Skip to main content

Google Security Operations

Your Security Operations conversation starts here. Ask questions. Share insights. Tell us what you've learned. Or tell us what you're working on. We want to hear about it!

  • 2,089 Topics
  • 6,615 Replies
2090 Topics
ORBR
ORBRBronze 5
posted in Google Security Operations
Is it possible to get a notification based on my Role?

Hi everyone,I’ve enabled user notifications in the notification settings (both for notifications and email alerts on case assignments).However, I only receive notifications when a case is specifically assigned to me, but not when a case is assigned to my role.Is there a way to configure it so that everyone assigned to a specific role receives a notification?

13
messier63
dnyaneshwar
dnyaneshwarBronze 5
asked in Google Security Operations
Automating EDR Alerts with a Custom List in SOAR

Hello Security Community Members,I hope you’re all doing well!We are currently working on improving our Endpoint Detection and Response process. We want to use manual analysis for some events or alerts and add summaries of false positive hash values to a custom list for future reference.The idea is that if we encounter the same event with the same hash value in the future, we’d like to pull that analysis from our custom list instead of doing the manual work all over again.I’m looking for some guidance on how to set this up in our SOAR playbook. Specifically:How can we configure the playbook to first check the custom list when an alert is triggered?What’s the best way to implement the logic that allows us to either reference the analysis from the custom list or continue with our normal incident response process? (but first look into custom list)Are there specific conditions we should use to make this work smoothly?I’d appreciate any tips or examples from anyone who has done something si

04
dnyaneshwar
R
rahul7514Bronze 2
asked in Google Security Operations
Increase priority of an alert

There are 20 Critical assets, if there are any alerts for these hosts, it has to been responded with priority compared to others. How can we implement this? In  simple terms how can i have dynamic priority for chronicle alerts based on criticality of the host , can some one help me with a simple example @jstoner  @cmmartin_google :Any suggestions or guidance

43
R
K
krunalmNew Member
posted in Google Security Operations
How can we grab a specific field and its value from an unparsed JSON ingested from source tools?

How can we grab a specific field and its value from an unparsed JSON ingested from source tools? I'm attaching an example unparsed JSON here and I need to grab the value of the field "LastMessageRcptCount" (which is 117). Thank you! {"f3u":"DLITTLE@Null.COM","ev":"DLITTLE@Null.COM","rs":"EmailSendingLimitExceeded;InternalRecipientCountToday=3;ExternalRecipientCountToday=1;ExceedingLimitType=External;Last MessagetraceId=Null;LastMessageRcptCount=117;CIP=Null;AS:45002","adt":"Generated by OBP2SenderRepService - Object Store: 1535;SpamRule=45002;","evnt":"Listed","ts":"2023-06-05T15:36:00.0000000Z","te":"2023-06-05T15:37:00.0000000Z","op":"EmailSendingLimitExceeded","wl":"SecurityComplianceCenter","tid":"Null","tdc":"1","reid":"Null","rid":"Null","cid&

110
F
Staff
L
leodasBronze 1
posted in Google Security Operations
Bangalore: Chronicle SIEM + SOAR Partner Technical Training

Hello,I recently came across past events that are conducted by google cloud security,Title : Bangalore: Chronicle SIEM + SOAR Partner Technical Training is there any recordings available for these sessions ? or when will it happen again in India ? or any virtual trainings available ?can someone suggest me some good learning resources for Secops other than cloudboost and the official documentation ?thanks for your help.

57
L
vanitharaj1208
vanitharaj1208Silver 2
asked in Google Security Operations
what is the Max number or limit of number overflow cases that can be created once rule is triggered?

what is the Max number or limit of number overflow cases with 100 alerts per case .. and rule triggered 10,000 alerts within 24 hours .so 30 alerts in normal cases and will it created 100 overflow cases? just want to know what is the limit ..

23
D
Staff
J
jscNew Member
asked in Google Security Operations
Filter incoming logs

Hi, we want to filter out some fields in the incoming raw logs from AWS cloudtrail. Is there an option that we can configure somewhere like this ?

02
J
N
NEIOBronze 3
asked in Google Security Operations
Optimizing the rule Recon activity

Hi Team,I require assistance with fine-tuning the rule: ["recon activity detected from internal host"] to minimize false positives and optimize its performance. Your support in this matter would be greatly appreciated.PFA. rule recon_activity_detected_from_internal_host{  meta:     subject = "recon activity detected from internal host"     description = "This rule is to identify instances where a local host initiates port scan against single internal IP over at least 50 different port or port sweep against more than 99 internal IP address over same port. Port scanning activities within the internal network may indicates that adversary attempting to identify vulnerable services on target systems after gaining an initial foothold on the network."     tactic = "Discovery"     technique = "Network Service Scanning"     subtechnique = ""     tool = ""     datasource = "Network

