Skip to main content

Google Security Operations

Your Security Operations conversation starts here. Ask questions. Share insights. Tell us what you've learned. Or tell us what you're working on. We want to hear about it!

  • 2,092 Topics
  • 6,622 Replies
2093 Topics
R
ravivittalBronze 3
asked in Google Security Operations
Track EID 7045 windows events to monitor new services

Does anyone have a sample rule they can share with me to track EID 7045 windows events to monitor new services? Also any sample rules or pointers you can provide for this detection would be a ton of help.- Randomized powershell executables - hash is poweshell.exe but file name is different.

13
R
G
GonFreecssNew Member
posted in Google Security Operations
Localization settings don't work as expected

When I click the my user icon (I'm an admin) in the upper-right, there is a "localization" option that allows the timezone and time/date format to be customized. The timezone setting doesn't appear to have any affect on the date/times displayed. I've tried multiple times, refreshed, etc. with no result. Whatever setting I choose does persist in the UI. It's not like I'm choosing a timezone, and it gets reset, but the date/times don't reflect my choice.If I go to SOAR Settings --> Advanced ---> Localization and change the timezone, the effects are immediate and my user Localization settings are reset. This is expected and the UI explains this well. This is where it gets a bit weird. After changing the timezone in the Advanced settings, if I return to my user settings, the instant I click the Localization option (NOT clicking the dropdown to change the timezone), the timezone is reset to UTC (no refresh needed). Then I'm back to square 1. Whatever I select has no effect, and I

02
G
D
dooyoungNew Member
asked in Google Security Operations
Is there a way to set up Syslog transport in a customer security solution and send it directly to Ch

Is there a way to set up Syslog transport in a customer security solution and send it directly to Chronicle?Syslog settings exist in customer security solutions without configuring Forward. You can configure log transmission right away by entering the Chronicle IP address here.However, when checking Chronicle Documents, it appears that there is no way to configure a forwarder or receive feed directly if there is no API.Unfortunately, the solution used by the customer is a security solution developed in South Korea and is not included in the definition provided in the Feed Source type.However, since it is a Linux-based solution, it is equipped with a transmission function through Rsyslog.Is there no way??

11
mikewilusz
Staff
M
mccrilbSilver 2
posted in Google Security Operations
URLhaus and SPAMhaus

I have two feature requests if anyone is interested. Also the API is pretty well documented if you don't want to wait. All info is below.Integration: URLhaushttps://issuetracker.google.com/issues/328715673Description:URLhaus provides a database of malicious URL's which is searchable by URL, Domain, Hash, tag or file typehttps://urlhaus.abuse.ch/browse/Many threat hunters use this service and there is no cost. The Use case would be for enrichment.API Documentation is located here: https://urlhaus-api.abuse.ch/SPAMhaushttps://issuetracker.google.com/issues/328450203For Domains and IP's. There is a limit of 5000 API requests per month Documenation: https://www.spamhaus.com/API Documentation: https://docs.spamhaus.com/sia/docs/source/10-API-Interface/110-API.html  

20
M
N
nehasrivastavaNew Member
posted in Google Security Operations
Authentication casesearchapi

HiI am getting 401 for call to casesearcheverything api callThe calls works for my company domain swagger but what should I be looking to  configure authentication via code ? Ex any headers , key-secret , auth calls ?I am using Java/springboot as dev env.Appreciate any pointers thanks

03
T
Staff
Chris_B
Chris_BBronze 5
posted in Google Security Operations
Ingesting Windows logs into Chronicle

Anyone have a good experience ingesting Windows logs into Chronicle? I’ve heard nxlogs , cribl, etc. E.g. can Chronicle use cribl stream ? I see there’s “edge” and “stream” flavors of cribl?

87
Tonio
R
Roni11Bronze 2
posted in Google Security Operations
Monitor GCP projects in Chronicle

Hello,How can I monitor my project in GCP  directly?I need to track every action that takes place in my project, for example: a new user is created, a new bucket is created, some changes have been made in vpc..I added my project in Chronicle settings - GOOGLE CLOUD PLATFORM. Does it have anything to do with my goal?Thank you

21
P
R
Roni11Bronze 2
asked in Google Security Operations
Help with YARA-L Rule

I need to create a rule that will trigger an alert every time a new bucket is created in GCP.I tried to do this - rule new_bucket_creation { meta:description = "Alert if a new bucket is created"severity = "Medium"events:$bucket.metadata.event_type = "RESOURCE_CREATION"$bucket.target.resource.resource_type = "STORAGE_BUCKET"outcome:$risk_score = 0condition:$bucket} How do I write such a rule? How should I properly change the rule I wrote?  Thank you

01
jstoner
Staff
N
nehasrivastavaNew Member
asked in Google Security Operations
CaseSearchEverything API

HelloI'm looking for a solution into using CaseSearchEverything API. As I understand1) it returns all cases based on created time based filter . Does it return also updated cases. Does It returns cases based on created time only? What happens when a case is updated. How to get based on updated time.2) Also how to get All comments for all cases instead of just one case id at a time ? We can get all cases using the above api but then have to do get comment using caseid, so it is doable but would be nice to get all related information together .Appreciate any pointers Thanks

64
N
S
srijankafleBronze 2
posted in Google Security Operations
Using markdown for dynamic values

Is there anyway we can use values from logs to populate in a markdown widget? I am trying to write a something similar to executive summary using markdown but instead of it being static I want to fetch some fields from the logs such as count of total events and authentication failure count. If yes, is there any reference document for the same?

