Google Security Operations

when we run a test in a rule editor, and we get a list of few test detections, is it possible to create a case out of them to test or refer for the playbook creation ?

Is it possible to set Direct Ingestion of Workspace Activity logs from multiple consoles/organisations to the same SecOps instance? https://docs.cloud.google.com/chronicle/docs/ingestion/default-parsers/workspace-activity

Hi Team,Can anyone provide an insight on how can we create an alert if a log source (Let's assume a principal.hostname) stops sending logs for 30 mins?  

Hi All,We have created a new permission group like “managed-plus” for our SOC users and we want to enable “manage tags” option in it.Any change in permission is not helping with it. Wanted to know if any of you guys have tried it or the permission group that handles the case tags options.

Hello All,I'm working on setting up alerting rules in SecOps, and I’m encountering an issue where some alerts are critical but tend to trigger frequently, creating unnecessary noise in the alert stream.I’m thinking of implementing a rule where, once an alert is triggered, subsequent alerts of the same type (or related) would be suppressed until a specified time window has passed. The goal is to avoid alert fatigue and ensure that we’re not overwhelmed with redundant notifications while still tracking important events.Has anyone implemented a similar mechanism? If so, could you share some insights on how you went about this or any best practices you’d recommend? I’m particularly interested in solutions where the suppression is time-based (e.g., 30 minutes after an alert is triggered, suppress any similar alerts during that period).Thanks,Suraj Kadav

Hello!I have a rule that round a value, but when I put the rule in the rule editor I have the following error: “parsing: function math.round not found line: 29 column: 22-32” The rule that I’m trying to create is:   events:    $e.metadata.log_type =$log_type    $e.metadata.event_timestamp.seconds =$log_time   match:    $log_type over 60m   outcome:  $last_event_timestamp = max($log_time)  $min_event_timestamp = min($log_time)  $now_ts = timestamp.now()  $diferenca= $now_ts-$last_event_timestamp  $time_in_minutes = math.round($diferenca/60)  $date_event_first = timestamp.get_timestamp( $min_event_timestamp,"SECOND", "GMT")  $date_event_last = timestamp.get_timestamp( $last_event_timestamp,"SECOND", "GMT")  $date_event_now = timestamp.get_timestamp( $now_ts,"SECOND", "GMT")   condition:  $e and $time_in_minutes >

Hi All,I wanted to check if it’s possible to use role-based authentication for the AWS SOAR integration. Currently, it seems to only support authentication using an access key and secret key.In my case, the access key and secret key keep changing frequently, which creates challenges. Has anyone discovered a way to implement role-based authentication for this integration?

Hey. I'm trying to use the Google Chronicle Security Operations standard Cases API (`v1alpha/cases`), but I consistently get a `500 Internal Server Error` with the message **"there is an empty key in the header"**. However, the legacy API (`legacy:legacyBatchGetCases`) works perfectly with the exact same authentication and headers.Has anyone successfully used the standard Cases API? What am I missing? What Works (Legacy API)https://cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.legacy/legacyBatchGetCases?rep_location=uscurl -H "Authorization: Bearer ${TOKEN}" \"https://chronicle.us.rep.googleapis.com/v1alpha/projects/{project}/locations/us/instances/{instance}/legacy:le

Hello Team,We’re currently performing a MITRE ATT&CK analysis for the curated detections using the MITRE ATT&CK Matrix dashboard.While the dashboard makes it easy to see how many rules exist per technique, identifying each rule’s corresponding rule name, rule set, and category is quite challenging — I have to review them individually. For techniques with a large number of rules, this becomes very time-consuming.I’m focusing only on curated rules, and it seems that the Ruleset dashboard doesn’t support MITRE queries — the mapping appears to be available only in the rules field, which doesn’t seem to work for curated content.Is there any way to generate a sheet like the example snippet below directly from the dashboard or through any other approach/tool?Thanks in advance for your help!