48
N
M
Mufa_shahBronze 2
posted in Google Security Operations
Splunk function equivalent Yara L

Hi All,Good morning ,I am trying to convert Splunk rules which uses complex functions and thier equivalent YARA L or other way for approach.Splunk Syntax | rex max_match=0 "(\\s+)foreach\\s*\\((?<foreach_clause>.*?)\\)\\s*\\{(?<foreach_loop>.*?\\\\\\r\\\\\\n\\1)\\}"| rex field=foreach_loop max_match=0 "(\\s+)foreach\\s*\\((?<foreach_clause>.*?)\\)\\s*\\{(?<foreach_loop>.*?)\\\\\\r\\\\\\n\\1\\}"| search foreach_loop=""*Add-content*""I think max_match cannot be achieved in Chronicle as of now.  How to approach this?  

42
M
A
Aravind3Bronze 2
asked in Google Security Operations
Info Needed: Playbook Environment

Hello Team,Could anyone please let me know if its possible to import a playbook to anyother environment other than default?And, Is it possible to change the environment of a deployed playbook?Thank you in advance,Aravind Sreekumar

33
A
pontorieroa
pontorieroaNew Member
asked in Google Security Operations
SecOps - Incident Manager Deprecated

Hi, I am looking into the SecOps platform and seen that the incident manager will be deprecated in 2025. is there a replacing tool introduced instead?Thanks,

21
D
Staff
vanitharaj1208
vanitharaj1208Silver 2
posted in Google Security Operations
Alert Grouping -Overflow case

if alert grouping criteria is set toGrouping Condition: XYZ Rule Name and UserOverflow Condition: Max 100 AlertsGrouping Duration: 24 hoursEvent Breakdown:9:30 AM - 50 Alerts for User ABC30 Alerts moved to Case XYZ20 Alerts moved to Overflow CaseBalance for Overflow: 809:45 AM - 50 Alerts for User ABCAll 50 Alerts moved to Overflow CaseBalance for Overflow: 3010:00 AM - 10 Alerts for User ABCAll 10 Alerts moved to Overflow CaseBalance for Overflow: 2010:15 AM - 500 Alerts for User ABC20 Alerts moved to Overflow CaseOverflow threshold exceededBalance for Overflow: 0Remaining Alerts: 480Question:What happens to the remaining 480 alerts when the overflow threshold is exceeded? How does the system handle these alerts, and what are the possible actions taken?

210
vanitharaj1208
vanitharaj1208
vanitharaj1208Silver 2
posted in Google Security Operations
How to set a padding period for the connector?

 A delay can occur between the time that Google SecOps SIEM indexes an alert and when indexing completes. To mitigate the risk of missing alerts, set a padding period for the connector. Additionally, increase the connector timeout. A significant padding period can negatively impact connector performance.https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/google-chronicle#overview 

04
vanitharaj1208
R
rahul7514Bronze 2
posted in Google Security Operations
VT feeds not working

Hi With regards to Google Chronicle, I do have a doubt and would like to know if anyone can assist or guide me .Is Virus total available with Google Secops by default or is there a separate cost involved ?Based on the below diag I was able to use the GCTI TOR Feeds and wish to use the VT if its availableI can see entity summary . I wish to use this information in my alerts . However when i am running the query it showing 0 results       

01
mikewilusz
Staff
ORBR
ORBRBronze 5
posted in Google Security Operations
Similar cases Predefined widget does not work

The predefined widget for Siemplify_Get Similar Cases doesn`t seem to work at all.I mean I do see the table headlines, And I do see that there are actual similar cases in the action results. But the table is empty.Does anyone else face this issue? 

04
ORBR
T
Staff
TonyHStaff
asked in Google Security Operations
Changes to Exchange Online from Microsoft

Hello Everyone, Quick note if you are currently using the Exchange Integration for SOAR. Per Microsoft "Today we are announcing that we will begin blocking the assignment of the ApplicationImpersonation role in Exchange Online to accounts starting in May 2024, and that in February 2025, we will completely remove this role and its feature set from Exchange Online." So starting in May of 2024, you will be unable to assign the ApplicationImpersonation role in Microsoft Exchange Online. For details of the changes that Microsoft is making to the ApplicationImpersonation role, see Retirement of RBAC Application Impersonation in Exchange Online. We recommend that you use Microsoft Graph Mail to work with Exchange Online. Documentation has been updated to warn of this change here

15
C
kaushalpatel
kaushalpatelNew Member
posted in Google Security Operations
Cloud SQL - Unusual Data Activity

what are the main events that can be used to detect following kind of unusual activity ?Unusual Data Transfer like copying large data outside the instanceAny sql queries that export or copy the data from unauthorized users or ips 

26
A
Staff
donkos
donkosNew Member
posted in Google Security Operations
Convert from UDM Search JSON Result to CSV

I'd like to convert the JSON result from a UDM Search into a csv string. The current issue I'm having is that if I just specify JsonResult|"udm.events", then the csv sheet seems to merge all the sections into one big single row blob - would be curious to see some suggestions without using some custom action code.

