Skip to main content

Google Security Operations

Your Security Operations conversation starts here. Ask questions. Share insights. Tell us what you've learned. Or tell us what you're working on. We want to hear about it!

  • 2,116 Topics
  • 6,738 Replies
2117 Topics
A
aravind_s12321Bronze 1
asked in Google Security Operations
Chronicle Parser - JSON

Hi All,Can we parse a log with the below mentioned format with out making any changes while ingesting?[ { "header": { "name": "EcoScope Data", "well": "35/12-6S", "field": "Fram", "date": "2022-06-14", "operator": "GeoSoft", "startIndex": 2907.79, "endIndex": 2907.84, "step": 0.01 }, "curves": [ { "name": "MD", "description": "Measured depth", "quantity": "length", "unit": "m", "valueType": "float", "dimensions": 1 }, { "name": "A40H", "description": "Attenuation resistivity 40 inch", "quantity": "electrical resistivity", "unit": "ohm.m", "valueType": "float", "dimensions": 1 } ], "data": [ [2907.79, 29.955], [2907.80, 28.892], [2907.81, 27.868], [2907.82, 31.451], [2907.83, 28.080], [2907.84, 27.733] ] } ] 

163
M
S
srijankafleBronze 2
posted in Google Security Operations
Office365 Feed API is creating duplicate entries in Chronicle

Hi Team,We are utilizing Chronicle Feed to ingest Office 365 logs. We have integrated Audit.AzureActiveDirectory, Audit.Exchange, Audit.SharePoint, Audit.General, and DLP.All as the sources. We are seeing duplicate entries of the authentication logs. This was verified as logs with same raw log (all characters) and same value in metadata.product_log_id is repeated  2-3 times on average (up to 16 times) increasing false positives and data misrepresentation on the dashboard. Has someone discovered this issue and if yes is there any solution to this?

31
D
Staff
AfvanJaffer
AfvanJafferBronze 5
asked in Google Security Operations
Onboarding orgs to chronicle

how can I onboard logs from two organizations into the chronicle?I have an organization that is currently set up native ingestion to chronicle, and everything is fine there. I have a requirement to send logs from a different organization now to the same chronicle instance, how can I do that?  

67
R
Staff
T
TheSecOpsGuyBronze 5
posted in Google Security Operations
Reduce AWS S3 Bucket cost - Integration with Chronicle Secops SIEM

Hi Team,We have integrated AWS CloudTrail and AWS Guardduty with Chronicle Secops SIEM and our AWS S3 cost has been spiked.Is there a way we can reduce the cost (apart from creating new S3 bucket or limiting S3 bucket data) ?

138
T
P
preet_mehtaBronze 5
asked in Google Security Operations
Need to install Siemplify SDK locally

Hi,I am developing a custom integration and need to write unit tests using pytest framework for an action.However, my action starts by importing Siemplify modules and they cannot be found in my local environment. On the other end, I cannot run the unit tests on the SOAR IDE.Is there any way that I can get some .whl file for siemplify-sdk or any way that I can download and install the siemplify package locally ?Thanks.

122
P
P
preet_mehtaBronze 5
asked in Google Security Operations
Support for Dropdown fields for Configuration Parameters of an Integration

Hey guys, currently, I am in the process of creating a new custom integration for Chronicle SOAR platform. My requirement is to create a configuration parameter field for the integration that must be a dropdown. However, I do not see any support for it.Am I missing something, or is there any workaround where I can use a dropdown field for a configuration parameter in my custom integration ?If possible, I would like to add a parameter with radio buttons. Need to know about the supprot for the same.Thanks.

