Skip to main content

Google Security Operations

Your Security Operations conversation starts here. Ask questions. Share insights. Tell us what you've learned. Or tell us what you're working on. We want to hear about it!

  • 2,069 Topics
  • 6,579 Replies
2069 Topics
D
deep0x00Bronze 1
asked in Google Security Operations
Question on Performance and Efficiency of "Delay Playbook v2" in High-Load Scenarios

Hello Everyone,I am considering the implementation of "Delay Playbook v2" to manage SLA requirements in my project. Before proceeding, I would like to gain insights into its resource consumption and overall efficiency.Specifically, I am curious about:The resource demands when deploying "Delay Playbook v2."Its performance when running 100 playbooks concurrently.Any experiences, benchmarks, or recommendations you can share would be greatly appreciated.Thank you in advance for your assistance!

15
D
T
tayvionpNew Member
asked in Google Security Operations
Entity Graph Data in BQ

I’ve been working with Google Chronicle’s Entity Graph and querying the associated data that has been exported to BigQuery. However, I’ve encountered a few challenges and would appreciate some guidance:Null Data: While querying the entity graph table in BigQuery, I noticed that a significant portion of the fields are returning NULL. Is this expected behavior? Are there certain configurations or ingestion processes I need to verify to ensure the data is complete?IOC IP Addresses: I’ve been trying to query for specific IP addresses (Indicators of Compromise) within the entity graph data, but I’m unable to locate them effectively. Specifically, I used the following query: Unfortunately, this query isn’t returning the expected results. Does the entity graph in BigQuery contain IPs or other IOC data directly?Relationship Data: One of the key strengths of the Entity Graph in Google SecOps (Chronicle) is its ability to map relationships between entities like users, IPs, devices

02
rajukg11
Staff
keso
kesoBronze 5
posted in Google Security Operations
Current status of MISP integration

Hello community! there are a lot of posts about the MISP integration and also a lot of updates in SecOps. I wanted to know, to this date, how can I ingest MISP data to chronicle?  Would be enough following [1]? Is the BindPlane/Collection agent necessary to ingest the data? what is the difference between the collection agent and the MISP integration [2]? Could you summarise what is required to do the ingestion? Thank you! [1] https://medium.com/@thatsiemguy/misp-bindplane-and-google-secops-262f48f9bdbd[2] https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/misp 

110
J
V
vanitharaj1208Silver 2
asked in Google Security Operations
Template Engine

Hi All, I'm trying to display who is enrichment result and this code works and displays itBut twice How to display it once and iterate using Entity.Identifier 

112
V
ahnna
Staff
ahnnaStaff
posted in Google Security Operations
Google SecOps Gets a Vertex AI Boost

Heads up, Google SecOps users! A new Vertex AI integration is now available in the Google SecOps Marketplace. This powerful addition lets you use Google's AI platform, Vertex AI and models, to create custom response actions and meet enrichment needs, boosting your team's efficiency. Key use cases include executing playbook prompts, suspicious email analysis, data transformation, and entity descriptions. Learn more in the full announcement here.

00
ahnna
Staff
V
venu_kilariNew Member
asked in Google Security Operations
Created a integration in SOAR swagger API

I created an integration in my SOAR instance using the following Swagger endpoint:api/external/v1/integrations/CreateIntegrationInstance.It returned a 200 success response, but the integration is not reflected in my SOAR instance. Could you help me troubleshoot this?

05
V
S
shrut_2025Bronze 1
posted in Google Security Operations
Cannot edit in read mode

Hi all,I'm trying to create a custom action for "trend vision one" integration in soar. It is supposed to fetch details through API but when i'm trying to test it, getting error "Custom action name" not found as it is not getting imported from constants module. I have to add action name in constants module, but it's in read mode only. Can anyone help me in solving this one?#constants module ide#trend "get alert details" custom action errorThanks a lot in advanceShruti 

01
N
A
anurag.q.singhBronze 2
posted in Google Security Operations
Error in parsing

So I havce written a parser.It's a custom parser.filter {  mutate {        replace => {             "raw_Event" => ""               }    }    grok {        match => {            "message" => ["%{GREEDYDATA:raw_Event}"]        }        overwrite => ["raw_Event"]        on_error => "grok_failed"    }      if "raw_Event" != "" {    mutate {        replace => {          "additional_fields.key" => "raw_Event"          "additional_fields.value.string_value" => "%{message}"        }    merge => {        "event1.idm.read_only_udm.additional.fields" => "additional_fields"      }

05
bsalvatore
C
ccg95Bronze 1
asked in Google Security Operations
Add alerts from Microsoft ATP incident to a Case

Hi,I'm using the Microsoft ATP connector to fetch incidents from the tenant and create a case for each incidents.Incidents in Microsoft Defender have one or more alerts related, which are aggregated by Defender to create the incident. When the case is created on the SOAR, it doesn't include all the related alerts to the incident. The MS ATP integration has one action for playbook which is "ListAlerts", that would return a JSON with all the related alerts and their info (this is working fine).My question now is how can I add those alerts to the Case, below the "Alerts" section. I have been trying different actions but none of them seems to work.Am I missing something here or do I need to develop the action myself?Thanks!

