Google Security Operations

Hi, I'm facing an issue with JIRA Sync Comments job in Chronicle SOAR. After a JIRA ticket is created from SOAR using Create Alert Issue action in the playbook, a JIRA ticket is created and a Jira tag is assigned to the case. But when running the Sync Comments job, it fails to sync the comments to and fro. When I did some troubleshooting I found, the sync from SOAR to JIRA is not happening because of the below line. When I checked the alert doesn't have the project name info popped in.for alert in case.get('cyber_alerts', []): issue_key = alert.get('additional_data') if alert.get('reporting_product') != PRODUCT \\ else alert.get('additional_properties', {}).get('AlertName') issue_project = alert.get("security_events", [])[0].get("additional_properties", {}).get("project_name") if issue_project not in project_names: siemplify.LOGGER.info(f"A

Hi,is there a way to create a reference list via the GUI? The only way I found is via APIs...Thanks.A

If I do a UDM Search for network.email.to = "<emailaddr>" it returns a result, but if I copy the UDM for network.session_id = "<sessionid>" for that result and search on that, it returns no results for the same time window:The log was ingested ~41 hours ago, circa 2023-10-02 at 9PM Pacific and I'm searching for it on 2023-10-04 at 2PM Pacific, but perhaps it still hasn't indexed that field for searching?

I'm looking at events in Chronicle withmetadata.log_type = "WORKSPACE_ACTIVITY"metadata.product_name = "drive"metadata.product_event_type = "download"But I'm not seeing any field that would indicate who or where the files are downloaded.  I'm wondering if I'm not understanding something in the log events correctly, or if there is somewhere I'm not looking to correlate files downloaded with who or where they are downloaded?Any pointers would be much appreciated.

As it seems that SOAR training is now on Skills Boost, do we need to retake all of them to get the badges even if we passed them all on https://learn.chronicle.security Just curious

What's the behavior of event field references when configuring a custom trigger for a playbook? What happens if there are multiple events with conflicting values in the event field the trigger is using?

Hi all,I was wondering if there is a way to cycle over a list of values inside a playbook. I've written an action inside my integration that fetch some data and return a json object, now I would like to repeat an action for every item of the json object.Thank you in advance

Hello everyone!I recently started using Fluent Bit to send DNS logs from Windows Server to Google Chronicle Forwarder which then forwards them to Google Chronicle SIEM.But I have a doubt.Im able to send dns logs in JSON raw format, using the following configuration:[INPUT]Name              winlogChannels          DNS ServerInterval_Sec      5[OUTPUT]Name          tcpMatch         *Host          IP of Chronicle forwarderPort          PORT of ChronicleFormat        json_linesHowever, the logs are sent in raw (json) format and are not parsed to UDM (structured data format of Chronicle). Should I modify the configuration ?Or the problem is with SIEM? Thank you in advance!

It seems like there are a lot of historical discussions around this, but how does someone get access to the Slack?I'm trying to gain access, but Is the only method to ask here in the community?

Does someone know if it's possible to ingest Windows DNS logs without using NXLog paid version? Even with other tools like filebeat, does the default parser work?

Can I get a instance of SOAR platform for testing?

On Google Chronicle SOAR, do we have integration to Tenable AD? (Tenable Identity Exposure) I could just find for Tenable IO and Tenable SC

Hello, when creating a custom job within the IDE, is there a way to specify the environment?

Hello does anyone know what does that means. "Unknown error code" View files in slack

Good Day,Is there a way to turn on Geo IP location for the logs that have Source IP data in them?  So for example I can see the Caller IP in the following log but no country code or GEO location and we want to add this.  Is there way to do this without using Chronicle or anything like that?"requestMetadata": {"callerIp": "174.95.10.102","callerSuppliedUserAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36,gzip(gfe),gzip(gfe)","requestAttributes": {"time": "2023-09-09T13:35:56.357323112Z","auth": {}},

How do we query the list of unparsed logs from the SIEM?

Hi All, I'm currently in the process of integrating the forwarder with the SIEM system. I've successfully installed the forwarder on my Ubuntu machine, and I also have administrative access to the SIEM platform. Could someone please provide guidance on how to forward logs from the source to the forwarder and then from the forwarder to the SIEM? If there's any documentation or a guide available, I would greatly appreciate it. Thank you in advance. View files in slack

Hi all, Could I please obtain a default parser or a sample parser for Aruba Wireless logs?

Hi all, Can I ingest firewall traffic logs with Google Cloud Audit and how? Is there a link or feed about that? I saw firewall rule logging but it is I guess about configuration changes about firewall not related to trafic logs.

Hi Team, when using the search chronicle api, is there a way to get more than 10,000 events? or some type of paging functionality? https://cloud.google.com/chronicle/docs/reference/search-api As per doc, it says What is the Page Size Property? - For each API call, you can specify the page_size property to limit the maximum number of returned results. As there's no next page token, to limit the volume of data returned, specify a narrower time range. Any help would be appreciated? Thanks!

How to parse security_result for any severity

Hi! We’d like to ingest some UDM data about group creation events (specifically linux groups created on a host via a cmdline process or other similar means), and we were wondering if you guys have any recommendations for how best to represent this kind of group in the UDM? I initially wanted to use the Group entity ( link ), but upon closer inspection of the fields, it seems like that entity is more intended for organizational groups (eg. LDAP groups)? So, we were wondering if anyone has any suggestions for a good way to represent linux group data in UDM?

Has anyone been able to use "filter" function within the JSON result pop-up? I've tried multiple times but I'm getting error saying invalid key, not found. Any working examples would be much appreciated! Thanks!

@Dmitry_Sarakeev , Please another question, the priority column in the Environment - Networks, for subnet upload in settings, please can you explain what the function of this is? Thanks

Any ideas on this error? It's occurring after the connector returns from the integration. The connector states it created Connector Execution: Dynamic script connector <Connector Name> Connector_d007badf-5245-45f3-97f4-4edfce9caa3d returned unexpected output. No cases created; Exception: Newtonsoft.Json.JsonReaderException: Unexpected character encountered while parsing value: {. Path 'cases[0].environment', line 1, position 28. at Newtonsoft.Json.JsonTextReader.ReadStringValue(ReadType readType) at Newtonsoft.Json.JsonTextReader.ReadAsString() at Newtonsoft.Json.JsonReader.ReadForType(JsonContract contract, Boolean hasConverter) at Newtonsoft.Json.Serialization.JsonSerializerInternalReader.PopulateObject(Object newObject, JsonReader reader, JsonObjectContract contract, JsonProperty member, String id) at Newtonsoft.Json.Serialization.JsonSerializerInternalReader.CreateObject(JsonReader reader, Type objectType, JsonContract contract, JsonProperty mem