Skip to main content

Google Security Operations

Your Security Operations conversation starts here. Ask questions. Share insights. Tell us what you've learned. Or tell us what you're working on. We want to hear about it!

  • 2,094 Topics
  • 6,629 Replies
2095 Topics
AfvanJaffer
AfvanJafferBronze 5
asked in Google Security Operations
Merge function does not append, it's just overwriting for this event field - "event.idm.read_only_ud

Hi I'm trying to append a new label into the "event.idm.read_only_udm.target.resource.attribute.labels" field in the event.But when I try =>  creating a new label and merging it with the above event overwrites the values itself, dont append to it.Below is the code snippet:filter {json {source => "message"array_function => "split_columns"} grok {match => {"textPayload" => ['%{TIMESTAMP_ISO8601:istio_timestamp}\\] \\\\"%{WORD:method} (?:%{URIPATH:uri_path}(?:%{URIPARAM:uri_param})?|%{DATA}) %{DATA:protocol}" %{NUMBER:status_code} %{DATA:response_flags} %{NUMBER:bytes_received} %{NUMBER:bytes_sent} %{NUMBER:duration} (?:%{NUMBER:upstream_service_time}|%{DATA:tcp_service_time}) "%{DATA:forwarded_for}" "%{DATA:user_agent}" "%{DATA:request_id}" "%{DATA:authority}" "%{DATA:upstream_service}"']}}mutate {replace => {"_labels.value" => "%{authority}""_labels.key" => "authority"}} mutate {merge => {"event.idm.read_only_udm.target.resource.attribute.l

13
D
R
ragnarNew Member
posted in Google Security Operations
Solutions for playbook failed associated within case

Hello,I'm looking into possible solutions to have a use case as if the playbook attached to case, and that plb is failed in any node, blocks on execution, can get alert of notification or something similar on that. i.e. System, User Notification, small playbook which directly attached to all the open cases along with if they have playbook's execution, check if the primarily playbook execution been failed in somewhere. etc. Possible Solution: Jobs (similar to action monitor), Playbooks, Notification etc. Thank you.

01
F
Staff
R
ravivittalBronze 3
posted in Google Security Operations
WMIC Suspicious Scheduled Tasks and WMIC File Download

Hi, Does anyone have a sample rule example for detecting WMIC Suspicious Scheduled Tasks and WMIC File Download? I am looking for both Scheduled Task and File Download. My search of Github did not fectch me any results unfortunately. 

32
jstoner
Staff
A
Anonymous
posted in Google Security Operations
Chronicle parser for Oracle DB audit logs

Hello Team,Not able to parser the required fields from the oracle database audit logs.Sample log - <13>1 20**-0*-**T14:51:00+05:30 md****1 journal 3491695 - [meta sequenceId="2"] Oracle Audit[3491695]: LENGTH : '240' ACTION :[7] 'CONNECT' DATABASE USER:[1] '/' PRIVILEGE :[6] 'SYSDBA' CLIENT USER:[6] 'oracle' CLIENT TERMINAL:[0] '' STATUS:[1] '0' DBID:[0] '' SESSIONID:[10] '4294**7295' USERHOST:[7] 'md****1' CLIENT ADDRESS:[0] '' ACTION NUMBER:[3] '100' Not able to parser fields ACTION, DATABASE USER. etc We are getting Grok error, so we took the field DATABASE USER, and wrote grok for the particular field, refering the default parser, but still getting grok error. grok {match => {"message" => [".*DATABASE\\sUSER:(?<DATABASE_USER>.*)\\sPRIVILEGE.*"]}overwrite => ["DATABASE_USER"]on_error => "grok_dbuser_fail"}if [DATABASE_USER] not in ["", "/"] {mutate {replace => {"event.idm.read_only_udm.principal.user.user_display_name" => "%{DAT

01
D
L
Lord_CapybaraBronze 1
posted in Google Security Operations
How to identify each device that sends logs to a single forwarder collector?

I have multiple firewalls (same log type) sending logs to a single collector and I need to identify them by their IP addresses. Is there a way to do this neither having to create and label hundreds of collectors nor requiring manual maintenance (e.g., using rsyslog would require editing it's config file every time a new log source is added)?

