Google Security Operations

Hello community! there are a lot of posts about the MISP integration and also a lot of updates in SecOps. I wanted to know, to this date, how can I ingest MISP data to chronicle?  Would be enough following [1]? Is the BindPlane/Collection agent necessary to ingest the data? what is the difference between the collection agent and the MISP integration [2]? Could you summarise what is required to do the ingestion? Thank you! [1] https://medium.com/@thatsiemguy/misp-bindplane-and-google-secops-262f48f9bdbd[2] https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/misp 

Hi All, I'm trying to display who is enrichment result and this code works and displays itBut twice How to display it once and iterate using Entity.Identifier 

Heads up, Google SecOps users! A new Vertex AI integration is now available in the Google SecOps Marketplace. This powerful addition lets you use Google's AI platform, Vertex AI and models, to create custom response actions and meet enrichment needs, boosting your team's efficiency. Key use cases include executing playbook prompts, suspicious email analysis, data transformation, and entity descriptions. Learn more in the full announcement here.

I created an integration in my SOAR instance using the following Swagger endpoint:api/external/v1/integrations/CreateIntegrationInstance.It returned a 200 success response, but the integration is not reflected in my SOAR instance. Could you help me troubleshoot this?

Hi all,I'm trying to create a custom action for "trend vision one" integration in soar. It is supposed to fetch details through API but when i'm trying to test it, getting error "Custom action name" not found as it is not getting imported from constants module. I have to add action name in constants module, but it's in read mode only. Can anyone help me in solving this one?#constants module ide#trend "get alert details" custom action errorThanks a lot in advanceShruti 

So I havce written a parser.It's a custom parser.filter {  mutate {        replace => {             "raw_Event" => ""               }    }    grok {        match => {            "message" => ["%{GREEDYDATA:raw_Event}"]        }        overwrite => ["raw_Event"]        on_error => "grok_failed"

Hi,I'm using the Microsoft ATP connector to fetch incidents from the tenant and create a case for each incidents.Incidents in Microsoft Defender have one or more alerts related, which are aggregated by Defender to create the incident. When the case is created on the SOAR, it doesn't include all the related alerts to the incident. The MS ATP integration has one action for playbook which is "ListAlerts", that would return a JSON with all the related alerts and their info (this is working fine).My question now is how can I add those alerts to the Case, below the "Alerts" section. I have been trying different actions but none of them seems to work.Am I missing something here or do I need to develop the action myself?Thanks!

Dear all, This is not really a question, but rather a memento, waiting for an official fix to be rolled out, for those of you who have ever hit your head, as has happened to me over the past few months, with the following problem when sending logs via CF.Scenario: you have just set up a new log type to send via CF, which you have done several times, no big deal. Only the logs don't make it into the DB, you look for them in the SecOps UI but there is no trace of them. You then decide to give it some time and wait a while.When you came back a some hours later you find that all your logs are being delayed, arriving 30min/1 hr late. What the on earth happened??After some investigation you find the Forwarder docker log (“docker logs --since=60m cfps”) full of error messages like:E0917 07:40:40.287215 489 syslog.go:545] strconv.Atoi: parsing "8205337b-7ff5-4a3e-8e29-1250c8c74701,": invalid syntax.

Hi all!I am trying to create a rule that alerts if for the past 30 days, a unique combination of user/country is seen for the first time. This is what I came up with so far: events: $selection.metadata.vendor_name = "Okta" $selection.metadata.event_type = "USER_LOGIN" $selection.security_result.detection_fields["legacyEventType"] = "core.user_auth.login_success" $userid = $selection.target.user.userid $country = $selection.principal.ip_geo_artifact.location.country_or_region match: $userid, $country over 1d outcome: $first_seen_today = max(metrics.auth_attempts_success( period:1h, window:today, metric:first_seen, agg:max, target.user.userid:$userid)) $first_seen_monthly = max(metrics.auth_attempts_success( period:1d, window:30d, metric:first_seen, agg:max, target.user.userid:$userid)) The problem begins when I add "principal.ip_geo_artifact.location.country_or_re

Is it possible to create a job and after executing it can connect to a connector and create a manual alert?In such a way that we can have a relationship between them?I am not using a specific connector like crowdstrike or chronicle, just creating alerts based on a manual connector made by me? no apisIn this way we can observe a job that only queries the cases of a specific tag and if they bring information, an alert is created. I would appreciate your response¡Thank you! 

