Security Forums

Hi everyone,I have a data table with two columns: destination_ip and location. The destination IP column contains values in CIDR format. The location column contains strings (e.g., country names). I want to run a search/query where I filter results for location to a specific country (e.g., Italy) from the query directly.What’s the best way to fetch the string value (location) from the data table based on the IP, so I can filter traffic for a country?Thanks in advance for your help!

To investigate the log ingestion volume by feed ID, I created the following dashboard query:----------ingestion.log_type = "CISCO_MERAKI"$Feed_id = ingestion.feed_id$Date = timestamp.get_date(ingestion.end_time)match:    $Feed_idoutcome:    $Volume = math.round(sum(ingestion.log_volume) / (1000), 2)order:    $Volume desc----------However, in addition to the feed IDs, there is a graph entry labeled as "empty."I would like to understand the reason why this "empty" entry is appearing.I will attach a screenshot of the graph. 

Hi folks,I’m using the following Python code to retrieve ingested log types from the last 90 days. The code works fine in existing SIEM environments, but since about two months ago, whenever I run it on newly deployed SIEMs, I get the following error: Impossible to retrieve log types from BigQuery: 404 Not found: Table chronicle-clientname:datalake.events was not found in location EU All SIEMs are deployed in the same region, and the issue only seems to affect the new environments.Code snippetdef get_log_type(self): """ Retrieves log types that have been ingested into the SIEM system. Returns: list: A list containing log types that were active in the past 90 days False: If an exception occurs. """ try: # Retrieve BigQuery credentials BQ_SCOPES = ["https://www.googleapis.com/auth/cloud-platform"] bq_credentials = service_account.Credentials.from_service_account_info( self.bigquery_ap

I’m reaching out to ask if anyone has insights into whether Mandiant has published any Indicators of Compromise (IoCs) for the UNC3886 threat group, particularly those linked to campaigns originating from or targeting Singapore.We’re currently assessing risk exposure related to this group and are interested in any published intelligence, reports, or threat data—especially around custom malware, zero-day exploitation, or region-specific activity.If you're aware of relevant Mandiant publications or datasets (public or available under subscription), I’d greatly appreciate the direction. Also, if anyone can share details about Mandiant's current subscription plans—especially those covering: Real-time IoCs Advanced malware analysis China-nexus espionage reporting Regional threat intelligence …please let me know.Happy to jump on a quick call if needed—just drop me a message.

Hi everyone,I’m working with custom Jobs inside the Google SecOps (formerly Siemplify) IDE, and I’m having trouble figuring out the proper way to pass parameters to my script.I already saw that I can use the method siemplify.extract_job_param() inside the script, and I know it’s possible to create parameters from the Job UI. However, I’m not sure where exactly I should provide the parameter values when running the Job.I understand that I could use “Default Values” when defining the parameters, but that doesn’t seem like the intended use. I also came across some information suggesting that parameter values can be set by configuring the integration from the Marketplace tab, but I couldn’t clearly figure out how this works.How should parameters be used in scheduled jobs?

I have a Python script that fetches IOCs (potentially thousands), runs a UDM search to find matching events, and then forwards the results to a 3rd-party tool.Previously, I used Reference Lists to store the IOCs and it worked fine. Since Reference Lists are deprecated, I’m re-working the script to use Data Tables instead.The issue I’m seeing:  - When I create a Data Table, populate it with IOCs, and immediately run a UDM search, I get no results.  - If I wait ~3 minutes and rerun the exact same UDM search, then I get the expected results.  Example query:metadata.event_type = "NETWORK_CONNECTION" AND target.ip IN %my_data_table.iocA similar lag happens if I modify an existing Data Table. For example:  - If I insert some test data and immediately run a UDM search, it still shows results (even though it shouldn’t).  - Only after ~3 minutes I get the correct/expected results.So my question is: how should I handle this delay?Waiting a fixed 3 minutes in the script doesn’t seem like a reliab

This is the final week to enter our Community Challenge focused on one of the hottest topics in the security world: Model Context Protocol (MCP).If you're new to the concept, MCP is transforming SecOps by allowing AI models to communicate with and leverage diverse security tools. This means you can interact with complex security data using natural language, helping your team produce insights faster and scale operations like never before.This is your last chance to dive into this cutting-edge technology and showcase your skills.All the details on how to enter are in our original post. Submissions close August 29, 2025. #SecOps #AIinSecurity #Cybersecurity #ModelContextProtocol #MCP #TechChallenge #SecurityOperations

Hello Team,Greetings,I am currently working on a detection rule that triggers when a feed is deleted. The challenge I am facing is that the event only provides the feed ID, and not the feed name.I attempted to create a data table that populates when a feed is created, but I am unable to reference that data table field inside the rule. I also tried running a stat search; however, if I move this to a SOAR playbook, I am not sure how to handle the time correlation, since the feed could have been created at any point in time.Could you please advise if there is a way to fetch the feed name rather than a feed_id in the same alert when a feed is deleted?  Thanks & regards,nasef

