Google Security Operations

Hi,Is there any way to clone a widget from one dashboard to another? I see an option to duplicate the widget within a dashboard, would be helpful if there was similar option available to clone it to another dashboard.

HI team, I require assistance in developing a custom parser for processing raw logs. Additionally, I seek guidance on constructing a filter within the Chronicle environment. Would you please guide me ? Thank you !

What is the correct way to ingest Azure Active Directory logs into Google Chronicle? I am trying to use Azure Blob Storage and the Third Party API option but neither are working. I have created an app in Azure, granted it the below permissions and then plugged the keys into Chronicle but to no avail. Am I missing a permission? Is there something obvious I might have missed? Here are the permissions my Azure App Registration has:AuditLog.Read.AllAuthenticationContext.Read.AllAuthenticationContext.ReadWrite.AllIdentityRiskEvent.Read.AllIdentityRiskEvent.ReadWrite.AllIdentityRiskyServicePrincipal.Read.AllIdentityRiskyServicePrincipal.ReadWrite.AllIdentityRiskyUser.Read.AllIdentityRiskyUser.ReadWrite.AllSecurityEvents.Read.AllSecurityEvents.ReadWrite.AllUser.ReadOffice 365 Management APIs (3)ActivityFeed.ReadActivityFeed.ReadDlpServiceHealth.Read@Nick_Troutini have you seen this? any tips?Update:I am no longer getting "failed" instead I have "active" but no Azure AD log

Recently I reviewed an article covering an attack path that an actor took in a Google Workspace/GCP environment.https://www.bitdefender.com/blog/businessinsights/the-chain-reaction-new-methods-for-extending-local-breaches-in-google-workspace/When going over the TTPs one mentioned as "Golden Image Lateral Movement" stood out. The technique boils down to local accounts containing the same credentials on a VM if that VM gets cloned. Assuming an organization has ample GCP logs (Like GCP Cloud Audit) is there a detection that can see this behavior?The FP rate will likely be high when looking for all clones however different orgs could modify the rule to bump out known procedures for cloning VMs.

Hello,I'm using alert grouping for Microsoft defender cases and so multiple alerts get grouped based on the Incident ID being the same for all. However, each one individually gets a playbook running and I'm not sure if there's a way to have all other playbooks pause while the first alerts runs through and have them run sequentially. I see an action "Wait for playbook to complete" but that seems like it'll only work if it's within the same alert and not across a single case.Any help on this would be highly appreciated. Open to any ideas here!Thank you,Krunal M

I have tried to follow the path in order to try the free instance offered to the community of the SOAR. I am trying to obtain the Google Cloud SecOps Technical Credential and it would be great to be able to access an instance of the  SOAR a bit in order to understand it better. Hope somebody can help me.Thank you for your time!Jaime 

I will like to know, if this type of SIEM needs agents to be installed on the client host?

Hello Everyone!!! Someone know if its a phone number to communicate with support???

anyone here tried creating a rule that was able to capture encryption in a host,I would like to get some ideas on how you do it,

Hello,our customer tries to sent files to parser which are bigger than 65000 bytes. Is this a forwarder limitation? If it is, is there a nice solution to reduce the attributes for the AD user context files. https://cloud.google.com/chronicle/docs/ingestion/default-parsers/collect-windows-adThanks for your help!

Does anyone have a dashboard to share? I have a few, but I'd like to see some different perspectives.  

Do any of you know when Google Chronicle SIEM was officially released? I cannot find any resources about this.

Is there a guide for submitting a custom integration to the marketplace and any best practices we should follow to increase the chance of acceptance?

Has anyone here ingested data to SIEM via a temporary label and then migrated to a new data label? We recently requested a new label for a net new data source and we're looking for the best way to migrate to this new data label.From what were hearing, it sounds like we need to start over and turn off the old feed and start a new feed with the same label. However, it seems that we cannot have duplicate logs in Chronicle (with the old logs persisting) without having errors. Would we need to manually delete or modify the stale logs from the previous data label in Chronicle in order to push data to this new data label?

