Google Security Operations

JIRA Sync Comment is not working from JIRA to SOAR, any comment updated on the JIRA end by the client is not visible at the case wall. Also, as per the integration a Jira tag is supposed to get added automatically post the incident creation, this is not working as well.Could anyone guide on the troubleshooting approach to be taken to fix this.

In SecOps, I want to use file utilities, where my use case is to create file, add custom data to file and add file to case wall. Need to automate all this process using playbook.

Hello,Is there any library or sdk for Golang that allows using the Ingestion API to send data to SecOps? Similar to the SDK Wrapper for Python.The only thing I found is this repo but does not seem to have all this possibilities to send logs and UDM data. https://github.com/googleapis/google-cloud-go/tree/main/chronicleThank you

 What is the source grouping identifier in the Alerts Grouping settings?

Hello, I've noticed through my dashboard that some windows assets (domain controllers) stopped sending logs to secops?What is the best way to get notified in this case without using dashboards ? This can be done on GCP and create alerting based on hostname ? Thanks.

Hi All,I have Observed that case.id value is passing wrong while creating an incident in ServiceNow in simulator mode while testing.Actual Case id is 10062 but  it passing as 10064.... it is happening in simulator mode 

Hey community,I'm evaluating High Availability (HA) scenarios for Google SecOps. Specifically, I'm exploring the following points:Chronicle Forwarders: Is it feasible to have two forwarders configured for automatic failover without a load balancer, or is a load balancer (VIP + health checks) mandatory?BindPlane Collectors: Given this emerging technology, what's the optimal practice? Can we reliably set them up as active/active, relying on Google's internal deduplication? Is there a better recommended approach?Our team understands the theory, but we haven't validated this practically yet. I'd appreciate any experiences, lessons learned, or recommendations on the best practices for achieving optimal HA.Thanks in advance! 

Hello! I'm trying to use source_grouping_identifier to drive alert grouping in SOAR. There's a relevant post here, and the SOAR documentation is here.The field is showing on the SOAR UI, but SOAR is creating a separate case for each alert rather than grouping them into the same case.  Has anyone had any success using source_grouping_identifier to drive alert grouping? The config seems pretty simple, so I'm not sure what I'm doing wrong. A screenshot of my grouping config is attached. Thanks much!

I have created a Job in SecOps that closes an incident in Microsoft Defender after certain conditions are met:When I go to the incident in Microsoft Defender, I can see that the incident was closed correctly with falsePositive:However, nothing appears written in the marked box of the following image:Am I doing this correctly with the comment? Or is that box filled in another way? And can I fill it through the Job?Any help will be apreciated! 

hello folks!Hope you guys are doing good. playing with the Jobs scheduler especially on the Close Cases Based On Search Tool, working on it, I realized there is two mandatory input fields on them.mandatory ones are  - Siemplify Username, Password I'm wondering where should I get this credential - from the google support folks ?Thanks!

Hello All,I am trying to integrate O365 and Intune using the documentaiton from:https://www.googlecloudcommunity.com/gc/Community-Blog/New-to-Google-SecOps-Integrating-Entra-ID-and-Office-365-Using/ba-p/775343https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/microsoft-intunehttps://www.googlecloudcommunity.com/gc/Community-Blog/New-to-Google-SecOps-Integrating-Entra-ID-and-Office-365-Using/ba-p/775297

Hi Team,I am new to the Chronicle. I am collecting the logs from paloalto firewall using the bindplane server and able to see the logs in Secops but the logs are not getting parsed . I used the log type as "PAN_FIREWALL" in the processor configuration and the logs are in the LEEF Format.Please advise what mistake I am doing here.ThanksJoe   

Use case is as follows; Playbook to update a Google Chronicle reference list in the SIEM with data from an external DB to keep the SIEM reference list up to date. It should run once per day to track specific user/device exclusions for a playbook that blocks user access.Issues:We do not want to manually track the exclusions/duration for many users. It doesn't scale. Currently we do not see a way to trigger an update/pull from our exclusion list on a time based frequency. 

Hello,Is it advisable to install the SAOR remote agent on a machine located in the DMZ? The intent is for the remote agent to communicate with the on-premises QRadar instance.

