Security Forums

We have 7-8 keys. In terms of cost effectiveness for billing as we would like to keep the billing minimum-1 - Is the 10 K limit at project level ? meaning 10K free allowed for for one project separately in google cloud or 2 - Is it for billing account (one credit card) where one billing account can be mapped for 2-3 different projects ? 3 -Basically if its at google cloud project level (irrespective of one billing account or 7 different billing accounts), then can we create 7 different google cloud projects in the same account for 7 keys with same / different billing accounts and have 10K quota for each project and key ? Basically trying to understand what’s allowed and what will save the cost for us.4- Like if 7 keys, 7 different projects, 7 billing accounts - what happens here ? only 10 K free quota or 70K free quota5 - If 7 keys, 7 different projects, 1 billing account , what happens here ? only 10 K or 70K free quota 

Hi All,I want to move an entire case with alerts, case wall comments, entities etc from source secops tenant to target secops tenant . is it possible to create a clone case for testing purpose from tenant to another. 

Hi everyone,We integrated Google SecOps with Windows Event Servers. Our team already had a Splunk UF in place, and we used it to forward logs to the Bindplane server. The connection was successful, but we observed that the majority of logs are getting truncated. When we increased the batch size, the truncation frequency decreased, but some logs are still being truncated. Does anyone have a workaround for this?Thank you in advance,

We have 7+ v2 classic [checkbox] keys, we got email that our keys will be automatically migrated or we can manually.We have below queries, appreciate if you can provide inline answers for all of them. There seems some confsion w.r.t needing code changes, billing etc post migration.If we manually migrate v2 (checkbox) to cloud v2 (checkbox) , it is said that no code change andwe can continue to use siteverify api. Questionsa) But after migration if our usage goes above 10000 like 150000, then what, will we be charged or not ?b) Will our siteverify api stop working and give error if more hits more than 10000 ?c) If it will give error, then how can we enable billing ? will it be enabled by default when we manually migrate orautomatically migrate ?d) What if we do not enable billing and if our v2 checkbox/invisible migrated to cloud and usage more than 10000 ?e) What if we do not enable Enter

Hello everyone,has anyone tried using detection_window in the options?I found it in the documentation, but I don't know how to use it, and it was only mentioned in an example rule; it doesn't appear in the options section.When I put it in one of my rules, it doesn't work. rule failed_logins_from_new_location{ meta: author = "Security Team" description = "Detects multiple failed logins for a user from a new, never-before-seen IP address within 10 minutes." severity = "HIGH" events: $e.metadata.event_type = "USER_LOGIN" $e.security_result.action = "FAIL" $user = $e.target.user.userid $ip = $e.principal.ip outcome: $failed_login_count = count($e) $unique_ips = count_distinct($ip) $first_fail_time = min($e.metadata.event_timestamp) match: $user over 10m condition: #e >= 5

Hi,What is the best way to field unparsed events ingested in SecOps SIEM without it being a pain. I have so far been searching for raw log with regex and using Procedural Filtering for individual log source until I collect few hundreds and then try to work on parser extension. This has been painful and a lot of manual task and chances of missing unparsed event is high for us (considering the volume of data we ingest and search result capping the returned events to x result (10,000 default) I believe there should be a way for searching for just unparsed logs so that we have better visibility of what we are missing out on. 

in case of multiple instances for an integration , which instance results will the extract_configuration_param  return when used in Jobs ?

Hi all, fairly frequent user of GTI seeking to understand how best to use it for Strategic level threat intelligence (generating product for execs, C-suite, business areas in order to inform high level decision making). At the moment, I consume the “strategic” or similarly tagged reports, create profiles for managing and track reports on a particular topic and use threat profiles to give a birds eye view of the threats to my organisation. I can then leverage the API to pull these into a threat matrix off platform when needed. I have three questions:1.) Am I missing anything? Does anyone have any creative uses for the platform in the strategic domain?2.) I like the industry and country threat assessments within GTI but have a question re the methodology, as the explainer does not seem to make sense. In theory, the methodology should spit out a score between 0 and 10. But when experimenting with the methodology, I can see the score going way beyond that. Fo

usually, TIP stands for threat intelligence platform, but not sure what does it stands for in TIPCommon,  as none of the methods in the TIPCommon are related to Threat intelligence .

Do I still need to configure the Chrome Management Event ingestion if I already configured the Direct Ingestion for Google Workspace Activity Logs?

I’m trying to retrieve cases that have been recently updated. The `CaseSearchEverything` (external/v1) endpoint can filter by date, but only the case creation date, using `startTime` and `endTime` filter values. It does not have the ability to filter cases by `startModifiedTime` and `endModifiedTime`.The `GetCaseDetails` endpoint returns a value `modificationTimeUnixTimeInMs`, which means that the last modified time value exists somewhere, but is not available to `CaseSearchEverything` via filter parameters. The value also doesn’t appear in the output of `CaseSearchEverything`, preventing me from applying post-processing filters against bulk results.Is there another way to filter cases by last modified time via external API?If not, can we make a feature request for this?

when we run a test in a rule editor, and we get a list of few test detections, is it possible to create a case out of them to test or refer for the playbook creation ?

