Security Forums

i accidentally uploaded a confidential file to Google threat inteligence. How do I request to delete it?

I cannot find any documentation saying how to do this. Any guidance would be appreciated on a step-by-step on this.

Need more Information Around Custom View , Custom View 1 with role Tier 1 and custom view 2 with role Soc manger Im not able to view these on the alert view section need more clarity around this like how to use and which scenarios

Are jobs independent of Integration?

Hi experts!I am working in the SAP space and I have to integrate the SAP Enterprise Threat Detection (ETD) solution with Google Chronicle. Is there a standard way to do this integration?Thank you for the support!Regards,

Hello,Has anyone else experienced issues with the "Delay Playbook" or "Delay Playbook V2"?I attempted to run a 30-second test, but it kept getting stuck indefinitely.Any workarounds?

Is there a method to close multiple alerts simultaneously in the SIEM? We've faced an issue where rules set as 'Live' but with 'Alerting OFF' generated alerts in the SIEM. These rules are intended for monitoring purposes and not to trigger alerts.

I want to build a lightweight version of SCC for internal usage within my Organization  using the SCC APIs (either the google cloud client libraries or the REST API). Looking at the APIs  documentation my understanding is that APIs only support discovering assets / findings  and application vulnerability features of SCC. I see the below features of SCCAsset Discovery and Inventory (APIs available)Unified security findings (APIs unavailable)Notifcations and actions (APIs unavailabe)Application vulnerability detection (APIs available)Misconfiguration detection (APIs unavailabe)Anomaly detection (APIs unavailabe)T

How to insert links of instruction doc/pdf in instruction action so that analyst can refer to perform the action during investigation.  

Flow-multiple choice question:  for example if answer is no, I want to the "no" branch does a feedback and get back to a process before the multi choice question. I've tried just to move the previous process to the "no" branch but it can't be added to that branch. Do you have any idea?   

Hi Team,Want to know. Does Chronicle SOAR has ability to setup a proxy for routing the network calls (i.e. within Integration/Action apps) to external APIs? If yes, any references/links about how/what/where.

How to get security alert from browsers?

Hi everyone,I'm reaching out to the community to learn more about Google Chronicle SIEM and its unique features compared to other SIEM tools.I'm familiar with some of Chronicle's strengths, such as Natural Language Query (NLQ) for searching logs and Alert Graph for visualizing incident context. However, I'm interested in getting a broader perspective from the community.Are there any other features specific to Chronicle that you find particularly valuable? Perhaps functionalities that other SIEMs lack?I'm also curious to hear about any real-world experiences using Chronicle's unique features. How have they impacted your security operations and threat hunting capabilities?Thanks in advance for sharing your insights!Best regards,Surya Teja.

Hi guys,i have a problem with a custom parser on chronicle.This is the log:<158>Jul 10 10:23:02 test-lb[1362591]: 12.12.12.12:47934 [10/Jul/2024:10:23:02.545] test~ back/test 0/0/0/3/3 200 51745 - - ---- 59/17/1/1/0 0/0 "GET https://www.example.c HTTP/2.0"And this is the custom parser: # Product: HAPROXY# Category:  Load balancing# Supported Format: SYSLOG# Reference: N/A# Last Updated: 2024-07-22  filter {  mutate {    replace => {  "process" => ""  "pid" => ""  "client_ip" => ""  "client_port" => ""  "timestamp" => ""  "frontend_name" => ""  "backend_name" => ""

Hey everyone,We have an issue with restricting access to a SecOps instance.Before, the provisioning procedure required an IDP group mapped to Chronicle's backend to grant access to users in said group. This meant that if a user was not part of the IDP group, they could not access Google SecOps. This was the case even if you used Cloud Identity.However, recently, this provisioning has changed. Now a provisioning wizard pops up and you can directly choose Cloud Identity, which makes it easier as you can now control access with GCP IAM and assign roles to any user within your GCP IAM console. However we have an issue with this new way.We have to restrict access to only a specific group within IAM BUT users that have the EDITOR role at Org level still have access to Google SecOps and this should NOT be the case. We have tried applying a Deny policy BUT the roles associated to Chronicle in IAM are not included in DENY policies.Does anyone have an idea o

Hi,I was looking at the PULSE_SECURE_VPN parser. And found out that there are many other type of format present in the parser. apart from Syslog I was able to see that there is JSON format, xml format and also windows format.In the parser it is written like it supports the above mentioned format. But the description only shows SYSLOG support. Can anyone help me about finding out what is the default format the PULSE_SECURE_VPN parser supports. And what are all these format because I was not able to find any integration method against Windows, JSON or XML. Thanks,anshul

Hey guys,I understand keeping a few older python versions available for integrations, but currently the only versions available are python2.7 and 3.7, both of which are already quite some time out of support (Status of Python versions). We start noticing that the codebase of our integrations is deteriorating due to the fact there is no newer version available, and we cannot take advantage of newer features. A lot of dependencies also have moved on and enforce newer python versions. I consider this a pretty big security issue in a security product, especially with such a focus on supply chain security in the new DORA legislation. When will this be addressed?

Is it possible to ingest data from sources such as Fivetran, CloudQuery, Steampipe into Chronicle? or alternatively, query a data lake via federated query?

Is SCC able to detect remote commands / commands on an OS on a kernel level.

Can SOAR through it's automation rapidly change access control mechanisms?

Hey all, I'm pretty new to Security and Chronicle and while looking into log ingestion in Chronicle I encountered the topic of ingesting Okta logs into Chronicle, particularly for two customer usecases: system logs and user_context logs. By googling I was able to find this resource for system logs, but wasn't able to find much documentation for steps to follow to get user_context logs. I'm looking for something that can provide steps like getting the API key and plugging it into Chronicle like I see with other log sources.Any help would be appreciated!

Hi, We are a software company and are building new CUSTOM integration for Google Chronicle SOAR, for our client. Would like to know below.1) What is the process (detailed steps) to submit the CUSTOM SOAR integration/app to publish on SOAR marketplace? I found some detail here requirements-for-publishing-integration  but more information (e.g. how/where/whom to submit, are there any testing criteria etc,) will help.2) Approximately how many days this process may take? 

Does Google Security Operations implement nonsignature-based malicious code detection mechanisms?Nonsignature-based detection mechanisms include, for example, the use of heuristics to detect, analyze, and describe the characteristics or behavior of malicious code and to provide safeguards against malicious code for which signatures do not yet exist or for which existing signatures may not be effective.The reason I ask is because I know the capabilities are capable of looking up malicious file hashes, but what about behavior / characteristics of malicious code, for which signatures do not exist.Thanks.

Hi members of the community, How do you stay informed about the latest SecOps releases? Do you rely on your own research, or is there a formal process to keep you updated? I'm exploring ways to improve communication and knowledge sharing in this area, and I would love to hear your thoughts!

Is there an ability to retain audit logs of session and network connections termination for non-local maintenance on SecOps?