Google Security Operations

Has any one completed the stage 2 of SOAR migration to GCP ?Could you simply explain the pointers that you followed for the same.  

Hi All, I am testing the Microsoft 365 Defender (XDR) Integration v26.0 and have observed the following which when looking at the documentation seems to be by design. Scenario 1Event triggered and “Incident 1” created in XDR Event triggered and “Incident 2” created in XDR Both incidents and their associated alerts are ingested into the SOAR and created: Case 1 with the name “Incident 1” Case 2 with the name “Incident 2” XDR then correlated Incidents 1 & 2 and based on a rule and renamed “Incident 1” to “Suspicious activity on one endpoint”  moved the alert from “Incident 2” to “Incident 1” and closed “Incident 2” The Sync Job in SOAR attached all alerts to Case 1 but left the Case name as “Incident 1” The SOAR Case “Incident 2” was left open along with it’s associated AlertScenario 2Event triggered and “Incident 1” created in XDR Event t

Hello,Has anyone successfully created a simulated case using the API?I'm trying to use the following documentation:https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.legacyCases/simulateAlertHowever, I'm running into some issues. The API call reaches the CreateSimulatedCustomCase method, and the audit logs show that the service account is recognized and has the chronicle.legacyCases.simulate permission. Despite that, the request fails with the following error:Request is missing required authentication credential. Expected OAuth 2 access token, login cookie or other valid authentication credential.I'm authenticating with a Service Account using the cloud-platform

Hello, team I’d like to understand the delay between when a case is created and when it’s detected. All cases based on CrowdStrike have a delay of 1 to 2 hours before the alert is generated. Can this time be adjusted? Why does this only happen with CrowdStrike? We have two SecOps consoles with different environments, and this delay only occurs on one of them; both have the same collection permissions.  

Hello everyone,I'm trying to build a Google SecOps SOAR integration with Freshdesk using HTTPv2.My goal is to automatically create a Freshdesk ticket when a case is moved to either:Investigation ResearchI created an Alert Playbook with a Custom Trigger configured as: [Case.Stage] = InvestigationOR[Case.Stage] = Research The playbook contains a simple HTTPv2 action that should create a ticket in Freshdesk.The playbook is enabled and saved. I also verified that the case stage is successfully changed, for example:"Case stage set to Investigation"However, the playbook never executes when the case stage changes.From the documentation and community posts, I understand that Alert Playbooks can access Case fields (Case.Stage, Case.Name, Case.Tags, etc.), but I'm not sure whether a Case Stage change is actually considered a trigger event for an Alert Playbook.My question

Hello team, Is it possible to use UDM filters to filter the events that triggered a rule?In QRadar, you can apply this type of filter to determine which event actually triggered the rule, and I’d like to know if SecOps has the same search mechanism, since we use this data to create a report.Regards,Renato Ferreira​​​​​​​

Hi,Could anyone help me to fetch alert detections (custom as well as curated) of a specific entity from case using UDM Search Query and REST API?So that I can display it on the case overview.  

We are configuring remote agents for the SOAR to communicate internally to our tools. We have successfully deployed the remote agents (docker) and they are showing "Lived" status on the web ui.However, during the integration configuration, when we check "run remotely" and select the remote agent, we are unable to save the config. It's showing error "An error occurred while saving instance configuration". We configured everything as the documentation indicated including the service account mapping. The remote agent container does not show any error. 

Hi everyone, I have a feature proposal that I believe would greatly benefit our workflows.Every SOC team relies heavily on documentation. On any given day, we need quick access to: Playbooks and Standard Operating Procedures (SOPs) Guides and how-tos Internal systems documentation Detailed reporting for major incidents Reference lists The list goes on We all want Google SecOps to truly function as a "single pane of glass" for our analysts. Currently, forcing them to context-switch and jump between SecOps and external tools like Loop, OneNote, Confluence, or an external wiki breaks focus and disrupts the workflow.Implementing a simple, native Markdown-based wiki directly into Google SecOps seems like a straightforward solution with massive benefits. Having all security-critical documentation residing in the primary operational tool would be incredibl

