Skip to main content

Google Security Operations

Your Security Operations conversation starts here. Ask questions. Share insights. Tell us what you've learned. Or tell us what you're working on. We want to hear about it!

  • 2,087 Topics
  • 6,615 Replies
2088 Topics
T
TheSecOpsGuyBronze 5
posted in Google Security Operations
Parser for Raw logs

HI team, I require assistance in developing a custom parser for processing raw logs. Additionally, I seek guidance on constructing a filter within the Chronicle environment. Would you please guide me ? Thank you !

82
T
lime
limeBronze 1
posted in Google Security Operations
Chronicle. Azure AD / O365 logs

What is the correct way to ingest Azure Active Directory logs into Google Chronicle? I am trying to use Azure Blob Storage and the Third Party API option but neither are working. I have created an app in Azure, granted it the below permissions and then plugged the keys into Chronicle but to no avail. Am I missing a permission? Is there something obvious I might have missed? Here are the permissions my Azure App Registration has:AuditLog.Read.AllAuthenticationContext.Read.AllAuthenticationContext.ReadWrite.AllIdentityRiskEvent.Read.AllIdentityRiskEvent.ReadWrite.AllIdentityRiskyServicePrincipal.Read.AllIdentityRiskyServicePrincipal.ReadWrite.AllIdentityRiskyUser.Read.AllIdentityRiskyUser.ReadWrite.AllSecurityEvents.Read.AllSecurityEvents.ReadWrite.AllUser.ReadOffice 365 Management APIs (3)ActivityFeed.ReadActivityFeed.ReadDlpServiceHealth.Read@Nick_Troutini have you seen this? any tips?Update:I am no longer getting "failed" instead I have "active" but no Azure AD log

57
R
Staff
A
amalone341Bronze 1
posted in Google Security Operations
Detection Request Around Golden Image Lateral Movement in GCP

Recently I reviewed an article covering an attack path that an actor took in a Google Workspace/GCP environment.https://www.bitdefender.com/blog/businessinsights/the-chain-reaction-new-methods-for-extending-local-breaches-in-google-workspace/When going over the TTPs one mentioned as "Golden Image Lateral Movement" stood out. The technique boils down to local accounts containing the same credentials on a VM if that VM gets cloned. Assuming an organization has ample GCP logs (Like GCP Cloud Audit) is there a detection that can see this behavior?The FP rate will likely be high when looking for all clones however different orgs could modify the rule to bump out known procedures for cloning VMs.

22
A
K
krunalmNew Member
posted in Google Security Operations
Handle playbook runs with Alert grouping

Hello,I'm using alert grouping for Microsoft defender cases and so multiple alerts get grouped based on the Incident ID being the same for all. However, each one individually gets a playbook running and I'm not sure if there's a way to have all other playbooks pause while the first alerts runs through and have them run sequentially. I see an action "Wait for playbook to complete" but that seems like it'll only work if it's within the same alert and not across a single case.Any help on this would be highly appreciated. Open to any ideas here!Thank you,Krunal M

02
K
J
JaimedesNew Member
posted in Google Security Operations
Cannot Access SOAR Free Edition

I have tried to follow the path in order to try the free instance offered to the community of the SOAR. I am trying to obtain the Google Cloud SecOps Technical Credential and it would be great to be able to access an instance of the  SOAR a bit in order to understand it better. Hope somebody can help me.Thank you for your time!Jaime 

03
S
Staff
E
Eddy_GuzmanNew Member
posted in Google Security Operations
Is this type of SIEM needs agents to be installed on the client host?

I will like to know, if this type of SIEM needs agents to be installed on the client host?

11
G
E
Esmeralda_LaraNew Member
posted in Google Security Operations
Is there a phone number to communicate with support???

Hello Everyone!!! Someone know if its a phone number to communicate with support???

