Skip to main content

Google Security Operations

Your Security Operations conversation starts here. Ask questions. Share insights. Tell us what you've learned. Or tell us what you're working on. We want to hear about it!

  • 2,076 Topics
  • 6,583 Replies
2076 Topics
jeff_bryner
jeff_brynerNew Member
asked in Google Security Operations
CaseSearchEverything not returning any data

Is there something that needs to be turned on to allow the SOAR CaseSearchEverything endpoint to return data? We have cases and I can get other SOAR api endpoints to work. This one returns success but never any data even within the swagger UI. Here's how I'm calling it.  

05
jeff_bryner
P
preet_mehtaBronze 5
posted in Google Security Operations
How does an alert gets its name in SecOps SIEM

Hey folks,I have a rule that generates alerts if some log matches the conditions mentioned in the rule. However, when the alert is generated, it shows the name "[n/a]", as mentioned in the screenshot. Can someone explain why does this happen, and what steps should be taken for adding a name to the generated alert.

27
P
Rached1996
Rached1996Silver 1
asked in Google Security Operations
Forwarder audit logs

Hello community , how i can identify forwarder logs in the audit logs ?thanks in advance

18
A
Staff
M
MagnusKNew Member
posted in Google Security Operations
Chronicle integration with GCP

Hi All,So i m newbie who earlier worked as blue teamer.I was recently moved to enginerring side where i have been tasked to do integration of project with infra completely on gcp and they want to move most of their application logs to chronicle. Can you help me understand where to start. I have gone through the documentation and it v good but i dont know where to start

12
A
Staff
A
Anonymous
asked in Google Security Operations
Log types getting mixed up

Hi,I have configured my BindPlane agents to collect logs from the Windows Security Events, Microsoft-Windows-PowerShell/Operational, and Sysmon channels. For each log source, I have specified the log type in the processor configuration as per the documentation.I have set up three different ports on the destination, with each port designated to receive a specific log type. Logs are being sent and received on all three ports as expected.However, in Google SecOps, when I search for logs from the Microsoft-Windows-PowerShell/Operational channel, I observe that some logs are incorrectly categorized as Windows Events log type instead of PowerShell log type. This issue does not occur for all logs; some logs from the PowerShell channel are correctly written as the PowerShell log type, while others are misclassified as Sysmon or Windows Events or misclassified as Powershell when its Windows Events etc.My forwarder is configured to listen 20 different log types, and this issue only occurs with B

23
A
Staff
V
vanitharaj1208Silver 2
asked in Google Security Operations
Issue with IsFavorite Parameter Not Being Reflected in API response (add attachment)

We are using the /external/v1/cases/AddEvidence/ endpoint to add evidence as an attachment to a case. Despite passing IsImportant: true in the request body, the isFavorite field in the API response always returns false. 

015
D
Staff
J
james2526New Member
asked in Google Security Operations
Issues with Efficiently Managing Multipart Uploads via Google Cloud Storage API

Hello Everyone,I’m working on integrating Google Cloud Storage for a project requiring large file uploads (several GBs), and I’m encountering some challenges with multipart uploads using the Cloud Storage API.Here are the key issues I’m facing:If an upload is interrupted, is there an optimal way to resume from the last uploaded part? The API documentation mentions resumable uploads, but I’m unsure how to combine that effectively with multipart uploads for maximum reliability.I often need to attach metadata to the files, but with high-volume uploads, managing this through the API seems inefficient. Is there a way to batch metadata assignments or streamline this process?When uploading files over 10GB, I occasionally encounter timeout errors even with appropriate retry logic. should I adjust existing timeout configurations?Looking for your expert opinions.

01
D
Staff
J
JewlesNew Member
asked in Google Security Operations
Google SecOps Recovery from API outage

I was told by our implementor that Google SecOps pulls logs from a source API every 15 minutes, and if the source goes down or there is some issue with the API connection that prevents logs from being pulled, they are lost, and there is no way for Google SecOps to retrieve them after the connection is restored. This doesn't sound right to me. Is there a way to pull missed logs assuming the source still has them available? 

