Skip to main content

Google Security Operations

Your Security Operations conversation starts here. Ask questions. Share insights. Tell us what you've learned. Or tell us what you're working on. We want to hear about it!

  • 2,108 Topics
  • 6,715 Replies
2109 Topics
S
swanandNew Member
asked in Google Security Operations
Display outcome variables from yara-L rules on alert view

Hi,I would like to show the "outcome" variables from YARA-R rule on the UI. (preferably the alert screen under cases).  Please suggest how this can be achieved.

35
gsec
S
swanandNew Member
posted in Google Security Operations
Will "retrohunt" remove existing alerts / cases that were created from previous detections

Hi,If I run "retrohunt" for a detection rule, will it delete existing alerts and cases from chronicle SOAR  and generate the fresh detections on evaluating historical events  OR it will create duplication and rednundant alerts and cases ? Thanks !

43
S
sudeep_singh
sudeep_singhBronze 1
posted in Google Security Operations
How to convert EPOCH time to UTC ?

Hello,I have EPOCH "time": 1723791636 in the raw log which i want to parse and map to the udm.metadata.collected_timestamp.seconds .But, when i try to map it doesn't show in the output, without any error.Can anyone help me with this ? 

154
sudeep_singh
vanitharaj1208
vanitharaj1208Silver 2
asked in Google Security Operations
SOAR Case management

Has someone has integrated Chronicle SOAR with any case management for handling the cases and reporting.If so, were the enrichments pushed from the SOAR platform to the case management system?Can any one reply / Help me? 

21
D
Staff
vanitharaj1208
vanitharaj1208Silver 2
asked in Google Security Operations
Splunk Query

Hi Guys,i have observed different output in action "Execute Splunk query" if query is beginning with | pipe output is accurate | inputlookup data.csv | head 5and if without | pipe result is different inputlookup data.csv | head 5Any idea why?

11
mikewilusz
Staff
E
Emmie-123Bronze 1
asked in Google Security Operations
Chronicle SIEM raw log search

Hi Team,  How do I comment something (text or numbers or both) in the raw log search/scan in chronicle SIEM?for example. INC897 (This is incident number which should be commented out) 192.76.0.2(my search query) in UDM search, it can be done using //INC897, however, im not sure how to achieve this in raw log search. please assist me on this. Thanks

181
cmorris
Staff
M
MarinusCBronze 2
asked in Google Security Operations
How does Google SOAR decide whether a entity is internal or external?

Hello all, we are struggeling with the "IsInternalAsset" entity configuration. We mapped a field in the ontology configuration to "DestinationDomains", which in my opinion should be an external Entity.However, if you open a “DestinationDomains” entity in a case, it will appear as “IsInternalAsset” = “True”.Can anybody help or knowns how to configure an entity as internal or external?Thanks a lot!Some screenshots:

224
maxjunker
N
NEIOBronze 3
asked in Google Security Operations
Integration of Threat Intelligence Platform in Chronicle secops

Hi Team,We have successfully integrated several supported Threat Intelligence (TI) platforms. However, we need guidance on properly configuring these integrations within our Security Orchestration, Automation, and Response (SOAR) system to ensure their visibility and functionality.Could anyone provide detailed information on how to achieve this? Additionally, if there are specific configurations required within the SOAR system, please outline the necessary steps. Thanks,Neha.H

77
N
Omskirt
OmskirtBronze 2
posted in Google Security Operations
Native Dashboard: Reference list

Good day,Can the reference list be integrated or called in the native dashboard? For example, when we create a use case in the native dashboard, can we call the reference list? On my end, I am unable to call the reference list in the native dashboard due to error something. If it’s possible, could you provide an example? If not, could you suggest a workaround?

113
D
Staff
marcospaulor
marcospaulorNew Member
asked in Google Security Operations
API query limits(udmSearch)

Hello everyone,Is it possible to request an increase in the API query for udmSearch? I know that the default limit 120 QPH? If so, where do I need to make this request from?Thanks. 

