Google Security Operations

Ingested phishing email data using soar webhook It created the simple event with all the json fields like json.headersHow to extract fields and create entities out of it ?

Hi team,Please tell me if i can use reference list in chronicle custom dashboard? It's quite urgent. would appreciate your help on this.@Jacqui_N Best regardsEmmie

Hi Experts,Are we able to ingest logs that are not indicated in the log type?https://cloud.google.com/chronicle/docs/ingestion/parser-list/supported-default-parsers 

Hi How can we integrate Red Hat OpenShift with Google Chronicle

Hi folks,I have created an entity insight for an IP Address entity, if the enrichment process of IP finds it to be suspicious. However, later on, if the IP is marked as non-suspicious, I would like to delete this insight, or maybe edit it.Is this possible ? I could not find any action (via SDK, code, or even UI) that supports edit/delete action on entity insights.Thanks.

Hello everyone,One of our customers is encountering the following error message when accessing SecOps SIEM.We are using BYOID and following the setup guide from Chris Martin, see: https://medium.com/@thatsiemguy/linking-azure-idp-to-chronicle-secops-platform-ba649660d5fb For this particular customer, there is an added complication: they do not have an Azure Entra ID P1 license and therefore are not allowed to assign a group to the Enterprise Application. They can only authorize individual users for the Enterprise App.In GCP IAM, I mapped the Chronicle Viewer role to the following principal:  principalSet://iam.googleapis.com/locations/global/workforcePools/<WORKFORCE_POOL_ID>/attribute.userPrincipalName/<userPrincipalName>  Unfortunately, this does not seem to be working. Does anyone have any ideas?Thank you!

Hello,Can I forward all alerts from Chronicle to my on-premises SIEM QRadar?Thank you

@travisn  Hello, Like others have written here, I too have contacted sales numerous times via the online chat function with no response. I was able to get one person to email me, but when I replied with a few questions I never heard back. I really need to hear back from someone soon. I find the lack of follow through very concerning. Thank you

Hello,We have a product that ships log messages to a file in a top level nested JSON array - example:[{"test": "testing","hostname":"hostname1"},{"test":"testing","hostname":"hostname2"}]We need a parser that can break out each individual event delimited by the comma to its own event.  The built-in JSON parser only recognizes JSON events individually it seems and does not recognize the top level array even though a top level array JSON is valid JSON.Please assist or point me to a good direction.  In Logstash we can use the "split" function to assist with this.

Hi,  I am trying to ingest sentinelone alerts into secops but i got this message: "Error: INTERNAL_ERROR Unable to process the feed due to an internal error.What you can do?If the problem continues, contact Chronicle Support"what should i do in that case?@cmmartin_google 

Some context here: I'm writing a detection rule to monitor the network connections and check if any of them match with IOCs. The thing is that I want this rule to trigger if:Is IOC and found any allowed network connections, ORIs IOC and found more than 2 blocked network connectionsWhat's the best approach here? I've tried to create 3 variables (misp, allow, block) with 2 placeholders (allowed, blocked) like this:  $allow.security_result.action = $allowed. With that, I built the condition like this: $ioc and (#allowed > 0 or #blocked > 2).I'm aware such conditions exist for like 1 IOC and 5 blocks in the time range but the rule doesn't trigger. Is there's another approach, like checking the security_result.action under the outcome section using any function? Any thoughts?

Hi I am not sure if i am putting my question correctly here ,  Is it necessary to learn Chronicle Ingestion API , are there scenarios where normal integration method wont work and will have to adher to Chronicle Ingestion API , reason for asking this i am not good with coding and stuff .So just wanted to know if i should start learning python .Can we have a video based tutorial of a log ingestion via Chronicle Ingestion API ,explaining the steps ?

I'd like to create a rule from a dashboard tile. Is that possible? Could you provide me with more information on how to do this?

