Skip to main content

Google Security Operations

Your Security Operations conversation starts here. Ask questions. Share insights. Tell us what you've learned. Or tell us what you're working on. We want to hear about it!

  • 2,083 Topics
  • 6,595 Replies
2084 Topics
J
Jay_TeeBronze 1
posted in Google Security Operations
ingest logs that are not supported

Hi Experts,Are we able to ingest logs that are not indicated in the log type?https://cloud.google.com/chronicle/docs/ingestion/parser-list/supported-default-parsers 

14
D
K
Khushboo14New Member
posted in Google Security Operations
Red Hat Openshift integration

Hi How can we integrate Red Hat OpenShift with Google Chronicle

23
D
P
preet_mehtaBronze 5
asked in Google Security Operations
Edit or Delete an Entity Insight

Hi folks,I have created an entity insight for an IP Address entity, if the enrichment process of IP finds it to be suspicious. However, later on, if the IP is marked as non-suspicious, I would like to delete this insight, or maybe edit it.Is this possible ? I could not find any action (via SDK, code, or even UI) that supports edit/delete action on entity insights.Thanks.

12
P
jansch
janschBronze 1
posted in Google Security Operations
Mapping Individual Users in GCP IAM

Hello everyone,One of our customers is encountering the following error message when accessing SecOps SIEM.We are using BYOID and following the setup guide from Chris Martin, see: https://medium.com/@thatsiemguy/linking-azure-idp-to-chronicle-secops-platform-ba649660d5fb For this particular customer, there is an added complication: they do not have an Azure Entra ID P1 license and therefore are not allowed to assign a group to the Enterprise Application. They can only authorize individual users for the Enterprise App.In GCP IAM, I mapped the Chronicle Viewer role to the following principal:  principalSet://iam.googleapis.com/locations/global/workforcePools/<WORKFORCE_POOL_ID>/attribute.userPrincipalName/<userPrincipalName>  Unfortunately, this does not seem to be working. Does anyone have any ideas?Thank you!

14
jansch
R
Roni11Bronze 2
posted in Google Security Operations
Chronicle forward alerts to QRadar

Hello,Can I forward all alerts from Chronicle to my on-premises SIEM QRadar?Thank you

01
M
Staff
T
TK421New Member
posted in Google Security Operations
No return contact from sales

@travisn  Hello, Like others have written here, I too have contacted sales numerous times via the online chat function with no response. I was able to get one person to email me, but when I replied with a few questions I never heard back. I really need to hear back from someone soon. I find the lack of follow through very concerning. Thank you

15
ErikaB
Community Manager
E
epselonNew Member
posted in Google Security Operations
Support for top-level array JSON structured messages?

Hello,We have a product that ships log messages to a file in a top level nested JSON array - example:[{"test": "testing","hostname":"hostname1"},{"test":"testing","hostname":"hostname2"}]We need a parser that can break out each individual event delimited by the comma to its own event.  The built-in JSON parser only recognizes JSON events individually it seems and does not recognize the top level array even though a top level array JSON is valid JSON.Please assist or point me to a good direction.  In Logstash we can use the "split" function to assist with this.

21
ionutm
Staff
yasinmnk
yasinmnkBronze 2
posted in Google Security Operations
Sentinelone alerts

Hi,  I am trying to ingest sentinelone alerts into secops but i got this message: "Error: INTERNAL_ERROR Unable to process the feed due to an internal error.What you can do?If the problem continues, contact Chronicle Support"what should i do in that case?@cmmartin_google 

11
T
Staff
L
lopesNew Member
asked in Google Security Operations
Rule Conditions

Some context here: I'm writing a detection rule to monitor the network connections and check if any of them match with IOCs. The thing is that I want this rule to trigger if:Is IOC and found any allowed network connections, ORIs IOC and found more than 2 blocked network connectionsWhat's the best approach here? I've tried to create 3 variables (misp, allow, block) with 2 placeholders (allowed, blocked) like this:  $allow.security_result.action = $allowed. With that, I built the condition like this: $ioc and (#allowed > 0 or #blocked > 2).I'm aware such conditions exist for like 1 IOC and 5 blocks in the time range but the rule doesn't trigger. Is there's another approach, like checking the security_result.action under the outcome section using any function? Any thoughts?