122
marcospaulor
S
swanandNew Member
posted in Google Security Operations
Inteaction with user through email in playbook

Hi, I need to achiveve this:On rule detection, playbook should execute that will execute below block in loop.*Send email to user -- > wait for response -> If user happy --> Close the case OR if user not happy/ needs further information, again repeat *Send email to user step.Please suggest how this can be achieved in soar playbook. OR if this is not feasible, what's the fallback ? Thanks   

71
F
Staff
B
BeacorNew Member
posted in Google Security Operations
SOAR Free Edition - Unauthorized Access

When I login to the SOAR Free Edition portal, I am able to authenticate, although get an "unauthorized access" error.  Can someone please assist with my registration.

01
S
Staff
TheChris
TheChris
asked in Google Security Operations
re.capture and timestamp.get_timestamp to match business hours?

Hello,I have the risk_score outcome below that is WORKING as expected, but I had to split the logic into two regex capture. I'm trying to have this in a single line, but due to the single group capture limit, I'm not able to have the intended regex (Mon|Tue|Wed|Thu|Fri) ([8-9]|1[0-8]) that would match both the day of week and hour. I want to match if it's "business hours" in London, between 8:00 and 18:59 Mon to Fri.   outcome: $risk_score = max( 100 - if( re.capture(timestamp.get_timestamp($e.metadata.event_timestamp.seconds, "%a", "Europe/London"), "Mon|Tue|Wed|Thu|Fri") != "" and re.capture(timestamp.get_timestamp($e.metadata.event_timestamp.seconds, "%k", "Europe/London"), "[8-9]|1[0-8]") != "" , 50, 0) )   I tried this, but the single group capture limitation blocks me:   outcome: $risk_score = max( 100 - if( re.capture(timestamp.get_timestamp($e.metadata.event_timestamp.s

02
TheChris
J
jonathanYaoNew Member
posted in Google Security Operations
For Method: legacy.legacyUpdateAlert, where can I get {instance}

Hi, when I try to use POST https://chronicle.googleapis.com/v1alpha/{instance}/legacy:legacyUpdateAlert to update an alert, I need to specify {instance} in path parameter. For projects/{project}/locations/{location}/instances/{instance}, may I know where I can get location? Besides, I can use either project_name or project_id, is it correct?When I use project ID and customer ID I obtained from Google SecOps - Settings -Profile, the API returns 404 Not Found. Appreciate your kindly comments. 

31
David-French
Staff
A
Anonymous
asked in Google Security Operations
Clarification Required Regarding Timestamp in Dashboard

Hi Team,We would like to know if we have an option to delete the timestamp filter field from individual dashboard panels just like any other filters.Additionally, I would like to know if all panels of the same dashboard are updated for the same global time range if a global timestamp filter is being used in the dashboard.Please provide a reference to the relevant documentation for the same.Thank you 

02
A
chicoqueiroga
chicoqueirogaBronze 2
asked in Google Security Operations
Error when trying to create a parser extension

Hello everyone,I'm trying to parse a json object that has several json-like attributes. Also, I'm trying to parse a json array, and after I renamed and merged the fields to UDM, I'm facing this error:generic::unknown: pipeline.ParseLogEntry failed: LOG_PARSING_CBN_ERROR: "generic::invalid_argument: failed to convert raw output to events: failed to convert raw message 0: field \\"idm\\": index 0: recursive rawDataToProto failed: field \\"read_only_udm\\": index 0: recursive rawDataToProto failed: field \\"about\\": failed to make strategy: received non-slice or non-array raw output for repeated field""This is my parser extension:filter {mutate {replace => {"Entities" => """Country" => """City" => """SourceAddressResolution" => """Asn" => """Carrier" => ""}}json {source => "message"array_function => "split_columns"on_error => "not_json_message"}if [Entities] != "" {mutate {replace => {"Entities" => "{\\"js_array\\":%{Entities}}"}}json {source => "En

112
chicoqueiroga
T
tony_shekNew Member
posted in Google Security Operations
Successful login alert without MFA

I wonder if there is any way Google SEIM generates an alert for the users who successfully login bypassing or without MFA?

13
AymanC
Omskirt
OmskirtBronze 2
asked in Google Security Operations
Preview Dashboard/Native Dashboard

I’ve working in Yara-l. Is there any way to get more resources about native dashboard coz I’m confused on other features on doing that because they are different in looker dashboard this was a new to me. Please elaborate this.

