Skip to main content

Security Forums

Welcome to the Google Cloud Security Forums! Your ultimate security conversation spot. Collaborate with peers and experts to solve challenges, together.

2642 Topics
S
shrut_2025Bronze 1
posted in Google Security Operations
Get User & Get user related alerts

Hi Everyone,I want to fetch user and user related alerts directly from chronicle siem using api. Needed in agent development work using google agent development kit. Does there is any api which can help me in first checking whether user exist or not and 2nd, getting user related alerts.Thanks & RegardsShruti  

01
Eoved
pontorieroa
pontorieroaNew Member
asked in Google Security Operations
401 when trying to access SecOps - Chronicle service Admin

Hi,We have granted our users access to Google SecOps via giving the role "Chronicle service admin", however they get 401 and if we look at any errors in the developer tools, we can see the following:POST https://siemplify-soar.com/api/external/v1/auth/siem?format=camel  400 (Bad Request)Can anyone please advise on what the issue could be and why that role is not working as expected? Also, we have tried to add roles/chronicle.editor as provided in the documentation but it returns 400 as if the role is not correct.Thanks,

10011
pontorieroa
jaymin
jayminBronze 5
asked in Google Security Operations
Understanding the Entity Enrichment in SOAR

 Hi folks,I have a question about the behavior of entity enrichment when an entity is enriched using an action in a particular case.When I view the entity in the Entity Highlight section of the x case, I see the enrichment fields.But, when the same entity is associated with y case, I don't see the enrichment fields.Does entity enrichment only apply to the particular case where it was enriched?However, when I refer the entity in the entity explorer I see those enrichment fields.I want to handle a scenario if an entity is already enriched in x case then it shouldn't get enriched again(if it is enriched with in 24 hrs then we should skip the enrichment using the last_enrichment field).Currently, it will enrich the entity again on the y case as the entity of y case does not contains the enrichment fields.Entity in X CaseEntity in Y CaseEntity Explorer  

291
ylandovskyy
Staff
pontorieroa
pontorieroaNew Member
asked in Google Security Operations
GitSync - Push Playbooks - 400 bad request - ".. the integration instance is missing"

Hi,I have installed and configured GitSync in my dev instance and ran the "Test" from the configuration page. The test was successful.I have then followed the steps from the documentation and tried to run the "Push Playbooks" job for several folders / playbooks.I had to set the repo URL and all the other values that I have already configured in the integration, within the job Testing tab otherwise it would say that they are not defined. After defining them all, I still get the following error:Reading configuration from Server General error performing Job Push Playbook 400 Client Error: Bad Request for url: http://server:80/v1alpha/projects/project/locations/location/instances/instance/legacySdk:legacyIntegrationConfiguration?identifier=GitSync&format=snake: b'{"errorCode":2000,"errorMessage":"Integration settings for [Identifier: GitSync] could not be found because the integration instance is missing.","innerException":null,"innerExceptionType":null,"correlationId":"....."}' Traceb

142
pontorieroa
H
heli_secopsNew Member
asked in Google Security Operations
Google SecOps Forwarder: Logs not appearing in UI despite "successfully uploaded" messages

I'm experiencing an issue with my Google SecOps (Chronicle) Forwarder where logs are not appearing in the Chronicle UI, even though the forwarder's Docker logs indicate successful uploads.Here's a summary of my setup and the problem:Problem Description: I'm trying to forward SSH logs from /var/log/secure on an Amazon Linux 2023 host using a Dockerized Google SecOps Forwarder.The forwarder's Docker logs show Batch (...) successfully uploaded. messages.When I manually echo data into /var/log/secure, those specific entries do appear in the Chronicle UI.However, SSH login logs generated by rsyslog and written to /var/log/secure are not appearing in the Chronicle UI, despite the forwarder indicating successful uploads.Troubleshooting Steps Taken So Far:Forwarder Configuration:Confirmed the forwarder configuration file (config.conf) for the FILE collector is below.collectors:- file:common:enabled: truedata_type: OPENSSHbatch_n_seconds: 10batch_n_bytes: 1048576metadata:labels:environment: aws

302
H
A
angel288New Member
posted in Google Security Operations
Statistical analysis for event count

Hi everyone,I’m exploring the capabilities of Google SecOps SIEM and its YARA-L language. My question is:Is it possible to use YARA-L to detect spikes or deviations in event counts across an entire log source?For instance, can I create a detection rule that triggers when there’s a sudden increase in the number of events from a particular log source, indicating an anomaly or unusual activity?If so, could you share an example or documentation that explains how to set up such a rule?Thanks in advance!

