Skip to main content

Google Security Operations

Your Security Operations conversation starts here. Ask questions. Share insights. Tell us what you've learned. Or tell us what you're working on. We want to hear about it!

  • 2,069 Topics
  • 6,579 Replies
2069 Topics
L
lschwertfegerNew Member
posted in Google Security Operations
SecOps Dashboard button hidden

On dashboard panels there is a three dot menu and an "explore from here" button in the top right. The "explore from here button" is not working, in the HTML code when inspecting the button it shows "display: none" and this code cannot be changed. The button will appear for a millisecond when hovering over the panel and then disappears, sometimes it stays put but disappears when you select it. Is this intentional or just a bug? 

03
L
V
VivekPuthanNew Member
posted in Google Security Operations
SOAR AWS WAF module

I integrated  AWS WAF response module with the default region as  us-central-1, for other region it is showing an error. I have integrated one AWS account  with this module and while executing action for example- List IP Sets. The module is only able to list CLOUDFRONT - IP sets only. But we have IP sets configures in eu-central-1.  When I give scope as regional - the module is not able to list regional IP sets in that acccount.  Some one please help if  something needs to be done on AWS side ? or anything needs to be done on SecOps side. 

06
V
E
erik314Bronze 3
asked in Google Security Operations
query on extracting data

I need to extract data that matches domains external to my organization. In this case, es@city-data.com but I would like to exclude others like yahoo gmail Expt among others. How could I do it? The logic example I'm trying to give is similar to this...... and not $w.network.email.from = "MyOrgantization@ .*"Rule Pishing_365{  meta:    author = ""    description = "pishing 365"    severity = "High"  events:    $w.metadata.product_name = "Office 365"    ($w.metadata.event_type = "EMAIL_UNCATEGORIZED" or $w.security_result.category = "MAIL_SPAM" and not $w.network.email.from = "MyOrgantization@ .*")    $w.security_result.category=$spammatch:    $spam over 1moutcome:    $spam_count = count($spam)  condition:    $w and $spam_count >= 1}

02
E
Rached1996
Rached1996Silver 1
asked in Google Security Operations
Transform data from GB to TB

Hello Community , actually i'm developping a dashboard to visualise licence usage and the value in my dashboard is shown in GB How i can transform the results in TB ?Thank you 

02
Rached1996
GaurangPatel
GaurangPatelBronze 1
posted in Google Security Operations
How to Display the Latest Record for Each ID in SIEM Dashboards

Hi team,I am building a dashboard to show the top detections. For this, I am creating a table view with columns for detection title and counts. It's pretty simple—I have used the detection title and the product log id with count measure to achieve this. However, I am facing an issue.Let's say, for product log id = 1, the title is abc. After some time, a new record gets ingested with the same product log id = 1 but with the title xyz. With the current approach, I get two rows: abc, 1 and xyz, 1. However, I only need xyz, 1, as it is the latest record.In summary, I want to deduplicate the product log id by selecting only the most recently ingested record for each ID. Is this possible? If yes, please let me know how.Thankscc: jstoner 

03
AymanC
A
abisec94New Member
posted in Google Security Operations
Fine-tunning Regex

Hello All,facing issue to finetunn ssh.exe from the below udm filed kindly share me with proper resolution principal.resource.attribute.labels.value !=about.labels.key = "AdditionalFields"about.labels.value = "{\\"HostName\\*********":\\"\\",\\"NetBiosName\\":******\\"\\",\\"OSFamily\\":\\"Windows\\",\\"OSVersion\\":\\"10.0\\",\\"IsDomainJoined\\":false,\\"RemediationProviders\\":[{\\"RemediationState\\":\\"Active\\",\\"RemediationDate\\":\\"2025-01-20T15:12:39.1178618Z\\",\\"Type\\":\\"remediation-provider\\"}],\\"LastRemediationState\\":\\"Active\\",\\"ThreatAnalysisSummary\\":[{\\"AnalyzersResult\\":[],\\"Verdict\\":\\"Suspicious\\",\\"AnalysisDate\\":\\"2025-01-20T15:12:39.1178618Z\\"}],\\"LastVerdict\\":\\"Suspicious\\",\\"Asset\\":true,\\"DetailedRoles\\":[\\"PrimaryDevice\\"],\\"RbacScopes\\":{\\"ScopesPerType\\":{\\"MachineGroupIds\\":{\\"Mode\\":\\"Any\\",\\"Scopes\\":[\\"794\\"]},\\"Workloads\\":{\\"Mode\\":\\"All\\",\\"Scopes\\":[\\"Mdatp\\"]}}},\\"Type\\":\\"host\\",\\