We are pulling results from an internal API for an action that needs to be executed by another system. When the results are returned, we are making multiple comments because each execution of the async action thinks the results are new. The problem is there are multiple actions that need to run so when the results are returned the action is not yet complete. One idea was to use the scripting directory to track progress, but there has to be something more elegant. 

Hey guys, a new member on the community but have been using Chronicle SOAR for for around 18 months now. Anyone here utilizing the Starlight Stellar connector that's out of the box for ingesting alarms?

Looking for guidance to troubleshoot some Azure actions for a simulated case for some reason I am able to trigger on the simulated case but azure ad actions can't ingest the case data

Hello,is it possible to somehow duplicate a connector, so there is new mapping available?For instance, i have an EmailV2 connector. I use it for different purposes:1. XDR integration (since it lacks the connector), i parse the data via e-mail.2. Manual Enrichment (we have a pre-set form that analysts can send to an e-mail and it will return the needed data)3. Vulnerability e-mails from different providers4. etc.... At some point, all the available fields in mapping are full. Is there a way to duplicate the connector so i get a new set of mapping available in onotology? I.E.EmailV2 - Data enrichment protectorEmailV2 - Vulnerability managementEmailV2 - SIEM .....So, at some point, the mapping is full and i cannot parse anything else (without custom regex actions that we have in place, but that does not enable us to work with entities.   

Hello everyone!I am having a doubt regarding the deprecated label; i.e.,  $ioc.graph.entity.labels.key, which has to be populated as $ioc.graph.entity.user.attribute.labels.key nowadays.I am using this new label in the rule, however, all logs contain deprecated labels entity.labels.key and entity.labels.value, thus the rule doesn't detect logs with $ioc.graph.entity.user.attribute.labels.key.I would like to know, if there is some way to define in the rule that $ioc.graph.entity.user.attribute.labels.key = $ioc.graph.entity.labels.key or such option doesn't exist and I have to ignore the compilation warning and keep using the deprecated label? Thank you in advance!🙂

Hey folks!!For GCP audit logs does anyone know if there are any udm event for storage.object.get or storage.object.delete? I am unable to find any information on it. I can locate the events by querying Udm.metadata.product_event_type = “storage.buckets.delete” 

What does this different color (Green, Grey, Red, violet etc..) coding says for an Event? Are there any more ?@jstoner Is there any kb that covers this topic? I tried finding but no luck.

How can I log in to the SOAR free edition:https://app.siemplify-soar.com/#/login 

There's an official Chronicle Looker block available on the Marketplace, and it mentions that the 'BigQuery Export feature needs to be enabled for your Chronicle tenant.' Can someone please explain what this feature is and how I can set it up?Block on Marketplace I understand that this feature involves the Chronicle sending parsed events to BigQuery, which can then be used to connect with Looker. I'm currently facing delays in seeing these events in BigQuery. Is there anyone who can assist me with this issue?

Hello everyone!Im currently struggling with the regex usage in the rule.I need to create a regex in order to detect the logs with an Admin privilege from  "PermissionGroup": "Admins" or "SocRole": "Administrator"security_result.detection_fields.value = "{\\"PermissionGroup\\": \\"Admins\\",\\"SocRole\\": \\"Administrator\\"}" I created regex on the regex website to match SocRole : (?<=\\"SocRole\\":\\s\\")(.*?)(?=\\")However, when Im trying to apply it in my rule, it keeps giving the error that literal is not terminatedre.regex($e.security_result.detection_fields.value, `(?<=\\"SocRole\\":\\s\\")(.*?)(?=\\")` I also tried this way:$e.security_result.detection_fields.value = /SocRole:.*/ . but it doesnt detect any logs  Can you please help me to correct this issue?Thanks in advance!🙂

Is there a list of out-of-box Chronicle rules available somewhere to review? Similar to what SCC Premium provides here: https://cloud.google.com/security-command-center/docs/how-to-use-event-threat-detection