Skip to main content

Google Security Operations

Your Security Operations conversation starts here. Ask questions. Share insights. Tell us what you've learned. Or tell us what you're working on. We want to hear about it!

  • 2,082 Topics
  • 6,589 Replies
2082 Topics
R
rahul7514Bronze 2
posted in Google Security Operations
Yara L help

I am trying to build the below YARA L rule and i am seeing the same IP triggering after every couple of hours , how can i suppress them to avoid duplicate ticket creation . events: $e.metadata.event_type = "NETWORK_CONNECTION" $e.metadata.vendor_name = "Check Point" $e.security_result.action != "BLOCK" ( $e.target.ip != "" and $e.target.ip != "0.0.0.0" and $e.target.ip in cidr %cidr_rfc_1918 and $dip = $e.target.ip ) and ($e.principal.ip != "" and $e.principal.ip != "0.0.0.0" and not $e.principal.ip in cidr %cidr_rfc_1918 and $sip = $e.principal.ip) $sip in %IOC_IP match: $sip over 60m  

02
jstoner
Staff
R
rahul7514Bronze 2
posted in Google Security Operations
Splunk to chronicle conversion

Hi TeamI have a Splunk query which i am trying to convert to Chronicle  Splunk Query | tstats summariesonly=true allow_old_summaries=true count as count values(Authentication.user) as user values(Authentication.dest_nt_domain) as dest_nt_domain values(Authentication.app) as app values(Authentication.src) as src values(Authentication.dest) as dest values(host) from datamodel="Authentication" WHERE nodename=Authentication.Successful_Authentication AND Authentication.app = win:remote AND ([ | inputlookup UCL-Monitored_Server_List | fields host | rename host AS Authentication.dest] OR [ | inputlookup UCL-Monitored_Server_List | fields ip | rename ip AS Authentication.dest]) AND ([ | inputlookup UCL-Monitored_Server_List | fields ip | rename ip AS Authentication.src] OR [ | inputlookup UCL-Monitored_Server_List | fields host | rename host AS Authentication.src]) AND NOT ([ | inputlookup UCL-Service_Account | fields domain, use

12
jstoner
Staff
S
suryanmenonNew Member
posted in Google Security Operations
Ingesting Proofpoint On Demand logs

Does anyone have experience ingesting PROOFPOINT_ON_DEMAND logs? I found this documentation for Proofpoint TAP and I see Proofpoint On Demand as another API ingestion option under SIEM feeds but couldn't find relevant documentation. The input parameters are also different for ON_DEMAND compared to TAP, so was wondering if anyone had done this before

41
mikewilusz
Staff
K
Khushboo14New Member
posted in Google Security Operations
Log Stoppage

Hi Team,Can someone help in understanding how we can monitor log stoppage from collectors/forwarders and webhook through GCP. 

01
mikewilusz
Staff
G
Greg_BammelNew Member
posted in Google Security Operations
When passing a event variable to a widget - is there any way to prevent it from deduplicating?

When passing a event variable to a widget - is there any way to prevent it from deduplicating. For example, I have event_names = "[Event.headline]".split(',') event_descriptions = "[Event.description]".split(',') event_product_name = "[Event.product_name]".split(',') However, since product name is a duplicate... I end up with less values in the list and their index doesn't correlate to the other lists. Bug?

05
P
M
Mufa_shahBronze 2
posted in Google Security Operations
graph.metadata.threat.threat_feed_name equivalent in secops for anonymous_vpn

Hi all,what would be the anonymous_vpn threat feed name equivalent in GCTI ?

21
hzmndt
Staff
R
rahul7514Bronze 2
posted in Google Security Operations
MFA alert

Hi Can someone tell me where i am going wrong , i getting this error  events: $event.metadata.product_event_type = "Update user" $event.metadata.log_type = "AZURE_AD_AUDIT" $event.principal.application = "Azure MFA StrongAuthenticationService" $targetuser = $event.target.user.userid ( $event.src.resource.attribute.labels["StrongAuthenticationMethod"] != "" and $event.src.resource.attribute.labels["StrongAuthenticationMethod"] = $OldRememberTrustedDevices and $NewRememberTrustedDevices = $event.target.resource.attribute.labels["StrongAuthenticationMethod"] ) or ( $event.src.resource.attribute.labels["StrongAuthenticationPhoneAppDetail"] != "" and $OldRememberTrustedPhone = $event.src.resource.attribute.labels["StrongAuthenticationPhoneAppDetail"] and $NewRememberTrustedPhone = $event.target.resource.attribute.labels["StrongAuthenticationPhoneAppDetai

23
jstoner
Staff
S
skadavBronze 5
posted in Google Security Operations
Where to find API list for SIEM

I am trying to find API list for SIEM but unable to get it.I have SOAR Swagger API, but not able to find SIEM. Please let me know if anyone has any idea.

