Security Forums

General Approach: Using System SchedulersFor most general use cases, you can create a simple script (batch, shell, Python, etc.) containing your Git commands (git pull, git push, etc.) and then use your operating system's built-in scheduler to run this script at regular intervals.Linux/macOS (Cron): Create a shell script (e.g., ~/gitsync.sh) with your commands. Make sure it has execute permissions (chmod +x ~/gitsync.sh). Edit your crontab using crontab -e. Add a line to schedule the script, for example, to run every 15 minutes: bash */15 * * * * /bin/bash /home/user/gitsync.sh >> /home/user/cron_log.log 2>&1 This command executes the script and redirects the output to a log file for monitoring.

  */15 * * * * /bin/bash /home/user/gitsync.sh >> /home/user/cron_log.log 2>&1  

We were recommend to post here re. case #10394319, Project number [removed by moderator] and as belowPlease could you highlight for attentionThanksRyan We are writing to appeal the suspension of our Firebase Hosting project dg-style-chooserThis is a false positive. Our application is a legitimate business tool, not phishing.What our application does:We operate LiveStory and DamnGood, two digital magazines that feature content creators.Our web application allows potential creators to browse visual style preferences and submit applications to be featured in our publications.The form collects standard contact information (name, email, Instagram handle) that creators voluntarily provide to apply for partnership opportunities.Why this is NOT phishing:We are a registered business operating at joindamngood.com and joinlivestory.com.We do not impersonate any other brand or service.We do

Is there a way to filter the workspace logs and reduce it before sending it to secops ?It is consuming too much storage of the tenant storage limit.

Hello Commmmmunity, I am attempting to implement the detection rule below in SecOps but keep getting an error message when I test or attempt to save the rule.“parsing: error with token: ":" expected '=' between meta assignment key and value line: 11 column: 12-13” rule MAL_Dropper_NetSupportRAT { meta: author = "Sam" description = "Detects a dropper that delivers a decoy ChaGPT Installer and NetSupport RAT" hash = "d86f647f3dfa6a53de7b531cb590636331f83afcea60d4b3d44de5ea3b7d33af" malware = "NetSupport" malware_id = "TWOU5d" category = "MALWARE" strings: //dropped files $d1 = "ChatGPT Installer.exe" $d2 = "setup.exe" //netsupport strings $n1 = "NetSupport" nocase $n2 = "install_netsupport_manager_silently" $n3 = " [removed by moderator] " condition: uint16(0) == 0x5A4D and all o

Hi,I am new at using the Google recaptcha thing.First, I have to say that Google knows how to make things complicated!!! I cannot find my way around the recaptcha dashboard? It looks like a big mess to me.Anyhow, I have made some recaptcha keys for websites of mine. I am now trying to strengthen my website security after having been hacked over and over.The plugin in I am using asks for both the recaptcha main key and the security key. I seem to be able to find the main keys but I don't seem to have any access to the security keys?Do I need to start over or is there a way to find the security keys once having been made?If so, how?Thanks,John

Hi,  I have a rule created that is to see the users that have used vpn after business hours for the day adn this is for informational purposes only and i want this to be triggered only once per day at a certain time. Eg: 12 AM. how can i set this timei have made the metch section to be 24 hours, but i want to know how i can set a specific time like 12 am for the rule to be triggered. 

Hello all, I need to create some automate TAGs depend con the value of the hostname. Example if a host is from Belgium: BEL-XXX, if its from Brazil: BRA-XXX. Well i thought about the funcion on SOAR casa data→ TAGS. Teh proble here, is i have more than 1 product in incoming alerts, and in one alert the entity is saved in host_name entity, in other deviceDNSname...etc… So, is there any solution or best practice for this?  Thanks!

Hi,The reCAPTCHA that we were planning to migrate automatically has apparently been migrated automatically the other day.As a result, we have received an email from Google Cloud titled “Action Required: Accept Your Invitation to Manage reCAPTCHA on Google Cloud”.If we approve this, we currently have only one project that has an active reCAPTCHA contract—after clicking Accept/Approve, will the keys that were automatically migrated this time appear in that project?

