Google Security Operations

Hi exploring options for creating dashboards using APIs. i found a repository of python functions which helps to create detections rules and can perform may other things in similay way i am searing for dashboards.here is the repository i am refering: https://github.com/chronicle/api-samples-python 

Guys  i want to fetch 3rd party threat intel data in my google secops and make its list which will get updating every 24 hour.can any 1 guide.

We just finished setting up ingestion of MS Cloud Defender alerts into our Google SecOps instance.Using the following docs:https://cloud.google.com/chronicle/docs/ingestion/default-parsers/ms-defender-cloud-alerts#overview Alerts are flowing just fine. Next step is to create alerts if any fired.  I’ve tried leveraging the Curated detections, but noticed that the event type referenced in the curated detections is different, so they wont fire.    My event type beign ingested are comingmetadata.log_type = "MICROSOFT_DEFENDER_CLOUD_ALERTS" Looking at the curated detections logic, I see completely different log_type. metadata.log_type = "MICROSOFT_GRAPH_ALERT" Whats “microsoft Graph Alert” to start and why

Someone please help how to set up custom alerting to get alerts for the IOC Matches shown in Dashboard

Hey Community and SecOps enthusiasts! Google Cloud just released its next certification for Google Cloud Professional Security Operations Engineers. This cert program is all about assessing your ability to conduct platform operations, data management, threat hunting, detection engineering, incident response, observability and more! Check out all the details here. 

Hi there,I’m trying to incorporate user behavior patterns (UEBA techniques) into SecOps rules. For example, let’s say I want to create a rule that triggers an alert whenever a user clears Windows event logs. I only want that to trigger an alert if the user has not previously ran similar commands in the last 30-90 days. If they haven’t ran those commands previously, then that is considered ‘anomalous’ and an alert will be triggered. I took a look at using metrics but only certain functions are supported.Is this possible? I figured with playbooks in SOAR it is, but was hoping to accomplish this within the rule itself.Thanks!

How do I change the sample data in expression builder for subsequent actions in playbook development?I’ve selected the drawing pin icon to set the json to the actions sample but if place a condition step to after to check values from that result it defaults to the null sample data.Am I missing something very obvious here? 

Good morning,At one of our clients we are sending alerts from FAZ to the SOAR via API. After reviewing the events/logs closely, I noticed that the fields related to transferred bytes or megabytes in the connections are not being included.Is there any way to add these fields — perhaps through a configuration option or similar?I saw the "Search logs" option under FAZ integration, but it doesn’t seem to be working.Any ideas? Thanks in advance.

Hi everyone,We’re currently implementing SecOps and I’m struggling with a specific scenario where I couldn’t find clear documentation. At the moment, we have a single environment that centralizes all open cases. Our requirement is to segment these alerts so that, for example, firewall events are separated by client, in different environments, based on criteria such as IP addresses, domain names, or even email addresses.My questions are: What would be the best way to automatically assign these cases to the right environment? Should this be handled with rules, or is it better to use playbooks for this type of segmentation? If anyone has faced a similar situation or can share best practices, I’d really appreciate your input.

Do we have any matrix for Informational, Low, Medium, High, Critical that exactly tells the range for all these fields accurately 

Hi, is it possible to aggregate another aggregation? My goal is to get the average time for the maximum and minimum time. But since there’s a limitation I’m not getting the correct result. Is there any workaround to get avg? 

Hi,I need to create a playbook that creates Jira tickets based on alert priorities. If an alert's priority is high, it should create a high-priority ticket and so on. However, my condition doesn't match anything, and the playbook always chooses the last step. How should I create the condition to make that work correctly?"

Hi All,Any idea what does this means?  

Calling all Security Operations Enthusiasts! Google Cloud is offering a beta for the new Professional Security Operations Engineer certification! The exam will be available until August 8.  Check out the post in News & Announcements. 

