Security Forums

Hello,I have a bindplane configuration that collects logs from Active Directory and Windows Events. However, I noticed that some events are not being sent to the blindplane, but are generated on the server.For example, event 4740. I can see this event in the event viewer, but at no point is it consumed by the bindplane.What could be causing these events not to be brought in?

Hi All,I have a use-case to list out the cases where SLA’s were breached and I am trying to use the dashboard to achieve this.Due to limitations with customising SLAs in chronicle with both case priority and  case stage I cannot use the default SLA definition settings.The idea is to get the handling time of each stage and list down the case IDs which breaches the required conditions in the dashboards. Does anyone know how I can get the handling time per case in the new native dashboards? Or should this be tried another way?

Hey all! We are trying to get a two-way sync between MSXDR (microsoft 365 defender) and SecOps cases. We have the 365 defender integration configured, and we get secops cases created based on MSXDR incidents.  However, we need the following:Secops case closed > XDR incident is set to resolvedXDR incident is resolved (in XDR) > Secops case is closed The need here is:The analyst does not need to close a case in two portals (secops and XDR portal) XDR sometimes does merging or autoclosing, this incident status change should reflect in Secops 

Hi everyoneI’m currently testing log ingestion from a Linux VM to Google SecOps (Chronicle) using Bindplane (no Chronicle Forwarder, only the Bindplane agent and gRPC).In the Bindplane destination, I’m using: Protocol: gRPC Endpoint: malachiteingestion-pa.googleapis.com Auth: json, with the Ingestion Authentication File from SecOps Correct Customer ID But on the VM, the Chronicle exporter always shows:"error": "upload to chronicle: Permanent error: 403 Forbidden" Any idea what can cause a 403 in this case, or anything that must be enabled/checked on the SecOps side?Thanks!

Hi All,Would like to know if there is a possibility to monitor the changes made to a reference list such as adding / deleting a value from the reference list? As we have for changes made to rules from GCP console. Thanks!

Hey Community, I'm working on configuring a detection rule in SecOps to monitor and generate an alert when a file owned/signed by my company is uploaded to VirusTotal. Has anyone worked on a similar task in the past? 

New Feature for Saved IOC Searches:  We have enhanced the Intelligence Search workflow to eliminate repetitive manual entry. Threat hunters can now build complex queries once and save them for future use. This allows teams t

 This Google Threat Intelligence search query is designed to identify files submitted from specific countries, along with community feedback indicating the presence of a Ransom note, which strongly suggests a potential victim from that country and is sharing that intelligence. submitter:DE comment:"SUSP_RANSOM_Note" 

 This Google Threat Intelligence search query uses a high-fidelity byte signature to instantly identify LockBit 3.0 ELF ransomware samples. content:{34043B5C0B8CFB1AEEDB995A9AA9EE19F9AA9AEE9A09DACA299AAAEE6E09F9EE9A69A99A09B95AF909EEBA6ADA097A9AB95E5000F30668841826EF11C041B0CFA3C0AE5E4FA36E5EAE7E8F2F4FA3CEAE5F4F01A3535FA323A2D1

 This Google Threat Intelligence search query is designed to hunt for malicious files that attempt to confuse, manipulate, or evade security Large Language Models (LLMs) by embedding specific adversarial commands or "jailbreak" phrases. entity:file (crowdsourced_ai_analysis:"DAN" or crowdsourced_ai_analysis:"ignore previous instructions" or cro

Hi everyone,I'm using the Siemplify SOAR SDK to create a case in Google SecOps. The case is being created successfully, but the alerts and events are not showing up inside the case. Here is the code I'm using:import json from SiemplifyAction import SiemplifyAction from SiemplifyConnectorsDataModel import AlertInfo # Initialize the SiemplifyAction object siemplify = SiemplifyAction() # Create multiple events as dictionaries with necessary fields event1 = { "identifier": "event_id_1", "name": "Event 1", "type": "Type of event", "severity": 30, "description": "Description of event 1" } event2 = { "identifier": "event_id_2", "name": "Event 2", "type": "Type of event", "severity": 50, "description": "Description of event 2" } # Create multiple AlertInfo objects and add events to them alert1 = AlertInfo() alert1.identifier = "alert_id_1" alert1.name = "Alert 1" alert1.type = "Type of alert" alert1.severity = 40 alert1.description

The Mandiant Intelligence Validation Research Team (VRT) has published VHR20251209 - Content Expansion. This content pack requires Director version 4.12.1.0-0 or higher.If you’ve enabled the Content Service, this content pack will automatically download and be applied to your Director. Otherwise, you can download the security content pack from the Mandiant Documentation Portal.Summary of Changes7 Actions added 6 Files addedRelease HighlightsA new Action covering CVE-2025-55182, a Deserialization of Untrusted Data vulnerability that allows a remote attacker to execute a

For the best results using Mandiant Attack Surface Management,  add the following IP addresses to your allowlists: 34.68.34.64/27 8.34.210.32/27 Visit the documentation for information on the Mandiant ASM scan rages.    

Hi everyone,I am looking for advice on the best architecture for ingesting Akamai WAF logs into Google SecOps. We are currently trying to find another way rather from using Bindplane.We are checking with Akamai DataStream 2, but we are running into a visibility issue. The streams seem to be metrics-heavy and when we look at the WAF data, we are primarily seeing the "Rule Trigger" ( just the Rule ID and Action, e.g "securityRules": "ULnR_28976|3900000:3900001:3900005:3900006:BOT-ANOMALY-HEADER|" ).In that case, we are missing the deeper forensic context we need for analysis, such as: Payloads / Post Body details The specific logic that caused the match So I have some questions:  Is DataStream the wrong tool for this? Is it possible to configure DataStream 2 to include full request details, or is it strictly for high-level metrics and simple triggers?