Do you know when the APIVoid integration in Google SecOps (SOAR) will support the new APIVoid v2 APIs? The current integration (linked below) references the older v1 endpoints:https://docs.cloud.google.com/chronicle/docs/soar/marketplace-integrations/apivoid APIVoid has announced that v1 APIs will be deprecated on Feb 28, and v2 introduces breaking changes. From the APIVoid v2 API documentation, requests now use POST with a JSON payload, for example: curl -X POST "https://api.apivoid.com/v2/ip-reputation" \ -H "Content-Type: application/json" \ -H "X-API-Key: YOUR_API_KEY_HERE" \ -d '{"ip": "80.82.77.139"}' Additionally, the response structure has changed. Previously (v1), responses were wrapped under data or 

I am creating a new integration, and for that I copied the pyproject.toml file from an existing integration. To generate the uv.lock file, I am using the uv sync command as mentioned in the Content Hub install and build steps.Once the uv.lock file is created, I use the mp build --integration <integration_name> command to generate the build, and I can see the output in the Out folder. After that, I change IsCustom to true, generate the ZIP file, and try to install it. However, I encounter an error. Upon investigation, I found that the issue is related to dependencies.I had some working integrations on my instance. I exported those integrations and copied it’s dependences and replaced them in the Out folder, and after doing that, the installation worked.To reproduce this issue, I tried generating a build for an already available integration in

Hello Community,I am trying to clearly understand the design and deployment model of Google SecOps SOAR Remote Agents, specifically when the target systems (for example, FortiGate firewalls or other on-prem security tools) are hosted inside a private customer network. I would like clarification on the following points: Hosting Model Do we need to create a VM in the customer private network to host remote agent? Is the Remote Agent always expected to run on a dedicated VM or server inside the customer’s private network? Is this the recommended and supported architecture for interacting with internal devices such as firewalls, AD, or other non-internet-exposed systems? Allowing Access for Remote Agent to Google Publisher and Firewall

HI everyone, I’m trying to find a documentation of the SOAR api, but I’m unable to find an API that lets me retrieve playbook results per alert.I want to be able to retrieve the data from query enrichments that I’ve created. Has anyone been successful at doing this? 

I am looking to build a dynamic asset inventory in Chronicle SIEM to map AWS Account IDs to their respective OUs.My environment has a lot of accounts and CloudTrail logs lack OU context. My plan is to create a Chronicle Data Table with a bulk export of current accounts and then use a YARA-L detection rule to catch CreateAccount events (which contain the OU name). This rule would trigger a SOAR playbook to automatically append the new Account ID and OU mapping to the Data Table. What is the best practice for my problem?Which YARA-L rule and playbook should I create for this solution?Thanks

Hello guys,I’m working on SecOps Audit events for MOC purposes.I wrote a query to identify modifications on Parsers & Extensions.Here’s my query :events: metadata.log_type = "GCP_CLOUDAUDIT" target.application = "chronicle.googleapis.com" // Filter on Parser Mgmt events metadata.product_event_type = /\.ParserService\./ $action = re.capture(metadata.product_event_type, `ParserService\.(.*)$`) // Exclude 'Read' events not $action = "GetParser" not $action = "ListParsers" not $action = "ListParserExtensions" not $action = "GetParserExtension" $evtid = metadata.id match: $evtidoutcome: $timestamp = array(timestamp.get_timestamp(metadata.event_timestamp.seconds, "SECOND", "Europe/Paris")) $audit_action = array_distinct($action) $log_type = array_distinct(re.capture(target.resource.name, `logTypes/([^/

Hi Folks,I’m new to SecOps and still getting familiar with the platform’s functionality. Apologies if this is a basic question, but I believe it will be helpful not only for me but also for others who are beginning their SecOps journey. I’m looking for guidance on how to search logs in SecOps for the following requirement:We have onboarded Windows servers via Bindplane, and I want to run a query to list all logs coming from a specific Windows server.Currently, we are using a query similar to the one below (Partial query) :metadata.log_type = "WINEVTLOG"$host = strings.coalesce(principal.asset.hostname, principal.hostname)However, we are observing an issue where we have onboarded only 50 Windows servers, but the query returns more than 50 host values. Upon initial review, these additional hosts appear to be introduced during parsing (exact cause not yet confirmed).

Hi Team,While running a Dashboard query using “Run in Search”, the query returns No results, even though the same query shows results within the dashboard visualization. The issue specifically occurs when applying an equality filter (=) on a derived field created using an if() expression. metadata.product_event_type = "test" $inference = if( security_result.summary = "Client Authentication Bypass", "ABP", if(security_result.summary = "SSH Agent Forwarding Requested", "AFR"))$inference = "ABP"match: principal.ip, target.ip, $inference  When filtering with: $inference = "ABP"  → No results are returned. However, removing the equality filter entirely returns results Using a negation filter:

I have this nested JSON: "jsonPayload": {"message": "\"id2\":{\"timestamp\":\"2026-01-19 03:15:20\", \"app_name\": \"test1234\", \"client_port\": \"2233\", \"client_host\": \"hostName\"},}I wrote this code snippet but it doesn't work, can you tell me why?filter { mutate { replace => { "client_port" => "" } } grok { match => { "jsonPayload.message" => ["client_port=(?P<client_port>[0-9]+)"] } overwrite => ["client_port"] on_error => "client_port_not_present" } statedump{} mutate { rename => { "client_port" => "event.idm.read_only_udm.principal.port" } } mutate { convert => { "event.idm.read_only_ud