Security Forums

metadata.event_type = "EMAIL_TRANSACTION"$email = network.email.from$email in %SAE_Regex_Test_Listmatch: $emailoutcome: $total_count = count_distinct(network.email.mail_id)order: $total_count desclimit: 100The above query works great if I'm using a string reference list - it will return counts based on the items in that reference list if they're present in the logs (user1@example.com, user2@example.com).The reason I'm using reference lists is because there is the potential to search hundreds of items in one go, this way my query string does not exceed the length limit. However I also need to searches using wildcards for domains, e.g. .*@example.com - is there any way to still use reference lists to do those searches and return per item results?

Planned Maintenance for MSV Updater Service On Tuesday, June 24 at 9AM EDT, Mandiant Security Validation will undergo planned maintenance. This maintenance is expected to last no longer than 1 hour and service should be restored by 10AM EDT. This maintenance window applies to both on-prem and SaaS customers. During the maintenance time frame, do not attempt to perform the following updates: Directors (on-prem only) Actors Content

Hi All,Is there any way in SecOps by which we can check the Reputation of a public IP through google TI in YARA L rules and calculate the risk score.for eg: based on TI if the Risk score > 50 then the rule should trigger an alert.

Hi,I'm completely locked out of my Google Cloud project (PII Removed by Staff), which I created using my personal Google Account (PII Removed by Staff). I built this project to authorize Gmail access for my WinUI 3 application using OAuth. I now receive this message when trying to access the project: You need additional access to the project...Missing permissions: resourcemanager.projects.getserviceusage.services.list Trying to use the IAM Troubleshooter results in this error: You do not have the required permissions to troubleshoot policies on the specified resource or the resource does not exist. The project no longer shows up in my console — I can't select or manage it anywhere. I’m not part of any Google Workspace or organization. I’m just an individual developer trying to recover access to something I built. I don’t know what changed. Troubleshooter URL:https://console.cloud.google.com/iam-admin/troubleshooter;permissions=resourcemanager.projects.get,serviceusage.services.list;pri

Hello,I have a QRadar connector configured on my SOAR instance, it is working fine, the logs arrive correctly and cases are being generated.The issue is that in QRadar there are some Custom Fields that are not ingested correctly.I do have configured the custom fields on the connector page like this:The fact is that I get the Filename and Request field, but I got some issue on the "SHA 256" field, I think the problem is the space present in the custom field.How do the SOAR translate the space? Do I have to write SHA_256 or something like this?Thanks in advance!

Hello community I want to ask if there is any way to list the rules into a dashboard that uses a specific log_type (metadata.log_type) or in a search, maybe.Thanks in advance 

Hello Team,when I'm executing the action Crowdstrike update detection  im getting the failure message.Error executing action 'CrowdStrikeFalcon - Update Detection'. Reason: Failed to update detection 342703c303344c35a3530b2a1f78cbd7: Failed to validate resource. could you please help me with the exact detection id in crowdstrike instance.could you please share the detection id place holder in SecOps SOAR.Thank you! 

       Malicious webhooks can be a significant security risk, allowing attackers to exfiltrate data, trigger unauthorized actions, or maintain persistence within your systems.        This guide will walk you through purging malicious webhooks using Google tools, from beginner concepts to advanced administrative techniques.       How-To Guide: Purging Malicious Webhooks with Google Tools:   I. Beginner Level: Understanding Webhooks and Basic SecurityWhat is a Webhook?         Imagine a webhook as an automated message sent from one application to another when a specific event occurs. It's essentially a "user-defined HTTP callback." For example, a webhook could notify your team's chat when a new customer signs up, or trigger a build process when code is committed to a repository.How can Webhooks be Malicious?A malicious webhook is one that is either: ✓ Compromised: An attacker gai

Dear Community Members, 🎉 Welcome to the reCAPTCHA Enterprise Community! 🎉 We’re thrilled to have you here. Whether you’re a seasoned developer, a security enthusiast, or just curious about reCAPTCHA Enterprise, this community is the place to connect, learn, and share your experiences. What is reCAPTCHA Enterprise? With reCAPTCHA Enterprise, you can protect your websites or mobile applications from spam and abuse, and detect other types of fraudulent activities on the sites, such as credential stuffing, account takeover (ATO), and automated account creation. Let’s explore the powerful features that reCAPTCHA Enterprise offers: Score-Based and Checkbox Challenges: Prevent account takeovers (ATOs) by using score-based and checkbox challenges. These mechanisms assess user interactions and provide real-time risk scores, allowing you to take appropriate actions based on the level of risk. Multi-Factor Authentication (MFA): Verify an end user’s identity using MFA. This adds