46
P
M
Mufa_shahBronze 2
posted in Google Security Operations
Key_value_UDM_fields

Hi All, Any type of  key-value UDM fields when used multiple time with  "AND" condition in YaraL it doesn't work. but when i try the same in UDM search it works.// Sample ExampleUDM Search , Events are getting detected But when i try the same thing in Rules Editor in YARA L doesn't seem to work  Sample Rule to Test  rule Yara_L_Bug_Testing {   meta:    author = "Rahul Shah"  events:    $e.metadata.log_type = "GCP_CLOUDAUDIT"    // Key Value pair fields used multiple times with AND conditions doesn't work        // Testing UDM works    ($e.target.resource.attribute.labels.key = /event type/ nocase and $e.target.resource.attribute.labels.value = "auth")    AND    ($e.target.resource.attribute.labels.key = /event name/ nocase and $e.target.resource.attribute.labels.value = "authorize")  condition:    $e}

86
S
Z
ZorghostBronze 5
posted in Google Security Operations
Ingesting Zoom logs into Chronicle

Hello everyone,I am planning to ingest Zoom operation and activity logs into Google SecOps (Chronicle) and would like your insights on the most efficient way to achieve this.My proposed approach involves using Cloud Functions in conjunction with Google Cloud Scheduler to run jobs that will fetch the logs from Zoom API endpoints. However, I am uncertain about the optimal receiving point. Here are the options I'm considering:Pub/Sub: I could create a topic and establish a direct feed from Chronicle to that topic. The Cloud Function would publish the fetched logs to this topic.Cloud Storage: The Cloud Function would dump all the logs into a bucket, and Chronicle would fetch them using a direct feed from the bucket.Log Ingestion API: The Cloud Function would post the logs directly to Chronicle using the available log ingestion API.Which solution do you think is the most efficient? I plan to adopt the approach you suggest for similar situations in the future.Thank you in advance for your as

132
Z
JaredBloomberg
JaredBloombergNew Member
asked in Google Security Operations
Risk Score Based on Distinct Criteria

Hello,I've been wrestling with the correct syntax to calculate a risk score based on unique, not repeated, values across multiple logs.For example, let's say there are several different discovery commands run on the command line of a single host over the course of five minutes such as ipconfig, whoami, and systeminfo; for this example let's also say that ipconfig is run twice in that five minute window.Technically only three distinct commands have been run but if you use a sum aggregation (and let's say you give each one an arbitrary value of '5') then in this case the sum will be 20 instead of 15. Is there a way to calculate the risk score based solely on each unique occurrence of a command and not the total number of commands in the match window?I know there is the array_distinct aggregation which would show only the three distinct commands but I cannot figure out how to incorporate that into a risk score and subsequently a condition statement.Is this something that is even possible

32
JaredBloomberg
K
KaramatsuNew Member
posted in Google Security Operations
Proper JSON Format for an Entity such as a Server

Hello,I need to develop some code to that will export the characteristics of servers and various network elements to Chronicle SIEM as entities so it can use the information to enrich events (and later for use with Chronical SOAR). I'm told that normally this is done by interfacing with Active Directory or some sort of EDR solution, but that's not an option, so we have to roll our own, and it's proving difficult because there seems to be no concise documentation for entity processing.What I have now is software on our side that generates JSON documents with a structure that tries to be compliant with the Entity documentation, but it's proving difficult. So two questions to begin with:(1) Is there somewhere I could find examples of the JSON documents produced by other solutions (like AD or EDR products) for ingestion into Chronicle? I don't mean on the AD/EDR side but rather the final JSON that is ready to be ingested.(2) Is there documentation on the Chronicle-side parser to actually i

01
DanDye
Staff
K
kpmarquezNew Member
posted in Google Security Operations
Stats in search not working

Recently trying stats in search (Preview) but it seems not working on our end. Tried the sample in documentation. 

21
DanDye
Staff
D
Dev_ChoudharyBronze 1
posted in Google Security Operations
Google Threat Intelligence integration with SIEM Sentinel

How we can integrate Google Threat Intelligence  GTI to SIEM specially to Microsoft Sentinel or Splunk

71
DanDye
Staff
S
Suraj_RNew Member
posted in Google Security Operations
Is there a way we can solve this roadblock webhook.site limit without using a third party?

Hi All, We are currently using webhook.site as our webhook provider to integrate Slack with Chronicle SOAR but there is a roadblock here as webhook.site has limit on number of requests we can send on an URL for free... Is there any other way through which we can solve this issue without using a third party?

