Skip to main content

Google Security Operations

Your Security Operations conversation starts here. Ask questions. Share insights. Tell us what you've learned. Or tell us what you're working on. We want to hear about it!

  • 2,063 Topics
  • 6,570 Replies
2063 Topics
S
satya_sakethBronze 3
posted in Google Security Operations
automate re-run playbook

I am unable to loop the playbook.i have created the playbook for automating the eml analysis If eml file is not uploaded it should notify the again. For notifing again ihave 2 optionsLooping as shown in imageRerun the playbook if failes. (Configure action retries in playbooks  |  Google Security Operations  |  Google Cloud)Regarding Rerun(retries) feature do i need to raise a techinical ticked to enable it.Thanks in advance.

111
kentphelps
Staff
adnanrahicbp
adnanrahicbpNew Member
posted in Google Security Operations
High Availability w/ OpenTelemetry Collector + Bindplane - a Practical Demo

If you’re building out your OpenTelemetry telemetry pipeline for SecOps, I wrote a practical guide on how to avoid data loss using High Availability (HA) collectors, persistent queues, and proper batching.Includes: Gateway architecture (with diagrams) Docker + Kubernetes examples Bindplane setup with CLI + UI Would love to know what patterns the community is using.Read the full guide here: https://bindplane.com/blog/how-to-build-resilient-telemetry-pipelines-with-the-opentelemetry-collector-high-availability-and-gateway-architecture

40
adnanrahicbp
jetheridge
jetheridgeNew Member
asked in Google Security Operations
On Demand Machine Isolation for Defender

Hey all, I’ve noticed that the Microsoft Defender ATP SOAR Integration has “Create Isolate Machine Task” and accompanying unisolate machine task actions. However, these find the host directly from the alert. I want to be able to have isolate and unisolate actions that can take in a hostname/hostid as an input so that they can be ran ad-hoc. Any ideas?

171
_eo
SaDaVF
SaDaVFNew Member
asked in Google Security Operations
Creating case level automations for ITSM integration?

Hello. My company has recently adopted Google SecOps alongside our current ITSM tool in-which we use to conduct case management and handling. We would like to have SecOps automatically create and updates cases in our ITSM tool, however I don’t see any automated functionality to run things at case level.Could some advice be provided on how to move forward particularly with the following:Have cases created in ITSM when analyst change the case state to incident.  Have new alerts added to our ITSM when alerts are added to cases in secops with incidents already raised. Have new alerts removed to our ITSM when alerts are removed from cases in secops with incidents already raised.I already have actions and integrations for our ITSM that work for these purposes, but I now need a trigger to automate them which I cannot find in SecOps.

150
SaDaVF
raybrian
Staff
raybrianStaff
posted in Google Security Operations
SecOps API Wrapper SDK for Python

Announcing the release of a simple SecOps API Wrapper SDK: https://pypi.org/project/secops/   now using the SecOps API is as easy as: pip install secops   from secops import SecOpsClient client = SecOpsClient() chronicle = client.chronicle( customer_id="your-chronicle-instance-id", project_id="your-project-id", region="us" )   Currently supported methods: UDM Search Stats Search CSV Export Entity Summaries Entity Summary from UDM Search List IOC Matches in Time Range Get Cases Get AlertsPlease let us know your feedback, and which other use cases you'd like to see supported.

6627
mihirvala08
Staff
MichaelCain
MichaelCainNew Member
asked in Google Security Operations
Clarification on metadata.log_type in Google Chronicle – Parser Indicator or Detection Field?

