Google Security Operations

Hi community, I am working on YARA-L detection rules in Google Chronicle to identify suspicious self-equality assignments (tautologies) in SQL logs. These patterns, like "1=1" or "test=test", are often used in SQL injection attempts to bypass filters or force true evaluations. Goal: Detect patterns where the left side of "=" exactly matches the right side, such as: test=test 1=1 time=time status = status flag=flag admin=admin bypass=bypass enabled=enabled id=id version=version But not detect mismatches like: 1=2 a=B (and similar non-tautologies) Challenges in Chronicle: I Tried regex -> ([A-Za-z0-9'-]+)\s*=\s*\1 were i used /1 #BackReference, but unfortunately backreference is not supported in YARAL, so using re.regex to directly check for equal values on both sides of "=". Then i used were grouping issue => The Chronicle re.capture() function only returns the first match in the text, and it supports only 0 or 1 capture group. If the regex contains 0 capture groups, Chronicle ret

I need to close alerts in SecOps when alerts are closed in our internal case management system. Currently, I’ve used update_alert.py method mentioned in the Blog by ​@DanDye.The error I’m running into indicates “Chronicle API has not been used in project xyz before or it is disabled. Enable it by visiting https://console.developers.google.com/apis/api/chronicle.googleapis.com/overview?project=xyz then retry. If you enabled this API recently, wait a few minutes for the action to propagate to our systems and retry.”I also, do see the option to update alert is greyed out in the UI. I’m unable to enable Chronicle API by following the link mentioned in the error, any suggestions on how to enable this functionality would be appreciated.  

Hello,I’ve search for this answer for more than 2 weeks.Is there any way to use jobs (or other feature of SOAR) to attach action/block/playbook to case/alert in particular time/situation? example scenarioI have jobs that check updates on servicenow ticket - and as gathering information, sending direct updates in snow, sending emails and so on I would like to also attach playbook for other multiple actions that we would like to proceed instead of coding all via managers. any advice? It is very simple to do with siemplify.action library while for some reason .jobs doesn’t allow it. Thanks in advance!

can we trigger a playbook using context value or if context value updated ?

https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.investigations/list?rep_location=africa-south1using the above doc, im trying to pass an alertId or caseId as parameters in the filter field, but i keep getting this error - INVALID_ARGUMENTCan anyone help on this. Many Thanks in advance.    param = {        "filter": "alertId=<alert_id>"    } base = "https://us-chronicle.googleapis.com/v1alpha/projects/<project_id>/locations/us/instances/<instance_id>/investigations"     try:         response = mysession.session.get(url=base, params=param)        rt = response.json()        print(rt)        except Exception as e:        print("\nError ",e)error im getting :{'error': {'code': 400, 'message': 'failed to list investigations', 'status': 'INVALID_ARGUMENT'}}

can we trigger a playbook using context value or if context value updated ?

I am working on a custom dashboard in Google Security Operations (Chronicle) and need guidance on building a source system–wise backlog case count view. The requirement is to create a weekly trend graph that shows the number of open cases, grouped by the originating source system / detection source.I am looking for clarification on the recommended UDM fields to identify the case source and the best approach to query only open cases and aggregate them on a weekly basis. Any sample queries or best practices for this use case would be appreciated.

I am trying to enhance / enrich event data / UDM by means of a Data Table. I have the following data table called CrownJewelsColumn 1: Hostname - mapped to entity.asset.hostnameColumn 2: Asset_ID - mapped to entity.asset.asset_idColumn 3: IP - mapped to entity.asset.ipColumn 4: Owner - mapped to entity.asset.attribute.labels.valueColumn 5: CrownJewel - mapped to entity.asset.attribute.roles.nameColumn6: OwnerKey - mapped to entity.asset.attribute.labels.key My goal is to enrich UDM data with data from above,especially I want asset.attribute.roles.name to contain CrownJewel, and I want an asset.attributes.labels entry where by key is called Owner and value from Collumn 4. But whatever I try, following both the google document, as well as the blogs from ​@jstoner  (well written!) But I can’t get any enrichment happening….Here’s two detection rules I tried: 1:rule enrich_asset_crownjewels_byIP{ meta: description = "Override asset entity context with CrownJewels data table" author =