43
A
Staff
Z
ZorghostBronze 5
posted in Google Security Operations
issues and unable to override network.application_protocol for APIGEE X logs

There is something suspicious regarding the network.application_protocol udm field:Everyt time I try to override the default Apigee X field mapping for this field I receive the following error when I test the parser extension: No UDM events or entities were generated for the current parser configuration. if this is not intended, rectify the code snippet/UDM mappings and then click preview.According to the statedump, I am confident that the following parser extension logic shoud be working fine:filter { mutate { replace => { "jsonPayload.headers.x-forwarded-proto" => "" } } json { source => "message" array_function => "split_columns" on_error => "_not_json" } if [_not_json] { drop { tag => "TAG_MALFORMED_MESSAGE" } } else { if [jsonPayload][headers][x-forwarded-proto] != "" { if [jsonPayload][headers][x-forwarded-proto] in [ "http","https", "ssh", "

01
A
Staff
Omskirt
OmskirtBronze 2
posted in Google Security Operations
If else then

Can we use if else then in outcome section in Native dashboard like working the hours. I’m getting on this. if (timestamp.get_hour($timestamp, "UTC") >= 1 and timestamp.get_hour($timestamp, "UTC") < 17, 50) 

02
Omskirt
R
rahul7514Bronze 2
posted in Google Security Operations
help with Query

HiUpon checking the IOC tab i can see Mandiant Open Source Intelligence feeds , how can i call these feeds when trying to build a YARA L rule ,i want to create an alert where traffic towards these IOC's that are allowed needs to trigger an alert  and send it to SOAR .error is this Also i can see this info from entity summary using Virus total , does that mean i can use this info in building YARA L . I am not sure if we have enterprise edition of VT or not ?  

05
JensW
matthewnichols
Community Manager
matthewnicholsCommunity Manager
posted in Google Security Operations
Online Event - Mastering SecOps Detections

SecOps enthusiasts! Wanted to let you know about an upcoming online event Oct 16 & 17 that we just posted on our Events page,  Mastering Google SecOps Detections. If putting curated detections to work, how they can be modified, and how to write your own detections is of any interest to you, then mark this on your calendar and come check it out. Let's see if we can help solve any problems you're running into today. Also, they'll explore the role of AI in optimizing detection capabilities. See you all there!     

00
matthewnichols
Community Manager
keso
kesoBronze 5
posted in Google Security Operations
Understanding how to interact with cases

Hey, I'm working with Cases and Playbooks but have got trouble understanding some things. 1. When using the "Siemplify_Assign Case_1" in Dynamic mode, how does the "automatically select the instance work" work? What is the decision to select one or another case? Regarding the case, what is the decision in SIEM to create a new case or group it in a similar case?Thank you!

01
AymanC
Z
ZorghostBronze 5
posted in Google Security Operations
Is there an API endpoint to create an alert in Chronicle ?

Good day,Is there an API endpoint that can be leveraged to manually create alerts using a cloud function for example in google secops siem ?Thank you in advance !

21
cmmartin_google
Staff
keso
kesoBronze 5
posted in Google Security Operations
Maturity of the Chronicle/SecOps

Hey, I do not know if it is just me, but I think Chronicle/SecOps still has a lot to mature. From several issues I have had with the tool, 3 have ended in Feature Requests. 2 are related with audit logging (which does not seem as a new functionality but rather as something the product should already have and probably will take a while to be implemented) and the other is a visual thing which is a minor thing. There are still a lot of references to siemplify (the solution, just delete the references, but c'mon what about the howto? wouldnt it better to upgrade?). SIEM and SOAR give the sensation that are two different products (just look how even the SIEM and SOAR admin GUI is different from each other or how SOAR logging is not integrated with GCP). The CLI is limited and the training usually is not updated.Any thoughts? Might be just me? Thank you!

11
cmmartin_google
Staff

Badge winners

  • Comments Posted 1
    hytech_sghas earned the badge Comments Posted 1
  • Solution 1
    Rmosshas earned the badge Solution 1
  • Authored Posts 1
    Umairbadar39has earned the badge Authored Posts 1
  • Comments Posted 1
    Rmosshas earned the badge Comments Posted 1
  • Comments Posted 1
    Gabby23has earned the badge Comments Posted 1
Show all badges
Terms & ConditionsCookie settings
Privacy Policy Terms of Service Gen AI Policy Community Guidelines Cookie Settings

© 2025 Google. All rights reserved.