Hi community, I am looking for best practices (and example detections) to monitor application version drift…..What i needed ? Alert when devices are not on the expected/current version after a rollout. Alert when a device rolls back to a lower version (intentional or suspicious)as Questions Flag “version != expected_version” Flag “version < expected_version” (rollback) I want to be able to alert when devices are not on the expected or current version after a rollout, and also when a device rolls back to a lower version, whether intentional or suspicious. What is the recommended detection pattern to flag version != expected_version and to flag version < expected_version for rollback? Are there any gotchas with handling semantic versions, for example comparing 1.10.3 with 1.9.12? 

Like the title says, is this possible? I have tried many ways to get it done in the events section, would like something like this:events:$e1$e2$e1..metadata.event_timestamp.seconds - $e2..metadata.event_timestamp.seconds < 60

I'm working with data tables in Google SecOps and using them in my detection rules. I have a data table named UserAccountCreatedNew with the following columns: My goal is to check whether both Hostname and UserID from an event match a single row in the data table—not just independently across different rows. For example, I want to avoid this: Hostname matches row 1UserID matches row 2 Instead, I want to confirm that both values exist together in the same row. Sample Data Table: UserAccountCreatedNew Hostname,UserID,LogTypeWIN-1234, [removed by moderator] ,winevtlogWIN-5678, [removed by moderator] ,winevtlogWIN-9999, [removed by moderator] ,winevtlog Yara L Rule : rule windows_user_account_created_and_deleted_in_short_interval { meta: author = " [removed by moderator] " data_source = "Windows" severity = "Low" priority = "Low" events: $delete.metadata.product_event_type = "4726" $delete.metadata.vendor_name = "Microsoft" $delete.principal.hostname = $hostname $delete.target.user.userid

Hello folks, I’m a newbie and almost know nothing about coding 😓I was playing with the Parser Extension and bummer, none of it working 🤢Is anyone here can shed some light to write me a working Parser Extension based on “Office 365” prebuilt parser with the sample RAW log as below?My objective is to map the "AttachmentDetails" which include the labels, Name and Size to the additional fields or any relevant fields that fit: {  "CreationTime": "2025-01-30T13:44:55",  "ExchangeMetaData": {    "AttachmentDetails": [      {        "Labels": [          "aaaaaaa-bbbb-ccc-dddd-eeeeeeeeeeee"        ],        "Name": "TestFile1.xlsx",        "Size": 45682      },      {        "Labels": [],        "Name": "Burger.pdf",        "Size": 555555      },      {        "Labels": [],        "Name": "picture.jpg",        "Size": 120456      },      {        "Labels": [          "aaaaaaa-bbbb-ccc-dddd-eeeeeeeeeeee"        ],        "Name": "List.csv",        "Size": 12345      }    ],    "BCC": [],    "C

How to choose standard plan for recaptchaHere is the plans for recaptchahttps://cloud.google.com/security/products/recaptcha?hl=en#pricingI want to go for "reCAPTCHA Standard".I created  "reCAPTCHA Essentials" and  manage recaptcha from for https://www.google.com/u/2/recaptcha/admin/site/xxxand display key details at https://console.cloud.google.com/security/recaptcha/xxxI used 4K of 10K so far. I enabled billing (free trial currently). And I created reCAPTCHA Enterprisehttps://www.google.com/recaptcha/admin/enterpriseBut I cannot find at anywhere where can I choose stadard plan for the google recaptcha product 

I am trying to access SOAR Advanced reports in SecOps, but page is not accessible.Error : An error has occurred. Search for Log identifier <identifier-value> in the Google Cloud Logs Explorer.

I have a playbook where I need to send a message to a user with approval links. Sometimes the user will not look at the message, so if there is no response, I would like to resend the message after a 4 hour wait. Sending the message is easy, but how can I monitor for their response and resend if needed?

When attempting to upgrade the Python version for IDE integrations, the upgrade button does nothing and I see the following errors in the Developer Console in Chrome. Is there any workaround or fix for this?