Do you know when the APIVoid integration in Google SecOps (SOAR) will support the new APIVoid v2 APIs? The current integration (linked below) references the older v1 endpoints:https://docs.cloud.google.com/chronicle/docs/soar/marketplace-integrations/apivoid APIVoid has announced that v1 APIs will be deprecated on Feb 28, and v2 introduces breaking changes. From the APIVoid v2 API documentation, requests now use POST with a JSON payload, for example: curl -X POST "https://api.apivoid.com/v2/ip-reputation" \ -H "Content-Type: application/json" \ -H "X-API-Key: YOUR_API_KEY_HERE" \ -d '{"ip": "80.82.77.139"}' Additionally, the response structure has changed. Previously (v1), responses were wrapped under data or data.report, e.g.: { "data": { "report": { "ip": "80.82.77.139", "blacklists": { "engines": { ... In v2, the response is now flat, for example: { "ip": "80.82.77.139", "version": "IPv4", "blackl

@jstoner, (& any other staff) hope you're well.I have been tinkering with Yara-L for a rule creation. Specifically, I want to detect RDP connections from users/hostnames in which their last RDP usage was 35 or more days ago (30 days is also fine). Is this possible with the current Yara-L? I've almost everything but I can't quite nail it down. If this isn't possible, is there a suitable compromise you can suggest e.g search for RDP connections then check if the associated user has logged in the past 30 days.This is the best I've gotten:  rule rare_rdp_connections { meta: author: Bob etc. etc. events: $e1.metadata.event_type = "NETWORK_CONNECTION" $e1.src.port = 3389 or $e1.target.port = 3389 or $e1.network.application_protocol = "RDP" $e1.principal.user.userid = $user outcome: $login_monthly_access = max(metrics.auth_attemtps_success)(period:1d, window:30d, metric:event_count_sum, agg:sum, $user) condition: $e1 and $login_mont

We were recommend to post here re. case #10394319, Project number [removed by moderator] and as belowPlease could you highlight for attentionThanksRyan We are writing to appeal the suspension of our Firebase Hosting project dg-style-chooserThis is a false positive. Our application is a legitimate business tool, not phishing.What our application does:We operate LiveStory and DamnGood, two digital magazines that feature content creators.Our web application allows potential creators to browse visual style preferences and submit applications to be featured in our publications.The form collects standard contact information (name, email, Instagram handle) that creators voluntarily provide to apply for partnership opportunities.Why this is NOT phishing:We are a registered business operating at joindamngood.com and joinlivestory.com.We do not impersonate any other brand or service.We do not ask for passwords, financial information, or any sensitive credentials.The data collected is used solely

Is there a way to filter the workspace logs and reduce it before sending it to secops ?It is consuming too much storage of the tenant storage limit.

I need to integrate Falcon Crowstrike EDR with Google Secops to send alerts for detections and scheduled rules. Google's documentation mentions a direct API connector, but I'm unsure if this method will allow me to send all my alerts in near real-time. Are there other ways to integrate Crowstrike Falcon with Google Secops, such as using a pipeline like Bindplane? What prerequisites do I need?

