Google Security Operations

I have set a context value for a filed Threat_type = "URL" and used action get context value to verify if it was set.(Scope was alert level)i was able to see and it was set to URL.my question : Where Can see context value in case wall?

Hi, I attempted to use the Chronicle API (legacySearchAlerts ) to retrieve alert information, but I'm unsure how to apply pagination. I set the startTime, endTime, and pageSize query parameters, but I don't know how to set the pageToken for the first call. Additionally, the response body only contains alerts and user_alerts without a next_page_token, which is not match to the API document, so I can't retrieve the next page.

We are creating Widgets and the Tag Filter is taking forever to return results. Is this normal? We don't have that many tags (maybe 15-20).  

Hello,Is it possible to get mandiant, digital threat monitoring alerts into google secops? I have been trying to leverage the api with the following website: https://gtidocs.virustotal.com/reference/get-alertsI am trying to find a more streamlined way to get these alerts live in secops that does not involve a script.Thanks.

Hello , actually i'm searching for dropped logs on my forwarderIn gcp monitoring ( metric explorer ) i can see the value of total logs dropped which is 0.053/s ( mentionnedin the screenshot ) i can't understand the value , what does that mean 0.053/s can any one help ? 

So long before this happened i  can access my SecOps completely fine, but i dont know why recently i cant sign-in into my SecOps. Its Looping again and again in the sign-in page. But if i try to sign-in by my smartphone (with the same account email), i can sign-in and access SecOps smoothly. So i think the problem is on my Notebook, i have tried several ways, such as: clear browser cache and cookies, try other browser, using Incognito, and reinstall the browser, but still i cant sign-in.* you can see the video in the link, how my sign-in looping looks likehttps://drive.google.com/file/d/1m63luTcUS4HRrNcVmOknQMcMYRwOQq4-/view?usp=sharinghttps://drive.google.com/file/d/1pAGJF9ivGSzuStW7Nmu8X4Gs58-VhQIR/view?usp=sharing

Hello,I recently integrated an S3 bucket for one of our application logs. The logs are in JSON format, and the files in the S3 bucket are named in the format FileName.json.gz.SecOps is successfully pulling the logs, but I'm encountering an issue with the log format. The logs are breaking improperly—either after each line, comma, or curly brace { } —resulting in an incorrect format when ingested.I’ve double-checked the basics but haven’t been able to pinpoint the root cause of this issue.Has anyone faced a similar problem? If so, how did you resolve it? Any guidance or troubleshooting steps would be greatly appreciated.Thanks in advance for your help!

Hello,I tried to create an extension parser to my KUBERNETS_NODE parser by using map data fields.I created 10 fields, and I can't add more.Is there such a limitation to Chronicle?, If I create the extension using code snippets instead, will it work?Thanks  

When is the new dashboard for Google SecOps/Chronicle Releasing? @admin11_2 

How to purge unnecessary data from Google Chronicle SIEM in 2023? I have access to both Chronicle and Google Cloud consoles but can't find the data ingestion management section

Is there something that needs to be turned on to allow the SOAR CaseSearchEverything endpoint to return data? We have cases and I can get other SOAR api endpoints to work. This one returns success but never any data even within the swagger UI. Here's how I'm calling it.  

Hey folks,I have a rule that generates alerts if some log matches the conditions mentioned in the rule. However, when the alert is generated, it shows the name "[n/a]", as mentioned in the screenshot. Can someone explain why does this happen, and what steps should be taken for adding a name to the generated alert.

Hello community , how i can identify forwarder logs in the audit logs ?thanks in advance

Hi All,So i m newbie who earlier worked as blue teamer.I was recently moved to enginerring side where i have been tasked to do integration of project with infra completely on gcp and they want to move most of their application logs to chronicle. Can you help me understand where to start. I have gone through the documentation and it v good but i dont know where to start

Hi,I have configured my BindPlane agents to collect logs from the Windows Security Events, Microsoft-Windows-PowerShell/Operational, and Sysmon channels. For each log source, I have specified the log type in the processor configuration as per the documentation.I have set up three different ports on the destination, with each port designated to receive a specific log type. Logs are being sent and received on all three ports as expected.However, in Google SecOps, when I search for logs from the Microsoft-Windows-PowerShell/Operational channel, I observe that some logs are incorrectly categorized as Windows Events log type instead of PowerShell log type. This issue does not occur for all logs; some logs from the PowerShell channel are correctly written as the PowerShell log type, while others are misclassified as Sysmon or Windows Events or misclassified as Powershell when its Windows Events etc.My forwarder is configured to listen 20 different log types, and this issue only occurs with B

We are using the /external/v1/cases/AddEvidence/ endpoint to add evidence as an attachment to a case. Despite passing IsImportant: true in the request body, the isFavorite field in the API response always returns false. 