02
G
E
ev13New Member
posted in Google Security Operations
SIEM rule to detect encryption

anyone here tried creating a rule that was able to capture encryption in a host,I would like to get some ideas on how you do it,

12
AymanC
S
Sebastian-indevNew Member
asked in Google Security Operations
Incoming Forwarder Bytes Limit

Hello,our customer tries to sent files to parser which are bigger than 65000 bytes. Is this a forwarder limitation? If it is, is there a nice solution to reduce the attributes for the AD user context files. https://cloud.google.com/chronicle/docs/ingestion/default-parsers/collect-windows-adThanks for your help!

01
M
Staff
D
diego_santos1New Member
posted in Google Security Operations
Dashboard Sharing Request

Does anyone have a dashboard to share? I have a few, but I'd like to see some different perspectives.  

01
M
Staff
A
Anonymous
posted in Google Security Operations
Chronicle SIEM release date

Do any of you know when Google Chronicle SIEM was officially released? I cannot find any resources about this.

12
jstoner
Staff
R
recon_acookNew Member
posted in Google Security Operations
Is there a guide for submitting a custom integration to the marketplace

Is there a guide for submitting a custom integration to the marketplace and any best practices we should follow to increase the chance of acceptance?

02
hzmndt
Staff
stefancoook1
stefancoook1Bronze 2
posted in Google Security Operations
Migrating log data to a new data label

Has anyone here ingested data to SIEM via a temporary label and then migrated to a new data label? We recently requested a new label for a net new data source and we're looking for the best way to migrate to this new data label.From what were hearing, it sounds like we need to start over and turn off the old feed and start a new feed with the same label. However, it seems that we cannot have duplicate logs in Chronicle (with the old logs persisting) without having errors. Would we need to manually delete or modify the stale logs from the previous data label in Chronicle in order to push data to this new data label?

01
M
J
joshgmiNew Member
posted in Google Security Operations
How to maintain state in async action?

We are pulling results from an internal API for an action that needs to be executed by another system. When the results are returned, we are making multiple comments because each execution of the async action thinks the results are new. The problem is there are multiple actions that need to run so when the results are returned the action is not yet complete. One idea was to use the scripting directory to track progress, but there has to be something more elegant. 

11
M
K
krunalmNew Member
posted in Google Security Operations
Anyone here utilizing the Starlight Stellar connector that's out of the box for ingesting alarms?

Hey guys, a new member on the community but have been using Chronicle SOAR for for around 18 months now. Anyone here utilizing the Starlight Stellar connector that's out of the box for ingesting alarms?

01
M
L
Lawrence_MichelNew Member
posted in Google Security Operations
Looking for guidance to troubleshoot some Azure actions for a simulated cases?

Looking for guidance to troubleshoot some Azure actions for a simulated case for some reason I am able to trigger on the simulated case but azure ad actions can't ingest the case data

01
M
J
Jure_HorvatNew Member
posted in Google Security Operations
Duplication of connector for mapping purposes

Hello,is it possible to somehow duplicate a connector, so there is new mapping available?For instance, i have an EmailV2 connector. I use it for different purposes:1. XDR integration (since it lacks the connector), i parse the data via e-mail.2. Manual Enrichment (we have a pre-set form that analysts can send to an e-mail and it will return the needed data)3. Vulnerability e-mails from different providers4. etc.... At some point, all the available fields in mapping are full. Is there a way to duplicate the connector so i get a new set of mapping available in onotology? I.E.EmailV2 - Data enrichment protectorEmailV2 - Vulnerability managementEmailV2 - SIEM .....So, at some point, the mapping is full and i cannot parse anything else (without custom regex actions that we have in place, but that does not enable us to work with entities.   

00
J
N
NastyaSBronze 2
posted in Google Security Operations
Deprecated label in YARA-L Rule

Hello everyone!I am having a doubt regarding the deprecated label; i.e.,  $ioc.graph.entity.labels.key, which has to be populated as $ioc.graph.entity.user.attribute.labels.key nowadays.I am using this new label in the rule, however, all logs contain deprecated labels entity.labels.key and entity.labels.value, thus the rule doesn't detect logs with $ioc.graph.entity.user.attribute.labels.key.I would like to know, if there is some way to define in the rule that $ioc.graph.entity.user.attribute.labels.key = $ioc.graph.entity.labels.key or such option doesn't exist and I have to ignore the compilation warning and keep using the deprecated label? Thank you in advance!🙂