I am creating a new integration, and for that I copied the pyproject.toml file from an existing integration. To generate the uv.lock file, I am using the uv sync command as mentioned in the Content Hub install and build steps.Once the uv.lock file is created, I use the mp build --integration <integration_name> command to generate the build, and I can see the output in the Out folder. After that, I change IsCustom to true, generate the ZIP file, and try to install it. However, I encounter an error. Upon investigation, I found that the issue is related to dependencies.I had some working integrations on my instance. I exported those integrations and copied it’s dependences and replaced them in the Out folder, and after doing that, the installation worked.To reproduce this issue, I tried generating a build for an already available integration in Content Hub (InfobloxNIOS). First, I ran the build command to generate the build and installed it on my instance, and it worked correctly. T

In Google Security Operations SOAR, native dashboard queries allow for the visualization of custom metrics, such as case counts and SLA compliance, using widgets like bar charts, pie charts, and tables. Users can create custom dashboards, configure widget filters by time range or SOC environment, and display up to 12 widgets. Key Aspects of SOAR Native Dashboard QueriesCreation & Access: Navigate to Dashboards & Reports > SOAR Dashboards to create, view, and share custom dashboards. Query Structure: Data can be queried for specific metrics, such as tracking active cases, SLA metrics (met/exceeded), or specific incident types. Widget Customization: Widgets can be added, rearranged, and edited (using the cog icon) to display data in various formats. Data Types: Common widgets show data regarding case occurrence time, incident severity, and user assignments. Interactivity: Users can click on widget graphics to drill down into specific incident details. For detailed configuratio

I’m looking for guidance on the appropriate contact point within Google for reporting and following up on unauthorized administrative actions performed by an external party with (current or former) Google Workspace admin access.More specifically, I’m trying to understand: Which Google team or function is responsible for handling this type of incident (e.g. Workspace Support, Trust & Safety, Abuse, Partner oversight, etc.)? Through which channel (ticket type, form, or email) such reports should be submitted to ensure proper review and ownership? Whether there is a defined process for incidents involving actions performed through the Google Workspace Admin Console by a third party? What kind of information or audit logs are typically expected to support an investigation? My goal is to avoid being redirected between multiple teams and to engage the correct channel from the start.Any guidance or direction would be greatly appreciated. Thank you.

Hello all, I need to create some automate TAGs depend con the value of the hostname. Example if a host is from Belgium: BEL-XXX, if its from Brazil: BRA-XXX. Well i thought about the funcion on SOAR casa data→ TAGS. Teh proble here, is i have more than 1 product in incoming alerts, and in one alert the entity is saved in host_name entity, in other deviceDNSname...etc… So, is there any solution or best practice for this?  Thanks!

General Approach: Using System SchedulersFor most general use cases, you can create a simple script (batch, shell, Python, etc.) containing your Git commands (git pull, git push, etc.) and then use your operating system's built-in scheduler to run this script at regular intervals.Linux/macOS (Cron): Create a shell script (e.g., ~/gitsync.sh) with your commands. Make sure it has execute permissions (chmod +x ~/gitsync.sh). Edit your crontab using crontab -e. Add a line to schedule the script, for example, to run every 15 minutes: bash */15 * * * * /bin/bash /home/user/gitsync.sh >> /home/user/cron_log.log 2>&1 This command executes the script and redirects the output to a log file for monitoring.

Hello Commmmmunity, I am attempting to implement the detection rule below in SecOps but keep getting an error message when I test or attempt to save the rule.“parsing: error with token: ":" expected '=' between meta assignment key and value line: 11 column: 12-13” rule MAL_Dropper_NetSupportRAT { meta: author = "Sam" description = "Detects a dropper that delivers a decoy ChaGPT Installer and NetSupport RAT" hash = "d86f647f3dfa6a53de7b531cb590636331f83afcea60d4b3d44de5ea3b7d33af" malware = "NetSupport" malware_id = "TWOU5d" category = "MALWARE" strings: //dropped files $d1 = "ChatGPT Installer.exe" $d2 = "setup.exe" //netsupport strings $n1 = "NetSupport" nocase $n2 = "install_netsupport_manager_silently" $n3 = " [removed by moderator] " condition: uint16(0) == 0x5A4D and all of ($d*) and 2 of ($n*)} I’m getting similar error messages for rules that have “strings:” in them. What could be wrong?

