Security Forums

Hey Community, I'm working on configuring a detection rule in SecOps to monitor and generate an alert when a file owned/signed by my company is uploaded to VirusTotal. Has anyone worked on a similar task in the past? 

I am having difficulty writing a detection rule to identify VPN IPs, specifically for services like Mullvad VPN and other similar VPN providers, using only built-in threat feeds (no external data sources). I do not want to hardcode ASN numbers.

Hello,I have a bindplane configuration that collects logs from Active Directory and Windows Events. However, I noticed that some events are not being sent to the blindplane, but are generated on the server.For example, event 4740. I can see this event in the event viewer, but at no point is it consumed by the bindplane.What could be causing these events not to be brought in?

hello, has anyone encountered or have used security_result.variables.key before? i would like to ask for your help with the parser syntax for it. tyia!

Im using set context on alert level and i have multiple duplicate values.Now i need to remove all duplicates

Hello guys! Got a few questions regarding the new reCAPTCHA changes done by Google.I did receive the email "We’re writing to inform you that all Google reCAPTCHA keys will need to be migrated to a Google Cloud project by the end of 2025..." as most of you probably already did.So far based on my research I am aware of the following, but you can confirm my questions please: 1. The existing V2 Checkbox, V2 Invisible and V3 keys will continue to work even after this change, however, Google is not specifying is they will automatically migrate the keys themselves, or what happens if the user does not migrate all the keys.  Will they still be available/working on the sites used? From my understanding, they are suggesting to migrate otherwise, the sites may loose protection if the reCAPTCHA service surpasses more than 10.000 requests

Hi All,I’ve integrated Microsoft Graph Mail with Google SecOps SOAR. For the Delete Mail  action, if we don’t provide specific values for the Sender or Subject filters, will the action delete all emails from the user’s mailbox?

I’ve been using this page to reference collector ID values in ingestion metrics.https://docs.cloud.google.com/chronicle/docs/ingestion/ingestion-notifications-for-health-metricsRecently, I’m seeing bbbb1111-bbbb-1111-bbbb-1111bbbb1111and ffffffff-ffff-ffff-ffff-ffffffffffffvalues returned for ingestion.collector_id -- are these documented anywhere? Seeing UDM as the ingestion.metadata.log_type for these -- I assume one or the other of these corresponds with entity risk change UDM events which have recently been enabled, but not sure about the other.https://docs.cloud.google.com/chronicle/docs/release-notes#October_28_2025

I am pulling in AD Context Logsas per Collect Microsoft Windows AD logs  |  Google Security Operations  |  Google Cloud For user accounts, I am seeing the Enrichment in my event logs, however for Computer objects I am not seeing this? Here’s the context dataBut when I check event logs for that host:although the IP is there, which I doubt is from enrichment, the other attributes not… I need at least the role.  

I have seen “Integration - Updated integration action definitions to meet the new requirements of IDE” come up in lots of SOAR integration updates. What new requirements are being referenced? Is there some kind of deadline by which these updates have to be implemented?

Can anyone identify the difference in the maximum result when using different over values in the match?Example: I search the last hour of logs by log_type: events: $event.metadata.event_timestamp.seconds > timestamp.current_seconds() - 3600 $silent_hostname = $event.metadata.log_type And in the match I insert: match: $silent_hostname over 30 min This shows me 2 groups of logs:Group A (the first 30 minutes) and Group B (the last 30 minutes).With the following outcome, to show me the max timestamp of each group: outcome: $max_event_time = max($event.metadata.event_timestamp.seconds) I get 2 results, each with the max timestamp for its group.However, if I change the over value to 1 hour, it is supposed to return only one result, with the max timestamp equal to the max timestamp from Group B. But th

I’m trying to integrate reCaptcha v 3 into our checkout page. It seems that no matter what I do the call to grecaptcha.enterprise.execute is always returning a token of 0.Here is the button event: function OnCCCard(e) {            e.preventDefault();            grecaptcha.enterprise.ready(async () => {                console.log('Getting Token');                const token = await grecaptcha.enterprise.execute('MyKey', { action: 'checkout' });                console.log('Got Token:' & token);            });        }No matter what I try the second console.Log always says : “Got Token: 0”I’m not sure what I’m doing wrong. 