Hi community,we are a relatively new customer of Google SOAR & SecOps.I am currently trying to set up some playbooks with interactions with users and/or SOC Teamembers.Our favorite tool for communication is MS Teams. The integration is configured, we can send Messages via playbooks and also send replys to those messages via playbook. What we would like to do is using "WaitForReply" to those messages/replys and use the reply to continue the playbook (via conditions).Flow would be like:Case -> send Teams message -> send Teams message reply with more details -> wait for specific reply of user/soc -> split path to action 1 or action 2 -> continue with rest of the flow.....Replay from user/soc could be something like "yes" "no" "escalate" ...Unfortunatelly the documentation to the MS Teams integration in SOAR is missing a lot of information and there are zero examples on how to use those actions.Maybe someone has created a similar flow with MS Teams before and is willing

Hi All,I have made changes to the cyberint code when im executing the code from TIPCommon import validate_map_file ModuleNotFoundError: No module named 'TIPCommon'. How to fix this

Hi!I want to define SLA periods in our environment and ensure that our analysts are notified accordingly. For example, if an SLA is defined for 12 hours, the assigned analyst should receive:A medium-priority notification after 6 hours,A critical notification after 8 hours,And a final notification when the SLA is breached (i.e., after 12 hours).These notifications should be sent either via email or another suitable method. Is there a way to implement this?

Hi,I want to ingest S3 bucket logs using BindPlane. Is it possible to do this without an agent, using only a configuration that specifies the source and destination? If so, how can I handle authentication on the AWS S3 side?If it's not possible to do it without an agent:When using an agent to ingest S3 logs, do I need to create an IAM user with the necessary permissions and store the credentials in the agent for authentication?

Hi,Is there a way to automatically group multiple alerts from the same user—especially when individual tickets already exist for similar alerts—so that new alerts can be referenced or linked to an existing Jira ticket instead of creating separate ones each time?

The doc linked here  https://cloud.google.com/chronicle/docs/ingestion/default-parsers/collect-windows-dnsshows Bindplane collecting DNS from the Windows Event channel  Microsoft-Windows-DNSServer/Audit.   I enabled "Analytical and Debug Logs" and see queries and query results under Microsoft/Windows/DNS-Server/Analytical in Event Viewer.  There are no query details in the Microsoft-Windows-DNSServer/Audit channel.Two issues:1) the google example collects from Audit, not Analytical where the queries and result are located.2) this powershell does not list a Channel for Microsoft-Windows-DNSServer/Analytical,Get-WinEvent -ListLog *and when I try to read from Microsoft-Windows-DNSServer/Analytical (guessing the name) Bindplane does not not start, the error is that it cannot find the channel.My questions:Should I be able to use Bindplane to read the DNS queries and query results from the Analytical channel ?I confirmed Bindplane can read the dns debug log file

I have installed the BindPlane agent on a Windows server to ingest Windows logs and listen on port 514 for firewall logs, then ingest them into Google SecOps SIEM.The Windows log ingestion is working correctly, but the firewall log ingestion is not.Can someone check my configuration file? receivers: windowseventlog/source0__security: attributes: log_type: windows_event.security channel: security max_reads: 100 poll_interval: 1s raw: true start_at: end udplog/source0_firewall: add_attributes: true async: max_queue_length: 100 processors: 3 readers: 1 listen_address: 0.0.0.0:514 operators: - field: attributes.log_type type: add value: udp exporters: chronicle/chronicle_w0_labels: compression: gzip creds: '' customer_id: xyz endpoint: asia-south1-malachiteingestion-pa.googleapis.com ingestion_labels:

Hey all,We're currently trying to write a parser extension for Google Workplace Activities, as we found that key fields are not being mapped to UDM for some Google Groups changes.The problem we're facing is that one input payload contains multiple events, each of which becomes a separate UDM event. When we're trying to map new fields for matching events, they're applied to all the output events. filter { json { source => "message" array_function => "split_columns" } mutate { replace => { "event.idm.read_only_udm.target.resource.name" => "" } } statedump { "label" => "1" } if [id][applicationName] == "groups_enterprise" { for index1, item1 in events { if [item1][name] == "change_acl_permission" { for index2, parameter in item1.parameters { if [parameter][name] == "group_email" { mutate { replace => { "event.idm.read_only_udm.target.resource.name" => "%{parameter.val

I am running into the Service Account Key Creation Error. I have tried just about everything:Here is the error: Here are the permissions:Here are the policy mods:It make no difference if we enforce or not enforce the override.What am I missing?ThanksJeff

Hey,I am unable to find spam classification from Google workspace activity logs ingested to our Google Secops SIEM. Is there're any related field that I need to look into or any additional configuration required to fetch it?Delivered to Gmail mailboxSpam classification details:The message was considered suspicious.The message contains suspicious content.It's retrieved from admin.google.com > reporting > Email log search

Elevate Physical Security with Google SecOps Unlock unparalleled visibility and threat detection for your physical security by integrating your logs from doors and cameras into Google SecOps. Imagine bringing the power of SecOps playbooks to your physical security teams, transforming how they respond to real-world events. This integration funnels your "real world" security events into a powerful digital analysis platform, providing a holistic view of your security posture. Access Control Integrating physical security logs into Google SecOps requires careful access control to ensure the Physical Security team only sees relevant data. This is achieved through: RBAC (Role-Based Access Control): Create a specific "Physical Security" role with permissions to view relevant alerts, cases, and search physical security UDM data, while excluding access to broader cyber security features or sensitive IT data. Data RBAC (Data Segmentation): During log ingestion, use distinct log_type values and e

Hello Community,we are stuck on a simple case but confusing part in a regex/strings within chronicle, documentation doesnt specifically mention this part.We are trying to match a, field_A value with field_B's part of the value.Ex:$oringalfile.field_A = "test.py"$secondaryfilefullpath= "etc/somedirectory/test.py" What is the best way to match this ? Split end part of the string, store and then compare? How to achieve this? Would be great if i can get a lead here.Thank you!

Hi,I've created a Block Playbook which will delay all other Steps for 1 Minute if a certain Condition is not met. Afterwards the Block Playbook will add a Case Tag and move on...The delay is set to 1 minute but the Playbook gets delayed for 1 hour - Case Wall example:I'm using the delay Playbook V2 action - I've not tested the other ones.Different example:Am I'm missing something?

  Using the API Documentation to Run API Queries The API documentation offers a valuable feature: directly querying the REST API for Indicators, Reports, Alerts, Actors, Malware, Vulnerabilities, and other data. To get started, obtain your API key by logging into the Google Threat Intelligence (Google TI) portal, navigating to the 'API Key' section on the left side, and then visiting this URL: https://www.virustotal.com/gui/user/<your username>/apikey The key will be used in the x-apikey field in the documentation. To retrieve the Google TI Threat Score, provide a string in the x-tool field within the documentation. This string can be any value, such as “API_Docs_Testing.” Both the x-tool and x-apikey fields are located in the HEADERS section of the documentation’s query builder. The query builder also includes PATH PARAMS and QUERY PARAMS. Path parameters appear before the question mark in the query URL, while query parameters appear after the question mark. After buildin

Hello,we are performing a search based on data table, we are not getting any resultsthe query:metadata.log_type = "S1_ALERT"principal.ip in cidr %data_table_xx.cidrwhile performing the same logic in a test rule we get the results that we needthe rule logic:events:$e.metadata.log_type = "S1_ALERT"$e.principal.ip in cidr %data_table_xx.cidroutcome:$related_hostnames = array_distinct($e.principal.hostname)$related_threatname = array_distinct($e.security_result.threat_name)$related_username = array_distinct($e.principal.user.userid)condition:$ecan you please tell if there is something missing in my query or there is an issue with data tables in searches?

Hello everyone,Would it be possible to configure a trigger that is activated directly from within a Microsoft Teams channel or group chat? Additionally, is there a way to view the information that is being passed to the trigger when it's activated from this source?Any insights or advice on how to set this up or if this functionality exists would be greatly appreciated!Example would be posting a URL in a chat then the playbook takes that URL and does the playbook process etc.Thank you in advance for your help.