02
N
K
Kalia-66Bronze 1
asked in Google Security Operations
UDM event for Storage.Object events

Hey folks!!For GCP audit logs does anyone know if there are any udm event for storage.object.get or storage.object.delete? I am unable to find any information on it. I can locate the events by querying Udm.metadata.product_event_type = “storage.buckets.delete” 

02
D
D
deeshuBronze 2
asked in Google Security Operations
Event Color Coding

What does this different color (Green, Grey, Red, violet etc..) coding says for an Event? Are there any more ?@jstoner Is there any kb that covers this topic? I tried finding but no luck.

14
jstoner
Staff
M
mountaincode2Silver 2
asked in Google Security Operations
How do I login to the SOAR free edition?

How can I log in to the SOAR free edition:https://app.siemplify-soar.com/#/login 

24
M
A
abhi-kakadiya-7New Member
posted in Google Security Operations
What is BigQuery export feature in Chronicle ?

There's an official Chronicle Looker block available on the Marketplace, and it mentions that the 'BigQuery Export feature needs to be enabled for your Chronicle tenant.' Can someone please explain what this feature is and how I can set it up?Block on Marketplace I understand that this feature involves the Chronicle sending parsed events to BigQuery, which can then be used to connect with Looker. I'm currently facing delays in seeing these events in BigQuery. Is there anyone who can assist me with this issue?

01
M
Staff
N
NastyaSBronze 2
asked in Google Security Operations
Regex in YARA-L rule

Hello everyone!Im currently struggling with the regex usage in the rule.I need to create a regex in order to detect the logs with an Admin privilege from  "PermissionGroup": "Admins" or "SocRole": "Administrator"security_result.detection_fields.value = "{\\"PermissionGroup\\": \\"Admins\\",\\"SocRole\\": \\"Administrator\\"}" I created regex on the regex website to match SocRole : (?<=\\"SocRole\\":\\s\\")(.*?)(?=\\")However, when Im trying to apply it in my rule, it keeps giving the error that literal is not terminatedre.regex($e.security_result.detection_fields.value, `(?<=\\"SocRole\\":\\s\\")(.*?)(?=\\")` I also tried this way:$e.security_result.detection_fields.value = /SocRole:.*/ . but it doesnt detect any logs  Can you please help me to correct this issue?Thanks in advance!🙂

175
AymanC
S
SurP0000001Bronze 2
asked in Google Security Operations
Chronicle default threat detection rules - is there any repo to review them?

Is there a list of out-of-box Chronicle rules available somewhere to review? Similar to what SCC Premium provides here: https://cloud.google.com/security-command-center/docs/how-to-use-event-threat-detection

49
S
P
phaubertinBronze 2
posted in Google Security Operations
gcp_dns_modification.yaral tuning issue

Hi all, I'm working on tuning that yaral rules gcp_cloudaudit/gcp_dns_modification.yaral   from the github repo. When I look at detection vs rules languages, the udm fields target.user.email_addresses isn't present in our procedural filtering.  the udm fields that lookalike the most has an email address, is  target.user.userid . I want to know if target.user.email_addresses is still a valid field? if not, by which it's replaced. Other question, our goal whould be to exclude all DNS operation made by  container-engine-robot.iam.gserviceaccount.com that is GKE managed SA by GCP. We are under the impression that SA is managed by google, and It would be tiny risk that Threat actor could take over this account. Thanks for your help, 

02
P

Badge winners

  • Comments Posted 1
    hytech_sghas earned the badge Comments Posted 1
  • Solution 1
    Rmosshas earned the badge Solution 1
  • Authored Posts 1
    Umairbadar39has earned the badge Authored Posts 1
  • Comments Posted 1
    Rmosshas earned the badge Comments Posted 1
  • Comments Posted 1
    Gabby23has earned the badge Comments Posted 1
Show all badges
Terms & ConditionsCookie settings
Privacy Policy Terms of Service Gen AI Policy Community Guidelines Cookie Settings

© 2025 Google. All rights reserved.