It looks like they are not collected in neither SIEM or SOAR by default. Any idea?
https://cloud.google.com/security-command-center/docs/reference/rest/v2/IssueType
Solved
How to ingest Chokepoint findings from SCCE into SecOps?
+8- Silver 2
Best answer by _K_O
Thanks for the explanation! So, there are several exports configured and I can't figure out which one goes to SecOps. Any idea how to figure that out? Because that could point me to the filter that should also contain finding_class="CHOKEPOINT"
My best guess is that it's the ones that start with SOAR_Connector:
That being said, you may need to reach out to your TAM to confirm which ones were set up for your project. I only have two available so I'd probably just modify both.
+12- Bronze 5
Within the Risk Overview Setting Page, there are pub subs which push the events from SCCE to SecOps SIEM/SOAR:
If you look into the different connectors & jobs, you'll see the event types that are being pushed from SCCE. By default, it looks like a few finding classes are not included. (This doesn't account for the Threat finding_class though which confuses me).
My assumption is that you would need to add the Chokepoint finding class to those queries:
finding_class="CHOKEPOINT"
+8- Silver 2
Within the Risk Overview Setting Page, there are pub subs which push the events from SCCE to SecOps SIEM/SOAR:
If you look into the different connectors & jobs, you'll see the event types that are being pushed from SCCE. By default, it looks like a few finding classes are not included. (This doesn't account for the Threat finding_class though which confuses me).
My assumption is that you would need to add the Chokepoint finding class to those queries:
finding_class="CHOKEPOINT"
Thanks for the explanation! So, there are several exports configured and I can't figure out which one goes to SecOps. Any idea how to figure that out? Because that could point me to the filter that should also contain finding_class="CHOKEPOINT"
+12- Bronze 5
- Answer
Thanks for the explanation! So, there are several exports configured and I can't figure out which one goes to SecOps. Any idea how to figure that out? Because that could point me to the filter that should also contain finding_class="CHOKEPOINT"
My best guess is that it's the ones that start with SOAR_Connector:
That being said, you may need to reach out to your TAM to confirm which ones were set up for your project. I only have two available so I'd probably just modify both.
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.