33
A
I
ion_Bronze 2
posted in Google Security Operations
Slack Interactivity URL

HelloWe finally moved to SOAR and are experiencing an issue with our first integration. I've enabled the Slack integration to allow SOAR -> Slack communication, however, it appears that Slack -> SOAR won't work unless I provide slack with an interactivity URL. This makes perfect sense, however, I can't find a good reference to this in the documentation. I've tried our base secops instance URL as well as a webhook that I created on SOAR, neither worked.In my mind SOAR needs to host some code that catches these webhooks and give me a URL to configure in my slack app, is this correct? Alternatively, am I meant to self host the source code that is linked in the documentation and then put the URL I control into my slack app?Any help would be appreciated, it feels like i'm missing something obvious

1111
S
Staff
shubham8agar
shubham8agarNew Member
posted in Google Security Operations
What is the difference between Alert and Event inside a case ?

Google SecOps Chronicle SOAR, when using a custom connector, you can return a CaseInfo() or AlertInfo() object. If CaseInfo() is returned, it creates a case and may generate an event, which sometimes Chronicle treats as an alert.Can you clarify the following:When does Chronicle create an Alert versus an Event?What’s the difference between a Case, Alert, and Event?

43
S
Staff
K
kpmarquez_10Bronze 1
asked in Google Security Operations
Microsoft Intune Context

Can anyone share if you have existing ingestion of  Intune Context data, we do have the Microsoft Intune but its mostly an audit logs for provisioning, I was hoping that Intune Context can be a source for asset entity. If anyone has existing feed for Intune Context can you share how you did it? as currently there is no available default Third Party API. Thanks! 

01
hzmndt
Staff
P
preet_mehtaBronze 5
asked in Google Security Operations
How to enable Generative AI - Gemini Summary widget

Hello folks,In my SecOps instance, I do not see Gemini AI icon on the top-right corner of navbar.Also, in my Case view, I do not see Gemini Summary widget, as mentioned in the following document: https://cloud.google.com/chronicle/docs/soar/investigate/working-with-cases/using-the-gemini-case-summary-widgetIs there any way where I could enable this ?

52
P
JuLenny
JuLennyBronze 2
asked in Google Security Operations
Detection Rule Conditional Output

Hi,I'm trying to identify failed logins to our Linux servers and created a detection rule for that. Different servers yield slightly different messages that are stored in `metadata.description`. For example, one server would yield the following value: metadata.description = "Failed none for jlxx from 10.0.0.142 port 57835 ssh2" While another server would yield this value: metadata.description = "pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.0.0.142 user=jlxx" That's what I put in the `events` section of the rule, to capture both options:  events: $e.metadata.event_type = "STATUS_UPDATE" $e.metadata.product_event_type = "sshd" $e.metadata.product_name = "AuditD" $e.principal.namespace = "LAN" re.regex($e.metadata.description, `^Failed none for |^pam_unix(sshd:auth): authentication failure;`) But I'm struggling with creating the extraction of the relevant info (user & IP) in the `outcome`

04
JuLenny
yasinmnk
yasinmnkBronze 2
posted in Google Security Operations
JAMF_PRO

Hi,I am trying to ingest jamf-pro logs at the end i see this message:"Please Note,An API key is needed to complete feed setup. To generate an API key, go to the Google Cloud console: APIs & Services > CredentialsLearn how to set up API keys" after i create this API key where should i use it? Is there any related documentation for Jamf-pro connection. Thanks in advance.

24
hzmndt
Staff
O
otascNew Member
posted in Google Security Operations
Attach a playbook to all vulnerabilities cases

Hello everyone,I’m currently using the Jira integration to manage vulnerabilities. Is there a way to automatically attach a playbook to all cases with a specific tag? For example, I’d like to attach a playbook to all cases labeled with the “vulnerability” tag, and ensure that any new cases with this tag also have the playbook attached.

38
A
donkos
donkosNew Member
asked in Google Security Operations
Integration Update Redundancy - Export/Import Name Renaming

Hello all,One regular thing I have to do is update integrations and one risk mitigation I do is export the current integration before performing the update.What field in the exported json can I change so that the tenant does not produce this overwrite warning message on  reimport: 

18
P
T
tbankutiNew Member
posted in Google Security Operations
SentinelOne Cloud Funnel not working

Hi,We have some critical issue with the SendinelOne Cloud Funnel setup that supposed to be seamless. It is too seamless as not producing any data. Funnel is configured correctly towards a GCP bucket and we can search through Datalake, all validated. From SIEM side it is set as SentinelOne Singularity Cloud Funnel but there is no data coming in at all. Any hints ? Thanks

34
G
Staff
R
rahul7514Bronze 2
asked in Google Security Operations
Feed Changes

Hi TeamI have configured a Azure AD feed and provided a Asset namespace . For some reason i now want to change the Asset namespace , can i do it on the existing feed or i would have to create a new feed from scratch with same detail and disable the current one .reason why i am asking is i dont see any save option if i edit and make changes .

