Skip to main content

Google Security Operations

Your Security Operations conversation starts here. Ask questions. Share insights. Tell us what you've learned. Or tell us what you're working on. We want to hear about it!

  • 2,064 Topics
  • 6,571 Replies
2064 Topics
ar3diu
ar3diuBronze 2
posted in Google Security Operations
IAM Role Mapping in Chronicle SOAR for Google Groups

How can we use group email addresses to assign permission groups and SOC roles in SOAR regardless of what IAM roles they were given in the project IAM? (e.g. Two groups with the same IAM role but who should have different permissions and SOC Roles in SOAR?) I tried to use the email address of a google group instead of a IAM Role Name but it doesn't seem to work.Docs: https://cloud.google.com/security-command-center/docs/map-users-in-secops 

42
ar3diu
J
javieralvarezlNew Member
posted in Google Security Operations
Google SecOps Go library

Hello,Is there any library or sdk for Golang that allows using the Ingestion API to send data to SecOps? Similar to the SDK Wrapper for Python.The only thing I found is this repo but does not seem to have all this possibilities to send logs and UDM data. https://github.com/googleapis/google-cloud-go/tree/main/chronicleThank you

01
kentphelps
Staff
V
vanitharaj1208Silver 2
asked in Google Security Operations
Source group identifier

 What is the source grouping identifier in the Alerts Grouping settings?

45
willzj
Rached1996
Rached1996Silver 1
posted in Google Security Operations
Host stopped sending events - Monitoring

Hello, I've noticed through my dashboard that some windows assets (domain controllers) stopped sending logs to secops?What is the best way to get notified in this case without using dashboards ? This can be done on GCP and create alerting based on hostname ? Thanks.

02
R
Staff
V
vanitharaj1208Silver 2
posted in Google Security Operations
Bug - SOAR Case id in simulator

Hi All,I have Observed that case.id value is passing wrong while creating an incident in ServiceNow in simulator mode while testing.Actual Case id is 10062 but  it passing as 10064.... it is happening in simulator mode 

01
J
P
pablo_vallejoBronze 1
posted in Google Security Operations
Best Practices for HA Setup: Chronicle Forwarders vs. BindPlane Collectors (Failover Strategies)?

Hey community,I'm evaluating High Availability (HA) scenarios for Google SecOps. Specifically, I'm exploring the following points:Chronicle Forwarders: Is it feasible to have two forwarders configured for automatic failover without a load balancer, or is a load balancer (VIP + health checks) mandatory?BindPlane Collectors: Given this emerging technology, what's the optimal practice? Can we reliably set them up as active/active, relying on Google's internal deduplication? Is there a better recommended approach?Our team understands the theory, but we haven't validated this practically yet. I'd appreciate any experiences, lessons learned, or recommendations on the best practices for achieving optimal HA.Thanks in advance! 

21
a_aleinikov
willzj
willzjNew Member
asked in Google Security Operations
source_grouping_identifier not working for alert grouping

Hello! I'm trying to use source_grouping_identifier to drive alert grouping in SOAR. There's a relevant post here, and the SOAR documentation is here.The field is showing on the SOAR UI, but SOAR is creating a separate case for each alert rather than grouping them into the same case.  Has anyone had any success using source_grouping_identifier to drive alert grouping? The config seems pretty simple, so I'm not sure what I'm doing wrong. A screenshot of my grouping config is attached. Thanks much!

01
a_aleinikov
mikelmi01
mikelmi01New Member
asked in Google Security Operations
Job not creating comment for incident in Microsoft Defender

I have created a Job in SecOps that closes an incident in Microsoft Defender after certain conditions are met:When I go to the incident in Microsoft Defender, I can see that the incident was closed correctly with falsePositive:However, nothing appears written in the marked box of the following image:Am I doing this correctly with the comment? Or is that box filled in another way? And can I fill it through the Job?Any help will be apreciated! 

01
mikelmi01
AfvanJaffer
AfvanJafferBronze 5
posted in Google Security Operations
Chronicle SOAR > Jobs Scheduler > Close Cases Based On Search

hello folks!Hope you guys are doing good. playing with the Jobs scheduler especially on the Close Cases Based On Search Tool, working on it, I realized there is two mandatory input fields on them.mandatory ones are  - Siemplify Username, Password I'm wondering where should I get this credential - from the google support folks ?Thanks!