Hi Team, I have a project in that I need to run automated IP/URLs/Hash block to firewalls but due to some compliance issues I can not integrate SOAR directly with Firewalls and IOC feed can be implemented at firewalls.So I decided to have IOC feeds in S3 bucket and want to integrate this S3 bucket with chronicle SOAR to block the IP/URL/Hash automatically basis in SOAR actions. Please help me how it can be achieved and share the reference article/MOP/video link. Regards,Brijesh Kumar

Hi I like to have a panel that shows all my ingested log sources and its last ingested time . i do see a panel "Recently Ingested Events" under Data Ingestion and Health but it shows only some log sources and not all the ones .I want panel showing all the log sources and its time , can some one help me understand how i can build it . @jstoner any suggestion .

I am looking at rolling out support case access to multiple users in a project and have a question about social engineering within Google technical cases, does anyone have insight on what steps Google takes to prevent social engineering via the support/cases system, ie someone attempting to escalate their own privileges within a GCP project.  Might be overthinking things a little bit, but other cloud providers (AWS) make explicit statements that they will not perform account administrative tasks on a users behalf via support, but i don’t see a similar claim from Google. 

We see occasionally parsing errors for some log types in the Data Ingestion dashboard. However as dashboard is not regularly monitored and doesn’t show out custom parsers, I would like to check if there is is way to create some detection for the parsing error so that we can act immediately. 

With below code, and where by "linktargetport": "389(ldap)"  if ![no_linktargetport_found] { mutate { replace => {"targetport" => "%{linktargetport}"} gsub => ["targetport", "[^0-9]", ""] } mutate { convert => {"targetport" => "integer"} } mutate { convert => {"targetport" => "string"} } mutate { replace => { "cse_event.idm.read_only_udm.target.port" => "%{targetport}" } } } } this errors out with  (the two converts was a suggestion from gemini...) LOG_PARSING_CBN_ERROR: "generic::invalid_argument: failed to convert raw output to events: failed to convert raw message 0: field \"idm\": index 0: recursive rawDataToProto faile

Hello Community, I am using the following query to provide a count of Cases, SLA Met, and Exceeded. Also, it is calculating the SLA Met percentage. match:    case_history.priorityoutcome:    $case_count = count(case_history.priority)    $case_sla_not_exceeded = count(if((case_history.sla_type != "CASE_SLA" AND case_history.sla_type != "ALERT_SLA" AND case_history.sla_type != "SOAR_CASE_HISTORY_SLA_TYPE_UNSPECIFIED" AND case_history.sla_type != "STAGE_SLA"), 1, 0))    $case_sla_exceeded = count(if(case_history.sla_type = "CASE_SLA", 1, 0))    $sla_status = ($case_count/$case_sla_exceeded) * 100order:    case_history.priority desc The issue is that it is returning the same count for case_count, case_sla_not_exceeded, and case_sla_exceeded. Has anyone encountered this issue? 

Hello, everyone,I’m new to Google SecOps; and currently following this guide: https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/microsoft-teams.Got stuck in steps 10-11 of the configuring part: the authorization link generated by running the “Get Authorization” action appears asInvalid URL Address - https://login.microsoftonline.com/*tenant-id*/oauth2/v2.0/authorize?client_id=*application

Below is the query used for creating timestamp chart for waf trafficnamespace = "onb-aws-waf" metadata.event_type != "STATUS_UPDATE" metadata.event_type = $event_typesecurity_result.action = $security_resultmatch: $security_result, $event_type by hour outcome: $Count = count(metadata.id) $Date = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%b %d %H")Order: $DateHow one can get the total traffic in New Dashboard such that I get to plot Blocked and Total Traffic on one graph. we do not want to map ALLOW instead Block and Total

Hi I am new to YARA L, I am trying to convert KQL query into YARA L, but I feel difficult to convert specific Rule which is mentioned below as URL Please go through URL for KQL Query. please help me to convert this rule into YARA LOLE object manipulation attempts stateful anomaly on database | Microsoft Sentinel Analytic Rules