12
D
D
dianibarNew Member
posted in Google Security Operations
Can I use cloud storage data access logs to monitor cloud storage with chronicle siem

Hello,I want to use chronicle SIEM to monitor cloud storage, so I can be alert in things like:High volume of data downloads, e.g. over a certain threshold of data.High number of files.Downloads from unusual IP addresses or IP addresses other than a few known ones.New identity/account downloading data.I checked the docs and the Cloud Audit Logs parser supports sources does not include Cloud Storage data access and field mapping references I can't find  storage.objects.get. Does it mean that by default this logs are not supported.Can you provide some ideas about what will be required to start monitoring cloud storage data access logs with Chronicle SIEM?

01
D
ORBR
ORBRBronze 5
posted in Google Security Operations
Create a loop in a playbook

Hello,Is there any way to create a loop action inside the SOAR playbook? 

52
M
S
srijankafleBronze 2
posted in Google Security Operations
Maximum character in log message

Hi Team,We are using Wazuh agent in some of our endpoint and using Chronicle forwarder to ingest those logs in to the Chronicle instance. Everything is working fine, however, we are noticing those logs are truncated at 8194 character (there are few that reach the limit). This is causing the parsers to fail - as the overall log is now not a JSON body. How can we increase the character limit.

21
D
S
santhoshactNew Member
posted in Google Security Operations
How to forward logs from Mysql DB server's table to Chronicle cloud or Chronicle Forwarder

Hi,We have a software product which writes logs to specific tables on Mysql DB on a Windows server, we need to forward those logs either directly to Chronicle or through forwarder, can anyone guide me how can i accomplish this?Thanks in advance

52
C
osiminel11
Staff
osiminel11Staff
posted in Google Security Operations
Community & Learning workshop - RSAC 2024

Attending RSAC 2024?   Join us at the upcoming Google Security Operations workshop, where we'll do a deep dive into Search capabilities. https://www.googlecloudcommunity.com/gc/Events/Community-amp-Learning-Workshop-RSAC/ev-p/732954  

100
osiminel11
Staff
M
mr345123Bronze 1
posted in Google Security Operations
Can a parser extension overwrite the timestamp?

 I have tested a date filter that imports the metadata.event_timestamp correctly when used in a custom parser.  I set the timezone in the date filter and the tz offset is applied to the time so that the metadata.event_timestamp is correct in Z time.When I test the same date filter when creating a parser extension,  the UDM output preview of the metadata.event_timestamp has the original time without the tz offset applied. Can a parser extension be used to overwrite event_timestamp? 

51
D
L
LewisHillNew Member
posted in Google Security Operations
Certificate of Sanitization in the Cloud

Hi everyone,A customer is requiring a certificate of sanitization as per NIST SP 800-88 guidelines. I've done some research on my own but, from the articles I read, it is a bit of a grey area and I have hit a wall. I'm aware that in the background, google, AWS, and Azure are all following NIST SP 800-88 when it comes to decommissioning storage media but this doesn't really help me in providing a certificate to the customer. The guidelines recommend cryptographic erasure and provide some guidance on generally how to verify cryptographic erasure which seems to be the right direction but I am still not confident on how compliant data sanitization is performed in the cloud.Does anyone have any experience with needing certificates of sanitization in the cloud that could help guide me in understanding the process? Any help is appreciated! 

11
D
S
samryanturnerBronze 5
posted in Google Security Operations
Closed Case Search

I'm currently using the below to get all closed cases within our SOAR platform - https://cloud.google.com/chronicle/docs/soar/reference/siemplify-module#get_cases_ids_by_filter This code below is returning "Action failed as JSON result exceeded maximum size 0MB". Am I using this wrong or am I missing further parameters? With the max results being set to 1000 by default i'm expecting the last 1000 case ID's that are closed. - closed_cases = siemplify.get_cases_ids_by_filter("CLOSE", sort_by="CLOSE_TIME")

11
F
Staff
G
GonFreecssNew Member
asked in Google Security Operations
Writing Data to the File System

There are a few situations where it would be useful to write data to the file system, but my experience is that the data will not persist for more than a few days. I've tried writing data within the integration folder, above the integration, to /var/lib/*, and so on...all without any luck. The data soon disappears.A specific example is the use of AWS Secret Manager. A credential file cannot be used because it will not persist. For now, using a parameter will suffice, but there are other uses for writing local data to support custom jobs/actions that need to track information between runs.Any ideas are appreciated. Thank you!

