Google Security Operations

Is there a way to filter the workspace logs and reduce it before sending it to secops ?It is consuming too much storage of the tenant storage limit.

I need to integrate Falcon Crowstrike EDR with Google Secops to send alerts for detections and scheduled rules. Google's documentation mentions a direct API connector, but I'm unsure if this method will allow me to send all my alerts in near real-time. Are there other ways to integrate Crowstrike Falcon with Google Secops, such as using a pipeline like Bindplane? What prerequisites do I need?

https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.investigations/list?rep_location=africa-south1using the above doc, im trying to pass an alertId or caseId as parameters in the filter field, but i keep getting this error - INVALID_ARGUMENTCan anyone help on this. Many Thanks in advance.    param = {        "filter": "alertId=<alert_id>"    } base = "https://us-chronicle.googleapis.com/v1alpha/projects/<project_id>/locations/us/instances/<instance_id>/investigations"     try:         response = mysession.session.get(url=base, params=param)        rt = response.json()        print(rt)        e

Hello,I’m implementing SLA tracking for Cases in Google SecOps and would like to understand the best practice for building dashboards.My SLA logic includes: Time to analyst assignment (unassigned → assigned) Identification of SLA-breached cases Visibility at both case level and analyst level Currently, I don’t see native SLA fields for Cases, so SLA is derived from case metadata (Created Time, Owner, Status).Questions: What is the recommended way to build dashboards showing: Cases that breached SLA SLA compliance per analyst Are SecOps dashboards expected to rely only on: Case filters and saved views? Case-based rules and tags? For analyst-level S

We occasionally get overflow cases but they get buried in the case queue and are pretty much ignored. I was building a playbook to send out automated email notifications that would attach when a case tag includes “Overflow” but I just read that you cannot automatically attach playbooks to overflow alerts.Does anyone have any methods to send out notifications if an overflow case gets created? 

Hello, I am trying to create an extension for the Defender for Endpoint parser because the current prebuilt does not include some additional fields that I need. But I am running into a very odd issue, I was attempting to use some of the prebuilt logic that was accessing the field but I am continually getting this error message - “No UDM events or entities were generated for the current parser configuration. If this is not intended, rectify the code snippet/UDM mappings and then click preview.” Here is my current parser logic:filter{ mutate { replace => { "record_AdditionalFields" => "%{properties.AdditionalFields}" } } statedump{ label => "start" } if [record_AdditionalFields] != "" { json { source => "record_AdditionalFields" target => "_AdditionalFields" array_function => "split_columns" on_error => "properties_additional_f

I need guidance on the optimal integration approach for ingesting Linux server logs into Google SecOps/Chronicle using the BindPlane agent.Specific Questions:1. Recommended LogType for Linux Systems   - What is the most appropriate log_type for general Linux server logs in Chronicle?   - Should we use "LINUX_SYSLOG", "SYSLOG", or a more specific parser?   - Are there different log_types recommended for different distributions (SUSE/Ubuntu/RHEL)?2. BindPlane Agent Configuration   - Best practices for configuring BindPlane agent on Linux servers   - Recommended log sources to collect (syslog, auth.log, secure, audit, etc.)   - Optimal pipeline configuration for Chronicle ingestion3. Integration Architecture   - Should logs go directly from BindPlane → Chronicle, or through Chronicle Forwarder?   - Recommended namespace configuration for multi-client environments   - Label strategy for distinguishing betw

Hi, My goal is to create a dashboard, preferably with the new dashboards not with the old feature, So far I get GB totals with this query $Log_Type = ingestion.log_type$Log_Count = ingestion.log_countmatch:$Log_Typeoutcome:$Total_Size_GB = math.round(sum(ingestion.log_volume) / (1024 * 1024 * 1024), 1)order:$Total_Size_GB desc And I’m able to retrieve the number of logs that each server generate with this query:$Log_Type = $e.metadata.log_type$Host = $e.intermediary.hostname$Date = timestamp.get_date($e.metadata.event_timestamp.seconds)match: $Date, $Log_Type,$Hostoutcome: $Event_Count = count($e.metadata.event_type)order: $Date descBut have no luck getting the number of GB each server generates in a daily fashion. ¿can someone hepl me with this task?