00
S
S
samnewtonNew Member
asked in Google Security Operations
MISP Ingestion Integration

Hi Everyone,I've set up the MISP Ingestion Integration but I'm having no luck getting events from MISP. Every time it downloads, there are 0 events. No errors, just no events.Has anyone done this successfully? I'm pulling my hair out.Thank you Sam 

04
cmmartin_google
Staff
S
Suraj_RNew Member
posted in Google Security Operations
Is there any way through which we can get the raw logs from Chronicle SIEM back to SOAR?

Hey Team, Is there any way through which we can get the raw logs ( not UDM mapped) from Chronicle SIEM back to SOAR? Something like a reverse search from SOAR to SIEM or anything else, as we are only having the mapped fields available in SOAR.... Thank you

125
R
Chris_B
Chris_BBronze 5
posted in Google Security Operations
remote login analysis using IP addresses - unreliable?

@Marie_Chudolij  YouTube video 2-27-24 - Chronicle SOAR to the Rescue: Orchestrate SIEM Reference List Updates for Improved Threat DetectionI suggest IP addresses and info inferred from IP address can be unreliable for remote login analysis as:- the geo location is not 100% reliable per se- logins via VPNs with changing IPs- logins via cloud resources (why is Joe from Chicago coming in from Council Bluffs, IA every few minutes?)In future sessions I'm interested in more behavior based analysis to look for bad remote logins.I enjoyed the YouTube video - thx for your work

01
D
Staff
ORBR
ORBRBronze 5
posted in Google Security Operations
Get Insights \\ Detailed table from JSON results

Hey,I`m struggling with some issues when trying to present insight on the case\\ alert page after enrichment actions, for example, QRadar AQL search or AAD user enrichment.I tried using the "Insights_Create Entity Insight From JSON" action but no luck. I would appreciate it if someone could please share a tutorial.

01
S
D
Staff
dnehodaStaff
posted in Google Security Operations
Empowering Detection Engineering with Chronicle SIEM and Mandiant Security Validation

Empowering Detection Engineering with Chronicle SIEM and Mandiant Security Validation       Introduction   Detection engineers face the relentless task of creating, refining, and validating SIEM rules to keep pace with evolving threats.  Ad hoc testing and reliance on simulated attacks often lead to blind spots and false positives. Mandiant Security Validation (MSV) offers a systematic, attack-centric approach to streamline rule development and proactively uncover weaknesses in your detection logic.   MSV for the Detection Engineer Beyond Vulnerability Scans: MSV tests your entire detection pipeline, not just isolated attack components. This uncovers gaps where SIEM rules may be too narrow or fail to correlate events across the attack lifecycle. Actionable Data: MSV doesn't just tell you if a rule works. It pinpoints exactly why an attack was missed (lack of required logs, flawed rule logic) or identifies the stages where existing rules trigger, highligh

10
D
Staff
A
amalone341Bronze 1
posted in Google Security Operations
Set of Yara-L Rules

Hey everyone, I got inspired and decided to write up a few of the rules i've written in Yara-L. The examples at the bottom of the repository show some of the flexibility Yara-L gives you and are good examples to learn off of. Please let me know if there are any questions, comments, or advice in regards to any of the rules. https://github.com/amalone341/YARA-L-Work

53
F
rav1and3
rav1and3Bronze 3
posted in Google Security Operations
Has anyone come across successful parsing for AWS logs with kinesis firehose format

I have logs in JSON format. Single log line has multiple single json objects delimited by new line. here each json object is one log. This is for AWS_ROUTE_53 parser.{"field1" : "value","filed2" : [ { "field3": "value" } ]}{"field1" : "value","filed2" : [ { "field3": "value" } ]}

22
rav1and3
D
Staff
dnehodaStaff
posted in Google Security Operations
Part 1: Dipping Your Toe into SOAR: Understanding the Basics

Part 1: Dipping Your Toe into SOAR: Understanding the Basics The Ocean of Security Threats     The relentless barrage of endpoint alerts your team faces is overwhelming – like a lone lifeguard battling an endless onslaught of waves. Manually sifting through these alerts to identify true threats is both exhausting and risky. To successfully navigate this digital ocean, you need powerful tools. Manual Response: Tiring and Time-Consuming Relying solely on manual processes for endpoint security creates a perfect storm. Analysts spend countless hours juggling alerts from disparate tools (like Tanium or CrowdStrike), struggling to piece together fragmented information, and performing repetitive analysis tasks. This steals precious time and energy away from proactively thwarting the most dangerous attacks.   A Life Raft Called SOAR       SOAR (Security Orchestration, Automation, and Response) is the solution! It's a comprehensive framework that transforms you