05
D
Staff
P
pankajsinghNew Member
posted in Google Security Operations
From where to import Tipcommon and EnvironmentCommon module

I am trying to import library TipCommon and EnvironmentCommon in my util class but it is giving bellow error.I looked into all siemplify classes but I didnot find its defination.error which I am getting:Traceback (most recent call last): File "/opt/siemplify/siemplify_server/bin/Scripting/PythonSDK/IntegrationsVirtualEnvironment/MS ISEC_V165.0/upspwgkm.vt2/4nx5ycwo.1fi.py", line 8, in from TIPCommon import validate_map_fileModuleNotFoundError: No module named 'TIPCommon'Let me know how to resolve this issue.

84
C
E
ev13New Member
posted in Google Security Operations
Workday Integration using Webhook

Is there any documentation available that outlines the differences between audit logs and user activity logs? My understanding is that audit logs encompass various events in Workday, including user activities like sign-in logs.

41
ionutm
Staff
A
Aravind3Bronze 2
posted in Google Security Operations
Exchange logs to Chronicle SIEM

Hello All,Could anyone please let me know what is the best way to ingest O365 mail logs (MS Exchange) to Chronicle, if we don't have an exchange server in place?Thanks in advance.Aravind Sreekumar

368
A
D
DahamNew Member
posted in Google Security Operations
Log collection protocols

Is Google SecOps support the following log collection protocols: Syslog over Syslog NG, SDEE(Security Device Event Exchange), SNMP Version 2 & 3, ODBC, FTP, Windows Event Logging Protocol, Netflow

32
D
A
Aravind3Bronze 2
asked in Google Security Operations
Query on Sending Data to Multiple Destinations

Hi All,I have a question: Is it possible to send data from a single source to two different locations? For example, I have a CrowdStrike source and I want to send logs to Chronicle while also saving them in an S3 bucket, or alternatively, send them to another location via Kinesis. Is this possible?Thank you in advance.Aravind S

15
D
Staff
N
nc2Bronze 5
asked in Google Security Operations
Log monitoring RBAC

Is there a way to have certain roles on the SIEM portion of SecOps to be able to view certain logs, and others not?

02
D
Staff
N
nc2Bronze 5
asked in Google Security Operations
No idea how integration of a user list from GCP happens in SIEM

I cannot find any documentation saying how to do this. Any guidance would be appreciated on a step-by-step on this.

85
D
Staff
vanitharaj1208
vanitharaj1208Silver 2
asked in Google Security Operations
Custom Alert View

Need more Information Around Custom View , Custom View 1 with role Tier 1 and custom view 2 with role Soc manger Im not able to view these on the alert view section need more clarity around this like how to use and which scenarios

11
F
Staff
vanitharaj1208
vanitharaj1208Silver 2
asked in Google Security Operations
Jobs

Are jobs independent of Integration?

21
F
Staff
M
menenitaNew Member
posted in Google Security Operations
Integration SAP ETD with Google Chronicle

Hi experts!I am working in the SAP space and I have to integrate the SAP Enterprise Threat Detection (ETD) solution with Google Chronicle. Is there a standard way to do this integration?Thank you for the support!Regards,

42
D
Staff
ORBR
ORBRBronze 5
asked in Google Security Operations
Delay playbook action issue

Hello,Has anyone else experienced issues with the "Delay Playbook" or "Delay Playbook V2"?I attempted to run a 30-second test, but it kept getting stuck indefinitely.Any workarounds?

33
JensW
E
ev13New Member
asked in Google Security Operations
Bulk Close Alerts in SIEM

Is there a method to close multiple alerts simultaneously in the SIEM? We've faced an issue where rules set as 'Live' but with 'Alerting OFF' generated alerts in the SIEM. These rules are intended for monitoring purposes and not to trigger alerts.

124
DanDye
Staff

Badge winners

Show all badges
Terms & ConditionsCookie settings
Privacy Policy Terms of Service Gen AI Policy Community Guidelines Cookie Settings

© 2025 Google. All rights reserved.