I am trying to enhance / enrich event data / UDM by means of a Data Table. I have the following data table called CrownJewelsColumn 1: Hostname - mapped to entity.asset.hostnameColumn 2: Asset_ID - mapped to entity.asset.asset_idColumn 3: IP - mapped to entity.asset.ipColumn 4: Owner - mapped to entity.asset.attribute.labels.valueColumn 5: CrownJewel - mapped to entity.asset.attribute.roles.nameColumn6: OwnerKey - mapped to entity.asset.attribute.labels.key My goal is to enrich UDM data with data from above,especially I want asset.attribute.roles.name to contain CrownJewel, and I want an asset.attributes.labels entry where by key is called Owner and value from Collumn 4. But whatever I try, following both the google document, as well as the blogs from ​@jstoner  (well written!) But I can’t get any enrichment happening….Here’s t

I need to createa hunting query for SQL injection to search in google Security Operation SIEM, what parameter should I use when searching?

I'm planning to write a detection rule to monitor a log source. I want to be notified when the log feed stops and no logs are being received!--scriptorstartfragment-->  events:    $e.metadata.vendor_name = string    $e.metadata.event_timestamp = int   condition:    not any $e where      $e.metadata.vendor_name == "Crowdstrike" and      $e.metadata.event_timestamp > now() - 1800!--scriptorendfragment-->}Here getting errors on the - not any $e where 

The use case is to drop the logs matching metadata.log_type = “WORKSPACE_ACTIVITY” AND metadata.product_name = “chrome”.Is there any other option besides Parser Extensions? From what I read, parser extensions are applied to the raw events. Is that right, or is there a method where I can also use UDM events on the normalized events to build the drop filter?

Hello Team,We are currently ingesting the following Google Workspace logs into Google SecOps: WORKSPACE_ACTIVITY WORKSPACE_ALERTS WORKSPACE_CHROMEOS WORKSPACE_GROUPS WORKSPACE_MOBILE WORKSPACE_USERS I would like to check whether Google Vault logs are also included as part of the Workspace log ingestion, or if any additional configuration is required to ingest Vault-related audit logs.Could you please confirm if Vault logs are supported automatically or if we need to enable any specific settings or APIs to receive them?Thank You

Hi all,Does anyone know why Google Cloud Platform Trust & Safety team does not reply to an appeal?This has been for over 8 days and I sent them many times but they don't respond-The GCP console is directing me to send appeal and I can not use anything or view the dashboard or take any corrective action  Pleas share any info that may help me in this situation  Kind regards  

I’ve been using this page to reference collector ID values in ingestion metrics.https://docs.cloud.google.com/chronicle/docs/ingestion/ingestion-notifications-for-health-metricsRecently, I’m seeing bbbb1111-bbbb-1111-bbbb-1111bbbb1111and ffffffff-ffff-ffff-ffff-ffffffffffffvalues returned for ingestion.collector_id -- are these documented anywhere? Seeing UDM as the ingestion.metadata.log_type for these -- I assume one or the other of these corresponds with entity risk change UDM events which have recently been enabled, but not sure about the other.https://docs.cloud.google.com/chronicle/docs/release-notes#October_28_2025

I’ve created a firewall rule to stop all traffic on all protocols from all countries except one.However when I look at my VMs network stats, the chart titled “Firewall incoming packets denied” shows less than one packet stopped per second.This is during a DDOS attack with millions of hits per second from around the world.How come the firewall does not stop 99% of these, if 99% of all countries are blocked?

Hi Team,I am looking to get an alert if I miss a log from an endpoint from a server. Since the ingestion API monitoring is not granular enough to get this info, I planned to create a dedicated Yara-L rule for the said server. The rule I had planned for looked something like this:    rule silentLogFromCriticalEndpoint { meta: author = "Srijan Kafle" description = "Detects missing logs from server" severity = "MEDIUM" created = "2024-06-03" events: $session.principal.namespace = "prodSydney" and $session.principal.hostname = "redacted" $source = $session.principal.hostname $tenant = $session.principal.namespace match: $source,$tenant over 12h outcome: $risk_score = 3 // logic to check delay here which is not working $delay = $session.metadata.event_timestamp - timestamp.current_seconds() condition: $session and $delay >= xyz }  line 2

We are setting up Google Cloud Load Balancer, and wish to distribute load to a number of webservers/VMs.We wish to keep external IPs on the VMs to allow for software updates etc.We also wish to protect the webservers from external traffic with a firewall, so only the load balancer can access them.Is that possible? As the load balancer only functions as a passthrough, the visitor IP is what the firewall sees.How can we use the firewall to only allow traffic from the loadbalancer?

Hi all,I’m currently working on testing playbooks in my environment and looking for the best practices when it comes to running simulated cases. Specifically, I’d like to know if there’s a way to automatically create cases based on actual events occurring within my environment to help simulate more realistic scenarios.If anyone has experience with this or can provide guidance on how to automate these test cases effectively, that would be greatly appreciated. I’m also interested in hearing how others approach playbook testing in general.Thanks in advance!