We are receiving a high-severity vulnerability finding on our GCP Virtual Machines for Processor MMIO Stale Data (likely related to Spectre/Meltdown variants, e.g., CVE-2022-21123, CVE-2022-21127,escription: We are receiving a high-severity vulnerability finding on our GCP Virtual Machines for Processor MMIO Stale Data (likely related to Spectre/Meltdown variants, e.g., CVE-2022-21123, CVE-2022-21127,CVE-2022-21123,CVE-2022-21125, CVE-2022-21166 ). The vulnerability scanner indicates that the Linux Kernel is missing a necessary mitigation.Affected Systems: GCP VMs running Linux Kernel 6.14.0-1017-gcp #18~24.04.1-Ubuntu GCP VMs running COS Kernel 6.12.46+ cos-125 Diagnostic Output: The /sys/devices/system/cpu/vulnerabilities/mmio_stale_data file reports: Vulnerable: Clear CPU buffers a

Hi as i said, I want to detect horizontal and vertical port scan detect within the same host as source. I have this, but to be honest im struggling a bit with the code, maybe someone can help me with this?   events:  $e.metadata.event_type = "NETWORK_CONNECTION" or $e.metadata.product_event_type = /TRAFFIC|traffic/ $src_ip  = $e.principal.ip $dst_ip  = $e.target.ip $dst_port = $e.target.port re.regex($src_ip, `^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[0-1])\.)`)re.regex($dst_ip, `^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[0-1])\.)`) not re.regex($dst_ip, `^(224\.|239\.|255\.)`)not re.regex($src_ip, `^(224\.|239\.|255\.)`)  match: $src_ip over 30m outcome:$unique_dsts = count_distinct($dst_ip)$unique_ports = count_distinct($dst_port)$risk_score = 80 condition: $e an

I am pretty new to SecOps custom parser.I was able to write a parser extension for a Syslog product,but now I have to create a completely new custom parser, the logs arrive in JSON format. Can someone help me with some example code? LOGS:{  "customerId": "obfuscated",  "events": [    {      "metadata": {        "eventTimestamp": "2025-10-29T16:17:30.954000+00:00",        "eventType": "GENERIC_EVENT"      },      "additional": {        "severity": "DEBUG",        "message": "SUCCESS - Authorization Code Generated"      }    },    {      "metadata": {        "eventTimestamp": "2025-10-29T16:17:28.916000+00:00",        "eventType": "GENERIC_EVENT"      },      "additional": {        "severity": "DEBUG",        "message": "SUCCESS - device ownership and compliance check"      }    },    {      "me

Hello Team… I have a query that successfully generates data and i’m able to visualize, however once i turn it into a dashboard visual nothing appears

Hello All,When I execute the MicrosoftAzureSentinel_Update Incident Details v2 action, I encounter the following error:Error executing action "MicrosoftAzureSentinel - Update Incident Details v2". Reason: A new version of the Microsoft XDR incident is available. Fetch the new version and try again.Even after rerunning the action, the same error persists. How can I resolve this issue?

Hello All,How can I check the feed status and monitor for issues using logs in GCP Log Exporter? Also, how can I set up alerts based on specific feed errors or failures?Example: When a feed is a setup and its status is failed then how to find the log in GCP log exporter.With Regards,Shaik Shaheer

Hey everyone,I’m currently working on a script that retrieves logs from one of our JSON sources and formats them into UDM events for ingestion into Google SecOps using the Ingestion API.Here’s an example of the formatted UDM payload I’m trying to send: {  "customerId": "Obfuscated",  "log_type": "Obfuscated",  "events": [    {      "metadata": {        "eventTimestamp": "2025-10-29T16:17:30.954000+00:00",        "eventType": "GENERIC_EVENT"      },      "additional": {        "severity": "DEBUG",        "message": "SUCCESS - Authorization Code Generated"      }    }  ]} Whenever I include the log_type field, the API responds with: [ERROR] HTTP 400 Bad Request{  "error": {    "code": 400,    "message": "Request contains an invalid argument.",    "status": "INVALID_ARGUMENT"  }} However