Hey, when configuring the Google Chronicle Integration, the system requires a "User's Service Account". Please, where I can export it from? If I leave it empty (to use the default) the test fails 😞 (or how can I grant the necessary permissions? )The documentation [1] says:"Service account of the Google SecOps SIEM instance. Copy the entire service account JSON file."[1] https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/google-chronicle Thank you!!

Greetings--Piggybacking on this post:https://www.googlecloudcommunity.com/gc/SOAR-Forum/Using-Environments-for-Multi-Tenancy/m-p/687636#M1977Are there any guides or syntax about how to link or associateForwarder Labels and Ingestion Labels and/or NameSpacesto their respective Environments to support a multi-tenancy deployment?e.g. I see in yaml:env: devAny advice is helpful.Thank you!!

I'm trying to access detailed audit logs specifically for SOAR Playbooks. Currently, I can view the audit logs for SIEM rules using metadata.product_name = "Google Cloud Platform", but I'm unable to locate similar logs for SOAR Playbooks.Has anyone managed to find or configure audit logging specifically for SOAR Playbooks? 

Hi TeamI am trying to replicate an alert that was built in Splunk .1) Use case is to check an anomaly in the SMB traffic . For this in Splunk we were using firewall traffic over port 139 and 445 and calculating the average and std dev between src and dest in a day and using the outlier concept which is if if traffic observed at a given point is above the (avg +2 std dev ) then an alert should trigger .can we built this alert in YARA L ?

Hi Can someone suggest how i can integrate oracle cloud with google chronicle? 

Hi I would like to ask if its possible to use our VT enterprise api on siem, we want to use it for threat hunting on the logs being ingested into siem.Thanks.  

Good morning--Over the years one of the concerns that our security team has had is around the use of "EDR bypass". If you're not familiar, EDR bypass is just as it sounds: hackers deploy tools to either turn off your Endpoint Detection and Response entirely or greatly diminish it's detection capabilities. Today I came across a post from a trusted partner with a host of EDR bypass IOC's. My question is two-fold:1. What is the efficacy / practicality of building out a custom detection using only IOC's ( mostly hashes and .exes) in Chronicle? Is detecting this type of activity better accomplished using our hunting platform?2. If building out a detection is the proper path, is it as easy as creating a list of the IOC's I'd like triggered on and then building the detecting to reference that list?Thank you in advance for any help your able to provide. 

How to update alert decryption using playbook/blocks i used tools- add/update alert - and passed json{"description": "test -updated description"}it showed -successand i used fetch original alert ... but i could see previous description How can i see the new updated description ?is there any other standard way of doing? 

Hi Has anyone experience this issue this field when copied or exported will show as security_result.action The challenge as a result is when i am writing the query in SIEM search  security_result.action != "QUARANTINE" the above logs (security_result[1].action[0]:"QUARANTINE") are not getting captured . If I type security_result[1].action[0] != "QUARANTINE" in SIEM search it throws error message . What should be the query in such cases ?

Hi all,I'm coming over from Splunk where this type of query would be pretty trivial, but I'm struggling to make it work in SecOps dashboards;I've read through this article about pivoting on data to create a basic time chart, but I'm not quite getting the data I want: https://www.googlecloudcommunity.com/gc/Community-Blog/New-to-Google-SecOps-Dashboarding-Using-Pivot-to-Create-a-Time/ba-p/735476I'd like to see the number of requests per minute of the 10 highest-volume IPs connecting to the network. So far I can easily make a "requests per minute by IP" chart, but it organizes the IPs numerically, (i.e 1.1.1.1, 1.1.1.2, 1.1.1.3, etc.) not by total count, even if I toggle the Count field to display in descending order. Anyone have any ideas? Thank you!

start date vs discovered date ?

Hi, I want to add workspace activity to Chronicle via Add feed --> 3rd party API and log type workspace Activities. However, I have some information but these are not completely fit to support documentation. https://us.v-cdn.net/6031969/uploads/editor/yi/awkiwyu7r61e.png