In the fourth quarter of 2024, Google Security Operations focused on empowering security teams with the capabilities to visualize, analyze, and act with confidence through our new native dashboards. But that's not all. We’ve rolled out a host of key enhancements including: Gemini Digital Threat Monitoring Alert Summarization New Search in Google Threat Intelligence Threat Profile Recommendation and Customization Enhancements (Preview) New Native Dashboards Expanded Regional Support

In the fourth quarter of 2024, Google Security Operations focused on empowering security teams with the capabilities to visualize, analyze, and act with confidence through our new native dashboards. But that's not all. We’ve rolled out a host of key enhancements including: Gemini Digital Threat Monitoring Alert Summarization New Search in Google Threat Intelligence Threat Profile Recommendation and Customization Enhancements (Preview) New Native Dashboards Expanded Regional Support

Hello , Please can someone tell me a best practices to avoid updates that can ruin my parsers.For exemple i have done some modification on a existing parser , and i received a new update and i want to make sure that the update does not ruin my modifications on the parser.Best regards.

Hey everyone,Is anyone else encountering the following bug in Google SecOps raw log search? I’m unable to perform raw log searches as well!! 

Hi All,We are trying to integrate file based logs into secops (FilePath: /opt/logs/audit.log).When we verify the forwarder logs, we are getting no such file found as the error.Kindly suggest the solution for this issue.

Is there any other option or workaround that we can do to export native dashboard that have been created? 

as per the documentation (https://cloud.google.com/chronicle/docs/reference/ingestion-api), here all i can see the limitation of payload should not increase more than 1MB and when i send 2-3k log lines(size is approx 21kb ) then the ingestion api is not throughing any error but i can see only 1000 log lines in chronicle and when i send them in a batch of 1000 then i'm able to ingest them all properly.is this some new limitation ? 

I have proxy logs that are mapping the wrong ip to target.ip for my environment. If I create an extension that overwrites the target.ip mapping, do I need to worry about any other fields changing (ex. conditional mappings based on target.ip from the parser)? I understand any fields enriched based on target.ip will change

Looking to reduce the amount of service account keys being used for services in SecOps. I see that the Gmail integration supports Workload Identity Federation with Domain Wide Delegated associated service accounts.Has anyone got this setup successfully? If so, how are you going about securing that service account/conditions on the WIF pool?

Hi!Is there, and what's the best way of getting the alerts out of Google SecOps SIEM alerts section to Slack for a notification whenever an alert is created based on rulesets?I've wondered through the API but couldn't find anything specific I could use and there is no integration for that as far as I know built in as well.

Hello,I am looking for a way to have a more dynamic risk score value for custom detections. For an alert about downloading logs, I would like to have the $risk_score go up when there are more unique files downloaded. I am trying with min() and if() with no luck. Here is the code: $n_files = count_distinct($udm_download.target.resource.name)  //number of unique file downloads $risk_score = $base_score + min($n_files/50 , 20) //If less than 1000 docs, add a value based on the number of unique docs, if more than 1000 docs, it will max out at 20 extra score.  This approach does not work:par

We have built a custom parser and mapped some of our fields to additional fields. Parser is active in SecOps.  Below are the additional fields mapping. Our requirement is to create a tile in SIEM with the  fields dns_host_addr, dns_name, dns_response_time. All these fields have to be included in the table view. Please let us know the steps to create a tabular view with all of these fields. mutate {replace => {"dns_host_addr" => "%{msg.dns_host_addr}"}on_error => "DNS_Host_address_replace_error"}if ![DNS_Host_address_replace_error] {mutate {replace => {"additional_dnshostaddr" =&

Is there any impact if we declare the $event variable in the query? Do you suggest declaring the $event variable in the query, or is it better not to declare it?

Hi All,I have a custom log source that sends only URLs over the syslog protocol to my SecOps instance. These logs lack timestamps or other typical fields. I've attempted to create a custom parser for these messages, but I'm encountering difficulties as shown below. Any help would be great.

Hi, my customer currently stores all their workspace logs in BigQuery on Google Cloud Platform (GCP). They would like to forward all logs from BigQuery directly to Google’s Security Operations (SecOps) solutions. Is this possible? If so, what would be the best approach to achieve this? Also, could you point me to any relevant documentation for this process?@cmmartin_google