Does Google perform any checks or limit the libraries that can be imported in the libraries prompt via free text entry? I believe its connected to pip so it would be theoretically possible to import malicious libraries?

Hello , i'm actually developping a dashboard based on yara-l which contains a data table i'm seeng this error : compilation error compiling query: validating query: data tables are not enabled for this query: invalid argumentwe cannot use data tables in preview dashboars ? if i'm not wrong ?

Hi Team,Could you please provide guidance on how we can begin training to create a custom parser?I have gone through below documentation, any other documenation will be helpful.https://cloud.google.com/chronicle/docs/reference/parser-syntax

Hello everyone,I'm reaching out to see if anyone has encountered similar challenges or has insights to share regarding monitoring and alerting on the health of log ingestion in Google SecOps.Here's a bit of context: We've set up a Cloud Function that queries our BigQuery table for information related to Google SecOps ingestion. We then import this data using the event import API : 

Hello,I get this error with my rule which is not surprising at all: validating intermediate representation: event variables are not all joined by equalities, the joined groups are: (ioc), (network) my rule:rule IOC_In_Forti { meta: ... priority = "Critical" events: $network.principal.ip = $srcip not net.ip_in_range_cidr($network.principal.ip, "10.0.0.0/24") not net.ip_in_range_cidr($network.principal.ip, "172.16.0.0/12") not net.ip_in_range_cidr($network.principal.ip, "192.168.0.0/16") $network.security_result.action_details = "accept" $network.metadata.log_type ="FORTINET_FIREWALL" $network.target.hostname = $hostname $srcip in %MaliciousIPs or $srcip in %MaliciousIPs2 or $srcip in %MaliciousIPs3 $ioc.graph.metadata.product_name = "ALIENVAULT_OTX" $ioc.graph.entity.ip = $srcip match: $hostname over 24h condition: $network and $ioc } I want

HelloDo you know if it's possible to get current user information in playbooks ?I know that there is a key named "General.CurrentUserFullName" but this seems to not work as expected.For example, I would use the information on which user is currently logged in, as a condition in a playbook.Thank you very much.

Next week is our first Launch week at Bindplane, where we are unveiling new features daily. Many of these will be directly applicable to SecOps use cases, especially:  New Sources and Destinations Processing — drop-in bundles that cut config time to minutes.Daily Drop Schedule (all times ET)10:30am: Blog post + short demo video for that day’s release11:00am: Live Q&A stream with the engineering teamWhat to ExpectMonday: Telemetry Routing — new ways to move data from any source to any destination.Tuesday: Custom Collectors — build & run OpenTelemetry your way.Wednesday: Scale — think order-of-magnitude, not incremental, growth.Thursday: Processing — drop-in bundles that cut config time to minutes.

Hello, I'm actually developing a dashboard for monitoring feeds ingestion metrics  (ingested through webhook) , but i'm not getting any results ( this problem is for all webhook feeds ) What is the best solution please ? or this is not handled by Google right now ) The Query used : ingestion.component = "Out-of-band processor"ingestion.log_type = "ZSCALER_xxx"$date = timestamp.get_date(ingestion.end_time)$logtype = ingestion.log_typematch:$date, $logtypeoutcome:$log_count_sum = sum(ingestion.log_count)order:$date desc 

Hello everyone Looking for guidance on detecting potential data exfiltration to external (USB/removable) drives. Has anyone built a YARA rule for identifying such activityOpen to examples or best practices for monitoring file transfers to removable media.thanks in advance

Hey community,I have just started to implement a SOAR for below scenario and seeking advice on the same.Obviously phishing emails do also contains images or buttons that takes us to a malicious URL. Now in my case, the URL is not directly malicious rather a captcha that if you solve will then take you to a malicious URL. I am thinking of if there's a way to command Secops SOAR to further check on a URL extracted from Image by solving captcha by itself?I also need help to get the right parser for URL extraction from the image. Current, all I see is just domain. 

My Google Chronicle integration is fairly behind - I am looking to update but one of the versions explicitly mentions there being an ontology mapping change in the release notes - I have been trying to compare the existing mapping rules with the ones provided by support for the newest version - there seems to be a fairly big difference in the entity rules themselves (different event types) - how should one do a comparison between the rules present in different versions?