08
ylandovskyy
Staff
Tonio
TonioBronze 5
posted in Google Security Operations
Chronicle Forwarder "strconv.Atoi: parsing" error

Dear all, This is not really a question, but rather a memento, waiting for an official fix to be rolled out, for those of you who have ever hit your head, as has happened to me over the past few months, with the following problem when sending logs via CF.Scenario: you have just set up a new log type to send via CF, which you have done several times, no big deal. Only the logs don't make it into the DB, you look for them in the SecOps UI but there is no trace of them. You then decide to give it some time and wait a while.When you came back a some hours later you find that all your logs are being delayed, arriving 30min/1 hr late. What the on earth happened??After some investigation you find the Forwarder docker log (“docker logs --since=60m cfps”) full of error messages like:E0917 07:40:40.287215 489 syslog.go:545] strconv.Atoi: parsing "8205337b-7ff5-4a3e-8e29-1250c8c74701,": invalid syntax. You also notice that the actual original log (within double quotes) is reported

12
G
K
KoifmanNew Member
posted in Google Security Operations
Working with risk analytics metrics - first time unique combination of user/country in past 30 days

Hi all!I am trying to create a rule that alerts if for the past 30 days, a unique combination of user/country is seen for the first time. This is what I came up with so far: events: $selection.metadata.vendor_name = "Okta" $selection.metadata.event_type = "USER_LOGIN" $selection.security_result.detection_fields["legacyEventType"] = "core.user_auth.login_success" $userid = $selection.target.user.userid $country = $selection.principal.ip_geo_artifact.location.country_or_region match: $userid, $country over 1d outcome: $first_seen_today = max(metrics.auth_attempts_success( period:1h, window:today, metric:first_seen, agg:max, target.user.userid:$userid)) $first_seen_monthly = max(metrics.auth_attempts_success( period:1d, window:30d, metric:first_seen, agg:max, target.user.userid:$userid)) The problem begins when I add "principal.ip_geo_artifact.location.country_or_region:$country" to $first_seen_today and $first_see

24
K
O
olivacris98New Member
posted in Google Security Operations
Job with conectors

Is it possible to create a job and after executing it can connect to a connector and create a manual alert?In such a way that we can have a relationship between them?I am not using a specific connector like crowdstrike or chronicle, just creating alerts based on a manual connector made by me? no apisIn this way we can observe a job that only queries the cases of a specific tag and if they bring information, an alert is created. I would appreciate your response¡Thank you! 

11
K
Staff
ahnna
Staff
ahnnaStaff
posted in Google Security Operations
Check out what's new in Google SecOps from Q4, 2024

In the fourth quarter of 2024, Google Security Operations focused on empowering security teams with the capabilities to visualize, analyze, and act with confidence through our new native dashboards. But that's not all. We’ve rolled out a host of key enhancements including: Gemini Digital Threat Monitoring Alert Summarization New Search in Google Threat Intelligence Threat Profile Recommendation and Customization Enhancements (Preview) New Native Dashboards Expanded Regional Support Public Sector Achievements Managed Defense Curated Detections Preview Support To access the details of our Q4 additions to Google Security Operations, visit this announcement. To find a comprehensive list of recent Google Security Operations Release Notes/Changes, go here.

00
ahnna
Staff
ahnna
Staff
ahnnaStaff
posted in Google Security Operations
Check out what's new in Google SecOps from Q4, 2024

In the fourth quarter of 2024, Google Security Operations focused on empowering security teams with the capabilities to visualize, analyze, and act with confidence through our new native dashboards. But that's not all. We’ve rolled out a host of key enhancements including: Gemini Digital Threat Monitoring Alert Summarization New Search in Google Threat Intelligence Threat Profile Recommendation and Customization Enhancements (Preview) New Native Dashboards Expanded Regional Support Public Sector Achievements Managed Defense Curated Detections Preview Support To access the details of our Q4 additions to Google Security Operations, visit this announcement. To find a comprehensive list of recent Google Security Operations Release Notes/Changes, go here.

00
ahnna
Staff
Rached1996
Rached1996Silver 1
asked in Google Security Operations
Parser update

Hello , Please can someone tell me a best practices to avoid updates that can ruin my parsers.For exemple i have done some modification on a existing parser , and i received a new update and i want to make sure that the update does not ruin my modifications on the parser.Best regards.