In Google SecOps SOAR playbooks, When I am trying to enrich IP/domain, all the IPs/Domains are being enriched. I dont see any option to use a particular IP in Enrich IP action of VirusTotalV3 integration. How can we enrich only desired IPs.

author = "XXX XXX"    description = "Detects a successful logon immediately following multiple failed logon attempts from the same IP or user, using specific Windows Event IDs."    severity = "High"    priority="High"    mitre = "T1110.001"    yara_version = "YL2.0"    tactic = "Credential Access"    technique = "Brute Force"   events:    // Event 1: Failed authentication attempts from Windows logs (4625).    $fail.metadata.event_type = "LOGIN_FAILED" and    $fail.principal.asset.ip = $ip_address and    $fail.target.user.userid = $user_id        // Event 2: A single successful authentication from the same IP (Windows 4624).    $success.metadata.event_type = "LOGIN_SUCCESS" and    $success.principal.asset.ip = $ip_address and    $success.target.user.userid = $user_id    match:    $ip_address, $user_id over 5m 

Hi Team,can someone help me with forwarding Zoom logs via API to secops SIEM?

Is there a way to account for null/zero values that show up when you run a match window? For example this query - ingestion.log_type != ""$log_type = ingestion.log_typematch:$log_typeoutcome:$event_count = sum(ingestion.event_count)$event_type_count = count_distinct(ingestion.event_type)$event_types = array_distinct(ingestion.event_type)order:$event_count desc Gives results back like the followinglog_type - Testevent_count - 4event_type_count = 3event_types - USER,,EDRas you can see it accounted for the zero value but I do not want it to account for the empty value in that count for event_type_count

Is there a way to account for null/zero values that show up when you run a match window? For example this query - ingestion.log_type != ""$log_type = ingestion.log_typematch:$log_typeoutcome:$event_count = sum(ingestion.event_count)$event_type_count = count_distinct(ingestion.event_type)$event_types = array_distinct(ingestion.event_type)order:$event_count desc Gives results back like the followinglog_type - Testevent_count - 4event_type_count = 3event_types - USER,,EDRas you can see it accounted for the zero value but I do not want it to account for the empty value in that count for event_type_count

I see this was already asked here, but the "solution" is strange and counters the whole purpose of having actual tables with columns. If I need to do a concat of all my columns into a SINGLE column for comparison, aka, a single dimension, aka exactly how it worked with reference lists, then this is useless! This exact same behaviour was possible with reference lists as you could have a line like `john@example.com_1.1.1.1` and do a concat on the UDM fields in the rule to compare them against the value from the reference list! My use case: I have a data table `common_behaviour` that is populated according to a business logic. That table contains the following columns:user:

Does anyone have a wrapper or code sample to easily run integrations in Pycharm or a debugger not within SOAR? It's brutal building in the IDE.

giám sát jp khách hàng tiềm năng bằng thời gian thực

Hey everyone!I am trying to create an alert using a webhook. This is the json sample I used for my webhook:{ "name": "Alert test", "environment": "EnviName", "rule_generator": "Test rule", "alert_identifier": "Alert-Test-1", "priority": 10, "display_id": "[Case.Id]", "start_time": "2025-08-14T14:00:00Z", "end_time": "2025-08-14T14:00:00Z", "device_product": "RULE", "events": [ { "name": "Event_No_Name1", "type": "Event_No_Type1", "severity": 1, "source": "Origin", "device_product": "RULE" }, { "name": "Event_No_Name2", "type": "Event_No_Type2", "severity": 1, "source": "Origin", "device_product": "RULE" } ], "custom_fields": { "detected_from": "Perseus", "source_case": "[Case.Id]", "playbook_origin": "Create Cortex Alert", "extracted_domains": "[Entity.Identifier]" }}In

Hi,I have a use case where an IP address is blocked based on the button clicked by the end user in an approval link. If the user declines, the playbook ends.However, I also need to add a timeout that sends a follow-up email to the user. The problem is that both "decline" and "timeout" currently behave the same way in my flow.Is there a way to separate these two flows so that the timeout triggers a different path from the decline?I've attached an image of my current setup for better understanding. Any guidance would be appreciated! 

Hello, I've been noticing email raw logs from Office 365 does not contain the recipient email address or user name. How to resolved this issue or are there configurations needs to be fixed?