02
L
R
rahul7514Bronze 2
posted in Google Security Operations
Generic Question

Hi I am not sure if i am putting my question correctly here ,  Is it necessary to learn Chronicle Ingestion API , are there scenarios where normal integration method wont work and will have to adher to Chronicle Ingestion API , reason for asking this i am not good with coding and stuff .So just wanted to know if i should start learning python .Can we have a video based tutorial of a log ingestion via Chronicle Ingestion API ,explaining the steps ?

01
D
Staff
M
mercanNew Member
posted in Google Security Operations
Rule Creation

I'd like to create a rule from a dashboard tile. Is that possible? Could you provide me with more information on how to do this?

02
AymanC
keso
kesoBronze 5
asked in Google Security Operations
-Google Chronicle- Integration

Hey, when configuring the Google Chronicle Integration, the system requires a "User's Service Account". Please, where I can export it from? If I leave it empty (to use the default) the test fails 😞 (or how can I grant the necessary permissions? )The documentation [1] says:"Service account of the Google SecOps SIEM instance. Copy the entire service account JSON file."[1] https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/google-chronicle Thank you!!

35
dlove40
M
MarinusCBronze 2
posted in Google Security Operations
How to get SIEM IOC Matches into SOAR

Hello all, there is no current post regarding this topic, so I open a new post. Is there any chance to ingest the IOC Matches from Google SIEM into Google SOAR as a new alert / case. In the past I thought there was a connector function which allowed to directly create alerts based on the IOC Matches. Or are there anywhere public IOC Detection Rules, which are reporting exactly the IOC Matches.Thank you for your help.~Marinus

03
dlove40
0
0xRPCW-SecOpsBronze 1
asked in Google Security Operations
Multi Tenancy & Forwarder Labels

Greetings--Piggybacking on this post:https://www.googlecloudcommunity.com/gc/SOAR-Forum/Using-Environments-for-Multi-Tenancy/m-p/687636#M1977Are there any guides or syntax about how to link or associateForwarder Labels and Ingestion Labels and/or NameSpacesto their respective Environments to support a multi-tenancy deployment?e.g. I see in yaml:env: devAny advice is helpful.Thank you!!

02
dlove40
S
skadavBronze 5
posted in Google Security Operations
How to check Detailed Audit Logs for SOAR Playbooks

I'm trying to access detailed audit logs specifically for SOAR Playbooks. Currently, I can view the audit logs for SIEM rules using metadata.product_name = "Google Cloud Platform", but I'm unable to locate similar logs for SOAR Playbooks.Has anyone managed to find or configure audit logging specifically for SOAR Playbooks? 

34
D
Staff
R
rahul7514Bronze 2
posted in Google Security Operations
Metrics usage in Yara L

Hi TeamI am trying to replicate an alert that was built in Splunk .1) Use case is to check an anomaly in the SMB traffic . For this in Splunk we were using firewall traffic over port 139 and 445 and calculating the average and std dev between src and dest in a day and using the outlier concept which is if if traffic observed at a given point is above the (avg +2 std dev ) then an alert should trigger .can we built this alert in YARA L ?

02
R
R
rahul7514Bronze 2
posted in Google Security Operations
Oracle cloud with chronicle

Hi Can someone suggest how i can integrate oracle cloud with google chronicle? 

67
R
I
ironbeaztNew Member
posted in Google Security Operations
Virustotal on SIEM

Hi I would like to ask if its possible to use our VT enterprise api on siem, we want to use it for threat hunting on the logs being ingested into siem.Thanks.  

