Skip to main content

Google Security Operations

Your Security Operations conversation starts here. Ask questions. Share insights. Tell us what you've learned. Or tell us what you're working on. We want to hear about it!

  • 2,064 Topics
  • 6,571 Replies
2064 Topics
C
Craig_LeabhartNew Member
posted in Google Security Operations
Playbook placeholders for internal users entity

there are playbook action placeholders for lots of entity types, but not for internal users. is there an easy way to get that same info that i'm overlooking (such as the output from a tool action or similar)?

01
C
C
conan_huNew Member
posted in Google Security Operations
Change and Delete Ontology

Hello, everyone! I’m configuring my CSV connection, and I’ve changed the title of my CSV file multiple times, but Ontology still giving me the initial version of my CSV file, as seen in the first image below, even though I’ve previously changed it.

03
C
C
conan_huNew Member
posted in Google Security Operations
Trouble setting up local CSV connector

Hi, Hello, I’m attempting to run a basic local case to test my playbook, but I’m having trouble setting up my local csv connector. Can someone assist me with this error? thanks a lot. [13:48:29,000 INFO] Csv Folder Path: /root/conantest.csv [13:48:29,000 INFO] CSV Limit: 10 [13:48:29,000 INFO] DeviceProductField: device_product [13:48:29,000 INFO] Time Field Name: timestamp [13:48:29,000 INFO] Time Field Timezone: UTC [13:48:29,000 INFO] Environment Field Name: conantest [13:48:29,000 INFO] Environment Regex Pattern: .* [13:48:29,000 INFO] Rule Generator Field Name: conantest [13:48:29,000 INFO] CSV Has Header: true [13:48:29,000 INFO] File Encoding Types: utf-8, latin-1, iso-8859-1 [13:48:29,000 INFO] Alert Field Name: conantest [13:48:29,000 INFO] Severity Field Name: 10 [13:48:29,000 ERROR] Unable to create folder: [Errno 13] Permission denied: '/root/conantest.csv' LOGGER: loadCon

03
C
J
Joseph3New Member
posted in Google Security Operations
Entity Selection

Hello, Please I have a question on the entity selection, is there a way to display or use those entities selected in the playbook step individually?

06
M
J
Joseph3New Member
posted in Google Security Operations
Query Joiner

Hello, please can someone direct me on how the query joiner works? These are the screenshot below of what i tried and error i was getting. Just trying to explore the action to see if it can accomplish my aim

01
J
G
Gary_TanNew Member
posted in Google Security Operations
Need help: Bridged Adapter doesn't work on Community OVA in VirtualBox

Hey community, I am new to siemplify, I just installed Community OVA in VirtualBox, chose Bridged Adapter, en0: Wi-fi. But when ssh to the vm to ip addresses show, I don't see an IP address from enp0s3 interface, as explained in step 14 as below https://www.manula.com/manuals/siemplify/quick-start-guide/5.6.x/en/topic/deploy-community-ova-in-virtualbox My VirtualBox is running on a MacBook Pro host, using wifi. Any suggestions?

02
S
Staff
L
Luis88New Member
asked in Google Security Operations
Unified Data Model?

Ok last question (for now).  What is UDM (Unified Data Model)?

02
K
S
SevenBridgesNew Member
posted in Google Security Operations
Security Command Center scan for projects that are deleted

Hi,When projects in GCP are in shut-down state, will Security Command Center remove all project-related vulnerabilities (vulnerabilities for all resources within the project)?As far as I see, non of them is removed, vulnerabilities still remain.Should we wait for 30-day period for the projects to be deleted, after which vulnerabilities will be automatically removed? Or will we have to mark them one-by-one with security marks?Thanks in advance for an answer.Best Regards,SBG

01
N
V
vinnie17New Member
posted in Google Security Operations
Getting started with Chronicle?

Is there any documentation on how to get started with Chronicle?

02
darrenswift
Staff
L
Luis88New Member
posted in Google Security Operations
Getting colleagues access to Chronicle?

I have a new team member, how do I get them access to Chronicle?

01
N
L
Luis88New Member
asked in Google Security Operations
Chronicle support?

One more question - how can I contact Chronicle Support?

01
N
M
MNlsNew Member
posted in Google Security Operations
AbuseCH Malware Bazaar Integration

Does anybody have an AbuseCH Malware Bazaar integration up and running yet? I am working on one and wondering if there would be interest from others to integrate into their environment.

02
S
Staff
S
sankarakumar_RNew Member
asked in Google Security Operations
How the grouping of alerts happening if am using arcsight SIEM ?

I know the grouping based on the entities and the time frame. to be more precise which time will it consider for the grouping? Is the base event (start time/ end time) or the alert ingestion time into Siemplify like (Triage time) . Kindly confirm?

03
S
Staff
L
luis_zamoraNew Member
posted in Google Security Operations
Endpoints

How or witch tool should I use to monitore por example seven endpoints at my local network

15
L

Badge winners

  • Authored Posts 5
    leodashas earned the badge Authored Posts 5
  • Authored Posts 5
    delstonhas earned the badge Authored Posts 5
  • Authored Posts 1
    SaDaVFhas earned the badge Authored Posts 1
  • Authored Posts 5
    hzmndthas earned the badge Authored Posts 5
  • Solution 10
    hzmndthas earned the badge Solution 10
Show all badges
Terms & ConditionsCookie settings
Privacy Policy Terms of Service Gen AI Policy Community Guidelines Cookie Settings

© 2025 Google. All rights reserved.