Security Forums

I'm looking for a way to identify Google SecOps SOAR cases where one or more playbook executions have failed. My goal is to programmatically retrieve a list of these cases, ideally using methods available within the Siemplify SDK (Python), so I can process them further in custom jobs or actions Is there a specific Siemplify SDK method, API endpoint, or recommended approach to filter cases based on the success/failure status of their associated playbook runs? I'm trying to avoid manually checking the playbook monitor for each case.Thanks!

Created a quick action which allows users to quickly create a HTML report based on multiple values across all alerts/events. Added quick action via SOAR Settings -> Case Data -> Views -> Default Case View -> Quick ActionsProblem I am facing:The Action does not allow me to pre-configure the "Run on Alerts" field. If a user does not uncheck all but one alert, my action executes up to 20 times flooding the case wall with report comments.Is there a setting/configuration I am missing?

Risk Analytics is a crucial feature within Google SecOps SIEM designed to help security teams identify unusual behavior and quantify the potential risk that various entities pose to the enterprise. It empowers analysts to move beyond basic alert triage and focus on the entities that represent the most significant threat. Key Components of the Risk Analytics Dashboard The central hub for this feature is the Risk Analytics dashboard, which provides a holistic view of entity risks, accessible to users with global scope in RBAC systems. Behavioral Analytics: This section lists entities (such as user accounts, servers, or laptops) based on their calculated Google Security Operations Entities risk scores. This allows tracking an entity's risk over time and serves as a metric for detection use c

Hi, I’m trying to create a detection rule in Chronicle that identifies cases where too many requests are sent to an external load balancer — specifically, more than 10,000 requests from the same IP within one day, where the response status is 400 or 500. This is the rule I wrote - rule too_many_requests_to_external_lb{meta:  severity = "HIGH"  platform = "Chronicle"

If I have to disable a human user on the Google Workspace using the Google SecOps SOAR, what is the integration I should use for the Google Workspace.

 Hey everyone 🤩, HI’m new here and really excited to join this community. I wanted to start off with a topic that almost every cloud security team is struggling with these days — alert fatigue.In Google Cloud, tools like Security Command Center and Chronicle generate tons of alerts every day. Many of them turn out to be low priority or false positives, but they still take up time and attention. After a while, it’s easy for real threats to get buried in the noise.I’ve been trying a few things to handle it better, like:Suppressing repeated low-priority alerts Using automation for triage Tagging alerts based on asset importance Testing out AI-based event correlation Still, I feel there’s a fine line between cutting down noise and missing something critical. So I wanted to ask everyone here:👉 How are you reducing alert fatigue in your G

I have 2 question that needs to be addressed how to move cases from” default” to another environment. is there a way to associate a detection rule when alerts created tied to specific environment other than default? is it possible to move cases from default to another environment via playbook? what action I need to use?

Hi, I’m building a dashboard (v2) but the fields I want to dashboard use IDs instead of names. I want some of the IDs to point to the same name too. I’m not sure what feature of YARA-L to use to achieve this. Here’s an example with dummy data:I want IDs 52a11631-8a6d-42be-aeb9-a6f8754e186c and 9a50ae9f-11e5-4475-88de-0ba55d8d6745 to be displayed as a single item named “XSS” while fcfc4231-21cf-4eec-b542-14687225b1b4 and 106886e1-e52d-4254-b57a-54b550db1602 to be displayed as a single item named “SQLi” in a bar chart in the dashboard It doesn’t look like the dashboard interface is capable of doing this so I’m thinking I need to build out a YARA-L query. I want to create query that looks similar to the following but I’m not sure how to do it within the constraints of the YARA-L syntax supported by the new dashboards engine:metadata.product_name = "WAF" AND security_result.action = "BLOCK"$Rule_ID =

Any way to easily identify/query the specific entity that alerts have grouped on? All I can see is a comment applied in the case wall but this is not easy to view at scale.For example, I would like to see which are the common entity types that are causing alerts to be grouped on, to inform alert grouping rules in SOAR settings.Additionally, I would be interested to see the values of these entities so that I can tune out common false positives in Blocklists (e.g. root account).I understand how to make these changes, but do not have the underlying information to be informed on what changes require to be made - I would like to create a dashboard to list the common entity types and values that my tenant’s alerts are grouping on.

How can I provide feedback for GTI when it has misleading, confusing, or inaccurate assessments of IOcs.E.g. Comcast v4 IP addresses are indicated as IOCs. We’re testing some GTI-related rules in the SIEM and the results by volume are mostly nonsense. So filtering on our side is needed.This is to be expected but some IOCs are obviously misleading,

Hello,For each environment we have an instance that we need to change the secret since it is expiring. How can we do that using a script instead of doing it manually?I didn’t see an endpoint for updating instances in swagger api. There is an endpoint for creating instances but doesn’t let you configure parameters.Any ideas? 