I am creating a new integration, and for that I copied the pyproject.toml file from an existing integration. To generate the uv.lock file, I am using the uv sync command as mentioned in the Content Hub install and build steps.Once the uv.lock file is created, I use the mp build --integration <integration_name> command to generate the build, and I can see the output in the Out folder. After that, I change IsCustom to true, generate the ZIP file, and try to install it. However, I encounter an error. Upon investigation, I found that the issue is related to dependencies.I had some working integrations on my instance. I exported those integrations and copied it’s dependences and replaced them in the Out folder, and after doing that, the installation worked.To reproduce this issue, I tried generating a build for an already available integration in

In Google Security Operations SOAR, native dashboard queries allow for the visualization of custom metrics, such as case counts and SLA compliance, using widgets like bar charts, pie charts, and tables. Users can create custom dashboards, configure widget filters by time range or SOC environment, and display up to 12 widgets. Key Aspects of SOAR Native Dashboard QueriesCr

I’m looking for guidance on the appropriate contact point within Google for reporting and following up on unauthorized administrative actions performed by an external party with (current or former) Google Workspace admin access.More specifically, I’m trying to understand: Which Google team or function is responsible for handling this type of incident (e.g. Workspace Support, Trust & Safety, Abuse, Partner oversight, etc.)? Through which channel (ticket type, form, or email) such reports should be submitted to ensure proper review and ownership? Whether there is a defined process for incidents involving actions performed through the Google Workspace Admin Console by a third party? What kind of information or audit logs are typically expected to support an investigation? My goal is to avoid being redirected between multiple teams and to engage the correct

Hello all, I need to create some automate TAGs depend con the value of the hostname. Example if a host is from Belgium: BEL-XXX, if its from Brazil: BRA-XXX. Well i thought about the funcion on SOAR casa data→ TAGS. Teh proble here, is i have more than 1 product in incoming alerts, and in one alert the entity is saved in host_name entity, in other deviceDNSname...etc… So, is there any solution or best practice for this?  Thanks!

Do you know when the APIVoid integration in Google SecOps (SOAR) will support the new APIVoid v2 APIs? The current integration (linked below) references the older v1 endpoints:https://docs.cloud.google.com/chronicle/docs/soar/marketplace-integrations/apivoid APIVoid has announced that v1 APIs will be deprecated on Feb 28, and v2 introduces breaking changes. From the APIVoid v2 API documentation, requests now use POST with a JSON payload, for example: curl -X POST "https://api.apivoid.com/v2/ip-reputation" \ -H "Content-Type: application/json" \ -H "X-API-Key: YOUR_API_KEY_HERE" \ -d '{"ip": "80.82.77.139"}' Additionally, the response structure has changed. Previously (v1), responses were wrapped under data or 

We were recommend to post here re. case #10394319, Project number [removed by moderator] and as belowPlease could you highlight for attentionThanksRyan We are writing to appeal the suspension of our Firebase Hosting project dg-style-chooserThis is a false positive. Our application is a legitimate business tool, not phishing.What our application does:We operate LiveStory and DamnGood, two digital magazines that feature content creators.Our web application allows potential creators to browse visual style preferences and submit applications to be featured in our publications.The form collects standard contact information (name, email, Instagram handle) that creators voluntarily provide to apply for partnership opportunities.Why this is NOT phishing:We are a registered business operating at joindamngood.com and joinlivestory.com.We do not impersonate any other brand or service.We do

General Approach: Using System SchedulersFor most general use cases, you can create a simple script (batch, shell, Python, etc.) containing your Git commands (git pull, git push, etc.) and then use your operating system's built-in scheduler to run this script at regular intervals.Linux/macOS (Cron): Create a shell script (e.g., ~/gitsync.sh) with your commands. Make sure it has execute permissions (chmod +x ~/gitsync.sh). Edit your crontab using crontab -e. Add a line to schedule the script, for example, to run every 15 minutes: bash */15 * * * * /bin/bash /home/user/gitsync.sh >> /home/user/cron_log.log 2>&1 This command executes the script and redirects the output to a log file for monitoring.