04
AymanC
N
n0lmesBronze 1
asked in Google Security Operations
Data Parsing unstructured JSON message field / UDM mapping

Very new to parsing in SecOps - looking to understand the best approach when dealing with JSON structured data that requires parsing / GROK with the jsonPayload.message section. Here is an example log:{"insertId": "id","jsonPayload": {"facility": "local7","message": "random unstructured data I am wanting to parse to UDM - could contain User, source and Dest IP etc. ","source_timestamp": "1999-01-31T12:59:59+00:00","sysloghost": "syslog_host","syslogip": "syslog_ip"},"labels": {"cloud.region": "gcp_region","first_observed_timestamp": "1999-01-31T12:59:59Z","host.name": "source_hostname","last_observed_timestamp": "1999-01-31T12:59:59Z","log.file.name": "my_log_filename","log.file.path": "my_log_path","log_count": "1"},"logName": "gcp_log_filename_path","receiveTimestamp": "1999-01-31T12:59:59","resource": {"labels": {"location": "gcp_region","namespace": "","node_id": "host_node_id","project_id": "gcp_project"},"type": "generic_node"},"severity": "INFO","timestamp": "1999-01-31T12:

12
N
H
harshwardhan16New Member
asked in Google Security Operations
Assistance Needed with Custom Parser Issues in Google Security Operations

Hi all,I am new to Google Security Operations and am trying to create a custom parser but facing issues in two cases. Can anyone help me with this?1. Problem:I am attempting to parse the following data to UDM, but I am unable to loop through this data and print it, as it does not have a parent object.sample input[{"info": "STRING"},{"info": "STRING"}]2. Problem:I have data that contains coordinates, and I am trying to map it to the region_coordinates field, which has a map type structure.Sample input:"location": { "coordinates": [ -84.6350721252, 33.8159259083, 0.0 ], "type": "Point" },Code I tried:The following code is not producing any response, and when I try with some other code, it throws an error for mapping:for index, phoneNumber in location.coordinates {mutate {convert => {"index" => "string""phoneNumber" => "string"}}mutate {replace => {"phoneNumber_label" => ""}}mutate {replace => {"phoneNumber_label.value" => "%{phoneNumber}"}on_error => "phoneNumber_

713
rajukg11
Staff
A
anurag.q.singhBronze 2
posted in Google Security Operations
Parser Extension not working

I have written a simple parser extension for a specific log type which was coming as unparsed.Parser Extension : filter {  mutate {        replace => {            "raw_Event" => ""            "vendor_name" => "Palo Alto Networks"            "event.idm.read_only_udm.metadata.event_type" => "GENERIC_EVENT"        }    }    grok {        match => {            "message" => ["%{GREEDYDATA:raw_Event}"]        }        overwrite => ["raw_Event"]        on_error => "grok_failed"    }      if [raw_Event] != "" {    mutate {        replace => {            "raw_Event_label.value.string_value" => "%{raw_Event}"  &n

42
suzhuang
Staff
mogriffs
mogriffsBronze 1
posted in Google Security Operations
Using Entity Graph for dynamic mappings?