16
A
jeffbezos42
jeffbezos42New Member
posted in Google Security Operations
O365 & Intune Integration

Hello All,I am trying to integrate O365 and Intune using the documentaiton from:https://www.googlecloudcommunity.com/gc/Community-Blog/New-to-Google-SecOps-Integrating-Entra-ID-and-Office-365-Using/ba-p/775343https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/microsoft-intunehttps://www.googlecloudcommunity.com/gc/Community-Blog/New-to-Google-SecOps-Integrating-Entra-ID-and-Office-365-Using/ba-p/775297https://cloud.google.com/chronicle/docs/ingestion/default-parsers/collect-microsoft365Unfortunately Intune is showing me this: [HTTP 403] The auth account provided in feed configuration lacks required permissions.Here are the permissions. I really don't understand why it won't integrate properly:The log type is Third Party API - Intune although I get the same error for Graph API. Secondly, with all O365 log types I get the following error: Error: HTTP_400[HTTP 400] The feed failed because of invalid request.What you can do?Check the feed configuration. Le

14
jeffbezos42
J
Joe_johnNew Member
posted in Google Security Operations
PaloAlto logs not getting parsed

Hi Team,I am new to the Chronicle. I am collecting the logs from paloalto firewall using the bindplane server and able to see the logs in Secops but the logs are not getting parsed . I used the log type as "PAN_FIREWALL" in the processor configuration and the logs are in the LEEF Format.Please advise what mistake I am doing here.ThanksJoe   

05
S
S
SecOps11New Member
asked in Google Security Operations
Trigger SOAR playbook without alert trigger - Time Based

Use case is as follows; Playbook to update a Google Chronicle reference list in the SIEM with data from an external DB to keep the SIEM reference list up to date. It should run once per day to track specific user/device exclusions for a playbook that blocks user access.Issues:We do not want to manually track the exclusions/duration for many users. It doesn't scale. Currently we do not see a way to trigger an update/pull from our exclusion list on a time based frequency. 

32
S
D
dhirajtecBronze 1
posted in Google Security Operations
SecOps SOAR Remote agent in DMZ

Hello,Is it advisable to install the SAOR remote agent on a machine located in the DMZ? The intent is for the remote agent to communicate with the on-premises QRadar instance.

02
T
Staff
donkos
donkosNew Member
posted in Google Security Operations
Custom Integration library imports

Does Google perform any checks or limit the libraries that can be imported in the libraries prompt via free text entry? I believe its connected to pip so it would be theoretically possible to import malicious libraries?

01
T
Staff
_K_O
_K_OBronze 5
posted in Google Security Operations
SOAR Remote Agent started Failing

Hi Everyone, TL;DR: Has anyone dealt with debugging why a SOAR remote agent would start failing? How did you manage to get the Agent to connect again?---I realized today (after several playbooks started failing) that the remote agent that we set up hasn't connected since the 11th of May.  I currently have a case open with support but getting a fix may take a while.When opening up the Remote Agent page, it shows that the Status is "FAILED" and when I download the logs for the last week, the file itself is empty (I'm assuming this is due to the FAILED connection for over a week).When I dive into the host, the docker connection is still live and healthy, so I'm not sure where to begin since it's likely on the Google side. (Initial deployment was done through the "Send Installer/docker Command" action within the SOAR itself. I've done some debugging on my end, including:Reviewing Docker logs on the host - nothing new in the logs over the past 3 weeks which could be related t

03
_K_O
Rached1996
Rached1996Silver 1
asked in Google Security Operations
Databales in preview dashboards - error

Hello , i'm actually developping a dashboard based on yara-l which contains a data table i'm seeng this error : compilation error compiling query: validating query: data tables are not enabled for this query: invalid argumentwe cannot use data tables in preview dashboars ? if i'm not wrong ?

13
jstoner
Staff
TheSecOpsGuy
TheSecOpsGuyBronze 5
posted in Google Security Operations
Training for Custom Parser

Hi Team,Could you please provide guidance on how we can begin training to create a custom parser?I have gone through below documentation, any other documenation will be helpful.https://cloud.google.com/chronicle/docs/reference/parser-syntax

410
TheSecOpsGuy
C
chrisd2Bronze 5
asked in Google Security Operations
Bindplane agent & Windows logs : Removal of a specific XML element via processors

Hello everyone,I have setup a Windows log collection via the Bindplane agent, everything is working fine. I just have one small issue with the logs : rawlog format is XML, it contains a key "RenderingInfo", that is useless and very verbose & that I would like to ditch at the agent level. A sample raw log is attached at the end of the post for reference. I am not sure what processor to use to remove this part of the raw log.Supported processors : https://github.com/observIQ/bindplane-otel-collector/blob/main/docs/processors.mdI saw that attributeprocessor could meet my needs, but it is unclear to me how we can provide provide keys to target for removal since the log is just considered as a string at this point and not structured data, even though it is XML.I also saw the transform processor could meet my needs.Does anyone have a feedback on a similar use-case ? Which processor suits best to achieve this ?Sample log, I would like to remove the <RenderingInfo> part, which is not

86
C
N
NPC0101Bronze 2
posted in Google Security Operations
Alerting on log ingestion anomalies using UDM Events

Hello everyone,I'm reaching out to see if anyone has encountered similar challenges or has insights to share regarding monitoring and alerting on the health of log ingestion in Google SecOps.Here's a bit of context: We've set up a Cloud Function that queries our BigQuery table for information related to Google SecOps ingestion. We then import this data using the event import API : https://cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.events/importSo far, everything works smoothly until we try to implement alerting rules on this data. The UDM events we are dealing with look like this : The useful information is placed in the additional fields of the UDM. However, it seems that the SIEM struggles to process these fields as strings or&