Hello community.We often forced to code our own integrations for products already listed in the Marketplace of SecOps SOAR. In some cases integrations miss functionality or lack adherence to best practices.Some code seems to originate from the legacy Siemplify API and may not have undergone thorough review. For example action parameter with an option for a GCP bucket that isn’t configurable - leaving it unclear which bucket is actually used and were the data is. Another example, integration that doesn’t allow SSL on DB connection.Documentation is not always clear (especially for non-engineering users) what parameters are required or how to configure the integration, action or connector.Contributing a fix would be faster than building a new integration from scratch.I found a GitHub  repository, but its not listing all integrations and is not clear if its main Marketplace repo or not.Is there any SOAR SecOps repo or community to contribute improvements and share feedback on integrations

Google Cloud's Security Command Center (SCC) offers a unified dashboard for consolidating security findings and assets. But what if you need to add your own business context to these findings? That's where security marks come in. To incorporate your specific business context into these findings, security marks prove invaluable. With the recent GUI upgrade, Enterprise versions now necessitate API usage, while SCC Standard and Premium versions retain GUI functionality. Security marks are custom key-value pairs you can use to annotate assets and findings in SCC. They allow you to add context like:Priority: “priority: high” Access Level: “access: confidential” Application: “app: marketing-web-prod” Incident Reference: “Incident-number: x2345”This feature is incredibly powerful for filtering, managing policies, and integrating SCC data into your security workflows. While you can add marks through the Google Cloud console, the Enterprise version of SCC often requires programmatic management

I have a monitoring probe and the recaptcha is blocking it. I've tried everything, including whitelisting, and it still doesn't work. I'd like to hear about your experiences with this.

Navigating security and regulatory compliance in the cloud can be a significant challenge. Staying on top of diverse requirements and demonstrating adherence to auditors is a complex task. To help lighten the load, Google Cloud is rolling out the new feature - SCC Compliance Manager, currently in preview for Enterprise Tier.Compliance Manager offers a library of frameworks, primarily consisting of frequently used cloud controls, to assist organizations in meeting their security and regulatory obligations within cloud environments. While you can customize an existing framework to align with specific needs, the option to create a completely custom framework is also available.So, what can it do for you?Define and deploy security rules: Instead of manually setting up security policies across your environment, Compliance Manager helps you define and deploy a secure and compliant configuration from the get-go.   See your compliance in a snapshot: With easy-to-read dashboards, you can quick

 Navigating security and regulatory compliance in the cloud can be a significant challenge. Staying on top of diverse requirements and demonstrating adherence to auditors is a complex task.To help lighten the load, Google Cloud is rolling out the new features in SCC Compliance Manager, currently in preview (For Enterprise service Tier). Compliance Manager in Google Cloud enables organizations to meet security and regulatory requirements for their Google Cloud infrastructure, workloads, and data. Compliance Manager offers a library of frameworks, primarily consisting of frequently used cloud controls, to assist organizations in meeting their security and regulatory obligations within cloud environments. While you can customize an existing framework to align with specific needs, the option to create a completely custom framework is also available. So, what can it do for you?Define and deploy security rules: Instead of manually setting up security policies across your environment, Complia

The logs on Cloud Logging can be ingested directly to Google Secops using export filters. You set a sink filter (e.g., logName:"syslog" AND textPayload:("auth failed")) and Secops only receives logs matching that. Although export filters are pretty straightforward and powerful, they have some limitations:Filters are static – you can only control inclusion/exclusion at the time of sink creation. You can’t easily enrich, transform, or route logs differently once they leave Cloud Logging. Scaling is limited – a single sink can push to Secops but lacks intermediate processing. An alternative way to  ingest logs from Cloud Logging is to use Pub/Sub. A Pub/Sub topic is a named resource in Google Cloud Pub/Sub that acts as a channel for sending messages from publishers to subscribers.Publishers send (or "publish") messages to a topic. Subscribers subscribe to that topic and receive those messages.The topic itself doesn’t store the messages permanently—it just serves as the communication point

I have multiple devices with the same Logtype, and I would like to calculate and display the amount of logs being ingested into SecOps for each device.I was able to display the log capacity for each Logtype using the following:$Log_Type = ingestion.log_typematch:$Log_Typeoutcome:$Total_Size_GB = math.round(sum(ingestion.log_volume) / (1024 * 1024 * 1024), 1)order:$Total_Size_GB desclimit:50Is there a way to display the log capacity for each principal.asset.hostname or principal.hostname?Thank you in advance.

There is a prebuilt parser in SecOps SIEM. This particular parser is made for Team Viewer audit events. Is there anyone who have managed to build their own parser where it is used for Team Viewer Outgoing Connection?   Please be informed audit events for Team Viewer are only applicable for events from:https://www.teamviewer.com/en/global/support/knowledge-base/teamviewer-tensor-classic/security/auditability-event-log/ The ones which i require help on the parsing is for Outgoing Connection:https://www.teamviewer.com/en/global/support/knowledge-base/teamviewer-classic/remote-control/out-of-session-features/connection-reports/ Much appreciated for any guidance.  Thank you.

Good morning, Im having issues with a native dashboard, and why i can’t view the data. For example if my search is “between days” it shows data But if my search is for example “Last 2 days” it does not shows anything. Im wondering why is this happening.Maybe is because of the query?Thanks.