Hi all,I'm looking for some clarity around the use and interpretation of the metadata.log_type and metadata.base_labels.log_types fields in Google SecOps / Chronicle UDM, particularly in relation to the log ingestion method and parser behaviour. The Standard Flow:When data (e.g., Windows Event Logs) is ingested via agents like BindPlane, Chronicle automatically detects the log source (e.g., WINEVTLOG) and uses the appropriate parser – in this case, Windows Event Parser. The parsed UDM ends up with fields such as:"metadata": { "logType": "WINEVTLOG", ... "baseLabels": { "logTypes": ["WINEVTLOG"] }}This makes sense – the original raw event (XML) is parsed and normalized, and the parser used is reflected here. My Question:When I take a pre-parsed UDM log (in the same format as above), and upload it manually via the Events Import API, the fields instead show:"metadata": { "logType": "UDM", ... "baseLabels": { "logTypes": ["UDM"] }}This behavior is expected, I suppose, since t

243
MichaelCain
S
SurendrasumithBronze 2
posted in Google Security Operations
Discrepancies in Data Ingestion health dashboard & SecOps Data.

Hi,We are encountering discrepancies between the data shown in the Data Ingestion Health Dashboard and the SecOps data.Specifically, I am trying to view the unparsed event count in the dashboard, which outputs the unparsed count. However, when searching for the same data source in Chronicle and checking the unparsed logs under "Event Type" (searching 10,000 logs at a time), no results are returned.Could this discrepancy be due to the tenant using autonomous parsing? If so, why does the dashboard show a different result?Additionally, if autonomous parsing is enabled, I understand that Chronicle will parse those events and categorize them under "GENERIC_EVENT." Is there a way to identify these events, such as through a tag or another method?Thanks,Sumith.P 

103
jt_wells
bruzz
Staff
bruzzStaff
posted in Google Security Operations
Introducing the SecOps Toolkit open source repository

I’m excited to announce the open sourced launch of secops-toolkit. 🚀After months of work, I'm excited to share this new open-source repository designed to accelerate automation for Google SecOps.What is secops-toolkit? The secops-toolkit is an open-source repository that provides a comprehensive collection of Terraform blueprints, modules, and CICD pipelines designed for Google SecOps, providing modular and scalable automations for the wider customer and partner community.The GitHub repository includes:Terraform modules: for the automation of Google SecOps configurations, including Data RBAC, Rules, and Reference lists based on new resources from google provider. Blueprints: developed using Terraform and Python scripts for automated bootstrap of Google SecOps, provisioning of new tenants in MSSP-like architecture and comprehensive end-to-end deployment of solutions for BindPlane, SecOps Forwarder as well as a sample Anonymization Pipeline in Google Cloud Platform. This project heavily

261
matthewnichols
Community Manager
donkos
donkosNew Member
posted in Google Security Operations
Stats Query - How to Avoid Doublecounting

Here's a sample query I have:metadata.event_type = "EMAIL_TRANSACTION" and network.direction = "INBOUND" " $url = about.url $url in %IOC_List match: $url outcome: $Total_Email_Count = count_distinct(metadata.id) $Total_Email_Allowed=sum(if(security_result.action!="BLOCK", 1,0)) $Total_Email_Blocked=sum(if(security_result.action="BLOCK", 1,0)) order: $Total_Email_Count descMy goal is to check if a url came up in inbound emails and return counts by a simplified version set of variables for security_result.action - if not explicitly blocked, count it as "Allowed" (along with a total count of emails). My problem is that about.url is an array of values, where the same url can come up several times - meaning my total email count might be 10, but my total allowed is 20, because each email is counted twice under $Total_Email_Allowed because the url is in about.url twice. Any suggestions?

