Google Security Operations

I'm looking for a way to identify Google SecOps SOAR cases where one or more playbook executions have failed. My goal is to programmatically retrieve a list of these cases, ideally using methods available within the Siemplify SDK (Python), so I can process them further in custom jobs or actions Is there a specific Siemplify SDK method, API endpoint, or recommended approach to filter cases based on the success/failure status of their associated playbook runs? I'm trying to avoid manually checking the playbook monitor for each case.Thanks!

Created a quick action which allows users to quickly create a HTML report based on multiple values across all alerts/events. Added quick action via SOAR Settings -> Case Data -> Views -> Default Case View -> Quick ActionsProblem I am facing:The Action does not allow me to pre-configure the "Run on Alerts" field. If a user does not uncheck all but one alert, my action executes up to 20 times flooding the case wall with report comments.Is there a setting/configuration I am missing?

Risk Analytics is a crucial feature within Google SecOps SIEM designed to help security teams identify unusual behavior and quantify the potential risk that various entities pose to the enterprise. It empowers analysts to move beyond basic alert triage and focus on the entities that represent the most significant threat. Key Components of the Risk Analytics Dashboard The central hub for this feature is the Risk Analytics dashboard, which provides a holistic view of entity risks, accessible to users with global scope in RBAC systems. Behavioral Analytics: This section lists entities (such as user accounts, servers, or laptops) based on their calculated Google Security Operations Entities risk scores. This allows tracking an entity's risk over time and serves as a metric for detection use c

Hi, I’m trying to create a detection rule in Chronicle that identifies cases where too many requests are sent to an external load balancer — specifically, more than 10,000 requests from the same IP within one day, where the response status is 400 or 500. This is the rule I wrote - rule too_many_requests_to_external_lb{meta:  severity = "HIGH"  platform = "Chronicle"

If I have to disable a human user on the Google Workspace using the Google SecOps SOAR, what is the integration I should use for the Google Workspace.

 Hey everyone 🤩, HI’m new here and really excited to join this community. I wanted to start off with a topic that almost every cloud security team is struggling with these days — alert fatigue.In Google Cloud, tools like Security Command Center and Chronicle generate tons of alerts every day. Many of them turn out to be low priority or false positives, but they still take up time and attention. After a while, it’s easy for real threats to get buried in the noise.I’ve been trying a few things to handle it better, like:Suppressing repeated low-priority alerts Using automation for triage Tagging alerts based on asset importance Testing out AI-based event correlation Still, I feel there’s a fine line between cutting down noise and missing something critical. So I wanted to ask everyone here:👉 How are you reducing alert fatigue in your G

I have 2 question that needs to be addressed how to move cases from” default” to another environment. is there a way to associate a detection rule when alerts created tied to specific environment other than default? is it possible to move cases from default to another environment via playbook? what action I need to use?

Hi, I’m building a dashboard (v2) but the fields I want to dashboard use IDs instead of names. I want some of the IDs to point to the same name too. I’m not sure what feature of YARA-L to use to achieve this. Here’s an example with dummy data:I want IDs 52a11631-8a6d-42be-aeb9-a6f8754e186c and 9a50ae9f-11e5-4475-88de-0ba55d8d6745 to be displayed as a single item named “XSS” while fcfc4231-21cf-4eec-b542-14687225b1b4 and 106886e1-e52d-4254-b57a-54b550db1602 to be displayed as a single item named “SQLi” in a bar chart in the dashboard It doesn’t look like the dashboard interface is capable of doing this so I’m thinking I need to build out a YARA-L query. I want to create query that looks similar to the following but I’m not sure how to do it within the constraints of the YARA-L syntax supported by the new dashboards engine:metadata.product_name = "WAF" AND security_result.action = "BLOCK"$Rule_ID =

Any way to easily identify/query the specific entity that alerts have grouped on? All I can see is a comment applied in the case wall but this is not easy to view at scale.For example, I would like to see which are the common entity types that are causing alerts to be grouped on, to inform alert grouping rules in SOAR settings.Additionally, I would be interested to see the values of these entities so that I can tune out common false positives in Blocklists (e.g. root account).I understand how to make these changes, but do not have the underlying information to be informed on what changes require to be made - I would like to create a dashboard to list the common entity types and values that my tenant’s alerts are grouping on.

Hello,For each environment we have an instance that we need to change the secret since it is expiring. How can we do that using a script instead of doing it manually?I didn’t see an endpoint for updating instances in swagger api. There is an endpoint for creating instances but doesn’t let you configure parameters.Any ideas? 

We have multiple customers and each has their own environment. Each environment has it’s own integration instances configured.I am planning to create a job that processes cases from different environments. How can I be able to select which integration instance the script should use depending on the case environment?

Hi All, Is it possible to get the PDF document for SecOPs Enterprise  configuration guide along with the license packaging details. 

