Skip to main content

Google Security Operations

Your Security Operations conversation starts here. Ask questions. Share insights. Tell us what you've learned. Or tell us what you're working on. We want to hear about it!

  • 2,064 Topics
  • 6,571 Replies
2064 Topics
rav1and3
rav1and3Bronze 3
posted in Google Security Operations
Schedule the native dashboards

Hello Team,Is there any chance that we can schedule the native dashboards and send it via email?This is possible in SIEM dashboard but I don't see such option in native dashboards.Can we expect that as feature?

04
chad-imp
M
marcus_aureliusBronze 1
posted in Google Security Operations
Case Comment preservation when Merging Cases

Hello everyone,When merging two cases in SecOps SOAR, the comments should stay on the Case Wall, however, I've found this isn't always the "case". Is there any way (my searching has not found one as of yet) to ensure preservation of case comments when merging cases?Thank you!

04
M
V
VictorSOARNew Member
posted in Google Security Operations
Tanium Integration with Service User account

Hi Team,Wanted to understand if we can use service username and password to integrate Tanium integration with SOAR.Document says to integrate it with API...so looking for possibility/

01
V
B
b41sNew Member
asked in Google Security Operations
Ingesting Google workspace alerts troubleshooting

Hi all,I'm following Google's documentation to ingest google workspace alerts via the Feed method. However i try to follow the principal of least privilege for the impersonation account. The documentation is a bit contradictive in my opinion due to the following:1. A custom role needs to be created for the impersonation account (for google workspace alerts that should be: Privileges > Services > Alert Center > Full Access > View access)2. But then it is still required to assign the super admin role to the impersonation account (making the custom role obsolete).I performed troubleshooting with and without the super admin role & custom role and this results in the fact that the account really does need the super admin role to fetch alerts from alert center. See here an overview for reference:1: API call without custom role and without super admin role: HTTP 403 Forbidden2: API call with custom role but without super admin role: HTTP 200 + exit code 0 but does NOT fetch al

33
B
mikelmi01
mikelmi01New Member
posted in Google Security Operations
Is it possible to create an exception via an action in SOAR?

I'm working with SOAR and I would like to know if it's possible to create an exception through a custom action. The idea is for this action to be triggered once certain conditions are met within a playbook, thereby preventing similar alerts from being generated in the future. In case it is possible, what are the fields that must be added in the code in order to successfully create said exception?There are a couple of rules generated through EDR that constantly generate the same alerts with the same data. I have a playbook that checks if those alerts are dangerous or not. I want to create a custom action that, in case the playbook confirms that said alert is actually a false alarm, generates an automatic exception in FortiEDR so that it doesn't create another alert in case it sees that there is the same information.This is the code I have for the moment in the custom action create_exception:from SiemplifyAction import SiemplifyAction from SiemplifyUtils import output_handler from FortiE

23
Chris_B
A
Akshay04Bronze 1
asked in Google Security Operations
Help Needed with Composite Rule: "detection source is not supported" Error in Chronicle SIEM

I'm working with composite detections in Google Security Operations (Chronicle SIEM) and running into an issue.I'm trying to implement a level 2 composite rule that consumes detections from a producer rule (login_with_location_producer) which extracts user email and login country from USER_LOGIN events.✅ Producer Rule (Works fine and persists detections):rule login_with_location_producer {meta:author = "Google SecOps Gemini"description = "Produces detections with user email and login country from Google Workspace login events."events:$e.metadata.event_type = "USER_LOGIN"$e.target.user.email_addresses[0] = $user_email$e.principal.ip_geo_artifact[0].location.country_or_region = $login_countryoutcome:$target_user = $user_email$country = $login_countrycondition:$e}❌ Composite Rule (Fails to parse with "detection source is not supported"):rule rapid_country_change_composite {meta:author = "Google SecOps Gemini"description = "Detects rapid login location change for a user within

01
jstoner
Staff
L
LD-88New Member
posted in Google Security Operations
Remote agent High availability

I'd like to know what people are using as far as High availability solution for the remote agents for SOAR?Having just one Remote agent would be a single point of failure so trying to find the right approach to having HA for this requirement.

03
sarahhhh20
Lun
LunBronze 1
posted in Google Security Operations
Can additional fields become array?