624
ScottieJ
Staff
rafaelramirez
Staff
rafaelramirezStaff
posted in Security Command Center
Container Threat Detection (KTD) - VirusTotal-Hash Links

How does it work? Hash Generation: The system generates hashes for process binary data. VirusTotal (VT) Query: Hashes are used to construct VT links and query the VT database. Link Retrieval: VT link is retrieved and displayed alongside corresponding findings. Risk Assessment: Quickly assess risk based on VT reputation data (e.g., benign, suspicious, malicious). Does customers need a VirusTotal License?VirusTotal License are not required to leverage this feature. Are we leveraging VT data when rating the severity of the finding (ex positive match = high / critical, no match at all = low or something like that) We are not leveraging VT data to rate the severity of the findings. 

50
rafaelramirez
Staff
rafaelramirez
Staff
rafaelramirezStaff
posted in Security Command Center
Virtual Machine Threat Detection - AWS Malware Disk Scan

This feature is subject to the "Pre-GA Offerings Terms" in the General Service Terms section of the Service Specific Terms. Pre-GA features are available "as is" and might have limited support. For more information, see the launch stage descriptions.What it does? Create and scan short-lived snapshots of Linux-and Windows-based Virtual Machines for malware without disrupting the workloads.  Analyzes executables on the VM for known malware signatures. Detected findings are reported to Google SCC. Enabling VM Threat Detection for AWS  Confirm AWS Connector: Ensure Security Command Center is connected to your AWS environment. Enable VM Threat Detection: Activate the feature within Security Command Center. Deploy CloudFormation Template: Deploy the provided template in your AWS accounts.   Further information:  https://cloud.google.com/security-command-center/docs/concepts-vm-threat-detection-overview#multicloud-features    

10
rafaelramirez
Staff
mikelmi01
mikelmi01New Member
asked in Google Security Operations
How to get all closed alerts in a Job even if the case is still open

I am trying to create a job that helps me get all alerts from a specific product (Cortex XDR, for example) that were closed recently. This is what I have for the moment:from SiemplifyJob import SiemplifyJob from SiemplifyUtils import convert_datetime_to_unix_time from datetime import datetime, timedelta def main(): siemplify = SiemplifyJob() # Get alerts closed modified in the last X hours hours = 1 threshold_time = datetime.utcnow() - timedelta(hours=hours) threshold_timestamp = convert_datetime_to_unix_time(threshold_time) recent_alerts = [] case_ids = siemplify.get_cases_ids_by_filter( status="CLOSE", update_time_from_unix_time_in_ms=threshold_timestamp, sort_by="UPDATE_TIME", sort_order="DESC", max_results=1000 ) for case_id in case_ids: case = siemplify._get_case_by_id(case_id) for alert in case.get("cyber_alerts", []): product = alert.get("additional_properties", {}).

133
K
Staff
D
dhirajtecBronze 1
posted in Google Security Operations
'Requests' in SOAR Permission Group

What is the functionality of "Requests" which is under Homepage while adding a permission in the permission group?Navigation: Settings-> Organization-> Permissions-> Add Permission Group-> Homepage 

21
_K_O
N
NESFNew Member
posted in reCAPTCHA
Recaptcha failing on download from Middle East

Hi, When attempting to download content from any of our blogs/resources (e.g., <URL Removed by Staff> in the Middle East, a 404 error appears. Or website support team suggests Google reCAPTCHA sometimes blocks access for users in certain regions, including parts of the Middle East, if it suspects the traffic may be suspicious. This can sometimes be triggered by factors such as device settings, browser extensions, or the use of a VPN, or the region in general. Is there any solution to resolving this? As we're worried that users in Middle Eastern locations might be affected. If that's the case, we could be missing out on important contacts for our teams, so resolving this is a priority. Regards, NES

30
N
A
Aswin_AsokanBronze 5
posted in Google Security Operations
Restricted Data Access Role Additional Limitations

We have setup Data RBAC and provided "Chronicle API Restricted Data Access Viewer" and "Chronicle API Restricted Data Access" with required IAM conditions.The expected controls are working as expected but the "Data Access Viewer" role has permissions which provides users to download collection agent config files and  see org details (which contains customer ID and project names) under Profile Section is SIEM Settings.Removing instances.generateCollectionAgentAuth can limit access to Collection agents. What permissions should I remove to limit the user from not seeing org details (which contains customer ID and project names) under Profile Section is SIEM Settings.We're planning to create a custom role with limited permissions.  

