Skip to main content

Hi,
Currently creating a playbook where its needed to do a UDM query to find a events that are created around the same time of the events of the case.
When the case starts runs the playbook and the GoogleChronicle - Execute UDM Query action, where it doesnt find the specfic event. i even made sure that the time range is correct and its not missing the event for a couple minutes by generating the start time and end time based on the timestamp of the events of the case using the action “Functions - Convert Time Format”, start time being 2 months before and the end time being 2 DAYS AFTER.

The action run but doesnt return any result, but if i do the EXACTLY same query directly on the SIEM, it is able to find that event.

I realize that after 30/40 minutos after the case being created, i can run(or rerun i guess) that action and its able to find the event.
I could fix the playbook just by adding a delay on the start of it of 1 hours or something and the action would run well and find the events but i want to run the playbook as fast as possible being the case be related to phishing with possible malware.
I have the version 61.0 right now and i know there a 62.0 version available.
Any idea?
 

To confirm what i said, i rerun the playbook and it as able to find the event.
Case created at 15:24:00
action didnt return events at 15:25:44
 

rerun the playbook, action return the event at 15:55:45 time
 

Hope it helps

Can you check the metadata.ingest.timestamp of the events? Is the ingest timestamp of those events prior to the execution of the action at 15:25:44?

hi, thank for the answer
but no the ingest time is before 15:25
 

note: its showing 14 hours because of the timezone being utc+1 on the secops

I meant yes, the ingest timestamp of those events ARE prior to the execution of the action.
Plus, im able to replicate it with every event recently ingested

If the time of the action is 30 minutes or something after  the timestamp of the event it works, retrieving the event correctly

Reply


Terms & ConditionsCookie settings
Privacy Policy Terms of Service Gen AI Policy Community Guidelines Cookie Settings

© 2025 Google. All rights reserved.