There are two endpoints for log ingestion into SecOps:europe-malachiteingestion-pa.googleapis.comchronicle.googleapis.comWhether using the APIs directly, or via the bindplane agent, we can get successfully logs into our SecOps instance.The "legacy" Malachite API works perfectly. The logs, labels, and base_labels are added, meaning Data RBAC works as expected.metadata.base_labels.allow_scoped_access = true metadata.base_labels.ingestion_kv_labels[0].key = "attempt_id" metadata.base_labels.ingestion_kv_labels[0].value = "597901e6cbfb490e8903fb660da2b4e0" metadata.ingestion_labels[0].key = "attempt_id" metadata.ingestion_labels[0].value = "597901e6cbfb490e8903fb660da2b4e0"The v1alpha, chronicle API allows our logs to be ingested. The ingestion labels are visible in SecOps, but the

Hi, We are in the process of setting up Google reCAPTCHA and are facing an issue related to URL filtering on our Palo Alto firewall. We created URL filtering rules to allow only recaptchaenterprise.googleapis.com, but reCAPTCHA is still not functioning as expected. During troubleshooting, access began working immediately after we removed the URL filtering restrictions, which confirms that the firewall had been blocking one or more additional Google domains required for reCAPTCHA validation. However, when we re-enabled the URL filtering policy and permitted only recaptchaenterprise.googleapis.com, the issue returned. This indicates that reCAPTCHA Enterprise relies on multiple backend Google domains, and allowing just this single URL is not sufficient for the complete validation workflow. To fully restore functionality, we may need to allow the complete Google reCAPTCHA domain set as recommended by Google, instead of permitting only a sing

Hi everyone,I’m working on a YARA-L detection rule in Google SecOps for Intune wipe operations. The rule should alert when any user performs more than 3 device wipe attempts within a 1-hour window.However, I need to add an exception for one specific identity (X), where the threshold should instead be 6 wipe attempts.In other words: in one hour For all attempts alert if wipe count > 3 For user X → alert only if wipe count > 6 My current simplified condition is: This triggers for all identities—including X—even though X should only alert after 6 events.I’m trying to implement logic like: IF identity == "X" THEN threshold = 6 ELSE threshold = 3Does any

Hi Team,I am looking to get an alert if I miss a log from an endpoint from a server. Since the ingestion API monitoring is not granular enough to get this info, I planned to create a dedicated Yara-L rule for the said server. The rule I had planned for looked something like this:    rule silentLogFromCriticalEndpoint { meta: author = "Srijan Kafle" description = "Detects missing logs from server" severity = "MEDIUM" created = "2024-06-03" events: $session.principal.namespace = "prodSydney" and $session.principal.hostname = "redacted" $source = $session.principal.hostname $tenant = $session.principal.namespace match: $source,$tenant over 12h outcome: $risk_score = 3 // logic to check delay here which is not working $delay = $session.metadata.event_timestamp - timestamp.current_seconds() condition: $session and $delay >= xyz }  line 2

I have been thinking about how google is assures log data post ingestion is stored in an immutable state for assurance from data security viewpoint.  I tried searching for SecOps documentation but unable to find a straightforward statement. Also, once data is stored, is there a way one could delete/alter the data, if one has an appropriate permission to do so.  And how to keep a tap to such actions.?  

I can't add a timezone setting to the timestamp.The part of the parser that extracts the timestamp is below.----------date {match => ["eventtime1", "UNIX", "UNIX_MS"]on_error => "not_eventtime1_valid"}----------I tried the following settings:①----------date {match => ["eventtime1", "UNIX", "UNIX_MS"]timezone => "Asia/Tokyo"on_error => "not_eventtime1_valid"}----------Result:No change.②----------date {match => ["eventtime1", "yyyy-MM-dd HH:mm:ss"]timezone => "Asia/Tokyo"on_error => "not_eventtime1_valid"}----------Result:Syntax error.The current time is stored in UNIX time in timestamp.Is it possible to reflect the time zone setting in the above settings?