Google Security Operations

Hi Like to create a YARA L query for the below1) Host not reporting (for more than 1 day)

Hi guys,here I come with another annoying problem within playbook development in Chronicle SOAR..Yesterday I needed to execute a UDM query into Chronicle SIEM from one of our playbooks. First try it worked very well, the query found some results and then I added those results on the case screen as insights.Then comes the exception of the query that didn't find any result. As you may know the action "Execute UDM query" from Google Chronicle integration returns two values: is_success and JSON_result. The first one is meant to catch any error on the API request, the second one should contain the results of the query itself. I discovered that when the query doesn't find any result, the field "JSON_result" is not instantiated.The result is that when I use placeholder values to add the insight if "JSON_result" doesn't exist I find in the insight something like "[Execute Query for last 24h logins.JsonResult| "events.udm.principal.location.countryOrRegion" | distinct()]". Why don't i

Hi All,Any one aware that which are the SIEM Tools aprat from Chronicle, any other tools which are more compatible with Google Cloud Platform.Need to get list of tools that I can use in GCP as SIEM.

HelloI'm looking for possible workaround or solution into case search filter in search (CaseSearchEverything) in API or Platform itself.Objective:Create a search filter using parameters in chronicle soar search.cases, case status, title, product, timeframe, tag, env, case sourcesalong with if playbook attached, and playbook execution status == failed etc.Perform a search using above parameters in chronicle soar search.Now at the moment, there is no support to create the filter in search same which available in case management (there is create and save custom filter in case management, and it can be used for filtering out cases).The same problem in API level, there is no parameters for filtering out cases associated with attached playbook and playbook execution status (i.e. open or close etc).So, question here, it there any way to possible any future improvement oncreate filter in search.more parameters in search such as playbook attached, playbook execution status etc.API Request:Reque

We have a webinar, Living on the Edge: Investigating Ivanti Connect Secure VPN Zero-Day Exploits coming up this Thursday January 18, 2024. It is a free webinar. Click here to sign up. 

We have a webinar, Living on the Edge: Investigating Ivanti Connect Secure VPN Zero-Day Exploits coming up this Thursday January 18, 2024. It is a free webinar. Click here to sign up. 

When we use approval links it contains domain https://localhost/, Is there any option to configure Approval link? 

Has anyone managed to successfully extract 'Case Closure Reason' within a playbook? It's required for some branching logic and it doesn't seem to be listed in the example data of 'Get Case Data' action.

Hello all, we need an efficient and responsive way to monitor our connectors in Chronicle SOAR; we need to know if/when they go down (Some type of alerting). How do you approach using a connector monitor to do that?

What is with the pop out side bar? Can we go back? I was away on vacation and haven't been out here for awhile, but was there a community discussion on this?

Hi I am trying to build an alert "detects an abnormally large number of endpoint changes per user account, as they relate to reboots, check , file system, user, and registry changes."What i am trying to achieve is on a particular time for same user on the same machine there should more than 1 of the event type . However my below query is not triggering this detection. Can you suggest where i am going wrong ? Also is there a SLACK channel where we can get interact for such doubts ?Query i created is this    rule Multiple_endpoint_changes { meta: author = "Rahul" description = "It detects an abnormally large number of endpoint changes per user account, as they relate to reboots, checks, file system, user, and registry changes." severity = "Medium" events: ( $e.metadata.event_type = "FILE_MODIFICATION" or $e.metadata.event_type = "USER_LOGIN" or $e.metadata.event_type = "USER_CHANGE_PERMISSIONS" or $e.metadata.ev

Hi,While validating a parser I see an error with messagegeneric::unknown: invalid event 0: LOG_PARSING_GENERATED_INVALID_EVENT: "generic::invalid_argument: *events_go_proto.Event_Alert: alert event device 1 is invalid: device is empty"The error message is seen for some of the logs due to the parser block below if ![missing_tenant] and "%{agent.labels.tenant}" != "" and "%{agent.labels.tenant}" != "-" { mutate { replace => { "event.idm.read_only_udm.principal.namespace" => "%{agent.labels.tenant}" } on_error => "failed_replace.tenantLabel" } }The parser works and the namespace is seen when looking at the statedump. However it shows the error above at UDM output and the validation fails. Just commenting out the code block above resolves the issue. Any pointers on what could be the issue and how to resolve it?Screenshots attached.

Hello,thanks to @cmmartin_google I came across the idea to import Misp data into Chronicle. For several reasons I was not able to do it the exact way he describes but I´ve got it working with an csv export and then the import via nxlog and a forwarder.  That is all working fine.  Now I was trying to adjust his rules. But this is the part I´m not able to get working. So here is the rule as I thought it should work: rule misp_ioc_network_domain_dns_question { meta: events: $event.metadata.event_type = "NETWORK_DNS" $event.network.dns.questions.name = $domain $event.principal.asset.hostname = $hostname $misp.graph.metadata.vendor_name = "MISP" $misp.graph.metadata.entity_type = "DOMAIN_NAME" $misp.graph.entity.hostname = $domain match: $hostname over 1m condition: $event and $misp }  And this is the MISP Log:And this is the log that should get detectedAny Idea what I´m doing wrong here?

