Google Security Operations

we need to schedule the job to run everyday at 9 am which can be done using advance scheduling but as per document I could not find the Advance Scheduling option in Jobs. Document Link  

Hi Team,We’re currently using the Ingestion Metrics dashboard in Google SecOps, which provides visibility into log ingestion volume at the log source level. However, we're looking to break this down further and view ingestion metrics per individual Windows server that is sending logs.Is there a way to: Get ingestion metrics grouped by host/server (e.g., hostname or asset_id)? Possibly use a query in Log Exploration to achieve this granularity. Any guidance or sample queries would be greatly appreciated.Thanks in advance!Best Regards,Manoj Gowda J

Hi all, I’m having issues ingesting FortiNDR logs into Google SecOps using cfproduction docker forwarder here is the details: Any thoughts why this happen? 

There is a list of domains accessible via a website that I would like to ingest into my SOAR. How can I ingest these domains directly into SOAR without building something outside of SecOps (download, upload to cloud storage, ingest)?

we need to schedule the job to run everyday at 9 am which can be done using advance scheduling but as per document I could not find the Advance Scheduling option in Jobs. Document Link  

Hi AllHow fast is Google SecOps' Gemini Summary? When a case was first created and a summary is generated, the speed at which Gemini Summary is generated varies depending on the situation, ranging from as fast as 1 minute to over 5 minutes. Is this normal? How about others?Also, why does Gemini not generate a summary immediately when a case is created, but instead requires the user to click to perform the summary? If Gemini generated the summary immediately, we wouldn't have to worry about this. Regards. 

Hi everyone,I'm trying to send multiple alerts via a webhook to Chronicle SecOps and have them be grouped under the same case. However, when I use my job (see code below), even though both alerts are sent together and share common fields, they always end up in separate cases. import sysimport jsonimport requestsfrom urllib3.util import parse_urlfrom SiemplifyJob import SiemplifyJobfrom SiemplifyUtils import output_handler# ====================# Embedded Constants# ====================PROVIDER_NAME = "HTTP V2"INTEGRATION_NAME = "HTTPV2"API_REQUEST_METHODS_MAPPING = { "GET": "GET", "POST": "POST", "PUT": "PUT", "PATCH": "PATCH", "DELETE": "DELETE", "HEAD": "HEAD", "OPTIONS": "OPTIONS",}AUTH_METHOD = { "BASIC": "basic", "A

Hi Team ,How to write Yara-L rule to detect this . *    Unusual IP - This IP address has not or has rarely been seen in last 30 days.*    Unusual Geo - The IP address, city, country and ASN have not (or rarely) been seen in last 30 days.*    New user & New Device - A new user logs in from an IP address and geo location, and device   which are not expected to be seen in the last 30 days. 

Hi All,I have added the entity and executed the run AV scan action via SOAR. Im getting the below error Start processing entity MD-GJ######Entity MD-MJ0EZ440 is of unsupported type GENERICENTITY, skipping...Start processing entity MD-GJ######Failed to find machine ATP by MD-GJ###### entity with type ADDRESS----------------- Main - Finished -----------------Status: 0Result: trueOutput Message: Failed to find machine ATP by MD-GJ###### entity with type ADDRESS1 entities were not found in ATPAction completed successfullyunder which entity type i have to store the value is it in hostname?

Good Day,I am trying to write a parser extension for JUNIPER FIREWALL.  I am trying to map the field URL to target.url but when I try and validate the parser it fails with “failed to evaluate expression: generic::invalid_argument: \"domain\" not found in state data".  How do I get it to only match the extension when it sees this specific log type that the prebuilt parser doesn’t fully parse out. The raw log is as follows:Jul 28 17:58:46 test-01-abc-gw AB_UTM: WEBFILTER_URL_PERMITTED: WebFilter: ACTION="URL Permitted" source-zone="EPT-Workload-Zone" destination-zone="SL-PUBLIC" 1.1.1.1(35806)->2.2.2.2(443) SESSION_ID=206160582269 APPLICATION="SSL" NESTED-APPLICATION="UNKNOWN" CATEGORY="EPT-Cluster-Web-Profile" REASON="BY_USER_DEFINED" PROFILE="EPT-Cluster-Web-Profile" URL=test.connect.abc.com username N/A roles N/A application-sub-category Encryption urlcategory-risk 0 Parser Syntax is as follows:filter {muta

Hi team, Earlier, we used to send an email to the Google SecOps team for integration submission. However, we now see a new GitHub repository — https://github.com/chronicle/marketplace — being used for this process. We have observed that it contains a different project structure than what we get after exporting an integration from the SecOps instance. Is there a quicker way to convert that into a marketplace-ready integration structure? Any feedback is appreciated.@cmorris @f3rz ​ @ylandovskyy 

Users in certain organizational units (OUs) are able to sign in on their mobile devices and switch between their work and personal Google accounts without any issues. However, users in other OUs are encountering an error message that says, "Account switching unavailable."I’ve reviewed and compared settings onDevices\Chrome\Settings\ User & Browser and Devices Devices\Chrome\Apps & extensions Devices\Mobile & endpoints\Settings\Universal   I couldn’t find any differences. Do you have any suggestions on what else I should check?

