Google Security Operations

Im using set context on alert level and i have multiple duplicate values.Now i need to remove all duplicates

I am having difficulty writing a detection rule to identify VPN IPs, specifically for services like Mullvad VPN and other similar VPN providers, using only built-in threat feeds (no external data sources). I do not want to hardcode ASN numbers.

Hi All,I’ve integrated Microsoft Graph Mail with Google SecOps SOAR. For the Delete Mail  action, if we don’t provide specific values for the Sender or Subject filters, will the action delete all emails from the user’s mailbox?

I am pulling in AD Context Logsas per Collect Microsoft Windows AD logs  |  Google Security Operations  |  Google Cloud For user accounts, I am seeing the Enrichment in my event logs, however for Computer objects I am not seeing this? Here’s the context dataBut when I check event logs for that host:although the IP is there, which I doubt is from enrichment, the other attributes not… I need at least the role.  

I have seen “Integration - Updated integration action definitions to meet the new requirements of IDE” come up in lots of SOAR integration updates. What new requirements are being referenced? Is there some kind of deadline by which these updates have to be implemented?

Can anyone identify the difference in the maximum result when using different over values in the match?Example: I search the last hour of logs by log_type: events: $event.metadata.event_timestamp.seconds > timestamp.current_seconds() - 3600 $silent_hostname = $event.metadata.log_type And in the match I insert: match: $silent_hostname over 30 min This shows me 2 groups of logs:Group A (the first 30 minutes) and Group B (the last 30 minutes).With the following outcome, to show me the max timestamp of each group: outcome: $max_event_time = max($event.metadata.event_timestamp.seconds) I get 2 results, each with the max timestamp for its group.However, if I change the over value to 1 hour, it is supposed to return only one result, with the max timestamp equal to the max timestamp from Group B. But th

I can't add a timezone setting to the timestamp.The part of the parser that extracts the timestamp is below.----------date {match => ["eventtime1", "UNIX", "UNIX_MS"]on_error => "not_eventtime1_valid"}----------I tried the following settings:①----------date {match => ["eventtime1", "UNIX", "UNIX_MS"]timezone => "Asia/Tokyo"on_error => "not_eventtime1_valid"}----------Result:No change.②----------date {match => ["eventtime1", "yyyy-MM-dd HH:mm:ss"]timezone => "Asia/Tokyo"on_error => "not_eventtime1_valid"}----------Result:Syntax error.The current time is stored in UNIX time in timestamp.Is it possible to reflect the time zone setting in the above settings?

Hi,I am developing a custom parser for a email-security product with JSON logs.Everything is working as intended, except for information I want to include under “security_result.action_details” UDM field, which does not get populated whatever I try.My code is as follows:if [event][scan][indicators] != "" { for indicator in [event][scan][indicators] { mutate { replace => { "action_details" => "indicator" } } mutate { merge => { "security_result.action_details" => "action_details" } } mutate { merge => { "udm_event.idm.read_only_udm.security_result" => "security_result" } } }}With the json log having information in this format (redacted all other information about the email and left only the structure and relevant field):

Hi All,Struggling to find "graph.metadata.threat.threat_feed_name"  for info stealers. Also , how to get those list of threat feeds , we can leverage. for both VT and Mandiant.Thanks in advance  

 Hi everyone,I’m reaching out to check whether others are experiencing issues with the curated detection ruleset Workspace: Data Exfiltration from Gmail in Google SecOps.We’re using the recommended direct ingestion path for WORKSPACE_ACTIVITY logs (including Gmail). While the ingestion and parsing work, we’ve noticed that the UDM fields produced by the Workspace Activity parser do not align with what the curated detection rules expect — specifically in the Workspace: Data Exfiltration from Gmail ruleset.Examples of mismatches include:principal.application is populated with only the message_info.source.service value (e.g., gmail-ui), while the curated rule expects a concatenated value such as gmail-ui send. The selector value is placed under additional.fields instead of a field the curated rule monitors. metadata.product_name is mapped as gmai