We have multiple customers and each has their own environment. Each environment has it’s own integration instances configured.I am planning to create a job that processes cases from different environments. How can I be able to select which integration instance the script should use depending on the case environment?

Hi All, Is it possible to get the PDF document for SecOPs Enterprise  configuration guide along with the license packaging details. 

Hi Everyone, TL;DR: Has anyone dealt with debugging why a SOAR remote agent would start failing? How did you manage to get the Agent to connect again?---I realized today (after several playbooks started failing) that the remote agent that we set up hasn't connected since the 11th of May.  I currently have a case open with support but getting a fix may take a while.When opening up the Remote Agent page, it shows that the Status is "FAILED" and when I download the logs for the last week, the file itself is empty (I'm assuming this is due to the FAILED connection for over a week).When I dive into the host, the docker connection is still live and healthy, so I'm not sure where to begin since it's likely on the Google side. (Initial deployment was done through the "Send Installer/docker Command" action within the SOAR itself.&

In this lab I am having problem with “Task 4 Create and deploy the reCAPTCHA session token and test site key”. I did every steps and successfully but when I click in “check my progress” I receive “Please configure the HTML files as mentioned in the instructions”… Who can help me please with 

I am trying to create a dashboard to visualize data, comparing a custom CIDR data table with a large amount of entries (~5k) to our logs. I am using net.ip_in_range_cidr to compare entries in the data table with log IP addresses.Other than filtering on log types or other fields, how else can I get better performance and avoid time complexity issues when running different queries?

Hi All, Is it possible to get the PDF document for SecOPs Enterprise  configuration guide along with the license packaging details. 

Hi team,Could someone please assist me with the native dashboard query for the Custom Curated Detection Dashboard? I’m looking to build the following: A table listing all curated rule sets along with their status — specifically indicating whether they are enabled, and whether each rule is precise vs. broad (for both detection and alerting categories). A table showing all curated rules that have fired, including an indicator of whether each is a detection-only event or an alert. Thanks in advance for your help

Hi Team,Am new to platform am trying to write a Yara-L logic for Detect when a privileged user successfully authenticates from a location, device, or ASN that has not been used by any other privileged account in the past 7 daysThanks

Hi All, @DAYJOB we’ve been working on prioritization and classification of alerts and incidents within the organization. One thing we’ve noticed when looking through metrics is that when an incident is raised for a ticket, it also changes the priority of the ticket:  As shown below, the priority of the ticket is changed by default to Critical: Is there a way to disable this functionality? We don’t classify every incident as a critical ticket and this throws off the metrics which we use to report to the leadership team.  Any advice would be appreciated. TIA.Kyhle

I’m am new to SecOps in general and am trying to be more efficient learning how to use stats and aggs along with combining multiple events. I am running into trouble fully understanding how to achieve exactly what I need. Does anyone have any documentation or resources that can be had to aide in this learning process?

Hi ,This is a question regarding JSON parser for SecOps.Let's suppose this the log :  {   "field1" => "value1"   "field2" => "value2"   "field3" => "value3"} Above is the usual trend. Now, we get a log like this :  {   "field1" => "value1"   "field3" => "value3"} field2 doesn’t exist here, on this the parser will fail and give the error “field2 not found in state data”.  For my parser, i do something like the following : json {        source => "json_data"        array_function => "split_columns"        on_error => "invalid_json"    }//Initiated JSON log.if ![invalid_json] {        json {            source => "json_data"            target => "parsed_json"        }         mutate {            gsub => ["json_da

Hello! We are working with the OOTB servicenow integration and are wondering what the best way  pull in information about change requests from a servicenow table? It is not an available ootb action currently but a common use case for working with Servicenow. 

I was working on SecOps parser update and encpuntered following error while pdating one of the parser:PLATFORM_ERROR: Smart Licensing has encountered an internal software error. Contact TAC: The platform provided UDI list has invalid values.This is preventing us from updating the parser and mapping it to the use cases. Has anyone encountered this and if yes how can we resolve this

Introduction This guide provides a high-level technical overview of GTI's core YARA-based hunting features. It is designed to help analysts understand the application of each tool in a typical threat intelligence workflow.For complete technical specifications, parameters, and API details, refer to the full, version-controlled documentation linked in each section. 1. LiveHunt: Real-Time Ingestion Stream Matching Function: LiveHunt applies a user-defined set of YARA rules against the real-time stream of files ingested and analyzed by Google Threat Intelligence.Mechanism: Rules are applied to every file submitted to GTI, including re-analyzed files. A match triggers an immediate notification, enabling real-time discovery. For PE files, LiveHunt performs automatic unpacking and scans both the packed and unpacked layers to increase dete