Hi all,I'm looking for some clarity around the use and interpretation of the metadata.log_type and metadata.base_labels.log_types fields in Google SecOps / Chronicle UDM, particularly in relation to the log ingestion method and parser behaviour. The Standard Flow:When data (e.g., Windows Event Logs) is ingested via agents like BindPlane, Chronicle automatically detects the log source (e.g., WINEVTLOG) and uses the appropriate parser – in this case, Windows Event Parser. The parsed UDM ends up with fields such as:"metadata": { "logType": "WINEVTLOG", ... "baseLabels": { "logTypes": ["WINEVTLOG"] }}This makes sense – the original raw event (XML) is parsed and normalized, and the parser used is reflected

Hey there,I'm posting this hoping to find answers (and possibily a solution): In the last weeks I've been trying to upload IOC domains to SecOps using the method described here (https://medium.com/@thatsiemguy/ioc-matching-in-chronicle-siem-45a97c0b91a8) but I really can't get the POST request to work.Allow me to elaborate. I'm posting to the endpoint "https://malachiteingestion-pa.googleapis.com/v2/entities:batchCreate" (documented here https://cloud.google.com/chronicle/docs/reference/ingestion-api#createentities) and passing a hostname-valued entity as the article suggested but although the API request i

running kubernetes  on alpine linux  and implement  helm chart  for  testing  locally  for small basic app functionalities  is possible run on windows too 

When i was running AV scan on the machine in Microsoft defender via CSOAR. The action shows executed successfully but it is not reflected in defender. I checked the integration it was successful. I checked the other actions List alerts it is working as intended. Could you please help to fix this.Thank you!

I want to send Fortanix logs to SecOps using export filter. I think there is no direct export filter available for Fortanix. I don’t want to go in complex Pub/Sub & Webhook approaches. I am looking for a direct export filter approach. How to proceed with it? 

Hello Everyone,While integrating Palo Alto with Chronicle, I found a document from Palo Alto which states that the endpoint URL should be set as "https://malachiteingestion-pa.googleapis.com/v2/unstructuredlogentries:batchCreate" or according to region. My question is, by doing this, how do we specify the Log type? How will Chronicle identify that this is intended for Palo Alto Prisma Access logs or any other log type?Reference: https://docs.paloaltonetworks.com/strata-logging-service/administration/forward-logs/forward-logs-to-an-https-serverThanks in advance.Aravind Sreekumar

Hello. My company has recently adopted Google SecOps alongside our current ITSM tool in-which we use to conduct case management and handling. We would like to have SecOps automatically create and updates cases in our ITSM tool, however I don’t see any automated functionality to run things at case level.Could some advice be provided on how to move forward particularly with the following:Have cases created in ITSM when analyst change the case state to incident.  Have new alerts added to our ITSM when alerts are added to cases in secops with incidents already raised. Have new alerts removed to our ITSM when alerts are removed from cases in secops with incidents already raised.I already have actions and integrations for our ITSM that work for these purposes, but I now need a trigger to automate them which I cannot find in SecOps.

Hi,I have wrote a custom actions that gets attachments from the case wall and creates a html table, allowing the user to click a button to download the attachment. This had been working okay but we have now been experiencing this following error:  File "/opt/siemplify/siemplify_server/bin/Scripting/PythonSDK/SiemplifyBase.py", line 170, in validate_siemplify_error raise Exception("{0}: {1}".format(e, response.content))Exception: 500 Server Error: Internal Server Error for url: http://server:80/v1alpha/projects/project/locations/location/instances/instance/legacySdk:legacyAttachmentData?attachmentId=3157&format=snake: b'{"errorCode":2000,"errorMessage":"An error has occurred. Search for Log identifier c55c79701e3341e380d50c8167df02c9 in the Google Cloud Logs Explorer.","innerException":null,"innerExceptionType":null,"correlationId":"c55c79701e3341e380d50c8167df02c9"}'This is happening when callin

Hi Team,We need to retrieve the Gemini-generated report via API for each case as it is generated. Can we access this outside the platform, or can we export the generated results via API? Either option would work for us.

which playbook action can be used to change the case name in chronicle SOAR, there is only update case description I can find not the case update action

Hi,I’ve got a rule logic that has been working great for a while, but recently some of my hosts have been tagged with IPv6 addresses in the context/metadata. This may or may not be accurate (not sure where it’s come from yet) but it’s broken my alert rule logic, but not the search logic. this inconsistent behaviour is really confusing.Here is my (slightly redacted rule logic)    $e.metadata.log_type = "NIX_SYSTEM"    $e.metadata.event_type = "USER_LOGIN"    $e.network.application_protocol = "SSH"      $e.security_result.description = "Accepted password"    $e.target.user.userid in %Privileged_Accounts    not $e.principal.ip in cidr %Trusted_Jump_ServersIn the Search field this produces no results. But the same logic with no other qualifiers in the detection engine has ~10,000 hits so far today.The issue appears to be the final  “not $e.principal.ip in cidr %Trusted_Jump_Servers” which ignores SSH co

Hey all, I’ve noticed that the Microsoft Defender ATP SOAR Integration has “Create Isolate Machine Task” and accompanying unisolate machine task actions. However, these find the host directly from the alert. I want to be able to have isolate and unisolate actions that can take in a hostname/hostid as an input so that they can be ran ad-hoc. Any ideas?

Announcing the release of a simple SecOps API Wrapper SDK: https://pypi.org/project/secops/   now using the SecOps API is as easy as: pip install secops   from secops import SecOpsClient client = SecOpsClient() chronicle = client.chronicle( customer_id="your-chronicle-instance-id", project_id="your-project-id", region="us" )   Currently supported methods: UDM Search Stats Search CSV Export Entity Summaries Entity Summary from UDM Search List IOC Matches in Time Range Get Cases Get AlertsPlease let us know your feedback, and which other use cases you'd like to see supported.