Google Security Operations

Hi everyone,I’m looking for a guide or best practices on creating parsers for JSON logs. If anyone has experience or resources to share, I’d appreciate your insights!Thanks in advance.

Hi all,I'm trying to use above mentioned actions of microsoft graph mail, but getting error "insufficient privileges to complete the operations". Can anyone help in solving this out?Thanks all in advance,Shruti Kumari 

Hello, is there any endpoint to deactivate or delete a tag from the database, I have several test tags without assigning them to cases and I would like to delete them, to get the tags I am consuming an api:endpoint: /api/external/v1/settings/tag-definition/method get and this comes back to me as a response: Is there any way to delete or disable if I pass the name of the tag or any id? I need to delete those tags that say test.¡thanks!

Hi Google Cloud Community Members,I've recently come through an in-platform method, with the ability to extract up to (from my testing) 99,999 rows, or 5MB worth of data to an EmailLimitations:Does not support Table CalculationsUnable to set specific hard row limit past 5,000 (either All results, or the results in the table)Benefits (In addition to the current capabilities):Export more than the available (5,000) rows.Ability to schedule email delivery, and ability to send schedules or not to scheduled depending on if there are or aren't resultsData groupingFurther Formats (JSON, Text, Html, Data Table)Run on Load (Auto refresh per load of the 'look')How does it work?It utilises the in-platform Looker-based dashboarding, in particular, you can create an 'Explore' look which exposes furt

Dear Community,I am trying to collect logs from a file located on a Windows machine. New log entries are appended to the same file daily at a specified time. The file path is D:\\Log\\CustomApplicationLog.csv.Could anyone kindly provide the docker run command and sample forwarder configurations suitable for this integration?Your assistance is greatly appreciated.Thank you in advance.

Hi,I couldn’t find any information regarding the network requirements for firewall rules related to the Remote Agent. Could someone provide the necessary addresses and details?Thanks in advance!

New to SecOps and I am creating a detection rule based on MS Defender events.  I'd like to set the severity of the detection based on the severity from Defender.  Can a variable be used in the meta section? meta:author = "JAB"id = "asdfasdfasdf"severity = "$Severity" I created the $Severity variable in the outcomes section.  Any ideas or suggestions?

Hi All,I have already created a custom parser that works well for JSON object coming through logs. However, I now need to update the parser to support JSON arrays. but I'm unsure how to loop through a JSON array.Sample log:  [{"test": "testing","hostname":"hostname1"},{"test":"testing","hostname":"hostname2"}]Any guidance or assistance on how to resolve this issue would be greatly appreciated.Thank you!

We’re excited to announce that Google Security Operations can now deliver end-to-end data pipeline management capabilities that empower customers to better manage scale, reduce costs, satisfy compliance mandates and most importantly, drive better security outcomes. Check it out! 

Dear Community Members,i have the following issue. A customer is using SAP and we want to include the SM20 logs into our SecOps instance. The customer told us that the SM20 logs are encrypted or "not human readable". How do you guys ingested this logs into your instance or maybe do you have an idea how these logs can be ingested properly.Thank you for your help!

Hello everyone,I am working on an advanced report to build an incident response matrix. So far, I've been able to gather the MTTR, alert creation time in SOAR, and case closure time. However, I'm facing an issue where I cannot retrieve the `event_metadata_eventTimestamp`cc in the advanced reports.As a result, I am unable to calculate MTTD (Mean Time to Detection), which is the time difference between when an alert was first detected in SIEM and when the alert was created in SOAR.The advanced report is very detailed, and I can see custom fields, system action results, alert entities, case assignment activities, playbooksand actions. Despite reviewing all of these, I have not been able to locate the event timestamp.Has anyone encountered this issue before? Any insights or solutions or workaround would be greatly appreciated.Thank you. 

Hello,I'm trying to run a Google Cloud API query from the SOAR platform, using the Integration.The error I'm getting is:"Failed to execute API request.Reason: An error occurred: 400 Client Error: Bad Request for url: https://logging.googleapis.com/v2/entries:list "These are the anonymized parameters that I sent:This is the config of the Integration. Any idea what I'm doing wrong?