Hi Everyone, TL;DR: Has anyone dealt with debugging why a SOAR remote agent would start failing? How did you manage to get the Agent to connect again?---I realized today (after several playbooks started failing) that the remote agent that we set up hasn't connected since the 11th of May.  I currently have a case open with support but getting a fix may take a while.When opening up the Remote Agent page, it shows that the Status is "FAILED" and when I download the logs for the last week, the file itself is empty (I'm assuming this is due to the FAILED connection for over a week).When I dive into the host, the docker connection is still live and healthy, so I'm not sure where to begin since it's likely on the Google side. (Initial deployment was done through the "Send Installer/docker Command" action within the SOAR itself.&

I am trying to create a dashboard to visualize data, comparing a custom CIDR data table with a large amount of entries (~5k) to our logs. I am using net.ip_in_range_cidr to compare entries in the data table with log IP addresses.Other than filtering on log types or other fields, how else can I get better performance and avoid time complexity issues when running different queries?

Hi All, Is it possible to get the PDF document for SecOPs Enterprise  configuration guide along with the license packaging details. 

Hi team,Could someone please assist me with the native dashboard query for the Custom Curated Detection Dashboard? I’m looking to build the following: A table listing all curated rule sets along with their status — specifically indicating whether they are enabled, and whether each rule is precise vs. broad (for both detection and alerting categories). A table showing all curated rules that have fired, including an indicator of whether each is a detection-only event or an alert. Thanks in advance for your help

Hi Team,Am new to platform am trying to write a Yara-L logic for Detect when a privileged user successfully authenticates from a location, device, or ASN that has not been used by any other privileged account in the past 7 daysThanks

Hi All, @DAYJOB we’ve been working on prioritization and classification of alerts and incidents within the organization. One thing we’ve noticed when looking through metrics is that when an incident is raised for a ticket, it also changes the priority of the ticket:  As shown below, the priority of the ticket is changed by default to Critical: Is there a way to disable this functionality? We don’t classify every incident as a critical ticket and this throws off the metrics which we use to report to the leadership team.  Any advice would be appreciated. TIA.Kyhle

I’m am new to SecOps in general and am trying to be more efficient learning how to use stats and aggs along with combining multiple events. I am running into trouble fully understanding how to achieve exactly what I need. Does anyone have any documentation or resources that can be had to aide in this learning process?

Hi ,This is a question regarding JSON parser for SecOps.Let's suppose this the log :  {   "field1" => "value1"   "field2" => "value2"   "field3" => "value3"} Above is the usual trend. Now, we get a log like this :  {   "field1" => "value1"   "field3" => "value3"} field2 doesn’t exist here, on this the parser will fail and give the error “field2 not found in state data”.  For my parser, i do something like the following : json {        source => "json_data"        array_function => "split_columns"        on_error => "invalid_json"    }//Initiated JSON log.if ![invalid_json] {        json {            source => "json_data"            target => "parsed_json"        }         mutate {            gsub => ["json_da

Hello! We are working with the OOTB servicenow integration and are wondering what the best way  pull in information about change requests from a servicenow table? It is not an available ootb action currently but a common use case for working with Servicenow. 

I was working on SecOps parser update and encpuntered following error while pdating one of the parser:PLATFORM_ERROR: Smart Licensing has encountered an internal software error. Contact TAC: The platform provided UDI list has invalid values.This is preventing us from updating the parser and mapping it to the use cases. Has anyone encountered this and if yes how can we resolve this

Hello Everyone,While working with custom parsers and entity ingestion in Google SecOps, I have come across two related issues around Entity visibility and UDM field availability. I am outlining them below: 1. Delay in Entity Visibility I created a custom parser and ingested entities. The logs appear immediately in Raw Log Search, but the corresponding entities only become visible in UDM Search and Native Dashboards after almost a full day. I ensured that timestamp fields such as graph.metadata.interval.start_time and graph.metadata.collected_timestampare set to the current time. Interestingly: Entities ingested using the v2/entities:batchCreate endpoint (USER/ASSET) appear within minutes. However, when trying to ingest FILE type entities v

Hello Everyone,I am working on building native dashboards in Google SecOps and came across multiple issues related to global filters and drill-downs.1. Additional Field Filters for EntityI need to create a global filter on a native dashboard using graph.additional.fields["key"]. Has anyone been able to use Entity additional fields as filters in native dashboards? Example: graph.additional.fields["key"] = "value" 2. Time Range Filter Not Working as ExpectedI applied a global filter using graph.metadata.interval.start_time across all charts in a native dashboard. When applied, no data is returned. But when editing an individual panel and applying the same time range, data is shown correctly. 👉 Question: Does the panel time filter actually use graph.metadata.interval.start_t

Hi Community,I have ingested the two entity with same IOCs data at the same time with different severity level fields. The raw log search shows both entries, but in UDM Search, only the latest entry is visible. Is this expected behavior?What should happen when I ingest the same entity with different severity levels and different interval start times?Will both entries be visible in the dashboard, or will only the latest entity be visible?My concern is that when similar entities are ingested, only the latest entry should be visible in the dashboard. Do I need to use the window.last function if the latest entry is not being considered? Entity wit