61
amithpatil
Staff
devashishsingh
devashishsinghBronze 3
posted in Google Security Operations
Dynamic data table - is this possible?

Is there a way to update the contents of a data table to match against from the actual source, for example, list of users access to particular resource, which is continuously updated with latest data set at the backend?

51
amithpatil
Staff
A
Avish_gargBronze 1
asked in Google Security Operations
Change the SecOps default URL

Hello,I wanted to check how we can update the change url provided for SecOps, the "https://xxx.xxx.chronicle.security/"  one.As SecOps backend IP is not provided for our instance, do we need to have some sort of CNAME flattening setup in our public DNS or is there any other option available in SecOps?Thanks

102
A
C
calmcloudNew Member
posted in Google Security Operations
Service account key creation is disabled

Hello, Google support team.I'm trying to crate a or download a json file for firebase push notifications. while creating the json file i'm facing an issue "The organization policy constraint 'iam.disableServiceAccountKeyCreation' is enforced on your organization." which is mentioned in the screenshot.Can you please help or provide us any way of doing things right.Thanks.

7611
J
kaushalpatel
kaushalpatelNew Member
posted in Google Security Operations
Reduce Case Creation Latency & Prevent Duplicate SOC Tickets from Playbooks

We are experiencing a significant delay between alert ingestion into Google SecOps (Chronicle SOAR) and the subsequent creation of a case. Our goal is to have a case created almost immediately when the first alert for a potential incident is ingested, provided a relevant case doesn't already exist. Additionally, we are facing an issue with our playbook automation. Our current setup executes a playbook after a case is created in Google SecOps. This playbook is designed to create a ticket in our external SOC ticketing system. However, when subsequent related alerts are ingested into the same Google SecOps case, the playbook seems to re-trigger (or a similar process does), resulting in multiple tickets being created in our SOC ticketing system for what is essentially the same underlying incident. This creates unnecessary noise and administrative overhead for our SOC team.We have attempted to use alert grouping with a 1-hour window and a maximum of 3 alerts, but this configuration has

366
kaushalpatel
D
Dominik_AlbrinkNew Member
posted in Google Security Operations
Microsoft Azure Sentinel Incident Connector v2: Same rule different results

 Hello,I currently have several alarms in the SOAR that are based on the same KQL rule in Sentinel. Sometimes, as described in the connector, the KQL is executed and the event data is taken over. In other cases, the SecurityAlert table is read.Connector Description: "Both scheduled and NRT alerts are by default ingested using the log analytics KQL queries to get alert and event data"We're using the Microsoft Azure Sentinel Incident Connector v2 in Version 52, today I've updated to 53As an example, I have two screenshots: both SOAR incidents were generated on different days using the same connector in the same SOAR environment. Both are originating from the same Sentinel Scheduled Alert.  In the "bad" example the Name of the Event equals the Sentinel AlertID from the SecurityAlert Table.But no infomation why the Incident was created in Sentinel - this originates from the KQL query of the Alert.Am I'm doing something wrong the outcome of the ingestion seems unpredicta

215
D
S
SharkTeamNew Member
asked in Cloud Security Foundation
Org Admin: Perm. Denied Disabling Org Policy (iam.allowedPolicyMemberDomains) - Fails in Cloud Shell

Hello, I am an Organization Administrator (`roles/resourcemanager.organizationAdmin`) for my Google Cloud Organization, but I'm encountering a persistent "permission denied" error when trying to disable the `constraints/iam.allowedPolicyMemberDomains` organization policy. This issue occurs even when running the command from Cloud Shell. **My Goal:** I need to make a Cloud Run service (`sharky-chat-service` in project `chat-bot-social`) publicly accessible by granting `allUsers` the `roles/run.invoker` role. To do this, I first need to modify or disable the `constraints/iam.allowedPolicyMemberDomains` organization policy, which is currently restricting IAM members to my organization's customer ID. **Details:** * **Organization ID:** `275283949867` * **User Account:** `Admin@sharkteam.[domain-redacted-due-to-filter]` * **Project ID (for context):** `chat-bot-social` * **Cloud Run Service (for context):** `sharky-chat-service` * **Region (for context):** `europe-central2` **Current Ef

562
S
ar3diu
ar3diuBronze 3
asked in Google Security Operations
An error occurred while fetching entity properties

Not sure if this is a permissions issue. I'm logged in with a user that has Chronicle API Admin and Chronicle SOAR Admin roles. The error occurs every time I check an Event from a Case Alert. Do you have any idea what's causing this? 