I have a question about the Entity Graph, and specifically whether I can customise it and use it for non-default purposes? Here is a simple use case I’d like to know if it’s possible and if so how I can go about it.We log information about customer activity. Customers have an ID, but they also have multiple accounts, each with their own Account ID. Some events have only customer ID, or only account ID, while other events will record both CID and AID.I would like to create a mapping in the Graph that is updated automatically when Chronicle sees a log with both IDs, such that when a log with only one of the IDs is seen, it can be enriched with the missing data. So if the log only has CID, then it is enriched with all known AIDs from the Graph, and when it has just an AID, it is enriched with the parent CID from the Graph.Is this possible?

01
rajukg11
Staff
A
anurag.q.singhBronze 2
posted in Google Security Operations
How to use drop in parser

So I have a problemThis is a sample log which I want to be dropped. So if the [message] contains <13>Feb 8 17:53:21 10.45.1.9 CEF:0|ArcSight|ArcSight|8.4.3.9181.0|agent:045|File processing ended: Success|Low| eventId=72362662 start=1739017401162 end=1739017401162 mrt=1739017401162so if the [message] contains agent:045 or agent:044, I want the whole log to be dropped.How can I do this?This is my parser :filter {    mutate {        replace => {            "src" => ""            "dhost" => ""            "src_present" => "false"            "dhost_present" => "false"            "status" => ""            "event.idm.read_only_udm.metadata.vendor_name" => "Indusface"            "event.idm.read_only_udm.metadata.product_na

01
rajukg11
Staff
R
russell_pfeiferBronze 5
posted in Google Security Operations
View License Utilization with a SecOps Search?

Good morning --Today I was trying to view how much of our current SecOps license we are using and, interestingly, wasn't able to locate the information in any of our dashboards. There are a few articles out there about how you can enable a license utilization dashboard but I was wondering if anyone had a way within search that this information could be displayed? I was able to do it easily within Splunk 🙂Thanks in advance

52
R
jaymin
jayminBronze 5
posted in Google Security Operations
How to create an action with predefined widget attached to it.

Hi everyone,I have a requirement where a predefined widget should be automatically attached to the case wall whenever a specific action is executed.I came across the SOAR documentation, which mentions that VirusTotal actions provide predefined widgets (Reference Link). I’m looking for a similar implementation.Does anyone know how can i create such predefined widgets and link them to custom actions? Any insights or guidance would be greatly appreciated!Thanks!

32
TomAtGoogle
Staff
C
citrenoBronze 1
posted in Google Security Operations
Workspace connector limitation for EDU Editions

Hi team,It has come to our attention that the Workspace Integration only works with Workspace Enterprise and Enterprise+ edition per the docs. We have a client with Workspace Education + which is the highest tier of Education tiers and yet the integration doesn't appear at all, both in SecOps(which is strange) but also in Workspace. Is this something that can be considered for some EDU editions, to our understanding the EDU editions are somewhat parallel to the enterprise editions in capabilities, so I wonder if this is intentional or not? It appears our only other alternative is Gmail to BQ to GCS to Secops, is that accurate and then use the WORKSPACE_ACTIVITY feeds for the activity logs. Is that accurate? Is there anything we can do to request an expansion into the EDU editions, at least the higher ones. 

02
C
ar3diu
ar3diuBronze 2
asked in Google Security Operations
Notifications for closed SOAR cases

Is there a builtin method/job to automatically send email notifications when a SOAR Case is closed?

05
S
Staff
G
GonFreecssNew Member
posted in Google Security Operations
Python Logging Level in Siemplify

Is there a way to set the logging level via a Job/Action (e.g., INFO, DEBUG, ERROR, etc.)?I understand this convention, but if I don't want to log debug messages, how can I set the level? Thanks!siemplify.LOGGER.debug(output_message)siemplify.LOGGER.info(output_message)  

28
S
Staff
V
vanitharaj1208Silver 2
posted in Google Security Operations
How to Create new case [from existing 2 cases with IOC or Combine 2 cases ] is it possible ?