65
Omskirt
C
ChicaBronze 3
posted in Google Security Operations
Email preview

In SOAR playbooks, is there a way to validate the (email content, recipient) details before sending it out directly as part of an automated action? Steps:The action should pull the recipient details automatically from the alertPopulate the email template and present that to AnalystAnalyst validates the content and makes correctionsHits the execute to send an email 

66
vanitharaj1208
matthewnichols
Community Manager
matthewnicholsCommunity Manager
posted in Google Security Operations
Two Part Series Blog: Detecting Impossible Travel

Hey SecOps SIEM enthusiasts. We just published a part 1 of two part series blog about detecting impossible travel using SecOps SIEM. It dives into implementing detection methods using custom YARA-L Detection rule, leveraging GeoSpatial and GeoIP enrichment. Check it out here. Part 2 SecOps SOAR coming next week.

61
matthewnichols
Community Manager
S
skadavBronze 5
asked in Google Security Operations
Issue with "Set Case SLA Action" - Timer Not Reflecting Placeholder Time

I'm encountering an issue with the "Set Case SLA Action" in our system. The time captured by the Placeholder isn't being reflected correctly in the Case SLA Timer. However, when I check the View Result, the timing appears to be correct.Has anyone else experienced this problem? If so, could you please share any solutions or workarounds that might help?Thanks in advance!

15
S
P
paczzNew Member
posted in Google Security Operations
How to set up a mail alert when a SOAR collector stops generating cases within a certain time?

Hello everyone, my question is the one mentioned in the title.I know that it is possible to create Jobs that can monitor if any of the connectors present errors when ingesting alerts.But I can't find a way (if there is one) to send these alerts by email so that action can be taken in the case of data loss as soon as possible.

63
S
Staff
AfvanJaffer
AfvanJafferBronze 5
asked in Google Security Operations
Chronicle Playbook Queued for long...

Hello everyone,I have a script that attaches a playbook to an alert, but once the playbook is attached, playbook moves to a queued state and doesn't recover.I checked other alerts to see if any playbooks are running or have failed, but that doesn’t seem to be the issue.

62
S
Staff
TheChris
TheChris
posted in Google Security Operations
How to build a YARA-L metrics for average daily outbound bytes vs actual?

I'm trying to build a rule that will check our VPN logs which contains the username and bytes out of all the users connections. I want to know the average of bytes out / day / username to be able to compare it against "$yesterday". The idea is that I will detect if johndoe had a "bytes out" of 50GB in a day while his average is only 20GB.I understand that I need to use metrics.network_bytes_outbound, but I always get an error. Suggestions?Run frequency: 24 hours $avg_bytes_out = max(metrics.network_bytes_outbound(period:1d, window:30d, metric:value_sum, agg:avg, principal.user.userid:$e.principal.user.userid)) {"code":400,"statusText":"Bad Request","message":"cannot identify time window in the rule","details":[],...

32
jstoner
Staff
vanitharaj1208
vanitharaj1208Silver 2
asked in Google Security Operations
How to send log from Kinesis Stream to Google chronicle via Lambda Function with log segregation

Hi All,we are trying to send logs from AWS Kinesis Stream to Google chronicle via Lambda Function.that Kinesis stream(5 streams) contains logs from multiple sources (Guard duty, winevt etc)we are trying to segregate the logs based on log types and send it to chronicle SIEM via webhookcan any one help us in this ????????(with supporting documents and links)

55
A

Badge winners

  • Comments Posted 1
    etherweavehas earned the badge Comments Posted 1
  • Authored Posts 1
    jadavpur08has earned the badge Authored Posts 1
  • Comments Posted 1
    Rosiehas earned the badge Comments Posted 1
  • Authored Posts 1
    ericv-avahas earned the badge Authored Posts 1
  • Comments Posted 1
    EJJessehas earned the badge Comments Posted 1
Show all badges
Terms & ConditionsCookie settings
Privacy Policy Terms of Service Gen AI Policy Community Guidelines Cookie Settings

© 2025 Google. All rights reserved.