Hello everyone,We activated most of the curated detection rules that are available within SecOps SIEM (about 150 of them), but we are receiving close to none alerts from them (only one or two have been triggered so far). For how much I whish to think that everything is going nice, I am more prone to think there is actually some unnoticed issue within our configuration. My fear is that the log been injected are not right for those rules. In particular, within the Windows Threat set, some have "Log Sources: EDR". How can I test/check if the logs from our EDR are actually fine for these rules? (We are using MalwareBytes with a custom written parser).We used the "Managed Detection Testing", but for what I see they test windows event source, not EDR.Any insight about this? Many thanks

Hello everyone, my windows servers are sending DNS debug logs and NPS debug logs from the corresponding files, using NXLog im_file module. When I send the log to Chronicle SIEM, the parser works good but there is one issue.The timezone configured on the Windows servers is CET (+02:00), while Chronicle parses the timestam as UTC. So my logs don't show up on chronicle portal until 2 hours from ingestion, and when they show, they have a wrong timestamp.Do I need to change the timezone on my server or is there another way to make Chronicle use the right Timezone?Maybe even using NXLog.Thank you

Hello everyone,I am currently working on implementing a Chronicle SIEM Use Case using YARA-L to detect data exfiltration and large uploads, but I am struggling to find a reliable approach.Challenges & Observations:A threshold-based approach (e.g., simply alerting on high outbound data volume) is too imprecise and results in excessive false positives.YARA-L metrics, such as metrics.network_bytes_outbound, seem promising, but I am unsure how to structure the rule effectively to differentiate between legitimate large uploads and actual data exfiltration attempts.My benchmark is the data exfiltration detection capability in Cortex (Palo Alto), which works very well and reliably. I would like to achieve similar detecti

Heads up, Google SecOps users! A new Vertex AI integration is now available in the Google SecOps Marketplace. This powerful addition lets you use Google's AI platform, Vertex AI and models, to create custom response actions and meet enrichment needs, boosting your team's efficiency. Key use cases include executing playbook prompts, suspicious email analysis, data transformation, and entity descriptions. Learn more in the full announcement here.

Anyone have methods they've used to monitor logging health? Specifically, alerting around:1. Feed connectivity2. VM (e.g. hosting BindPlane agents) CPU usage, memory usage, etc..3. Dashboarding best practicesI'm aware that if you have a SecOps instance you can leverage Google Cloud Monitoring for some of this and enable email alerts around feeds, but curious if other have deployed other/better methods.Thank you

Is it possible that I can ingest for emails coming in via the microsoft graph mail connector as separate events in an existing case rather than generating an new case for the email? If so, what are the methods needed to implement this solution?

Hi Community,I wanted to create a visualization of the meantime to detect. (Alert created timestamps - event timestamps) Do we have any resources that can help me with this? I can get the detection.commit_timestamp, which is when the alert was created, but I’m unable to get the case event timestamps.I tried using detection.detection_timestamp Time, but it appears to be the time of the detection window. 

Hello , I want to know if there is any possibility to upload lookml dashboard into chronicle ? This ca be done ? Thanks

Hi,I'm trying to figure out how I can change date and time formats in the SIEM parts of the SecOps interface. This is easy enough on the SOAR side of things, but can't for the life of me figure out how to do this for SIEM searches etc.I'd like to use YYYY-MM-DD HH:mm:ss (24 hour format) throughout the SecOps interface.Any pointers would be greatly appreciated!

I am reaching out in relation to the group function:https://cloud.google.com/chronicle/docs/detection/yara-l-2-0-syntax#groupNow i understand what it says:> Group fields of a similar type into a placeholder variable.But i am unable to visualize it.Does the `$ip` group variable contain all the unique IP addresses found across `principal.ip`, `about.ip`, and `target.ip`. If yes, then why do we need the `match` section. Isn't match like a GROUP BY in SQL.Also, why do we need a group() function. Can't just a match section suffice?Could you please help me connect the dots.Thank you.

Hello Everyone,I am considering the implementation of "Delay Playbook v2" to manage SLA requirements in my project. Before proceeding, I would like to gain insights into its resource consumption and overall efficiency.Specifically, I am curious about:The resource demands when deploying "Delay Playbook v2."Its performance when running 100 playbooks concurrently.Any experiences, benchmarks, or recommendations you can share would be greatly appreciated.Thank you in advance for your assistance!

I’ve been working with Google Chronicle’s Entity Graph and querying the associated data that has been exported to BigQuery. However, I’ve encountered a few challenges and would appreciate some guidance:Null Data: While querying the entity graph table in BigQuery, I noticed that a significant portion of the fields are returning NULL. Is this expected behavior? Are there certain configurations or ingestion processes I need to verify to ensure the data is complete?IOC IP Addresses: I’ve been trying to

Hello community! there are a lot of posts about the MISP integration and also a lot of updates in SecOps. I wanted to know, to this date, how can I ingest MISP data to chronicle?  Would be enough following [1]? Is the BindPlane/Collection agent necessary to ingest the data? what is the difference between the collection agent and the MISP integration [2]? Could you summarise what is required to do the ingestion? Thank you! [1] https://medium.com/@thatsiemguy/misp-bindplane-and-google-secops-262f48f9bdbd[2] https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/misp