Hello Community,I am trying to clearly understand the design and deployment model of Google SecOps SOAR Remote Agents, specifically when the target systems (for example, FortiGate firewalls or other on-prem security tools) are hosted inside a private customer network. I would like clarification on the following points: Hosting Model Do we need to create a VM in the customer private network to host remote agent? Is the Remote Agent always expected to run on a dedicated VM or server inside the customer’s private network? Is this the recommended and supported architecture for interacting with internal devices such as firewalls, AD, or other non-internet-exposed systems? Allowing Access for Remote Agent to Google Publisher and Firewall

Hello guys,I’m working on SecOps Audit events for MOC purposes.I wrote a query to identify modifications on Parsers & Extensions.Here’s my query :events: metadata.log_type = "GCP_CLOUDAUDIT" target.application = "chronicle.googleapis.com" // Filter on Parser Mgmt events metadata.product_event_type = /\.ParserService\./ $action = re.capture(metadata.product_event_type, `ParserService\.(.*)$`) // Exclude 'Read' events not $action = "GetParser" not $action = "ListParsers" not $action = "ListParserExtensions" not $action = "GetParserExtension" $evtid = metadata.id match: $evtidoutcome: $timestamp = array(timestamp.get_timestamp(metadata.event_timestamp.seconds, "SECOND", "Europe/Paris")) $audit_action = array_distinct($action) $log_type = array_distinct(re.capture(target.resource.name, `logTypes/([^/]+)`)) $actor = array_distinct(principal.user.email_addresses)order: $timestamp descunselect: $evtidUnfortunately, my filters to remove ‘Read’ events seem to be not wor

Hi Folks,I’m new to SecOps and still getting familiar with the platform’s functionality. Apologies if this is a basic question, but I believe it will be helpful not only for me but also for others who are beginning their SecOps journey. I’m looking for guidance on how to search logs in SecOps for the following requirement:We have onboarded Windows servers via Bindplane, and I want to run a query to list all logs coming from a specific Windows server.Currently, we are using a query similar to the one below (Partial query) :metadata.log_type = "WINEVTLOG"$host = strings.coalesce(principal.asset.hostname, principal.hostname)However, we are observing an issue where we have onboarded only 50 Windows servers, but the query returns more than 50 host values. Upon initial review, these additional hosts appear to be introduced during parsing (exact cause not yet confirmed).In Splunk, we typically rely on the host field to retrieve all logs from a specific server/device. Could someone please advi

Hi Team,While running a Dashboard query using “Run in Search”, the query returns No results, even though the same query shows results within the dashboard visualization. The issue specifically occurs when applying an equality filter (=) on a derived field created using an if() expression. metadata.product_event_type = "test" $inference = if( security_result.summary = "Client Authentication Bypass", "ABP", if(security_result.summary = "SSH Agent Forwarding Requested", "AFR"))$inference = "ABP"match: principal.ip, target.ip, $inference  When filtering with: $inference = "ABP"  → No results are returned. However, removing the equality filter entirely returns results Using a negation filter: $inference != "ABP"  → Also returns results The issue is reproducible across multiple dashboard queries using similar derived-field logic. The problem appears to be specific to equality (=) filtering on fields derived via if() expressions. Dashboard widgets show results, but “Run in S

I have this nested JSON: "jsonPayload": {"message": "\"id2\":{\"timestamp\":\"2026-01-19 03:15:20\", \"app_name\": \"test1234\", \"client_port\": \"2233\", \"client_host\": \"hostName\"},}I wrote this code snippet but it doesn't work, can you tell me why?filter { mutate { replace => { "client_port" => "" } } grok { match => { "jsonPayload.message" => ["client_port=(?P<client_port>[0-9]+)"] } overwrite => ["client_port"] on_error => "client_port_not_present" } statedump{} mutate { rename => { "client_port" => "event.idm.read_only_udm.principal.port" } } mutate { convert => { "event.idm.read_only_udm.principal.port" => "integer" } } mutate { merge => { "@output" => "event" } }} I want to extract the value of the client_port field and map it to the UDM principal.port fieldThanks in adva