Hi all,I am attempting to create a new Table chart in Native Dashboards utilizing the recently released SOAR Custom Fields feature.We are referring the Documentation: https://security.googlecloudcommunity.com/google-security-operations-2/new-feature-support-for-soar-custom-fields-in-native-dashboards-7604 I am trying to display standard case fields alongside two of our custom text fields: "Case ID" and "CID".  Per the documentation, I am using the required syntax paths: - case.custom_fields["Case ID"].string_seq.string_vals - case.custom_fields["CID"].string_seq.string_vals Whenever I attempt to run the query, the UI returns the following generic backend error: "An error occurred with your query. An unexpected error occurred. Loading Complete." We have already tried multiple troubleshooting variations to isolate the syntax, all of which fail:  Attempt 1(Using array_distinct in outcome):

Hi Google Community,We have already enabled these Google Workspace logs:WORKSPACE_ACTIVITY WORKSPACE_USERS WORKSPACE_GROUPS WORKSPACE_ALERTSWe want to understand clearly what WORKSPACE_PRIVILEGES will do differently compared to the above log sources.Main Questions:What extra things does WORKSPACE_PRIVILEGES handle that the other parsers (especially WORKSPACE_ACTIVITY) do not cover well? Can you explain the benefits of enabling WORKSPACE_PRIVILEGES? Please give some examples of logs/events: How they look in WORKSPACE_ACTIVITY (or others) How they look better / different in WORKSPACE_PRIVILEGES We want to confirm the real value before enabling it for the client.

Hi,Could anyone help me to fetch alert detections (custom as well as curated) of a specific entity from case using UDM Search Query and REST API?So that I can display it on the case overview.  

I am getting cannot import name 'extract_action_param'  & ‘extract_configuration_param’ from 'TIPCommon' error when I am testing the updated SOAR integration in staging mode for Azure Active Directory & Google Chronicle SOAR integrations. How to resolve this error?

Hi All,Anyone has performed a complete end to end implementation of multi tenancy in google secops SOAR SIEM.I need real example with implementation steps for typical GCP environment.Also if any relevant documents will be helpful

How do I automate the process to send an email alert to team if log source is not reporting.1.SOAR Dashboard: I have created a query to fetch last reported time of each log_type, but how do I trigger an email if last reporting time is greater than x hours or something?SOAR Job Script: Anyone has used this to automate this? 

I am currently testing the Microsoft 365 Defender Integration (XDR) v26.0 and have noticed that if I trigger 2 x events that create 2 x Incidents in XDR that become correlated under a new Incident Name, the new Incident Name is not reflected in Google SecOps SOAR, this seems to be by design however, I would like the case in SecOps SOAR to reflect the new Incident Name in XDR, I was thinking of utilising a KQL Query in a playbook to do this, any thoughts? Trigger an event Incident 123456 (Test Incident 1) created in XDR Trigger an event Incident 123457 (Test Incident 2) created in XDR Ingest takes place in SOAR Case 5672 created with the Name Test Incident 1 Correlation takes place in XDR Incident 123457 closed and alert moved to 123456 in XDR Incident 123456 renamed from Test Incident 1 to Suspicious Activity on Endpoint SOAR Case attaches new Alert to Case 5672 and Case name stays as Test Incident 1Thanks

Hi All,We would like to authenticate with Google SecOps MCP ( Remote MCP) using an MCP Proxy in between.  Our current setup is using Workforce Identity Federation with Microsoft Entra as IDP. Anyone who has achieved this in past or knows how this can be achieved.Our goal is to have controlled communication via central exit point (MCP Proxy Server) and use our existing SecOps user creds for users to query Google SecOps MCP.   

I want to mask my client data like phone number account number etc. Is it possible to mask these data field in Secops. If yes then kindly share the related document how it can be done. If no then kindly share any alternative for this.

Hi,I wanted to know global time filter of the Google SecOps SIEM dashbaord works on which field of IOC model if we have only IOC model data coming from IOC matches?Also, I have one observation that , match which is visible in IOC match table which is not returning while quering through dashboard for same time range?

Hi All,I have already created a custom parser that works well for JSON object coming through logs. However, I now need to update the parser to support JSON arrays. but I'm unsure how to loop through a JSON array.Sample log:  [{"test": "testing","hostname":"hostname1"},{"test":"testing","hostname":"hostname2"}]Any guidance or assistance on how to resolve this issue would be greatly appreciated.Thank you!

We have a SOAR Graph mail connector to a mailbox where users submit suspicious emails. Each connector ingestion adds any potentially malicious attachments to the case wall.Is there any way to adjust the permissions so that someone could see the playbook results, the case views etc, post to the case wall but not download a file auto attached to the case wall?