113
donkos
A
af27Bronze 1
asked in Google Security Operations
issue with siemplify.get_attachment(attachment_id)

Hi,I have wrote a custom actions that gets attachments from the case wall and creates a html table, allowing the user to click a button to download the attachment. This had been working okay but we have now been experiencing this following error:  File "/opt/siemplify/siemplify_server/bin/Scripting/PythonSDK/SiemplifyBase.py", line 170, in validate_siemplify_error raise Exception("{0}: {1}".format(e, response.content))Exception: 500 Server Error: Internal Server Error for url: http://server:80/v1alpha/projects/project/locations/location/instances/instance/legacySdk:legacyAttachmentData?attachmentId=3157&format=snake: b'{"errorCode":2000,"errorMessage":"An error has occurred. Search for Log identifier c55c79701e3341e380d50c8167df02c9 in the Google Cloud Logs Explorer.","innerException":null,"innerExceptionType":null,"correlationId":"c55c79701e3341e380d50c8167df02c9"}'This is happening when calling siemplify.get_attachment(attachment_id), although not entirely consistent but it s

50
A
_K_O
_K_OBronze 5
asked in Google Security Operations
SecOps IDE Case Creation Issue - Add Case Description

Hi Everyone, I have a question that I'm hoping you may know the answer to:I'm creating a SecOps Scheduled JobThe job performs some functionality (RSS Feed) and I want it to create a case Since it's not a log based event (more of a trigger), I need to trigger case creation myself (Python IDE)I've only managed to create a manual case using this method, not sure if there is a better way. (/api/external/v1/cases/CreateManualCase) Issue:I can't figure out how to add in a case description to the case during case creation. Attempted to Change Case Description API (/api/external/v1/cases/ChangeCaseDescription) but I can't figure out how to get the Case ID as the siemplify.case_id functionality does not return any information (I'm assuming that the case is being created while this is being called). Request:Do you know of a way to create a Manual case with a case description? OrDo you know of a better way to do this?

102
Q
Aphex2in
Aphex2inNew Member
asked in Google Security Operations
Sent Batch Error For FORTINET_FORTINDR

Hi all, I’m having issues ingesting FortiNDR logs into Google SecOps using cfproduction docker forwarder here is the details: Any thoughts why this happen? 

60
Aphex2in
mikelmi01
mikelmi01New Member
asked in Google Security Operations
Create multiple alerts in the same case from a SecOps job

Hi everyone,I'm trying to send multiple alerts via a webhook to Chronicle SecOps and have them be grouped under the same case. However, when I use my job (see code below), even though both alerts are sent together and share common fields, they always end up in separate cases.import sysimport jsonimport requestsfrom urllib3.util import parse_urlfrom SiemplifyJob import SiemplifyJobfrom SiemplifyUtils import output_handler# ====================# Embedded Constants# ====================PROVIDER_NAME = "HTTP V2"INTEGRATION_NAME = "HTTPV2"API_REQUEST_METHODS_MAPPING = { "GET": "GET", "POST": "POST", "PUT": "PUT", "PATCH": "PATCH", "DELETE": "DELETE", "HEAD": "HEAD", "OPTIONS": "OPTIONS",}AUTH_METHOD = { "BASIC": "basic", "API_KEY": "api_key", "ACCESS_TOKEN": "access_token", "NO_AUTH": None,}DEFAULT_REQUEST_TIMEOUT = 120ACCESS_TOKEN_PLACEHOLDER = "{{integration.token}}"# ====================# Internal Classes# ====================class HTTPV2DomainMismatchExc

50
mikelmi01
donkos
donkosNew Member
posted in Google Security Operations
Grouped Fields - URL

Why is there no grouped fields for URLs?https://cloud.google.com/chronicle/docs/investigation/udm-search#types_of_grouped_udm_fields

22
donkos
mikelmi01
mikelmi01New Member
asked in Google Security Operations
Creating Multiple Alerts in the Same Case via Webhook — Always Creates Separate Cases