12
G
M
misbano02New Member
posted in Google Security Operations
Need help with MFA usecase for adding new device or deleting a device

Hi Team,I have integrated O365 to chronicle SIEM and want to create a usecase for MFA activities. Specifically, if a user adds new device, deletes a device or deletes MFA then it should trigger alert.Can it be done using O365 los only or do I have to integrate Azure AD as well. is these any usecase available????

12
jstoner
Staff
T
taejunNew Member
posted in Google Security Operations
MISP Question

Hi guys, I have q question while setup chronicle.When checking ioc matehes log, I can check the feed information "MISP" Is chronicle already integrated with MISP?If i want to write a rule with MISP data, do i not need to do any additional MISP integration work?

02
jstoner
Staff
S
syedabuthahirNew Member
posted in Google Security Operations
Configure single sign-on (SSO) on edge

am facing issue on Configure single sign-on (SSO) on edge browser and getting the below error.The list of SSO providers could not be loaded.Please assist me on this issue.

41
D
A
Alexander567New Member
posted in Google Security Operations
Chronicle installment

I can't downloaded chronicle, I have already registered for for free edition but still I can't even get a chronicle site Pls  I need help. Thank you 

01
D
ORBR
ORBRBronze 5
posted in Google Security Operations
Builtin email settings vs. Exchange integration

Hi, If I want to send\\ receive emails to\\ from customers via a dedicated mailbox, what would be the best way to configure it? using the built-in SOAR email settings (customer configuration) or the exchange integration from the marketplace?

11
D
P
pruebaschroniclNew Member
posted in Google Security Operations
Compare similar cases

I have a doubt, I am making a playbook in which I use two actions (Get similar Case), in one of them I look at IPs and in another one I look at Users. The output of these actions is an array of case identifiers, how can I compare these 2 arrays to see if any of their elements match?

01
D
C
cmschelinNew Member
posted in Google Security Operations
Decrypting encrypted log traffic to the forwarder

We have a Chronicle forwarder set up, and we plan to send logs to it. Logs will be sent over the internet, so we're looking to encrypt the syslog data coming from our servers (rsyslog for Linux, nxlog for Windows).How do we ensure that the Chronicle forwarder unencrypts those logs before sending them up to the cloud?

21
D
M
misbano02New Member
posted in Google Security Operations
Need help to write regex for chronicle siem

write a regex to capture value between @ and " for below string.[{\\"ActionType\\":\\"Forward\\",\\"Recipients\\":[\\"Katrina.Demon@whxyz.co.um\\"],\\"ForwardFlags\\":\\"None\\"}] which is whxyz.co.um in above string.  or help write a yara code for capturing the same.  I am trying below, but is it giving error. re.capture ($e.security_result.detection_fields.value, "\\["([^"]+)"\\]") = $Domain

82
David-French
Staff
M
Mehul2New Member
posted in Google Security Operations
Chronicle script giving 404 (Resource Entity not found) at the time of ingesting logs to chronicle

Hi, CommunityWe have one of the chronicle script from https://github.com/chronicle/ingestion-scripts executing on GCP function and we are collecting data from ABC platform to chronicle.We are observed that we have successfully collected logs from the ABC platform and when we script try to forward collected logs to chronicle then we are getting below error.{    'code': 404 ,    'message' : 'Requested entity was not found.',    'status' : 'NOT_FOUND'}this error throw from the folder commom/ingest.py  line 206can someone help us to resolve this issue or suggest any possible solution.Thanks  

51
M
mokatsu
mokatsuBronze 5
posted in Google Security Operations
CSV Custom IOC Parser

I am trying to pull data by using the CSV Custom IOC feed from a GCP storage bucket. Looking at the Parser I structured the csv that is saved within the GCP storage based on the parser but When logs are ingested they are still coming in as "unparsed".1. Has anyone had any luck with that parser/feed?2. Does each column need to be filled (no empty values)?Any tips or guidance would be appreciated.

21
D
C
charetoileNew Member
posted in Google Security Operations
Chronicle SOAR: Shift Roster

Good afternoon,I am currently trying to implement case assignments based on different shifts amongst the team - also known as shift roster. Is there any out of the box functionality that I will be able to use in order to achieve this ? I am currently trying to evade complexity by using custom lists, custom functions and so on.If this functionality is not present/available, how are you guys doing it ? Appreciate your feedback on this topic.

21
D

Badge winners

Show all badges
Terms & ConditionsCookie settings
Privacy Policy Terms of Service Gen AI Policy Community Guidelines Cookie Settings

© 2025 Google. All rights reserved.