Skip to main content

Google Security Operations

Your Security Operations conversation starts here. Ask questions. Share insights. Tell us what you've learned. Or tell us what you're working on. We want to hear about it!

  • 2,080 Topics
  • 6,585 Replies
2080 Topics
R
recon_acookNew Member
posted in Google Security Operations
Is there a placeholder for the current analyst's name?

Is there a placeholder for the current analyst's name? For example, I have got an integration where I'd like to push something like, "Reviewed in Chronicle by [Analyst.Name]"

01
pigram86
R
recon_acookNew Member
posted in Google Security Operations
How can i change the height of HTML widgets to be bigger?

Anyone know how I can force the height of HTML widgets to be bigger? I have some widgets that are just a single image or iframe, but they shrink to the default minimum height

02
R
Z
zunni27New Member
asked in Google Security Operations
Google Chronicle IPs to Whitelist

Hello community, I'm trying to whitelist Chronicle IP addresses on our firewall for Feed Ingestion, is there a particular set of IP addresses to use?

262
R
Staff
D
Donald_MunengiwNew Member
posted in Google Security Operations
Ingesting from GCS buckets using feeds management UI

I have a question: When Ingesting from GCS buckets using feeds management UI, it mentions that chronicle doesn’t need authentication for the bucket because it has internal user, is this user a global user or specific to that cloud account? Can i ingest arbitrary bucket i don’t own but know the address to without authentication as unstructured logs and be able to view some bucket contents in chronicle?

02
A
J
Jason_BennettNew Member
posted in Google Security Operations
Problem with the built-in Siemplify (ChronicleSOAR) IDE's debug

Hi. We have been working on an API integration in SOAR and are running into a problem where the built-in Siemplify (ChronicleSOAR) IDE's debug output is throwing an error that it cannot interpret the JSON response being returned by our script: "Agent internal error: No JSON object could be decoded" - When testing the same script in an external IDE, it for sure is returning results in JSON, so I'm a little stumped.

05
D
Staff
C
CitrenoDanNew Member
posted in Google Security Operations
Is there any detailed training available like Chronicle SIEM Fundamentals for SOAR?

I completed the Chronicle SIEM Fundamentals...is there anything available for more detail like there is for SOAR? Specifically want to get a deeper look into ingestion, normalization, enrichment, parsing, and rules But I can't find much in the way of training

75
D
P
Pawe_NakielskiNew Member
posted in Google Security Operations
How to handle case with alerts and track conversation during a case

Hi All, I have 2 cases where I need good advise and best practise. 1. How you handle cases where is two or more diffrent alerts. Im using playbook with close alert but I can't close last alert. How to handle that to prevent closing case after closing one alert? Is there a way to use something like "close alert, if is the last alert, close case"? 2. How do you made constantly conversation during case? Im using exchange integration, is possible to Chronicle will track diffrent conversation without knowledge about subject? How do you using this integration in playbook? Is there a way to monitor constantly a mailbox and paste answer in proper case?

01
G
J
Jason_BennettNew Member
posted in Google Security Operations
Has anyone reliably integrated with Proofpoint TRAP?

Has anyone reliably integrated with Proofpoint TRAP? We are looking for python code that works for downloading incident detail.

00
J
M
Mohammad_SulaimNew Member
posted in Google Security Operations
How to configure one remote agent for multiple environments?

Hello All, where can I find the documentations to show me how to configure one remote agent for multiple environments?

013
M
E
Eli_EdelkindNew Member
posted in Google Security Operations
How do I get access to the Slack channel?

Would love to join

03
A
C
CitrenoDanNew Member
posted in Google Security Operations
SOAR Free Edition

Hey all,I'm trying to get access to "SOAR Free Edition" via the link on the main homepage. Where it says "Don't have a user yet? Get here", I already have an account I created. When I then click on the picture it takes me to the SOAR login screen but my credentials don't work, it says "Invalid email and password". I imagine it's doing this because it doesn't have an associated account but as I described, I've gone through all the steps to make an account.Can anyone help?Thanks!

00
C
K
kbprogrammerNew Member
asked in Google Security Operations
Ingesting a generic Syslog RFC 5424 into Chronicle?

Hi. I've got a RFC 5424 Syslog message I am attempting to ingest into Google Chronicle using the REST ingestion API.  The vendor is Mako Networks. I do not see a parser for this particular vendor listed here (https://cloud.google.com/chronicle/docs/ingestion/parser-list/supported-default-parsers). Is there a vendor neutral Syslog parser for Chronicle? Do I need to convert this to UDM? Any guidance would be greatly appreciated? 