40
D
Staff
R
Rahul_shah799New Member
asked in Google Security Operations
Yara to count the no. of any characters repeated in the command line

1. Is there any way in Yara to count the no. of any characters repeated in the command line?Below is the scenario i am trying to solvehttps://redcanary.com/threat-detection-report/techniques/obfuscated-files-information/  

02
R
M
mountaincode2Silver 2
posted in Google Security Operations
Trying to understand the statedump of my parser

I am trying to understand the statedump of my parser code.Raw log: { "records": { "hostname": "host" }, "resourceIdentifiers": [ { "tentantid": "a123", "type": "access", "subnet": [ { "ip": "10.1.1.1" }, { "ip": "10.1.1.2" } ] } ] } Parser: filter { json { source => "message" array_function => "split_columns" } for i, data in records.resourceIdentifiers { for j, subnet in data.subnet { mutate { replace => { "target.ip" => "subnet.ip" } merge => { "event.idm.read_only_udm.target" => "target.ip" } } } } statedump {} } Statedump: Internal State (label=): { "@createTimestamp": { "nanos": 0, "seconds": 1708690606 }, "@enableCbnForLoop": true, "@onErrorCount": 0, "@output": [], "@timezone": "", "message": "{\\n \\"records\\": {\\n \\"hostname\\": \\"host\\"\\n },\\

31
M
A
aravind_s12321Bronze 1
posted in Google Security Operations
Urgent: Error occured while parsing

Hello All,We have encountered an error while we trying to parse. Please find the below error.generic::unknown: pipeline.ParseLogEntry failed: LOG_PARSING_CBN_ERROR: "generic::invalid_argument: failed to convert raw output to events: failed to convert raw message 0: field \\"idm\\": index 0: recursive rawDataToProto failed: field \\"entity\\": index 0: recursive rawDataToProto failed: field \\"entity\\": index 0: recursive rawDataToProto failed: field \\"asset\\": index 0: recursive rawDataToProto failed: field \\"ip\\": failed to make strategy: received non-slice or non-array raw output for repeated field"Could anyone please let me know how to rectify this?

174
rahul7514
V
vyshakvNew Member
asked in Google Security Operations
Chronicle SOAR Free Edition

Looks like there is a bug in registering for the SOAR free edition, I am unable to find a way after sign in

02
V
M
mountaincode2Silver 2
asked in Google Security Operations
Why is the validation of my custom parser failing?

Hello,I am testing a custom parser for JSON data, but i am unable to get it to work.The log in JSON is as follows:{ "records": [ { "hostname": "host" }, { "hostname": "host1" }, { "hostname": "host2" } ] }The parser code is as follows:filter {for index, data in records {  if index == 0 {    mutate {      replace => { "target.hostname" => "%{data.hostname}" }    }  }  else {    mutate {      replace => { "intermediary.hostname" => "%{data.hostname}" }    }    mutate {      merge => { "event.idm.readonly_udm.intermediary" => "intermediary" }   }  }}}I want to see the output of my code. But I am unable to. I see the message failed: How can I get this to work.  

59
M
P
Paulo-LopesBronze 2
asked in Google Security Operations
Curated detections capacity

Hello, I enabled some curated detections and now chronicle is saying that I'm reaching the full capacity that will prevent enable further rules.But I did not enabled all curated rules, there are some missing windows threats to enable.Is there anyway to upgrade curated rules capacity? How can I use these rules if I cannot enable all of them? 

33
DAPerry
Staff
T
tayvionpNew Member
asked in Google Security Operations
Using Regex Fields as Variable

Utilizing Chronicle's first seen and last seen feature to create somewhat of an anomaly-based detection. The detection should take when an event was first seen if seen at all, and if the alert has been seen after 14 days then we should be alerted. However, I have to utilize a regex to retrieve the username. This then needs to be pulled into the entity graph, which means I have to utilize a variable for this to happen. here's a copy of the logic I have so far rule ripple_auth0_anomaly_ldap_vault_creds { meta: author = "tpayton" description = "Detects anomalous issuance of vault credentials to ldap users." events: // Retrieve all Auth0 events regarding the issuance of vault temp creds for ldap users $event.metadata.log_type = "AUTH_ZERO" $event.principal.hostname = /^Temp Vault Client auth=ldap/ nocase // Extract LDAP user $ldap_user = re.regex($event.principal.hostname, "auth=([^ ]+) expires") $entity.graph.entity.hostname = $ldap_user

12
T

Badge winners

  • Authored Posts 5
    ayush_gupta_oakhas earned the badge Authored Posts 5
  • Comments Posted 1
    jetheridgehas earned the badge Comments Posted 1
  • Solution 1
    _eohas earned the badge Solution 1
  • Comments Posted 1
    utshas earned the badge Comments Posted 1
  • Authored Posts 5
    maxjunkerhas earned the badge Authored Posts 5
Show all badges
Terms & ConditionsCookie settings
Privacy Policy Terms of Service Gen AI Policy Community Guidelines Cookie Settings

© 2025 Google. All rights reserved.