16
N
Aphex2in
Aphex2inNew Member
asked in Google Security Operations
YARA-L rule issue: event variables are not all joined by equalities

Hello,I get this error with my rule which is not surprising at all: validating intermediate representation: event variables are not all joined by equalities, the joined groups are: (ioc), (network) my rule:rule IOC_In_Forti { meta: ... priority = "Critical" events: $network.principal.ip = $srcip not net.ip_in_range_cidr($network.principal.ip, "10.0.0.0/24") not net.ip_in_range_cidr($network.principal.ip, "172.16.0.0/12") not net.ip_in_range_cidr($network.principal.ip, "192.168.0.0/16") $network.security_result.action_details = "accept" $network.metadata.log_type ="FORTINET_FIREWALL" $network.target.hostname = $hostname $srcip in %MaliciousIPs or $srcip in %MaliciousIPs2 or $srcip in %MaliciousIPs3 $ioc.graph.metadata.product_name = "ALIENVAULT_OTX" $ioc.graph.entity.ip = $srcip match: $hostname over 24h condition: $network and $ioc } I want to match the srcip against a reference_list or a

42
Aphex2in
S
sufuzBronze 1
asked in Google Security Operations
Get current user information in playbook

HelloDo you know if it's possible to get current user information in playbooks ?I know that there is a key named "General.CurrentUserFullName" but this seems to not work as expected.For example, I would use the information on which user is currently logged in, as a condition in a playbook.Thank you very much.

21
T
Staff
C
Craig_Lee_BPBronze 2
posted in Google Security Operations
Bindplane Launch Week w/ New SecOps Related Features and more

Next week is our first Launch week at Bindplane, where we are unveiling new features daily. Many of these will be directly applicable to SecOps use cases, especially:  New Sources and Destinations Processing — drop-in bundles that cut config time to minutes.Daily Drop Schedule (all times ET)10:30am: Blog post + short demo video for that day’s release11:00am: Live Q&A stream with the engineering teamWhat to ExpectMonday: Telemetry Routing — new ways to move data from any source to any destination.Tuesday: Custom Collectors — build & run OpenTelemetry your way.Wednesday: Scale — think order-of-magnitude, not incremental, growth.Thursday: Processing — drop-in bundles that cut config time to minutes.Friday: A secret surprise. How to JoinRead the teaser blog for easy access to each day’s topic https://bindplane.com/blog/bindplane-launch-week-1-daily-releases-begin-june-2ndBookmark the Launch Week page for videos and livestreams https://bindplane.com/launch-weekBr

01
matthewnichols
Community Manager
Rached1996
Rached1996Silver 1
asked in Google Security Operations
Dashboard based on webhook ( feeds)

Hello, I'm actually developing a dashboard for monitoring feeds ingestion metrics  (ingested through webhook) , but i'm not getting any results ( this problem is for all webhook feeds ) What is the best solution please ? or this is not handled by Google right now ) The Query used : ingestion.component = "Out-of-band processor"ingestion.log_type = "ZSCALER_xxx"$date = timestamp.get_date(ingestion.end_time)$logtype = ingestion.log_typematch:$date, $logtypeoutcome:$log_count_sum = sum(ingestion.log_count)order:$date desc 

11
JeremyLand
Staff
N
NASEEFBronze 5
posted in Google Security Operations
yara l rule to detect data exfiltered to external driive

Hello everyone Looking for guidance on detecting potential data exfiltration to external (USB/removable) drives. Has anyone built a YARA rule for identifying such activityOpen to examples or best practices for monitoring file transfers to removable media.thanks in advance

11
A
Staff
D
devashishsinghBronze 2
posted in Google Security Operations
Automating malicious image URL response: SOAR analysis, enrichment, email block & user notification

Hey community,I have just started to implement a SOAR for below scenario and seeking advice on the same.Obviously phishing emails do also contains images or buttons that takes us to a malicious URL. Now in my case, the URL is not directly malicious rather a captcha that if you solve will then take you to a malicious URL. I am thinking of if there's a way to command Secops SOAR to further check on a URL extracted from Image by solving captcha by itself?I also need help to get the right parser for URL extraction from the image. Current, all I see is just domain. 

21
kentphelps
Staff

Badge winners

  • Authored Posts 5
    leodashas earned the badge Authored Posts 5
  • Authored Posts 5
    delstonhas earned the badge Authored Posts 5
  • Authored Posts 1
    SaDaVFhas earned the badge Authored Posts 1
  • Authored Posts 5
    hzmndthas earned the badge Authored Posts 5
  • Solution 10
    hzmndthas earned the badge Solution 10
Show all badges
Terms & ConditionsCookie settings
Privacy Policy Terms of Service Gen AI Policy Community Guidelines Cookie Settings

© 2025 Google. All rights reserved.