Hi everyone,I'm trying to send multiple alerts via a webhook to Chronicle SecOps and have them be grouped under the same case. However, when I use my job (see code below), even though both alerts are sent together and share common fields, they always end up in separate cases. import sysimport jsonimport requestsfrom urllib3.util import parse_urlfrom SiemplifyJob import SiemplifyJobfrom SiemplifyUtils import output_handler# ====================# Embedded Constants# ====================PROVIDER_NAME = "HTTP V2"INTEGRATION_NAME = "HTTPV2"API_REQUEST_METHODS_MAPPING = { "GET": "GET", "POST": "POST", "PUT": "PUT", "PATCH": "PATCH", "DELETE": "DELETE", "HEAD": "HEAD", "OPTIONS": "OPTIONS",}AUTH_METHOD = { "BASIC": "basic", "API_KEY": "api_key", "ACCESS_TOKEN": "access_token", "NO_AUTH": None,}DEFAULT_REQUEST_TIMEOUT = 120ACCESS_TOKEN_PLACEHOLDER = "{{integration.token}}"# ====================# Internal Classes# ====================class HTTPV2DomainMismatchEx

40
mikelmi01
preeeya
preeeyaNew Member
posted in Google Security Operations
Getting only the alerts in SIEM search

Hi All,in siem search, i want to filter out only events that are flagged as alerts from all events that is populated when queried. this result will be used in dashboards. how to find the difference between an event is an alert from UDM fields. thanks 

433
mogriffs
manoj610
manoj610New Member
posted in Google Security Operations
How to Get Log Ingestion Metrics Per Server for Windows Log Source in native dashboard?

Hi Team,We’re currently using the Ingestion Metrics dashboard in Google SecOps, which provides visibility into log ingestion volume at the log source level. However, we're looking to break this down further and view ingestion metrics per individual Windows server that is sending logs.Is there a way to: Get ingestion metrics grouped by host/server (e.g., hostname or asset_id)? Possibly use a query in Log Exploration to achieve this granularity. Any guidance or sample queries would be greatly appreciated.Thanks in advance!Best Regards,Manoj Gowda J

30
manoj610
preeeya
preeeyaNew Member
asked in Google Security Operations
SIEM Dashboard Creation: To Case History

Hi everyone,I'm working on building a dashboard in Google SecOps where I want to implement a user-based filter. The idea is: when filters a specific username, the dashboard should dynamically display:That user’s login detailsPrevious cases/incidents the user was involved inLast login region(Any other relevant user metadata)I'm looking for suggestions or best practices on how to structure this kind of dashboard, particularly:What data sources should be connected or joined?How to design the filter to retrieve and reflect all these details for a selected user?Any recommended tools or integrations within GCP that simplify this?Thanks in advance for any guidance or examples!

432
preeeya
E
E82031New Member
posted in Google Security Operations
Detection Rule Variable and syntax errors

Hey, I'm writing a detection rule which I'm struggling with the syntax and not sure about the variable section i put in.  intro:The rule is suppose to combine 2 events:Event 1: is to detect when a security group was open to any-any rule (0.0.0.0) - which we have a working rule on that already.Event 2: detect when this security group is closed to 0.0.0.0 comunication - we have a lambda function that closes this automatically.So basically, we want to monitor if the lambda is not working - then pop up a detection alert.but when working on the the rule, I come acrros this error which is related to the placeholder:parsing: error with token: ":" invalid operator in events predicate line: 15 This is the rule:rule ttp_aws_security_group_open_to_world { meta: rule_name = "AWS Security Group Open to World" description = "Detects when an AWS Security Group is open to the world (0.0.0.0/0 or ::/0) and then revoked within 5 minutes." severity = "High" tactic = "TA00

171
Niles
Staff
d_patel_dj
d_patel_djBronze 1
posted in Google Security Operations
Web Risk API

Hello, I am looking to setup the Web Risk API integration within the SOAR via the marketplace. I am planning to use the service account JSON file content. When creating the service account I am unsure what the suitable role the SA needs for the Web Risk API. Is there a dedicate role for the Web Risk API? Any help on this would be great! Thanks 

112
Veeresh
Y
Staff
ylandovskyyStaff
posted in Google Security Operations
[GA] - New Google Threat Intelligence Marketplace Integration