02
J
R
rrazdanNew Member
posted in Google Security Operations
How to sort an array in YARA-L outcome section?

Hey Folks, Happy Holidays !!!I am trying to look for a way to sort an array of integers in increasing order in the outcome section of my rule. The reason to do that is to specifically look for an indexed value which can only be found when the array is sorted in the increasing order.My outcome section looks something like this and I am looking to sort the $Session_Diff array$Session_Diff = array($NextLoginTime - $PreviousLogoffTime)$Deltas = arrays.size($Session_Diff)$count_previous_events = count_distinct($previous.metadata.event_timestamp.seconds)$count_events = $count_previous_events + 1$pointer = $count_events - 2$final_result = arrays.index_to_int($Session_Diff, $pointer) Thanks in advance.

42
rajukg11
Staff
L
Laxmikant_NagarNew Member
posted in Google Security Operations
Virustotal enrich list of IP's

Hi,I have got a list of IP's which was accesed by a process and was enriched with a block and now wanted to check if they are suspicious.Is there a any way where i can give the list of IP's ( may be in a loop ) and verify if suspicious or not.Regards,Laxmikant

23
S
Staff
O
OmskirtBronze 2
asked in Google Security Operations
Else if condition SecOps

Hi, right now I'm practicing how to use "else if," but I sometimes get confused about how to use the parentheses. Could you provide me with any resources to help me better understand the "else if" condition? It just confuses me. Also, do you have any resources to easily understand regex, aside from Regex101?

52
O
Chris_B
Chris_BBronze 5
asked in Google Security Operations
metadata.event_type = "NETWORK_FLOW"

Hi all and happy new year!I'm playing around with my network logs and was puzzled to find we don't have any metadata.event_type = "NETWORK_FLOW" logs - at tleaset not according to SIEM 🙂 I understood we  have firewall logs and logs from our routers so I expected to see flow also. Would anyone offer which type of logs they see  metadata.event_type = "NETWORK_FLOW" logs in so I can narrow my efforts in examining raw etc.? thanks!

03
R
Staff
A
anurag.q.singhBronze 2
posted in Google Security Operations
Json parser

  { "AccountId": "741448936891", "Arn": "arn:aws:guardduty:ap-south-1:741448936891:detector/66ca0946c7dfd299da283198338550ee/finding/34ca0cfb393882ceadb00e62be29dfc0", "CreatedAt": "2024-12-30T23:46:09.137Z", "Description": "AWS CloudTrail trail arn:aws:cloudtrail:ap-south-1:741448936891:trail/sample_test was disabled by anurag-aws-learn-new calling StopLogging under unusual circumstances. This can be attackers attempt to cover their tracks by eliminating any trace of activity performed while they accessed your account.", "Id": "34ca0cfb393882ceadb00e62be29dfc0", "Partition": "aws", "Region": "ap-south-1", "Resource": { "AccessKeyDetails": { "AccessKeyId": "ASIA2ZIOM5W5QMW3FGAP", "PrincipalId": "741448936891", "UserName": "anurag-aws-learn-new", "UserType": "Root" }, "ResourceType": "AccessKey" }, "SchemaVersion": "2.0", "Service": { "Action": { "ActionType": "AWS_API_CALL", "AwsApiCallAction": {

01
cmmartin_google
Staff
Rached1996
Rached1996Silver 1
asked in Google Security Operations
Chronicle Audit Logs

Hello , I want to know if there is any possibility to view internal audit logs of chronicle ( login , modifications on parsers , rules modifications etc ... ) Thank you in advance

13
cmmartin_google
Staff
N
Naama12New Member
posted in Google Security Operations
view curated detection

Hi,I’m trying to see if I can get a list of all the curated detections I’ve created so far. I’d like to review the types of alerts I have so I can write custom rules that aren’t built-in.I tried searching for them in the SIEM search, but since the detections aren’t part of the events themselves, I couldn’t locate them. Additionally, the alerts on cases were turned off until now, so I couldn’t find them in the SOAR search either.Could you please help me with this?Thank you!

33
hzmndt
Staff
M
MorganGNew Member
posted in Google Security Operations
Cyberark privileged cloud

Has anyone done the log ingestion for CyberArk privileged cloud? Looking at the CyberArk's documentation you need a custom translator file. Has anyone else found another way to get these logs? or know of a XSL file that is publicly available?Cyberark Doc: https://docs.cyberark.com/privilege-cloud-standard/Latest/en/Content/Privilege%20Cloud/privCloud-connect-siem.htm 

13
M
A
Aswin_AsokanBronze 4
asked in Google Security Operations
Remote Agents Environments

We have Remote agents already running for specific environments. We need to share the existing agent between environments (i.e) Agent deployed for Development environment with Testing Environment. Currently there is no option to edit the existing agent to include additional environment. Should we deploy new agent altogether and configure instances aftermath.The reason behind having the agent to be shared between environments is we will be connecting to the same 3rd party services/apps in both cases.