Hello Commmmmunity, I am attempting to implement the detection rule below in SecOps but keep getting an error message when I test or attempt to save the rule.“parsing: error with token: ":" expected '=' between meta assignment key and value line: 11 column: 12-13” rule MAL_Dropper_NetSupportRAT { meta: author = "Sam" description = "Detects a dropper that delivers a decoy ChaGPT Installer and NetSupport RAT" hash = "d86f647f3dfa6a53de7b531cb590636331f83afcea60d4b3d44de5ea3b7d33af" malware = "NetSupport" malware_id = "TWOU5d" category = "MALWARE" strings: //dropped files $d1 = "ChatGPT Installer.exe" $d2 = "setup.exe" //netsupport strings $n1 = "NetSupport" nocase $n2 = "install_netsupport_manager_silently" $n3 = " [removed by moderator] " condition: uint16(0) == 0x5A4D and all o

Hi,  I have a rule created that is to see the users that have used vpn after business hours for the day adn this is for informational purposes only and i want this to be triggered only once per day at a certain time. Eg: 12 AM. how can i set this timei have made the metch section to be 24 hours, but i want to know how i can set a specific time like 12 am for the rule to be triggered. 

Hello Community,I am trying to clearly understand the design and deployment model of Google SecOps SOAR Remote Agents, specifically when the target systems (for example, FortiGate firewalls or other on-prem security tools) are hosted inside a private customer network. I would like clarification on the following points: Hosting Model Do we need to create a VM in the customer private network to host remote agent? Is the Remote Agent always expected to run on a dedicated VM or server inside the customer’s private network? Is this the recommended and supported architecture for interacting with internal devices such as firewalls, AD, or other non-internet-exposed systems? Allowing Access for Remote Agent to Google Publisher and Firewall

HI everyone, I’m trying to find a documentation of the SOAR api, but I’m unable to find an API that lets me retrieve playbook results per alert.I want to be able to retrieve the data from query enrichments that I’ve created. Has anyone been successful at doing this? 

I am looking to build a dynamic asset inventory in Chronicle SIEM to map AWS Account IDs to their respective OUs.My environment has a lot of accounts and CloudTrail logs lack OU context. My plan is to create a Chronicle Data Table with a bulk export of current accounts and then use a YARA-L detection rule to catch CreateAccount events (which contain the OU name). This rule would trigger a SOAR playbook to automatically append the new Account ID and OU mapping to the Data Table. What is the best practice for my problem?Which YARA-L rule and playbook should I create for this solution?Thanks

Hello guys,I’m working on SecOps Audit events for MOC purposes.I wrote a query to identify modifications on Parsers & Extensions.Here’s my query :events: metadata.log_type = "GCP_CLOUDAUDIT" target.application = "chronicle.googleapis.com" // Filter on Parser Mgmt events metadata.product_event_type = /\.ParserService\./ $action = re.capture(metadata.product_event_type, `ParserService\.(.*)$`) // Exclude 'Read' events not $action = "GetParser" not $action = "ListParsers" not $action = "ListParserExtensions" not $action = "GetParserExtension" $evtid = metadata.id match: $evtidoutcome: $timestamp = array(timestamp.get_timestamp(metadata.event_timestamp.seconds, "SECOND", "Europe/Paris")) $audit_action = array_distinct($action) $log_type = array_distinct(re.capture(target.resource.name, `logTypes/([^/

Hi Folks,I’m new to SecOps and still getting familiar with the platform’s functionality. Apologies if this is a basic question, but I believe it will be helpful not only for me but also for others who are beginning their SecOps journey. I’m looking for guidance on how to search logs in SecOps for the following requirement:We have onboarded Windows servers via Bindplane, and I want to run a query to list all logs coming from a specific Windows server.Currently, we are using a query similar to the one below (Partial query) :metadata.log_type = "WINEVTLOG"$host = strings.coalesce(principal.asset.hostname, principal.hostname)However, we are observing an issue where we have onboarded only 50 Windows servers, but the query returns more than 50 host values. Upon initial review, these additional hosts appear to be introduced during parsing (exact cause not yet confirmed).