04
cmorris
Staff
A
Aravind3Bronze 2
posted in Google Security Operations
Bug in Raw Log Search

Hey everyone,Is anyone else encountering the following bug in Google SecOps raw log search? I’m unable to perform raw log searches as well!! 

02
AymanC
sudeep_singh
sudeep_singhBronze 1
posted in Google Security Operations
File based integration with Google SecOps via Forwarder

Hi All,We are trying to integrate file based logs into secops (FilePath: /opt/logs/audit.log).When we verify the forwarder logs, we are getting no such file found as the error.Kindly suggest the solution for this issue.

16
A
S
srijankafleBronze 2
posted in Google Security Operations
Finding Unparsed events

Hi,What is the best way to field unparsed events ingested in SecOps SIEM without it being a pain. I have so far been searching for raw log with regex and using Procedural Filtering for individual log source until I collect few hundreds and then try to work on parser extension. This has been painful and a lot of manual task and chances of missing unparsed event is high for us (considering the volume of data we ingest and search result capping the returned events to x result (10,000 default) I believe there should be a way for searching for just unparsed logs so that we have better visibility of what we are missing out on. 

53
S
T
Tejaswini139Bronze 1
posted in Google Security Operations
Iterate through json output of table(rows and columns) resulted from query

Hi team,I want to run "Execute custom query" from Microsoft365Defender Integration. query is:EmailEvents | where Subject contains "testvalue".This query returns result table which has rows and columns in json format.for example,row1 {col1:val1, col2:val2,..}, row2{col1:val1, col2:val2,..},row...DeliveryLocation is one of the column names from the json result.I need to check whether DeliveryLocation=Inbox/folder and for each row where this condition is met, should remediate those mails accordingly.I exported the json result of this action and imported it in the IDE for this integration.How can I iterate through each row from json result and fetch DeliveryLocation. In the placeholder of the condition, check for DeliveryLocation and remediate particular emails in every row where DeliveryLocation=Inbox/folder.Thanks,Tejaswini  

43
K
Staff
O
OmskirtBronze 2
posted in Google Security Operations
Native Dashboard

Is there any other option or workaround that we can do to export native dashboard that have been created? 

01
jstoner
Staff
V
vedprakash_20New Member
posted in Google Security Operations
Need to know the limition of chronicle ingestionapi

as per the documentation (https://cloud.google.com/chronicle/docs/reference/ingestion-api), here all i can see the limitation of payload should not increase more than 1MB and when i send 2-3k log lines(size is approx 21kb ) then the ingestion api is not throughing any error but i can see only 1000 log lines in chronicle and when i send them in a batch of 1000 then i'm able to ingest them all properly.is this some new limitation ? 

11
raybrian
Staff
S
smit8New Member
posted in Google Security Operations
Extension Overwrite

I have proxy logs that are mapping the wrong ip to target.ip for my environment. If I create an extension that overwrites the target.ip mapping, do I need to worry about any other fields changing (ex. conditional mappings based on target.ip from the parser)? I understand any fields enriched based on target.ip will change

01
raybrian
Staff
S
samryanturnerBronze 5
asked in Google Security Operations
Workload Identity Federation and Gmail SOAR Integration

Looking to reduce the amount of service account keys being used for services in SecOps. I see that the Gmail integration supports Workload Identity Federation with Domain Wide Delegated associated service accounts.Has anyone got this setup successfully? If so, how are you going about securing that service account/conditions on the WIF pool?

45
S
R
rmrkNew Member
asked in Google Security Operations
SIEM alerts to slack

Hi!Is there, and what's the best way of getting the alerts out of Google SecOps SIEM alerts section to Slack for a notification whenever an alert is created based on rulesets?I've wondered through the API but couldn't find anything specific I could use and there is no integration for that as far as I know built in as well.

33
R
L
LazyBeanNew Member
posted in Google Security Operations
How to Separate Timeout and Decline Flows in Approval Links?

Hi,I have a use case where an IP address is blocked based on the button clicked by the end user in an approval link. If the user declines, the playbook ends.However, I also need to add a timeout that sends a follow-up email to the user. The problem is that both "decline" and "timeout" currently behave the same way in my flow.Is there a way to separate these two flows so that the timeout triggers a different path from the decline?I've attached an image of my current setup for better understanding. Any guidance would be appreciated! 

01
cmorris
Staff

Badge winners

Show all badges
Terms & ConditionsCookie settings
Privacy Policy Terms of Service Gen AI Policy Community Guidelines Cookie Settings

© 2025 Google. All rights reserved.