Hi everyone, I've been exploring Google Cloud's Confidential Computing products like Confidential VMs, GKE Nodes, and Confidential Space. The potential for protecting data-in-use is very promising, especially for sensitive AI workloads. My question is:How can we securely integrate third-party AI models (e.g., from open source or external vendors) into Confidential Space or Confidential VMs without compromising data privacy or the TEE trust boundary? Are there recommended architectural patterns, isolation practices, or attestation tools we should use when the model provider is not part of our organization? Appreciate any insights, resources, or examples you can share! Thanks,

Estou criando um webhook no SIEM para configurar com o Tenable. É  necessário criar um fluxo? Qual seria esse fluxo? Google Translate: "I am creating a webhook in the SIEM to configure with Tenable. Is it necessary to create a workflow? What would that workflow look like?"

Hi All,We are utilizing Webhooks to ingest alerts from various sources into SIEM and it's working fine.Can we also utilize it to ingest raw logs in json format into SIEM. w.r.t alerts, there will be only 20-30 events per day but in case of raw logs, the volume is high. Is it recommended to use webhooks for the same?

I am looking to setup SSO with Okta for our Google Secops tenant and following the google doc: https://docs.cloud.google.com/chronicle/docs/soar/admin-tasks/saml-soar-only/saml-configuration-for-okta but this just mentions SOAR.Is that how the SecOps SSO works and moreover, there is no External authentication option under SOAR Setting → Advanced → External Authentication.I also found this doc which mentions about the SSO setup with Okta: https://medium.com/@thatsiemguy/linking-okta-to-chronicle-secops-platform-c88ca530a515 which one should I really follow, would appreciate any responses on this? 

Hello community,We are currently ingesting a high volume (20TB+/month) of GCP_CLOUDAUDIT logs into Google SecOps, specifically 'Data Access' logs (customer requirement ) .I need to optimize this ingestion to reduce costs, but I lack visibility into which specific GCP Projects or Resources (e.g., specific GCS Buckets or BigQuery Tables) are generating the bulk of this volume. The default 'Data Ingestion & Health' dashboard aggregates by Log Type (e.g., 'GCP_CLOUDAUDIT') but does not break it down by the granular source project or resource name found in the payload.I’m trying to create a Dashboard that visualizes GCP_CLOUDAUDIT volume grouped by ( as examples : )GCP Project ID (extracted from metadata.product_log_id or resource.name) Resource Name (e.g., the specific noisy storage bucket)Has anyone built a dashboard like this or similar breakdowns that can guide me in the right direct

Please find below a Parser Extension for Google SecOps for SonicWall Secure Mobile Access (SMA)This extension enhances the existing parser which is for SMA 100s, to support SMA 1000s (e.g. SMA 8200v Work in progress # SonicWall SMA 1000 Parser Extension# Author: J Spoor# Version: 2.0 # SonicWall SMA 1000 Parser Extension# Author: J Spoor# Version: 2.0filter { grok { match => { "message" => "User='\\(\\s*%{EMAILADDRESS:user}\\s*\\)@" } on_error => "no_user_found" } if ![no_user_found] { mutate { replace => { "event1.idm.read_only_udm.principal.user.userid" => "%{user}" } } }else { mutate { replace => { "event1.idm.read_only_udm.principal.user.userid" => "UKNOWN" } } } mutate { merge

Custom parser for SonicWall SMA 1000 series e.g. SonicWall SMA 8200v Parser supports both Legacy Logging Format, as well as Modern Logging Format12.4.2 CEM Key:  LOGGING_MODERN_FORMAT = true12.5 Default. # SonicWall SMA 1000 Custom Parser# Author: J Spoor# Version: 2.2# Product: SonicWall Cloud Secure Edge# Supported Format: JSON# Last Updated: 2025-12-01# Copyright 2025 SonicWallfilter {# Initialization mutate { replace => { "loginlogout_event" => "false" "is_logging_modern_protocol" => "false" } } grok { # LOGGING_MODERN_PROTOCOL = true match => {"message" => "^<%{NUMBER:syslog_pri}>%{NUMBER:syslog_version} %{TIMESTAMP_ISO8601:timestamp} %{HOSTNAME:hostname}"} on_error => "no_header_match" }

Hi,I need to set up storage usage alerts for my SecOps environment at 50%, 75%, and 100% capacity.Is there a way to configure this, and is it supported?