02
jstoner
Staff
E
erik314Bronze 3
asked in Google Security Operations
Ingestion dashboard in google instance

Hello everyone, I have a question about a dashboard that I found in a repository in git hub which measures the daily intake in GB for Google SIEM. My question is about the filters, what is the exact amount it measures including all sources and integrations, I have the Forwarder, Ingestion API, Out of Brand Processor option selected by default, additionally the Normalizer option is unchecked, if the framework increases my intake considerably, should the latter be selected for an exact measurement or is it not necessary?     

01
hzmndt
Staff
D
Staff
Dmitry_SarakeevStaff
posted in Google Security Operations
Changes to Google SecOps Exchange Integration for Exchange Online

Hi everyone, Following the earlier post on this subject, we want to additionally remind that the Google SecOps Exchange integration stops working with Exchange Online in February of 2025 due to the changes introduced by Microsoft. To avoid disruptions, migrate your Exchange Online workloads to the Microsoft Graph Mail integration at your earliest convenience.The Exchange integration for on-premise Exchange deployments remains unaffected. Additional information on the issue: In February of 2024, Microsoft released an announcement about the retirement of RBAC Application Impersonation in Exchange Online. According to the announcement, assigning the ApplicationImpersonation role in Exchange Online is blocked as of September of 2024, and the ApplicationImpersonation role will be completely removed from Exchange Online in February of 2025. This change directly affects the SecOps Exchange integration as it will stop working with Exchange Online and will be usable only with the Exchange on-pr

10
D
Staff
keso
kesoBronze 5
asked in Google Security Operations
Pub/sub Feed configuration

Hello! when configuring a pub/sub push feed [1], could the push subscription be located in a different GCP project where Chronicle is running?And, when configuring the push subscription and as it says in [2]: "Select Enable authentication, and select a service account."Which service account does Chronicle use? where can I find it?(when using Google Cloud Storage it gives the possibility to configure a service account but not when using pub/sub, as shown in the following images:     Thank you! [1] https://cloud.google.com/chronicle/docs/administration/feed-management#pubsub-push-create[2] https://cloud.google.com/chronicle/docs/administration/feed-management#specify-url-pubsub

51
hzmndt
Staff
donkos
donkosNew Member
posted in Google Security Operations
Connector Updates - Ontology Mapping

When updating an integration with connectors, you usually get warnings that the ontology mapping will change (and whether you want to keep the default one or accept the modified one).Is there anyway to figure out what the changes in event fields and the mapping rules before the integration change is made?

01
cmorris
Staff
V
vanitharaj1208Silver 2
asked in Google Security Operations
Playbook - send an attachment to mail

can we email case wall attachments ?i have json results , i have converted to csv and added to case wall as an attachment now i want to email that attachment is it possiible?

85
D
Staff
R
rahul7514Bronze 2
posted in Google Security Operations
Cyberint Integration

Hi  TeamCan someone help me and tell me which module of Cyberint are we integrating here .?https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/cyberint 

11
James_E
Staff
migueltubia
migueltubiaBronze 1
asked in Google Security Operations
Close Source alert while closing SOAR case

Hi,we have several sources of alerts integrated in the SOAR. We'd like that, when we close the case in the SOAR, we could automatically close the alert in the origin (like SIEM, MS Defender, etc.). We can execute a playbook manually but we'd like to automate this...As we cannot create a trigger for this in a playbook, do you know if we can create a job to check this every XX minutes/hours? Is this possible? Any idea?Thanks!M.

44
migueltubia

Badge winners

  • Authored Posts 1
    patelrdhas earned the badge Authored Posts 1
  • Authored Posts 10
    Rob_Phas earned the badge Authored Posts 10
  • Comments Posted 1
    sivahas earned the badge Comments Posted 1
  • Authored Posts 1
    sivahas earned the badge Authored Posts 1
  • Authored Posts 15
    TheSecOpsGuyhas earned the badge Authored Posts 15
Show all badges
Terms & ConditionsCookie settings
Privacy Policy Terms of Service Gen AI Policy Community Guidelines Cookie Settings

© 2025 Google. All rights reserved.