Google Security Operations

Hello,I am unable to view the statedump of my parser code.Raw log is as follows:  "resource": { "type": "k8s_container", "labels": { "container_name": "abc", "namespace_name": "default", "location": "us-central", "project_id": "xyz", "cluster_name": "test-cluster", } }  The following is my parser code with the statedump:  filter { json { source => "message" array_function => "split_columns" } for key, value in resource.labels map { mutate { replace => { "test.key" => "%{key}" "test.value" => "%{value}" } } statedump {} } }  Where am i going wrong? 

Does anyone have some guidance on how to configure integration between Chronicle SOAR and Zscaler ZIA? From the official doc is not very clear where to configure on ZIA API key and password used by SOAR for the connection 

I'm looking for an architectural diagram of Google Chronicle which will be used for BCP/DR. Any idea where do I find this?

Hello,I am looking at the following preview documentation:https://cloud.google.com/chronicle/docs/preview/search/raw-log-search-in-investigateUsing UDM Search, one can only search for UDM events and not UDM entities. The documentation says:>After you complete a raw log search, each matching raw log line is replaced with the events and entities contained in the log line.What does that mean? And is raw log search and UDM entity search the same?Thank you!

Hi All,Please help us, how to write the use cases for Network devices in SIEM.Please share with me if have any example use cases format and we are not ware up on how to write the use cases.thanks!

Hi,How can we filter logs related to authentication failure across all log sources. We can see authentication activities using metadata.event_type="USER_LOGIN" but this contains overall login activities not just success and failure

Hello Experts, Can someone please provide some sample rules to detect WebShell detections?In Essense are trying to look for events related to file creation, modification, or deletion, particularly in commonly targeted locations like web application root directories (e.g., /var/www/html). Focus on events involving executable files with unusual names or suspicious scripts.

Hey All!Can someone explain what the 'case_ids_free_search' parameter is used for here? - https://cloud.google.com/chronicle/docs/soar/reference/siemplify-module#get_cases_by_filter My use case is to get all cases closed in the last x minutes that have a specific tag. So going to use a combination of 'get_cases_ids_by_filter' which offers the 'close_time_from_unix_time_in_ms' parameter to grab all recently closed cases. Then I was going to use 'get_cases_by_filter' with the Tag I want to look for and then the parameter for free search against the output from the previous call (all recently closed case IDs). As 'end time' is actually the end time of the event that triggered the case as opposed to the closure time of the case. It seems the case_free_search only accepts single Case IDs as opposed to an array, as this seems to work - recent_cases = siemplify.get_cases_ids_by_filter(status='CLOSE', sort_by='CLOSE_TIME', close_time_from_unix_time_in_ms=(get_epoch_min

Hey guys, [customer] logs are getting validation errors specifically with their "Group Creation" events, where their logs are missing the group.id attribute. Who should I work with to get the parser updated on Google's side to accommodate this use case? [Customer] wants to see the updates for this parser come through, so they're not looking to push a customer specific version of it.

Does anyone know how to create such a dashboard or event get the data in order to track Time to Respond and Time to Resolve for cases/alerts?I search the version 1 API and even if you use: /api/external/v1/dynamic-cases/GetCaseDetailsThe data returns: Creation, Modification, Start time, end timeThe  Modification field that tracks the update, is updated anytime the case is modified - this includes comments and assignment.The end_time field doesnt seem to be updated at all event after case closure. At least while I use the api explorer.Has anyone managed to create a dash board that is able to track this information?

Where can I find the license types for Chronicle (community plan enterprise plan)?

Can someone please provide some guidance on how to go about writing a YARA-L rule for to detect this?- Randomized powershell executables - hash is poweshell.exe but file name is different.

 Hey everyone!I've come across a peculiar issue and wanted to see if anyone else is experiencing the same thing. Normally, I'd open a support case for this, but since we're not on GCP yet and the change to GCP is ongoing, I can't do that just yet. So, I'm crossing my fingers that someone from Google can either confirm they're working on this or, if it's a more widespread issue.Here's what I've noticed:Alerts with alarming disabled are still showing up on the "Alerts & IOCs" page. We've seen this happening for both Curated Detections and Custom Rules. To catch our breath, we've gone ahead and archived the rules and disabled them completely.To add to the strangeness, we can't close these alerts either.Anyone else dealing with this?  Edit: Seems like this issue was fixed! Thanks Everyone!