Hi everyone,I want to export raw logs from our Google SecOps instance to a GCS bucket in the same region (northamerica-northeast2, Toronto) using the Data Export (Enhanced) API (directly with curl or the secops export CLI (https://github.com/google/secops-wrapper).However, I’m running into two main issues: Listing export jobs secops export list and the corresponding GET projects/.../dataExports REST call both return: { "error": { "code": 403, "message": "The caller does not have permission", "status": "PERMISSION_DENIED" }} This happens for me and for our SecOps administrator, who supposedly has full admin access in the SecOps

Hi All, I’m attempting to use the HTTPv2 integration however I’m getting a TIP Commons error: Is there a way to import this module for marketplace integrations? TIA!

Hi All, Has anyone else started seeing an issue with Custom Actions where the playbooks no longer automatically run the actions? It started happening on Friday (21st Nov) for actions that have been running without fail for more than a year: Now, when the playbooks trigger on a case, the “Choose Instance” field is not filled in which means all of the playbooks that I have which have custom actions are no longer completing their run: However, in the playbook it should automatically (dynamically) select the instance and run it without manual intervention:

I am trying to learn extending the parser and I have learned that the UDM entity data model has a field called additional and this accepts a Struct. So my idea was to parse any changes to the IAM policies and basically copy the object and put it into the additional fields. Using the AI lab had not much success but it might help you to find an example for me how this is done as you can see in the example. Because basically it creates a new key for each field in the bindingDeltas object.Here you can see the work that I have done with the AI lab at the same time.https://gist.github.com/sakirma/0a33218d0dfd2a329dc4f53b8b39c5a1

I am currently converting the following rule logic given below:https://analyticsrules.exchange/analyticrules/237c3855-138c-4588-a68f-b870abd3bfc9/I have already implemented most of the correlation and hotword-matching logic, but I am stuck on how to express several KQL constructs in Chronicle YARA-L, especially for the AzureDiagnostics table. can’t find appropriate Documentation for AzureDiagnostics.The KQL portion I am struggling to translate is exactly this:| extend hasHotword = iff(Statement has_any (hotwords), 1, 0) | summarize countEvents = count(), countStatements = dcount(Statement) , countStatementsWithHotwords = dcountif(Statement, hasHotword == 1) , countFailedStatementsWithHotwords = dcountif(Statement, (hasHotword == 1) and (Error > 0)) , countSuccessf

Hi @jstoner I am new to YARA L, I am trying to convert few KQL query into YARA L, but I can’t able to achive same as KQL logic. please help on this rules.Response rows stateful anomaly on database | Microsoft Sentinel Analytic Rules Drop attempts stateful anomaly on database | Microsoft Sentinel Analytic Rules

Howdy,I am facing some challenges with acquiring OnPrem AD Contextual data.Get-ADUser works fine, but the Get-ADComputer part errors out Using this:https://docs.cloud.google.com/chronicle/docs/ingestion/default-parsers/windows-ad # Set the location where the log file will be written$OUTPUT_FILENAME “C:\Data\SecOps\Logs\AD-AssetContext.json"If (Test-Path -Path $OUTPUT_FILENAME) { Remove-Item -path $OUTPUT_FILENAME -ErrorAction SilentlyContinue}# USER_CONTEXT: Gets all Active Directory users and their properties.Get-ADUser -Filter * -properties samAccountName | % { Get-ADUser $_.SamAccountName -propertie