is very frustrating.

131
ylandovskyy
Staff
ORBR
ORBRBronze 5
asked in Google Security Operations
Quick action buttons from a custom HTML widget

I really love the new “Quick Actions” widget, but I want to create similar thing using HTML, just with our own styling. What is the right way to call the manual action “Attach new playbook” API using HTML?  

41
ylandovskyy
Staff
ar3diu
ar3diuBronze 2
asked in Google Security Operations
Google Workspace Activity Logs - Direct Ingestion to Google SecOps - Enrichment is missing

GWS License: Enterprise Plus Ingestion method to SecOps: Direct Ingestion configured in GWS Admin Console Issue: User/Device Entity Enrichment is missing. Have a look in the screenshot where I compared a log from SecOps when the ingestion was done through SIEM Feeds versus collected through Direct Ingestion. Any idea if there’s an additional configuration to get this?    

495
ar3diu
pontorieroa
pontorieroaNew Member
asked in Google Security Operations
SIEM Data RBAC: Unable to create data access scope

Hi, I am trying to apply my terraform code to create access scopes in SecOps SIEM and I get the following error even though the service account running this has the Chronicle API admin and Security Admin roles assigned: │ Error: Error creating DataAccessScope: googleapi: Error 403: Permission 'chronicle.dataAccessScopes.create' denied on resource '//chronicle.googleapis.com/projects/<project name>/locations/europe-west3/instances/<customer ID>' (or it may not exist).│ Details:│ [│ {│ "@type": "type.googleapis.com/google.rpc.ErrorInfo",│ "domain": "chronicle.googleapis.com",│ "metadata": {│ "permission": "chronicle.dataAccessScopes.create",│ "resource": "projects/<project name>/locations/europe-west3/instances/<customer ID>"│ },│ "reason": "IAM_PERMISSION_DENIED"│ }│ ]││ with google_chronicle_data_access_scope.data_access_scope["scope-vg-cs"],│ on main.tf line 69, in resource "google_chronicle_data_access_scope" "data_access_scope":│ 69: resource "google_chronicl

332
pontorieroa
Chris_B
Chris_BSilver 2
asked in Google Security Operations
Files on the SOAR wall are where

We’re planning some file enrichment / manipulation in a SOAR playbook and it looks like we can “get the file on the SOAR case wall.” Where is this file actually?Example - using the Gmail integration and able to put eml file on wall.Context is what if the file is malicious - what’s in the immediate environs of the file - i.e. what’s the blast radius?

424
Chris_B
jasonsigman
jasonsigmanBronze 1
asked in Google Security Operations
Handling Loop Output Data

When using a loop in my playbook I end up having to write data to a file or case wall if I want to use it outside of that loop. Since this playbook is essentially a giant Python Script is there a way to set a global variable ( not something associated with the case or alert just the script itself ) and then reference that global variable throughout the playbook. 

322
jasonsigman

Badge winners

  • Authored Posts 1
    ericv-avahas earned the badge Authored Posts 1
  • Comments Posted 1
    EJJessehas earned the badge Comments Posted 1
  • Comments Posted 1
    kin.chanhas earned the badge Comments Posted 1
  • Authored Posts 5
    Jez_Khas earned the badge Authored Posts 5
  • Comments Posted 1
    reubanisaachas earned the badge Comments Posted 1
Show all badges
Terms & ConditionsCookie settings
Privacy Policy Terms of Service Gen AI Policy Community Guidelines Cookie Settings

© 2025 Google. All rights reserved.