Skip to main content

Google Security Operations

Your Security Operations conversation starts here. Ask questions. Share insights. Tell us what you've learned. Or tell us what you're working on. We want to hear about it!

  • 2,083 Topics
  • 6,591 Replies
2084 Topics
M
minkayaNew Member
posted in Google Security Operations
How can I ingest firewall traffic logs with Google Cloud Audit ?

Hi all, Can I ingest firewall traffic logs with Google Cloud Audit and how? Is there a link or feed about that? I saw firewall rule logging but it is I guess about configuration changes about firewall not related to trafic logs.

02
M
S
spawar_apexBronze 2
posted in Google Security Operations
when using the search chronicle api, is there a way to get more than 10,000 events?

Hi Team, when using the search chronicle api, is there a way to get more than 10,000 events? or some type of paging functionality? https://cloud.google.com/chronicle/docs/reference/search-api As per doc, it says What is the Page Size Property? - For each API call, you can specify the page_size property to limit the maximum number of returned results. As there's no next page token, to limit the volume of data returned, specify a narrower time range. Any help would be appreciated? Thanks!

15
S
manoj610
manoj610New Member
posted in Google Security Operations
How to parse security_result for any severity?

How to parse security_result for any severity

34
manoj610
K
Kalia-66Bronze 1
posted in Google Security Operations
How to represent linux group data in UDM?

Hi! We’d like to ingest some UDM data about group creation events (specifically linux groups created on a host via a cmdline process or other similar means), and we were wondering if you guys have any recommendations for how best to represent this kind of group in the UDM? I initially wanted to use the Group entity ( link ), but upon closer inspection of the fields, it seems like that entity is more intended for organizational groups (eg. LDAP groups)? So, we were wondering if anyone has any suggestions for a good way to represent linux group data in UDM?

02
K
K
krunalmNew Member
posted in Google Security Operations
Has anyone been able to use "filter" function within the JSON result pop-up?

Has anyone been able to use "filter" function within the JSON result pop-up? I've tried multiple times but I'm getting error saying invalid key, not found. Any working examples would be much appreciated! Thanks!

16
K
J
Joseph3New Member
posted in Google Security Operations
Can you please explain me about the priority controls order in subnets?

@Dmitry_Sarakeev , Please another question, the priority column in the Environment - Networks, for subnet upload in settings, please can you explain what the function of this is? Thanks

02
J
G
Greg_BammelNew Member
posted in Google Security Operations
Help with this error after connector returns from the integration?

Any ideas on this error? It's occurring after the connector returns from the integration. The connector states it created Connector Execution: Dynamic script connector <Connector Name> Connector_d007badf-5245-45f3-97f4-4edfce9caa3d returned unexpected output. No cases created; Exception: Newtonsoft.Json.JsonReaderException: Unexpected character encountered while parsing value: {. Path 'cases[0].environment', line 1, position 28. at Newtonsoft.Json.JsonTextReader.ReadStringValue(ReadType readType) at Newtonsoft.Json.JsonTextReader.ReadAsString() at Newtonsoft.Json.JsonReader.ReadForType(JsonContract contract, Boolean hasConverter) at Newtonsoft.Json.Serialization.JsonSerializerInternalReader.PopulateObject(Object newObject, JsonReader reader, JsonObjectContract contract, JsonProperty member, String id) at Newtonsoft.Json.Serialization.JsonSerializerInternalReader.CreateObject(JsonReader reader, Type objectType, JsonContract contract, JsonProperty mem

33
S
Staff
R
Roberto_DelNew Member
posted in Google Security Operations
How do you deal with nested JSON when creating a parser?

How do you deal with nested JSON when creating a parser? I see that JSON filter does not support nested JSON.

02
R
R
Roberto_DelNew Member
posted in Google Security Operations
How can we add a new log type? Do we have to contact google?

Hello everyone, we need to add the logs from a software that is still not supported in Chronicle, we will write our own parser. How can we add a new log type? Do we have to contact google?

14
R
M
minkayaNew Member
posted in Google Security Operations
I have a question about search page result limit on chronicle?

I have a question about search page result limit on chronicle. Even I changed the time interval, I can just see 10K event result. Is there any suggestion to increase the limit? Or is there any limitation for search result per search

09
M
J
Joseph3New Member
posted in Google Security Operations
Has anyone utilized the Re-Attach Playbook under Tools before and can explain how it works?

Dear Community, Please, has anyone utilized the Re-Attach Playbook under Tools before and can explain how it works? I noticed at my end that trying to execute the action within the same playbook you want to re-attach doesn't seem possible and that's what would have made sense logically.

011
J
P
pwckimmyNew Member
posted in Google Security Operations
Forward OS Log to Chronicle

After I deploy Chronicle Forwarder on Linux or Windows. Does Chronicle Forwarder transmit my OS data to Chonicle through the Internet?Can I establish a secure tunnel such as IPSec VPN between our data center and Chonicle to ensure data security and link stability?