I encounter some problems today on working for a parser, I created a custom parser for meet my customer needs and added some additional fields.I've got this pattern:"<%{INT}>%{SYSLOGTIMESTAMP} %{DATA:hostname} %{DATA}: %{IPV4:ip} %{DATA} %{DATA:username} \\\\[(?P<time>[^\\]]+)\\\\] \\\\\\"%{DATA:method} %{DATA:target} %{DATA:proto}\\/%{DATA:proto_version} %{INT:response} (-|%{INT:bytes}) \\\\\\"%{DATA:referer}\\\\\\" \\\\\\"%{GREEDYDATA:useragent}\\\\\\" %{INT:custom_field_1} %{INT:custom_field_2} %{DATA:jsession_id} (?<public_ip>(?:%{IPV4})(?:,\\s*%{IPV4})*)%{NOTSPACE:referral_url}" That matches this log:"09:04:08 sbobo-tsf-ml01 apache_access_log: 10.x.x.x - - [02/May/2025:09:04:00 +0000] "POST /sbobo/sismon/ClexEpromSet.jsp?MN=NODE_6074&MPN=NODE_6050 HTTP/1.1" 200 8604 "https://www.sbobo.net/sbobo/sismon/ClexEpromSet.jsp?MN=NODE_6074&MPN=NODE_6050" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/

13
C
d_patel_dj
d_patel_djBronze 1
asked in Google Security Operations
Track Mean time to Respond

Hi,I'm looking to track Mean Time to Respond (MTTR) for our SecOps team. Specifically, I want to measure the duration between an alert's creation (when it's initially assigned to the general 'analyst' role) and when it's subsequently assigned to an individual analyst.Is it possible to track this specific interval within SecOps?Thanks 🙂 

22
d_patel_dj
MikelSA
MikelSABronze 1
asked in Google Security Operations
How to remove

Hi everyone, how are you doing?I've been struggling with a small issue and can't seem to find the solution.I want to remove the parts like the "alert ID", "type", and "original identifier" — I just want to keep the entity name, without all the extra info that shows up.Thanks!

01
Y
Staff
D
devashishsinghBronze 2
asked in Google Security Operations
Filtering GCP audit logs by administrator group for dashboarding

I'm building a security audit dashboard in Google Secops and need to filter GCP audit logs to show actions performed only by members of our designated administrator group in GCP. The audit logs themselves don't directly include group membership information.Is it possible to define a user group (e.g., within Chronicle or using a lookup list) that I can then reference as a variable in my search query? The goal is to effectively filter the audit events to only include those initiated by users belonging to this specific administrator group.

12
D
N
NotMarcusNew Member
posted in Google Security Operations
Ingesting AWS PostgreSQL logs into Google SecOps SIEM

Hi,I have been running into an issue when I attempt to get my Postgres SQL logs from my AWS CloudWatch into my Google SecOps SIEM. I am able to successfully set up the ingestion feed, however, the logs appears to be getting broken up by the SQL query if it happens to contain a new line or tab in the log.Has anyone else run into this issue and what was your workaround for this? That for the help in advance.

12
N
G
ganeshsunkariNew Member
posted in Google Security Operations
Curated Rule pack details

Can you please list of curated packs that would be available based on type of chronicle secops subscription. Like Enterprise contains only few curated packs versus enterprise plus would have more packs. Need pack names. Thanks you.

12
a_aleinikov
G
ganeshsunkariNew Member
posted in Google Security Operations
Leverage Virustotal for detections in enterprise plus

We have enterprise plus instance, question is how do we know that all GCTI feeds like SPUR context, Remote Access Tools, Benign Binaries, Relationships are surfacing in the chronicle without any issues during the implementation phase. How do we confirm this.

21
a_aleinikov
G
ganeshsunkariNew Member
asked in Google Security Operations
Entity search results

While searching for an entity in UDM search, we get two different sections upon result. One is TimedData and other is Timeless Data .What does mean of timed data and timeless data, whats is the difference? 

22
jstoner
Staff
S
suryanmenonNew Member
posted in Google Security Operations
Ingesting AWS CloudWatch logs into SecOps SIEM

Is there any documentation or information available on ingesting AWS CloudWatch logs into SecOps? We have documentation available for CloudTrail, but were unable to find any for CloudWatch. Appreciate any advice.

25
D
Staff
N
NASEEFBronze 5
posted in Google Security Operations
Rule triggered for the very first time in the SecOps

hello team , I am looking for few things at the content level and if you can  come up something with these, it will be really helpfulRule triggered for the very first time in the SecOpsRule not triggered in last 30 / 90 daysRule recently triggered, but not seen in last 90days 

112
R
Staff
B
bit1290New Member
posted in Google Security Operations
Question about Google Secops Consumption metrics

We're facing some difficulties building a graph in Google Cloud Monitoring (Metrics Explorer) to visualize ingestion metrics from Google SecOps:   Specifically, we need to create time series graphs that show: The total amount of ingested GB over time The total ingested GB per log source over time We’ve confirmed that the Google SecOps integration is already set up in Cloud Monitoring and appears to be providing useful data. However, what we’re seeing in the graphs doesn’t match the ingestion values shown in Google SecOps or Bindplane dashboards. For example: Google Cloud Monitoring shows only a few KBs While Google SecOps and Bindplane reflect ingestion in the GB range Google Cloud Monitoring Google Secops Bindplane We're trying to understand this discrepancy. We noticed that the Total Ingested Log Size metric is of the "Delta" kind. From our understanding, delta metrics reflect only the change in value over ti

31
A
MikelSA
MikelSABronze 1
asked in Google Security Operations
Mapping alerts correctly

Hi, How are you doing?I've been having problems with the mapping for this It is supposed to come from AzureAD IdentityProtection, but at the moment i cant get to map any Entities Highlights for Default, only the IP. The name of the user comes in the "aaduserid" variable, but I want the alert to show the user's email address or display name as an entity — something more useful.Any solutions? I came with the solution to do some KQL querys, get the json, en enricht the entities, but im sure that im missing something.Thanks!