Hello Everyone,I’m working on integrating Google Cloud Storage for a project requiring large file uploads (several GBs), and I’m encountering some challenges with multipart uploads using the Cloud Storage API.Here are the key issues I’m facing:If an upload is interrupted, is there an optimal way to resume from the last uploaded part? The API documentation mentions resumable uploads, but I’m unsure how to combine that effectively with multipart uploads for maximum reliability.I often need to attach metadata to the files, but with high-volume uploads, managing this through the API seems inefficient. Is there a way to batch metadata assignments or streamline this process?When uploading files over 10GB, I occasionally encounter timeout errors even with appropriate retry logic. should I adjust existing timeout configurations?Looking for your expert opinions.

I was told by our implementor that Google SecOps pulls logs from a source API every 15 minutes, and if the source goes down or there is some issue with the API connection that prevents logs from being pulled, they are lost, and there is no way for Google SecOps to retrieve them after the connection is restored. This doesn't sound right to me. Is there a way to pull missed logs assuming the source still has them available? 

Hey Folks, Happy Holidays !!!I am trying to look for a way to sort an array of integers in increasing order in the outcome section of my rule. The reason to do that is to specifically look for an indexed value which can only be found when the array is sorted in the increasing order.My outcome section looks something like this and I am looking to sort the $Session_Diff array$Session_Diff = array($NextLoginTime - $PreviousLogoffTime)$Deltas = arrays.size($Session_Diff)$count_previous_events = count_distinct($previous.metadata.event_timestamp.seconds)$count_events = $count_previous_events + 1$pointer = $count_events - 2$final_result = arrays.index_to_int($Session_Diff, $pointer) Thanks in advance.

Hi,I have got a list of IP's which was accesed by a process and was enriched with a block and now wanted to check if they are suspicious.Is there a any way where i can give the list of IP's ( may be in a loop ) and verify if suspicious or not.Regards,Laxmikant

Hi, right now I'm practicing how to use "else if," but I sometimes get confused about how to use the parentheses. Could you provide me with any resources to help me better understand the "else if" condition? It just confuses me. Also, do you have any resources to easily understand regex, aside from Regex101?

Hi all and happy new year!I'm playing around with my network logs and was puzzled to find we don't have any metadata.event_type = "NETWORK_FLOW" logs - at tleaset not according to SIEM 🙂 I understood we  have firewall logs and logs from our routers so I expected to see flow also. Would anyone offer which type of logs they see  metadata.event_type = "NETWORK_FLOW" logs in so I can narrow my efforts in examining raw etc.? thanks!

  { "AccountId": "741448936891", "Arn": "arn:aws:guardduty:ap-south-1:741448936891:detector/66ca0946c7dfd299da283198338550ee/finding/34ca0cfb393882ceadb00e62be29dfc0", "CreatedAt": "2024-12-30T23:46:09.137Z", "Description": "AWS CloudTrail trail arn:aws:cloudtrail:ap-south-1:741448936891:trail/sample_test was disabled by anurag-aws-learn-new calling StopLogging under unusual circumstances. This can be attackers attempt to cover their tracks by eliminating any trace of activity performed while they accessed your account.", "Id": "34ca0cfb393882ceadb00e62be29dfc0", "Partition": "aws", "Region": "ap-south-1", "Resource": { "AccessKeyDetails": { "AccessKeyId": "ASIA2ZIOM5W5QMW3FGAP", "PrincipalId": "741448936891", "UserName": "anurag-aws-learn-new", "UserType": "Root" }, "ResourceType": "AccessKey" }, "SchemaVersion": "2.0", "Service": { "Action": { "ActionType": "AWS_API_CALL", "AwsApiCallAction": {

Hello , I want to know if there is any possibility to view internal audit logs of chronicle ( login , modifications on parsers , rules modifications etc ... ) Thank you in advance

Hi,I’m trying to see if I can get a list of all the curated detections I’ve created so far. I’d like to review the types of alerts I have so I can write custom rules that aren’t built-in.I tried searching for them in the SIEM search, but since the detections aren’t part of the events themselves, I couldn’t locate them. Additionally, the alerts on cases were turned off until now, so I couldn’t find them in the SOAR search either.Could you please help me with this?Thank you!