65
ar3diu
turri
turriNew Member
posted in Google Security Operations
Approval links

Is there any way to get the result of the approval link , i mean when the user decide to approve or decline the request where can i get this value?

134
SoarAndy
Staff
TaigaWalk
TaigaWalkBronze 1
posted in Google Security Operations
🚀 GitHub Actions-Based Ingestors for Google Chronicle — Open Source Contribution & Live Examples

Hi everyone,I recently contributed a set of GitHub Actions-based ingestion scripts to the open-source Chronicle ingestion-scripts GitHub repo via this pull request. These scripts are designed to provide a lightweight and infrastructure-free way to forward third-party security logs into Google Chronicle using the Unstructured Ingestion API.🛠️️ What’s IncludedThe ingestors are built entirely around GitHub Actions, and support:1Password audit logsGitHub audit logsMicrosoft Entra non-interactive sign-insSnowflake logsThinkst Canary Audit LogsEach connector includes:A standalone main.py for log collection and forwardingrequirements.txt for dependenciesExample GitHub Actions workflows for automated or manual scheduling📂 View the SourceYou can explore the full set of scripts here in my personal repo:👉 https://github.com/TaigaWalk/Chronicle-Scripts💡 Why GitHub Actions?These ingestors are meant for users who prefer not to manage Cloud Functions, Kubernetes

213
TaigaWalk
vaskenh
Staff
vaskenhStaff
posted in Security Command Center
Enhancing Google Cloud protection: 4 new capabilities in Security Command Center

On June 4, we posted a blog highlighting new features in Security Command Center (SCC) and Security Command Center Enterprise (SCCE). One of the cool new features available to customers is an integration with the Artifact Analysis component of Artifact Registry.  To learn more about this new integration as well as other new developments like agentless scanning for Google Cloud Compute and Google Kubernetes Engine (GKE), check out the below link to the full blog! https://cloud.google.com/blog/products/identity-security/enhancing-protection-4-new-security-command-center-capabilities

150
vaskenh
Staff
Vaishnoodevi
VaishnoodeviBronze 1
posted in Google Security Operations
Issue with JIRA Sync Comment Job and JIRA tag is not getting added post the issue creation

JIRA Sync Comment is not working from JIRA to SOAR, any comment updated on the JIRA end by the client is not visible at the case wall. Also, as per the integration a Jira tag is supposed to get added automatically post the incident creation, this is not working as well.Could anyone guide on the troubleshooting approach to be taken to fix this.

34
ylandovskyy
Staff
A
Akshay31New Member
posted in Google Security Operations
File Operations in SecOps

In SecOps, I want to use file utilities, where my use case is to create file, add custom data to file and add file to case wall. Need to automate all this process using playbook.

72
A
ar3diu
ar3diuBronze 3
posted in Google Security Operations
IAM Role Mapping in Chronicle SOAR for Google Groups

How can we use group email addresses to assign permission groups and SOC roles in SOAR regardless of what IAM roles they were given in the project IAM? (e.g. Two groups with the same IAM role but who should have different permissions and SOC Roles in SOAR?) I tried to use the email address of a google group instead of a IAM Role Name but it doesn't seem to work.Docs: https://cloud.google.com/security-command-center/docs/map-users-in-secops 

582
ar3diu

Badge winners

  • Authored Posts 1
    0xM4XDF1Rhas earned the badge Authored Posts 1
  • Comments Posted 5
    quotermicehas earned the badge Comments Posted 5
  • Comments Posted 5
    spanugantihas earned the badge Comments Posted 5
  • Authored Posts 1
    Cook942has earned the badge Authored Posts 1
  • Comments Posted 25
    bsalvatorehas earned the badge Comments Posted 25
Show all badges
Terms & ConditionsCookie settings
Privacy Policy Terms of Service Gen AI Policy Community Guidelines Cookie Settings

© 2025 Google. All rights reserved.