02
MikelSA
AV007
AV007New Member
posted in Google Security Operations
Rule Enabled and Disabled Timestamp ( Alerting Mode/ Live Mode)

Hi,I'm looking for timestamp details, such as when rules are enabled and disabled ( Alerting Mode/ Live Mode). I want to create a dashboard using this information. Please let me know if you have any insights.

02
David-French
Staff
donkos
donkosNew Member
posted in Google Security Operations
Link Click Tracker Automation

Hello all,I have received a request to automate some way to track who "actions" an email - where by actioning we mean that a list of recipients receive an email and are asked to acknowledge that they have read through it. The closest thing I'm aware of how to do this in SOAR is to send an email with voting buttons - there's a dedicated Graph Mail integration action that then waits for responses.The problem with that is the voting buttons are quite small and hidden - the preference would be a big visible button, clicking which logs some basic data on who clicked it. Anyone have any ideas?

12
S
Staff
V
vanitharaj1208Silver 2
asked in Google Security Operations
Custom Action - Get package SAS URI API

HI All,I'm building this custom action - https://learn.microsoft.com/en-us/defender-endpoint/api/get-package-sas-uri I need some guidance to Handle rate limit since it is 2 calls per minute"Rate limitations for this API are 2 calls per minute and 120 calls per hour."What will be the best approach to handle this?and i have one question - if we got 10 alerts and at same time playbook which got attached had this action - then this action will fail rest 8 alerts and 2 alerts had successful playbook run? 

05
S
Staff
R
rohan1804New Member
posted in Google Security Operations
IOC Generation Not Happening Despite Alert Triggers in SecOps

Hi everyone,We're currently working on ingesting IOC (Indicators of Compromise) data into SecOps. To achieve this, we’ve created custom rules and are successfully ingesting logs through a feeder. The logs contain known malicious IPs that have been verified via the Mandiant portal with a threat score above 80. The alerts are being triggered as expected based on these IPs.However, we’re noticing that IOCs are not being generated despite the alerts. Has anyone faced a similar issue? Is there any specific configuration or step required to ensure IOCs are created from triggered alerts?Any guidance or suggestions would be greatly appreciated.Thanks in advance!

02
R
J
jonahbfNew Member
posted in Google Security Operations
'Script did not return expected data" error in actions

When building our integration, we're seeing the error"Script did not return expected data. Did you call build_result/end_script? Check DebugOutput for details"in a couple of actions that had previously been working correctly. It seems like the expected output variables (like `is_success`) are not being populated. What's even more confusing is that we are calling SiemplifyAction.end() with the correct values - when we log what we've been passing, it all seems correct. We're passing true for the result_value, passing a valid message, passing a valid execution_status, etc.. Are there any changes to the SOAR SDK that would explain this? It broke without any code changes on our side 

010
J
A
AashShahNew Member
posted in Google Security Operations
Regarding exporting/ sharing of Secops Dashboards outside of the organization

Hi there,I've been working with SecOps Native Dashboards for the past 2 months, creating dashboards using YARA-L 2.0 query language. While the dashboards are great for internal use, I’ve encountered a challenge in trying to share or export them outside of our organization to other members/customers.Previously, I asked about this, but it seems like there were no clear options at that time. I’m reaching out now to see if there have been any updates or new features in SecOps that allow for the sharing or exporting of these dashboards externally.Link to the previously asked question: https://www.googlecloudcommunity.com/gc/SecOps-SIEM/Publishing-Sharing-Preview-Dashboards-for-Google-Secops/m-p/851383#M2714Any help, tips, or workarounds would be greatly appreciated!Thanks in advance!

03
jstoner
Staff

Badge winners

  • Authored Posts 5
    leodashas earned the badge Authored Posts 5
  • Authored Posts 5
    delstonhas earned the badge Authored Posts 5
  • Authored Posts 1
    SaDaVFhas earned the badge Authored Posts 1
  • Authored Posts 5
    hzmndthas earned the badge Authored Posts 5
  • Solution 10
    hzmndthas earned the badge Solution 10
Show all badges
Terms & ConditionsCookie settings
Privacy Policy Terms of Service Gen AI Policy Community Guidelines Cookie Settings

© 2025 Google. All rights reserved.