Hey folks! This week we finally released an official integration for Google Threat Intelligence. This integration combines the capabilities from Virustotal, Mandiant Threat Intelligence, Mandiant DTM and Mandiant ASM all in one place. It's recommended to start updating the playbooks to work with this integration, if you are a GTI customer. As part of the Phase 1 of the integration, it has parity with the capabilities of other integrations + small additional enhancements: "Enrich Entities" action that enriches IOCs, CVEs and Threat Actors all together. Also, the is_suspicious logic is now working with GTI Verdict instead of Engine count. "Submit File" action supports password-protected archives and you can submit files from external URLs (eq Cloud Storage buckets). New action for "Execute IOC Search" Over time, any new GTI feature will be added to this integration first, but it doesn't mean that VT or Mandiant integrations are deprecated. Here is an example of widget that that you wil

1714
_eo
MDAC2025
MDAC2025Bronze 1
posted in Google Security Operations
Google Secops and Active Directory

Hey everyone, hope you're all having a great week!I'm currently navigating a bit of a challenge...We're looking to integrate our on-premises Active Directory (which is hosted on GCP) with Google SecOps SIEM, and I'm really keen to hear about any successful experiences or valuable insights you might have.Has anyone here successfully tackled this specific integration?.Thanks in advance for your time.Cheers!

136
MDAC2025
Ewaz
EwazBronze 1
posted in Google Security Operations
How Can Confidential Computing Be Integrated with Third-Party AI Models Securely?

Hi everyone, I've been exploring Google Cloud's Confidential Computing products like Confidential VMs, GKE Nodes, and Confidential Space. The potential for protecting data-in-use is very promising, especially for sensitive AI workloads. My question is:How can we securely integrate third-party AI models (e.g., from open source or external vendors) into Confidential Space or Confidential VMs without compromising data privacy or the TEE trust boundary? Are there recommended architectural patterns, isolation practices, or attestation tools we should use when the model provider is not part of our organization? Appreciate any insights, resources, or examples you can share! Thanks,

150
Ewaz
S
srijankafleBronze 2
posted in Google Security Operations
Silent log source detection

Hi Team,I am looking to get an alert if I miss a log from an endpoint from a server. Since the ingestion API monitoring is not granular enough to get this info, I planned to create a dedicated Yara-L rule for the said server. The rule I had planned for looked something like this:    rule silentLogFromCriticalEndpoint { meta: author = "Srijan Kafle" description = "Detects missing logs from server" severity = "MEDIUM" created = "2024-06-03" events: $session.principal.namespace = "prodSydney" and $session.principal.hostname = "redacted" $source = $session.principal.hostname $tenant = $session.principal.namespace match: $source,$tenant over 12h outcome: $risk_score = 3 // logic to check delay here which is not working $delay = $session.metadata.event_timestamp - timestamp.current_seconds() condition: $session and $delay >= xyz }  line 23 and 26 not a working line currently but wanted to includ

3511
uts
Staff
ankitsynx
ankitsynxBronze 5
asked in Google Security Operations
What is file path on Chronicle SOAR, for files are downloaded from external services ?

Hi,I am trying to access the files that I download from services like exchange or Virustotal. Is there a place/file path that I could use to send/upload those files on another system ?I could see some upload options having parameters to define a linux server credentials and IP. But then it's an external server setup. Is there a way to upload files without downloading to external server. Something like a secure vault within Chronicle ?   

223
AfvanJaffer

Badge winners

  • Authored Posts 5
    delstonhas earned the badge Authored Posts 5
  • Authored Posts 1
    SaDaVFhas earned the badge Authored Posts 1
  • Authored Posts 5
    hzmndthas earned the badge Authored Posts 5
  • Solution 10
    hzmndthas earned the badge Solution 10
  • Comments Posted 1
    mihirvala08has earned the badge Comments Posted 1
Show all badges
Terms & ConditionsCookie settings
Privacy Policy Terms of Service Gen AI Policy Community Guidelines Cookie Settings

© 2025 Google. All rights reserved.