21
kentphelps
Staff
A
Aswin_AsokanBronze 4
asked in Google Security Operations
SOAR Community Edition - Access

Unable to reach the SOAR Community Edition Access request page - https://chronicle.security/soar-free-edition/. Seems like it has moved to different domain. The above URL resolves to Google Cloud SecOps SOAR page.Can anyone please share the link to request access?Also, Is there a Slack Channel for Google SecOps?

15
S
Staff
hzmndt
Staff
hzmndtStaff
posted in Google Security Operations
Chronicle Security Operations has been rebranded to Google Security Operations

April 25, 2024 Chronicle Security Operations (Chronicle SecOps) has been rebranded to Google Security Operations (Google SecOps). Both the logo and the platform name have been rebranded as part of this change. This rebranding reflects our commitment to bringing you the best of Google security operations features. There is no change to functionality in the platform. https://cloud.google.com/chronicle/docs/secops/release-notes

174
apskarthick
A
Aravind3Bronze 2
asked in Google Security Operations
Log type for AWS EC2 and Lambda

Hi Everyone,I'm not able to find the log type 'AWS_EC2_HOSTS' when trying to do a webhook integration with Google Secops. Also is there a log type to integrate AWS lambda. To just store the metric datas for AWS Lambda functions? Thanks a bunch in advance,Aravind Sreekumar

12
A
A
AJMSecOpsNew Member
posted in Google Security Operations
Ingestion API Use Case

What are the most appropriate use cases for using the Ingestion API for log ingestion? I have a few SaaS applications (e.g. Trellix Email Security) that I am looking to onboard via the Ingestion API, with working test code. 

11
rajukg11
Staff
A
anurag.q.singhBronze 2
posted in Google Security Operations
Regex

So I am writing a yaraL rule and I am stuck with a problem.I want to write a regex to capture the domain part of a url. For example : For https://www.example.com/path, it captures example.comFor http://example.org, it captures example.orgFor subdomain.example.co.uk/path, it captures subdomain.example.co.ukmy regex for this is : $domain = re.capture($e.any_variable, " (?:https?:\\/\\/)?(?:www\\.)?([^\\/\\s]+) ")The error I am getting here is : tokenizing: unable to tokenize: invalid char escapeCan somebody help me with this. @AymanC  @jstoner  

12
jstoner
Staff
A
Aravind3Bronze 2
posted in Google Security Operations
Ping action in Secops SOAR

Heyy Everyone,I'm working on creating a custom integration for Copilot. However, I'm encountering an issue where I can't save a custom action for "Ping".Could anyone help me understand what I might be doing wrong?Note:This is just for testing, not a use case. 

25
A
F
fbaumgarNew Member
asked in Google Security Operations
Calculating days until date in Yara-L Rule

I’d like to create a rule that matches if the date mentioned in an event field falls within the next 7 days. I’ve noticed various timestamp functions, but I’m not sure how to calculate the timestamp from dates other than those stored in event metadata. Below is the regex capture of the date available in the event:   $expiry = re.capture($e.metadata.description, ".*will expire on (\\\\d{4}/\\\\d{2}/\\\\d{2})") // $expiry = "2025/01/22"  Appreciate ideas how to calculate the time diff... 

14
jstoner
Staff
A
Aswin_AsokanBronze 4
asked in Google Security Operations
Dynamic Case Name and Severity

We have onboarded alerts from a 3rd party security product in SIEM. We have a single detection rule which monitors those events and creates cases in SOAR. By default the case name and severity is assigned as rule name and severity (meta section) in the detection rule.The events from the security product contain different kind of alerts and associated severitu and extracted those values in security.event fields and we have mapped to outcomes section as below,detection.outcomes.rule_detection and detection.outcomes.severityDoes SecOps having the capability to dynamically  assign the case name and severity based on the field values in outcomes section rather than the default values provided in YARA-L rule?

02
C

Badge winners

Show all badges
Terms & ConditionsCookie settings
Privacy Policy Terms of Service Gen AI Policy Community Guidelines Cookie Settings

© 2025 Google. All rights reserved.