12
K
M
Michael_ScheppNew Member
posted in Google Security Operations
There are still issues in SOAR v6 (6.2.7.5) when it comes to the entity type DOMAIN

Hi, it looks like there are still issues in SOAR v6 (6.2.7.5) when it comes to the entity type DOMAIN. This is still not part of the SDK. Only SOURCEDOMAIN and DESTINATIONDOMAIN. For example, the urlscan.io integration doesn't work with entities of the type DOMAIN, because it checks if the entity type is one of those in the screenshot. When will that be addressed? View files in slack

02
M
M
Mohammad_SulaimNew Member
posted in Google Security Operations
Is there a way to configure one agent for two environment?

second question: can we configure one agent for two environment? I have one simplify agent which I use to reach to my on-premis systems, but I have want to same agent in my test environment as well, how to proceed? thanks

05
M
M
Michael_ScheppNew Member
posted in Google Security Operations
Is it possible use wildcards for entity identifiers in the Blocklist?

Hi all, anybody knows if it's possible to use wildcards for entity identifiers in the Blocklist ( https://siemplify.elevio.help/en/articles/493-create-block-list-to-exclude-entities-from-alerts )? Otherwise, is there any other way to block the creation of entities, especially legit URLs without specifying every single URL?

25
M
A
Antonino_La2New Member
posted in Google Security Operations
How to configure Email EML Connector in chronicle SOAR to pull email from a gmail account?

Hi, Is there a way to configure Email EML Connector in chronicle SOAR to pull email from a gmail account? Google disabled the possibility to Turn on access for less secure apps and this is a requirement as per documentation here https://integrations.siemplify.co/doc/email-v2#overview

09
D
Staff
H
hpatel74New Member
posted in Google Security Operations
Not able to use Execute Command in Crowdstrike Falcon

Not able to use Execute Command in Crowdstrike Falcon, getting error put is not available do you know why?

00
H
A
Antonino_La2New Member
posted in Google Security Operations
Is there a way to set dark theme on chronicle dashboard view?

Hello everyone. do you know if there is a way to set dark theme on chronicle dashboard view? The rest of the pages have dark theme by default and looking at the source of the page I can see a css class called "theme" set to "dark". I can't figure out from where I can change the theme

04
A
M
Michael_ScheppNew Member
posted in Google Security Operations
Attach an playbook to a number of cases via API or rerun a playbook respectively via API

Hi all, I want to attach an playbook to a number of cases via API or rerun a playbook respectively via API. I thought this would be pretty easy, but it looks like I need an parameter called "alertGroupIdentifier" besides the "cyberCaseId" and the "originalWorkflowDefinitionIdentifier". Anybody knows if this is possible without that value or how to query it easily based on case IDs?

03
G
M
Mohammad_SulaimNew Member
posted in Google Security Operations
Alerts Grouping options for Carbon Black products

Hello All, what are the "Alerts Grouping" options for Carbon Black products which works best according to your experience?? Currently for me it makes too many "Overflow Cases". would appreciate some hints and pointers best regards Mohammad

16
M
F
FranSalcidosBronze 3
posted in Google Security Operations
Is it possible to prepare a single use case with different correlation Yara-L rules

dear people, I´m currently working on a specific use case about detecting activity during non-working hours on an international environment with different timezones. do you know if is possible to prepare a single use case with different correlation Yara-L rules ( per each timezone there are different outcomes) and call them from a "centralized" yara-L rule? thanks in advance!

02
F
P
Pawe_NakielskiNew Member
posted in Google Security Operations
Where i can find some information about Splunk integration

Hi everyone, I would like to find some information about splunk integration. Mainly Im interested about differences between push and pull option for taking alert from splunk. Anybody have experience in this matter? Now we are using push (from splunk) to chronicle (on prem btw) but I cant handle how to customize onthology, where can I test alerts like in common way using integration (pull from splunk).

05
D
Staff
I
Ilan_GoldschmidNew Member
posted in Google Security Operations
Is there a way for a chronicle rule to populate a list upon a hit?

Hey, i'm new to chronicle. i wanted to figure out if there's a way for a chronicle rule to populate a list upon a hit. appreciate the help !

01
T
R
Ross_SNew Member
posted in Google Security Operations
The 6.2.20 release notes

looks like the 6.2.20 release notes ( https://chronicle-soar.elevio.help/en/articles/839-release-notes-6-2-20-april-2022 ) were saved under the year 2022 and don't show on the "latest release notes" page ( https://chronicle-soar.elevio.help/en/categories/162-latest-release-notes-cloud ) where 6.2.19 is shown as the latest dated April 2023

01
S
Staff
A
Antonino_La2New Member
posted in Google Security Operations
Anyone know why I get this login error when trying to access my demo environment?

Hi, anyone know why I get this login error when trying to access my demo enviroment? I've just changed my name from settings. After the logout I'm not able to access anymore. View files in slack

01
T

Badge winners

  • Authored Posts 1
    patelrdhas earned the badge Authored Posts 1
  • Authored Posts 10
    Rob_Phas earned the badge Authored Posts 10
  • Comments Posted 1
    sivahas earned the badge Comments Posted 1
  • Authored Posts 1
    sivahas earned the badge Authored Posts 1
  • Authored Posts 15
    TheSecOpsGuyhas earned the badge Authored Posts 15
Show all badges
Terms & ConditionsCookie settings
Privacy Policy Terms of Service Gen AI Policy Community Guidelines Cookie Settings

© 2025 Google. All rights reserved.