11
I
Staff
R
russell_pfeiferBronze 5
posted in Google Security Operations
IOC Hunt Using Chronicle Detection

Good morning--Over the years one of the concerns that our security team has had is around the use of "EDR bypass". If you're not familiar, EDR bypass is just as it sounds: hackers deploy tools to either turn off your Endpoint Detection and Response entirely or greatly diminish it's detection capabilities. Today I came across a post from a trusted partner with a host of EDR bypass IOC's. My question is two-fold:1. What is the efficacy / practicality of building out a custom detection using only IOC's ( mostly hashes and .exes) in Chronicle? Is detecting this type of activity better accomplished using our hunting platform?2. If building out a detection is the proper path, is it as easy as creating a list of the IOC's I'd like triggered on and then building the detecting to reference that list?Thank you in advance for any help your able to provide. 

66
R
V
vanitharaj1208Silver 2
posted in Google Security Operations
Alert description

How to update alert decryption using playbook/blocks i used tools- add/update alert - and passed json{"description": "test -updated description"}it showed -successand i used fetch original alert ... but i could see previous description How can i see the new updated description ?is there any other standard way of doing? 

08
S
R
rahul7514Bronze 2
asked in Google Security Operations
help with Query

Hi Has anyone experience this issue this field when copied or exported will show as security_result.action The challenge as a result is when i am writing the query in SIEM search  security_result.action != "QUARANTINE" the above logs (security_result[1].action[0]:"QUARANTINE") are not getting captured . If I type security_result[1].action[0] != "QUARANTINE" in SIEM search it throws error message . What should be the query in such cases ?

711
R
Prjct2501
Prjct2501New Member
posted in Google Security Operations
Time Chart: Requests per minute of Top 10 IPs

Hi all,I'm coming over from Splunk where this type of query would be pretty trivial, but I'm struggling to make it work in SecOps dashboards;I've read through this article about pivoting on data to create a basic time chart, but I'm not quite getting the data I want: https://www.googlecloudcommunity.com/gc/Community-Blog/New-to-Google-SecOps-Dashboarding-Using-Pivot-to-Create-a-Time/ba-p/735476I'd like to see the number of requests per minute of the 10 highest-volume IPs connecting to the network. So far I can easily make a "requests per minute by IP" chart, but it organizes the IPs numerically, (i.e 1.1.1.1, 1.1.1.2, 1.1.1.3, etc.) not by total count, even if I toggle the Count field to display in descending order. Anyone have any ideas? Thank you!

12
Prjct2501
V
vanitharaj1208Silver 2
posted in Google Security Operations
udm fields -start date and discovered date

start date vs discovered date ?

03
S
M
minkayaNew Member
posted in Google Security Operations
How to add workspace activity to Chronicle via 3rd party API?

Hi, I want to add workspace activity to Chronicle via Add feed --> 3rd party API and log type workspace Activities. However, I have some information but these are not completely fit to support documentation. https://us.v-cdn.net/6031969/uploads/editor/yi/awkiwyu7r61e.png

130
yasinmnk
R
rahul7514Bronze 2
posted in Google Security Operations
Cisco NDR with chronicle

HiCan someone suggest how i can integrate cisco NDR with chronicle?  

01
brodsky
Staff

Badge winners

  • Comments Posted 1
    CBMascarenhashas earned the badge Comments Posted 1
  • Comments Posted 150
    ylandovskyyhas earned the badge Comments Posted 150
  • Authored Posts 1
    patelrdhas earned the badge Authored Posts 1
  • Authored Posts 10
    Rob_Phas earned the badge Authored Posts 10
  • Comments Posted 1
    sivahas earned the badge Comments Posted 1
Show all badges
Terms & ConditionsCookie settings
Privacy Policy Terms of Service Gen AI Policy Community Guidelines Cookie Settings

© 2025 Google. All rights reserved.