03
E
A
aguerojcNew Member
posted in Google Security Operations
The article “How to Use GitSync” provides full details! - Access denied

Hi,I would like to read the  article “How to Use GitSync” provides full details!" that was published in the newsletter March Newsletter! — SecOps Community. However, I get the message Request access, or switch to an account with access. I have requested access, but I don't get response. Could you help me with this issue?

01
S
Staff
Chris_B
Chris_BBronze 5
posted in Google Security Operations
Who here uses Asset namespaces ?

Who here uses namespaces ?

17
Chris_B
A
Akshay_Tiwari2New Member
posted in Google Security Operations
Is there any Information related to pricing for siem and soar?

Hello People is there any documentation related to pricing for siem and soar available or any contact to which i can connect. I am interested in the product from an MSP prospective.

03
S
Staff
K
krunalmNew Member
posted in Google Security Operations
Is there a way to control the number of simultaneous playbook runs per environment?

With current features, is there a way we can control number of simultaneous playbook runs per environment? For example, we're facing issues where multiple playbooks run if multiple cases are ingested for a single environment and that skews our playbook steps that look for duplicates. So I was wondering if we can set something up so that per environment only one case/playbook runs at a time and others wait in some sort of a queue?

04
K
V
Vivekram_RSNew Member
posted in Google Security Operations
Do we have any community edition or such for testing the integration?

Hi Everyone, I'm in the process of installing forwarder and make it talk to Chronical SIEM. Do we have any community edition or such for testing the integration? Thank you for the help

06
V
A
Anil_AgrawalNew Member
posted in Google Security Operations
Can i use IDE in the community license?

Hi Everyone, I am using the Community edition and am trying to create a new custom connector. But looks like, I can't use the built-in IDE.. Is getting a full license the only way to develop and test a custom connector?

02
A
P
Preet8309New Member
posted in Google Security Operations
How to get slack access for SecOps Community?

Can anyone please send me the invite?Thanks

01
L
P
Preet8309New Member
posted in Google Security Operations
Activate chronicle using metadata file

Hey all,I have a new chronicle instance, how would i activate it using the metadata xml file? I lookedup on the documentation but its fairly generic.Any help is appreciated.

01
P
P
pwckimmyNew Member
asked in Google Security Operations
chronicle Unified Data Model disk space

How much additional disk space UDM will take up?For example, if a UDM is generated after 1TB of raw logs are ingested, how much space will it take up?

02
P
P
pwckimmyNew Member
asked in Google Security Operations
chronicle forward data to other SIEM

Does Chronicle have the ability to forward data to other SIEM platforms? Such as Splunk, IBM QRadar.

41
M
L
Leif_TishendorfNew Member
posted in Google Security Operations
How to get the Chronicle forwarder docker container running under linux?

Trying to get the Chronicle forwarder docker container running under linux and I'm getting this error: + /opt/chronicle/chronicle_bin/chronicle_forwarder -config /opt/chronicle/external/test_dt_ingest_1_config.conf -bundle_version OFFICIAL_BUILD_1691582620_ac9b7292902207c0f3b828053fcad2d423239405_388 -container_version _BUILD_1691747437_ac9b7292902207c0f3b828053fcad2d423239405_00 -logtostderr I0815 16:29:21.487737 493 run_command.go:35] Chronicle forwarder starting I0815 16:29:21.489158 493 run_command.go:45] Forwarder ID is ce8e9d3d-2df5-4582-a415-d7958386cf13 W0815 16:29:21.489920 493 cflogger.go:404] Flush() not available for remote logs. F0815 16:29:21.490018 493 run_command.go:59] invalid output.identity.secret_key: unexpected end of JSON input Then it exits out and tries restarting with the same result. Anyone else run across this issue?

01
JaredBloomberg
JaredBloomberg
JaredBloombergNew Member
posted in Google Security Operations
Which resources for UDM parsing are apart from the official reference documentation?

Does anyone here know of any resources for UDM parsing apart from the official reference documentation? The docs are fine for what they are, showing you how , but Google doesn't seem to have very good training on teaching you why . I'm just trying to find any kind of tutorial (blog, YouTube video, webinar, etc.) that starts with the fundamentals elements of a parser/extension at a high level and walks you through it start to finish.

04
JaredBloomberg
B
Brad_CNew Member
posted in Google Security Operations
Is it possible to have an action that parses each entity on a playbook?

Hi everyone. I'm wondering if something is possible in a playbook. If I have an action that enriches a list of entities, can I have a previous action condition that parses each entity and processes each one down the correct conditional path? Right now the conditional seems to always process just based on first entity processed by the previous action.

12
B

Badge winners

  • Comments Posted 150
    ylandovskyyhas earned the badge Comments Posted 150
  • Authored Posts 1
    patelrdhas earned the badge Authored Posts 1
  • Authored Posts 10
    Rob_Phas earned the badge Authored Posts 10
  • Comments Posted 1
    sivahas earned the badge Comments Posted 1
  • Authored Posts 1
    sivahas earned the badge Authored Posts 1
Show all badges
Terms & ConditionsCookie settings
Privacy Policy Terms of Service Gen AI Policy Community Guidelines Cookie Settings

© 2025 Google. All rights reserved.