Skip to main content

Google Security Operations

Your Security Operations conversation starts here. Ask questions. Share insights. Tell us what you've learned. Or tell us what you're working on. We want to hear about it!

  • 2,073 Topics
  • 6,581 Replies
2073 Topics
Y
Yovel_OhanaNew Member
posted in Google Security Operations
Approval links got broken

Hey @Tomtomfridman , approval links got broken somehow. Is that a known issue? View files in slack

01
T
J
James_TippenNew Member
posted in Google Security Operations
Making my first connector

Hi all, I'm making my first connector. I must be misunderstanding something, but how do I prevent the connector from making duplicate investigations?

00
J
B
Bryan_CatsburgNew Member
posted in Google Security Operations
creating customers in chronicle siem

Hi Team, Looking for guidance creating customers in chronicle siem using the api. Can't seem to get it working.

02
B
C
cyrusrobinsonBronze 1
posted in Google Security Operations
Cool non-security alert automation

Hi, all! We're still working on the details, but I wanted to share a cool non-security alert automation my team is working on using Chronicle SOAR. We've got a very busy 24/7/365 SOC with 20+ analysts/analyst interns, and we also have a very permissive PTO policy (Our SOC's motto is "People First; Mission Always". We don't track PTO and encourage frequent time off to protect against burn out.) Managing that can get pretty crazy, so one of our senior analysts developed a form using Google Sheets/Google Studio to manage PTO requests. After submission, the form sends an email to our monitoring inbox which creates a Chronicle SOAR case/alert with the basic details of the request and sends a notification to our Sr Analyst Slack channel (where most of our comms occur). We're just getting started on this playbook and will eventually add a lot more functionality, but this was a cool use case that I thought I'd share. View files in slack

01
G
Y
Yaniv_Menasher1New Member
posted in Google Security Operations
Enterprise insights feature

Hi All, I was wondering if the Demo has the 'Enterprise insights' feature

00
Y
M
Mohammad_SulaimNew Member
posted in Google Security Operations
Entity types

Hi, All! currently these entity types are supported https://documents.siemplify.co/en/articles/158-what-entity-types-do-we-support , anyone know how we can create new entity types? for example EmailAddress would be one I would be interested to create. thanks in advance

00
M
L
Lawrence_MichelNew Member
posted in Google Security Operations
How to make a copy of an already existing playbook

Hello Team, looking for guidance on how to make a copy of an already existing playbook in our default environment.

11
EdwinRaja
Staff
A
amalone341Bronze 1
posted in Google Security Operations
Dashboard for time between logging and detections

Does anyone have any advice on how you could create a dashboard to see the average amount of time between the initial log time and a detection firing based off of that log? If possible I would like to see the distributions of time based on log source as well.

01
ShareablesCEO
M
Michael_ScheppNew Member
posted in Google Security Operations
Date of an Entity

Does anybody know a way to get the creation date of an Entity? Also, if it has isEnriched set to True, can we get anyhow the date, the last enrichment happened?

12
M
Y
Yovel_OhanaNew Member
posted in Google Security Operations
Multi-Choice Question in approvals links

Hey guys, was wondering, how can I control the outcome of the playbook in case that "Multi-Choice Question" using Approval Links is not getting answered under the given time (For example 5 minutes)? View files in slack

01
B
Y
Yovel_OhanaNew Member
posted in Google Security Operations
Decline an action using Approval Links

Another question, when I decline an action using Approval Links, this is the response I see in the playbook flow. The question is, how I can set a condition for that state? is_success = false isn't working. View files in slack

01
Y
M
Mohammad_SulaimNew Member
posted in Google Security Operations
Entity out fields which already coming with alerts of Cases

Hello All, can we make an entity out fields which are already coming with alerts of Cases, for example I have an alerts where I want to make the recepient email an entity and go further, wondering how to proceed with it. some guidance would be appreciated. thanks

03
C
C
cyrusrobinsonBronze 1
posted in Google Security Operations
Duo Connector

Has anyone had any success getting the Duo Connector for the Duo Integration to work on 6.2.2.1 or 5.6.4.520?

00
C
J
Jarre_OwensNew Member
posted in Google Security Operations
Generic alerts from a connector

Hi all, is there a way to make it so that "generic" alerts from a connector are attached as events to the actual triggering alert? Thanks!

01
T
Y
Yovel_OhanaNew Member
posted in Google Security Operations
Siemplify treating it as a placeholder

Any way to escape Siemplify treating it as a placeholder? View files in slack

21
T
pigram86
pigram86Bronze 2
posted in Google Security Operations
Windows event forwarding

@Lokesh_Dachepal If you don't want to use a SIEM product, you can always do Windows event forwarding to get all logs to a centralized place. https://learn.microsoft.com/en-us/windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection#bkmk-appendixc

00
pigram86
Y
Yovel_OhanaNew Member
posted in Google Security Operations
Slack Question

Hey guys, I am facing difficulties trying to wait for a reply on Slack Question I executed in the playbook. It seems like the question is sent and there is no way of getting anything to rely on it but it being sent. Suggestion on a solution or alternatives would be highly appreciated.

07
M
L
Lokesh_DachepalNew Member
posted in Google Security Operations
How SOAR playbook will identify the credentials of a particular machine

Hi, How SOAR playbook will identify the credentials of a particular machine and do the remidiation; If we need to store the credentials somewhere in the phantom - Where we neeed to store them.

02
L
Y
Yovel_OhanaNew Member
posted in Google Security Operations
Pass the entire event json to a block

Hey all, how can I pass the entire event json to a block im calling? (What is the placeholder)

05
R
J
Jarre_OwensNew Member
posted in Google Security Operations
Run an option for capturing old alerts

Hello all, I'm setting up a new integration and connector and was wondering if anyone could explain how to run an option for capturing old alerts after it's done? Essentially a lookback window? If so, is the methodology specific to each integration or is there a generalized process? Thanks in advance!

00
J
B
Ben_MontourNew Member
posted in Google Security Operations
Remote Agents been tested on CentOS 8

Have Remote Agents been tested on CentOS 8 or is there a hard requirement for CentOS 7?

112
B
K
Kevin_AbouNew Member
posted in Google Security Operations
Export / Import playbooks (Siemplify Community Cloud)

Hello, I'm trying to export one playbook from my Siemplify Community Cloud instance. I see in the documentation that it is possible to export a playbook through an API call but it seems that I can't do it with a community version. Am I wrong ?If someone has a solution it would be great.Thanks

20
K
J
Joseph_LutesNew Member
posted in Google Security Operations
Monitoring of cloud and on prem connectors

We would like to monitor logs from siemplify (specifically cloud connector logs as well as on prem logs)We would like to send them to our SIEM to monitor. How can we regularly pull these cloud and on prem connector logs in an automated fashion?

01
T
A
Alexandre_FaraiNew Member
posted in Google Security Operations
Access my instance's logs

Hello Everyone, on a Siemplify Cloud instance (not community cloud), how can I access my instance's logs?

09
A
M
Miquel_TurNew Member
posted in Google Security Operations
Siemplify logs to their SIEM

Hi Everyone! Is someone sending the Siemplify logs to their SIEM? I don't see how to do it. Thanks in advance!

02
M

Badge winners

Show all badges
Terms & ConditionsCookie settings
Privacy Policy Terms of Service Gen AI Policy Community Guidelines Cookie Settings

© 2025 Google. All rights reserved.