How create new cases based on information coming from multiple connectors, such as Mandiant and Exchange, with each connector providing different IOCs And then, within those cases, have specific playbooks run based on the IOCs pulled from each connector? 

22
S
Staff
G
grace01New Member
asked in Google Security Operations
No Raw Event Data for Webhook Ingested event

I am trying to ingest alerts from Akamai via webhook. There is alert data, but there is no event data that comes through on the alert, and when I look in the ontology to view the "raw event data", there isn't any. Has anyone else encountered this issue with webhooks and know how to resolve?

03
S
Staff
sarahhhh20
sarahhhh20New Member
posted in Google Security Operations
App State Directory Paths in SOAR

What would be the path for app state directory in soar? When Im creating a file or diler in /tmp/siem use case using an action, where can I find the full file path to access this file/folder? 

02
S
Staff
V
vanitharaj1208Silver 2
asked in Google Security Operations
Alert Grouping

Hi All,In Chronicle Soar,3 different Alerts from falcon have been grouped into a single casenote: grouping condition defined is if all entities match then all only it should group But what happened  is that alerts are being grouped together even when not all entities meet the specified grouping conditions, which require all entities to match.Question: Why are these alerts being grouped into a case when not all entities are matching?  

211
S
Staff
P
preet_mehtaBronze 5
asked in Google Security Operations
Alerts created in SecOps SIEM are present in SecOps SOAR ?

Hi folks,Needed a clarification about a scenario.I have a SecOps instance consisting of both: SIEM and SOAR capabilities.If an alert is generated using custom rules in SecOps SIEM, then will it be visible in the SOAR platform as well (under Case name: {rule_name}) ?As per my understanding, currently, to see all the alerts created in SIEM, into SOAR, we must use the Google Chronicle integration's connector that would fetch the detections and create cases and alerts.Let me know what is the correct behaviour.Thanks.

83
S
Staff
M
mccrilbSilver 2
asked in Google Security Operations
Case Filters are Broken

Instead of each user seeing their filters. users now see all the filters.Since that just started today when I logged in I assume it was some change put in last night 

02
M
A
anurag.q.singhBronze 2
asked in Google Security Operations
Need Assistance with Custom Parser

filter {  mutate {        replace => {            "raw_Event" => ""            "src" => ""            "StatusCode" => ""            "AttackURI" => ""            "AttackData" => ""            "UserAgent" => ""            "dhost" => ""            "act" => ""            "requestMethod" => ""            "event.idm.read_only_udm.metadata.vendor_name" => "Indusface"            "event.idm.read_only_udm.metadata.product_name" => "WAF"            "event.idm.read_only_udm.metadata.event_type" => "NETWORK_CONNECTION"        }    }  grok {  &

11
bsalvatore
S
samryanturnerBronze 5
asked in Google Security Operations
'panic encountered: non-string given for securityresult.description'

I have the following parser code - # Security Result if [severity] == "INFO" { mutate { replace => { "security_result_action" => "ALLOW" "security_result_description" => "SUCCESS" } } } However when previewing it's output I see the following error - generic::unknown: pipeline.ParseLogEntry failed: LOG_PARSING_CBN_ERROR: "generic::invalid_argument: failed to convert raw output to events: failed to convert raw message 0: field \\"idm\\": index 0: recursive rawDataToProto failed: field \\"read_only_udm\\": index 0: recursive rawDataToProto failed: field \\"security_result\\": index 0: recursive rawDataToProto failed: panic encountered: non-string given for backstory.SecurityResult.description: []interface {} []interface {}{\\"SUCCESS\\"}"Why is this not being interpreted as a string?

09
S
ar3diu
ar3diuBronze 2
asked in Google Security Operations
Crowdstrike Detections Connector doesn't collect detections triggered from OnDemand Scans

Has anyone else encountered the same issue?

75
ar3diu

Badge winners

Show all badges
Terms & ConditionsCookie settings
Privacy Policy Terms of Service Gen AI Policy Community Guidelines Cookie Settings

© 2025 Google. All rights reserved.