Hi there,A bit of context: I'm trying to develop a pySigma backend and pipelines for chronicle, so we can fully utilize the treasure trove of use cases that is SigmaChronicle enforces Conjunctive Normative Form (CNF) for UDM queries:You cannot use A OR (B AND C) in conjunctive normal form, but you can use (A OR B) AND (A OR C).Extrapolating this to a simple sigma query:    title: Test status: test logsource: category: test_category product: test_product detection: sel: principal.ip: - valueA1 - valueA2 principal.user.userid: - valueB1 - valueB2 condition: sel   Would lead to a CNF representation of   (principal.ip="valueA1" AND principal.user.userid="valueB1") OR (principal.ip="valueA

Getting an error" failed to create feed because the credential is in use in another instance of Chronicle. Please try with a different credential" I've tried to new auth keys and I get the same error. This is for the Proofpoint on Demand data feed. 

Hi All,Please help us create a dashboard on Analyst-Wise Resolved Alerts dashboard(Who is working on which alert and the status), if that is possible in Chronicle SIEM. Thanks,

Hi,I am attempting to design a personalized dashboard to monitor both new and resolved alerts associated with a specific analyst or user within the Chronicle instance. Unfortunately, I haven't identified a suitable keyword for use in the UDM Fields to construct the dashboard panel. If anyone has successfully developed a similar dashboard, I kindly request you to share the pertinent documentation or the dashboard YAML file.With Regards,Shaik Shaheer

I am looking at the structure of  a UDM Entity:https://cloud.google.com/chronicle/docs/event-processing/udm-overview#structure_of_a_udm_entityHowever, i am unable to view the schema for UDM Entity in the UI (UDM Lookup):What am i missing here please?Does the UDM Lookup only show the schema for UDM events and not UDM entities?

Dear team,I am looking at the following doc:https://cloud.google.com/chronicle/docs/reference/udm-field-listI cannot understand the different sections of this doc page and how they relate to each other.The doc contains a section "UDM Entity data model" and then further down, there is a section "UDM Event data model."There is no description at the start of each section heading, which is making it difficult for me to wrap my head around.Also, i was looking at the following video:https://www.cloudskillsboost.google/course_sessions/6877638/video/412296It speaks to the Nouns in UDM:However the doc page doesn't make any reference to the above. If at all, it does have a section as follows:https://cloud.google.com/chronicle/docs/reference/udm-field-list#udm_event_data_modelBut the content seems to be a bit disjointed, or perhaps, i am not able to connect the dots.Can someone please help me understand how is it that i should go about reading this page.Thank you. 

Hey everyone!Has anyone had success with using this API endpoint on Chronicle SOAR to get Connector logs?/api/external/v1/logging/pythonIt's visible under Cloud Logging in Swagger. Swagger references the following sample config:  "filter": "labels.integration_name=\\"Siemplify\\"", "pageToken": "string", "pageSize": 0, "sortOrder": "desc"  I've been trying to adapt this to get my config working. { "filter": "labels.connector_name=\\"My Exchange Mail Connector v2 with Oauth Authentication\\"", "pageToken": "string", "pageSize": 0,"sortOrder": "desc" } ' In all instances, including just using the sample config, I get a 400 Bad Request error. Is there any documentation surrounding the data structures that we can use in that filter anywhere, or any instances where anyone has got a working configuration?Thought I'd check in on this before going to Support. 

Hi,My question is pretty straight forward. I am maintaining a list of blacklisted process in my organization to a reference list (Regex) in Chronicle. However, I am not sure on how to make it case insensitive in the UDM search query and/or on the rule editor. I tried to use the nocase keyword to the search parameter that throws an error, which I assume would be same in the rule editor.  I also tired to add the nocase keyword inside each line of the list as well as (?i) before the words within list. None of the method I tried so far workedIs there any other alternatives that could help me achieve the use case?Regards,Srijan Kafle

I have a query in relation to the following document:https://cloud.google.com/chronicle/docs/reference/udm-field-listThe docs says the following:When writing rules for Detect Engine, use the <prefix> pattern $event for Event fields and $entity for Entity fields. For example:$event.metadata.event_type$event.network.dhcp.opcode$event.principal.user.location.city$entity.graph.entity.hostname$entity.graph.metadata.product_nameNow i can't understand why is `principal.user.location.city` prefixed with `$event`.`principal` is a noun in UDM. So why is `principal.user.location.city` prefixed with `$event`.Can you please help me fill the gap in my understanding.

Hello All,Could anyone please let me know how can we enable the dashboard in the below link?https://github.com/goog-cmmartin/thatsiemguy/blob/main/release_notes_to_udm/dashboard/chronicle_release_notes.yamlI tried running the below code but doesn't seems to be pushing logs with the changes to be made in the python code. Please find the below code.https://github.com/goog-cmmartin/thatsiemguy/blob/main/release_notes_to_udm/cloud_function/main.py

Hello All,Could anyone please let me know how to rectify the below error. Logs are coming in through syslog but not getting forwarded to Chronicle.Thanks,

Dear All,I wanted to inquire about any new features or updates that have been recently enabled in Yara-L, mainly threat intel feeds or the features which can be used to develop rules or to define new severity. Could you please provide me with information regarding the latest enhancements or functionalities added to the system?Thank you for your attention to this matter.Best regards,Aravind S