Zeek(used to be Bro) is an open-source Network Security Monitor that can be used for Detection System  and network traffic analysis framework. Zeek can generate real-time alerts, data logging for further investigation, and automatic program execution for detected anomalies. In addition, it can analyze various protocols, including HTTP, FTP, SMTP, and DNS, run host and port scans, detect signatures, and discover syn-floods. Zeek data can be ingested and parsed using chronicle parser as described in https://cloud.google.com/chronicle/docs/ingestion/default-parsers/collect-zeek Here is a list of searches using Chronicle UDM against Zeek logs Filter by destination IP:  metadata.vendor_name = "Zeek" AND target.ip = "204.79.197.203" Filter traffic between Source IP and destination IP:  metadata.vendor_name = "Zeek" AND principal.ip = "10.10.20.60" AND target.ip = "204.79.197.203" Filter by IP (either Source or destination):  metadata.vendor_name = "Zeek" AND ip = "10.10.2

I am looking at the following blog:https://chronicle.security/blog/posts/new-to-chronicle-a-new-view-for-search/ In this it says:The number on the right side of the panel represents the total events that contain a value for that field and the number in parenthesis next is the count of distinct values.Does the number in parenthesis indicate the count of events that contain a distinct value? And if yes, what does it essentially mean. Can you provide an example to provide an understanding.Thanks!

Does anyone have a sample rule they can share with me to track EID 7045 windows events to monitor new services? Also any sample rules or pointers you can provide for this detection would be a ton of help.- Randomized powershell executables - hash is poweshell.exe but file name is different.

When I click the my user icon (I'm an admin) in the upper-right, there is a "localization" option that allows the timezone and time/date format to be customized. The timezone setting doesn't appear to have any affect on the date/times displayed. I've tried multiple times, refreshed, etc. with no result. Whatever setting I choose does persist in the UI. It's not like I'm choosing a timezone, and it gets reset, but the date/times don't reflect my choice.If I go to SOAR Settings --> Advanced ---> Localization and change the timezone, the effects are immediate and my user Localization settings are reset. This is expected and the UI explains this well. This is where it gets a bit weird. After changing the timezone in the Advanced settings, if I return to my user settings, the instant I click the Localization option (NOT clicking the dropdown to change the timezone), the timezone is reset to UTC (no refresh needed). Then I'm back to square 1. Whatever I select has no effect, and I

Is there a way to set up Syslog transport in a customer security solution and send it directly to Chronicle?Syslog settings exist in customer security solutions without configuring Forward. You can configure log transmission right away by entering the Chronicle IP address here.However, when checking Chronicle Documents, it appears that there is no way to configure a forwarder or receive feed directly if there is no API.Unfortunately, the solution used by the customer is a security solution developed in South Korea and is not included in the definition provided in the Feed Source type.However, since it is a Linux-based solution, it is equipped with a transmission function through Rsyslog.Is there no way??

I have two feature requests if anyone is interested. Also the API is pretty well documented if you don't want to wait. All info is below.Integration: URLhaushttps://issuetracker.google.com/issues/328715673Description:URLhaus provides a database of malicious URL's which is searchable by URL, Domain, Hash, tag or file typehttps://urlhaus.abuse.ch/browse/Many threat hunters use this service and there is no cost. The Use case would be for enrichment.API Documentation is located here: https://urlhaus-api.abuse.ch/SPAMhaushttps://issuetracker.google.com/issues/328450203For Domains and IP's. There is a limit of 5000 API requests per month Documenation: https://www.spamhaus.com/API Documentation: https://docs.spamhaus.com/sia/docs/source/10-API-Interface/110-API.html  

HiI am getting 401 for call to casesearcheverything api callThe calls works for my company domain swagger but what should I be looking to  configure authentication via code ? Ex any headers , key-secret , auth calls ?I am using Java/springboot as dev env.Appreciate any pointers thanks

Anyone have a good experience ingesting Windows logs into Chronicle? I’ve heard nxlogs , cribl, etc. E.g. can Chronicle use cribl stream ? I see there’s “edge” and “stream” flavors of cribl?

Hello,How can I monitor my project in GCP  directly?I need to track every action that takes place in my project, for example: a new user is created, a new bucket is created, some changes have been made in vpc..I added my project in Chronicle settings - GOOGLE CLOUD PLATFORM. Does it have anything to do with my goal?Thank you

I need to create a rule that will trigger an alert every time a new bucket is created in GCP.I tried to do this - rule new_bucket_creation { meta:description = "Alert if a new bucket is created"severity = "Medium"events:$bucket.metadata.event_type = "RESOURCE_CREATION"$bucket.target.resource.resource_type = "STORAGE_BUCKET"outcome:$risk_score = 0condition:$bucket} How do I write such a rule? How should I properly change the rule I wrote?  Thank you

HelloI'm looking for a solution into using CaseSearchEverything API. As I understand1) it returns all cases based on created time based filter . Does it return also updated cases. Does It returns cases based on created time only? What happens when a case is updated. How to get based on updated time.2) Also how to get All comments for all cases instead of just one case id at a time ? We can get all cases using the above api but then have to do get comment using caseid, so it is doable but would be nice to get all related information together .Appreciate any pointers Thanks

Is there anyway we can use values from logs to populate in a markdown widget? I am trying to write a something similar to executive summary using markdown but instead of it being static I want to fetch some fields from the logs such as count of total events and authentication failure count. If yes, is there any reference document for the same?