Hello Google Cloud Support Team,I am experiencing a critical issue with my web application (tasleemai.com) where users are consistently failing to generate a reCAPTCHA Enterprise Token, which is blocking the registration process.Details: Affected Key (Site Key ID): 6LeaPgE... (Tasleem AI key) Domain: https://tasleemai.com (The site is now correctly enforcing HTTPS). Frontend Error: The browser console displays the error: Error: فشل في إنشاء رمز reCAPTCHA. which translates to "Error: Failed to create reCAPTCHA token." Key Metric Evidence: No scores or metrics are visible in the reCAPTCHA Enterprise dashboard for this key , confirming that the client-side API call (grecaptcha.enterprise.execute) is not successfully connecting to the Google service.

Is it possible to set Direct Ingestion of Workspace Activity logs from multiple consoles/organisations to the same SecOps instance? https://docs.cloud.google.com/chronicle/docs/ingestion/default-parsers/workspace-activity

Hi Team,Can anyone provide an insight on how can we create an alert if a log source (Let's assume a principal.hostname) stops sending logs for 30 mins?  

Hi All,We have created a new permission group like “managed-plus” for our SOC users and we want to enable “manage tags” option in it.Any change in permission is not helping with it. Wanted to know if any of you guys have tried it or the permission group that handles the case tags options.

Hello.I submitted this question to Google Cloud's contact form, but the quote was avoided, so I'm posting it here.I apologize for the inconvenience, but could you please confirm the following?I'm currently using reCAPTCHA with a free quotation of 10,000 instances on a site I manage.I would like to use the same free quota on other sites, so I plan to create a project and billing account on Google Cloud Platform for each site on which I will implement reCAPTCHA.I just want to confirm: if I create billing accounts with the same credit card, will the free quota for reCAPTCHA be separate for each billing account?Also, will the billing information be separate?Thank you for your support.

Hello!I have a rule that round a value, but when I put the rule in the rule editor I have the following error: “parsing: function math.round not found line: 29 column: 22-32” The rule that I’m trying to create is:   events:    $e.metadata.log_type =$log_type    $e.metadata.event_timestamp.seconds =$log_time   match:    $log_type over 60m   outcome:  $last_event_timestamp = max($log_time)  $min_event_timestamp = min($log_time)  $now_ts = timestamp.now()  $diferenca= $now_ts-$last_event_timestamp  $time_in_minutes = math.round($diferenca/60)  $date_event_first = timestamp.get_timestamp( $min_event_timestamp,"SECOND", "GMT")  $date_event_last = timestamp.get_timestamp( $last_event_timestamp,"SECOND", "GMT")  $date_event_now = timestamp.get_timestamp( $now_ts,"SECOND", "GMT")   condition:  $e and $time_in_minutes >

Hi All,I wanted to check if it’s possible to use role-based authentication for the AWS SOAR integration. Currently, it seems to only support authentication using an access key and secret key.In my case, the access key and secret key keep changing frequently, which creates challenges. Has anyone discovered a way to implement role-based authentication for this integration?

Hello Team,We’re currently performing a MITRE ATT&CK analysis for the curated detections using the MITRE ATT&CK Matrix dashboard.While the dashboard makes it easy to see how many rules exist per technique, identifying each rule’s corresponding rule name, rule set, and category is quite challenging — I have to review them individually. For techniques with a large number of rules, this becomes very time-consuming.I’m focusing only on curated rules, and it seems that the Ruleset dashboard doesn’t support MITRE queries — the mapping appears to be available only in the rules field, which doesn’t seem to work for curated content.Is there any way to generate a sheet like the example snippet below directly from the dashboard or through any other approach/tool?Thanks in advance for your help!

Hi Team, I have a project in that I need to run automated IP/URLs/Hash block to firewalls but due to some compliance issues I can not integrate SOAR directly with Firewalls and IOC feed can be implemented at firewalls.So I decided to have IOC feeds in S3 bucket and want to integrate this S3 bucket with chronicle SOAR to block the IP/URL/Hash automatically basis in SOAR actions. Please help me how it can be achieved and share the reference article/MOP/video link. Regards,Brijesh Kumar

Hi I like to have a panel that shows all my ingested log sources and its last ingested time . i do see a panel "Recently Ingested Events" under Data Ingestion and Health but it shows only some log sources and not all the ones .I want panel showing all the log sources and its time , can some one help me understand how i can build it . @jstoner any suggestion .

We have received a note from our internal security team to investigate if Google cloud and BigQuery integrations that we have now with Google are used in transferring/saving any of our customer level data in the google cloud. How can i confirm back if that’s happening or not?

I am looking at rolling out support case access to multiple users in a project and have a question about social engineering within Google technical cases, does anyone have insight on what steps Google takes to prevent social engineering via the support/cases system, ie someone attempting to escalate their own privileges within a GCP project.  Might be overthinking things a little bit, but other cloud providers (AWS) make explicit statements that they will not perform account administrative tasks on a users behalf via support, but i don’t see a similar claim from Google. 

We see occasionally parsing errors for some log types in the Data Ingestion dashboard. However as dashboard is not regularly monitored and doesn’t show out custom parsers, I would like to check if there is is way to create some detection for the parsing error so that we can act immediately.