Security Forums

I need to create a webhook to ingest the alerts from my platform.I have a few questions regarding the field-mapping capabilities: Mapping Severity: In the mapping section i didn’t see the alert severity field. I need to map that field from my json payload.  Nested If-Else Support: Does the Expression Builder support nested if-else conditions? Something like: IF(condition1, IF(condition2, valueA, valueB), valueC ) Combining fields: Also can i combine few of the fields like classification, id, timestamp fields from my payload to create Alert title? e.g. suscpicios 1.2.3.4 at time. Store Full JSON Response: Is there any method to store or dump the entire webhook JSON payload into a field inside the Event object? This would allow me to reference addi

Hi AllHow to export the list of rule name both curated and custom. (not the rule set name) RegardsAjay P

hello, has anyone encountered or have used security_result.variables.key before? i would like to ask for your help with the parser syntax for it. tyia!

I have been thinking about how google is assures log data post ingestion is stored in an immutable state for assurance from data security viewpoint.  I tried searching for SecOps documentation but unable to find a straightforward statement. Also, once data is stored, is there a way one could delete/alter the data, if one has an appropriate permission to do so.  And how to keep a tap to such actions.?  

Hi everyone,I’m working on a YARA-L detection rule in Google SecOps for Intune wipe operations. The rule should alert when any user performs more than 3 device wipe attempts within a 1-hour window.However, I need to add an exception for one specific identity (X), where the threshold should instead be 6 wipe attempts.In other words: in one hour For all attempts alert if wipe count > 3 For user X → alert only if wipe count > 6 My current simplified condition is: This triggers for all identities—including X—even though X should only alert after 6 events.I’m trying to implement logic like: IF identity == "X" THEN threshold = 6 ELSE threshold = 3Does any

We have just enrolled in Cloud Armor paygo.Two attacks have been identified already. The dashboard reads “Mitigation is enforced. No action is required”.But the VM is still unavailable when we allow external traffic.What else can we do?

Im using set context on alert level and i have multiple duplicate values.Now i need to remove all duplicates

I am having difficulty writing a detection rule to identify VPN IPs, specifically for services like Mullvad VPN and other similar VPN providers, using only built-in threat feeds (no external data sources). I do not want to hardcode ASN numbers.

Hi All,I’ve integrated Microsoft Graph Mail with Google SecOps SOAR. For the Delete Mail  action, if we don’t provide specific values for the Sender or Subject filters, will the action delete all emails from the user’s mailbox?

I am pulling in AD Context Logsas per Collect Microsoft Windows AD logs  |  Google Security Operations  |  Google Cloud For user accounts, I am seeing the Enrichment in my event logs, however for Computer objects I am not seeing this? Here’s the context dataBut when I check event logs for that host:although the IP is there, which I doubt is from enrichment, the other attributes not… I need at least the role.  

I have seen “Integration - Updated integration action definitions to meet the new requirements of IDE” come up in lots of SOAR integration updates. What new requirements are being referenced? Is there some kind of deadline by which these updates have to be implemented?

Can anyone identify the difference in the maximum result when using different over values in the match?Example: I search the last hour of logs by log_type: events: $event.metadata.event_timestamp.seconds > timestamp.current_seconds() - 3600 $silent_hostname = $event.metadata.log_type And in the match I insert: match: $silent_hostname over 30 min This shows me 2 groups of logs:Group A (the first 30 minutes) and Group B (the last 30 minutes).With the following outcome, to show me the max timestamp of each group: outcome: $max_event_time = max($event.metadata.event_timestamp.seconds) I get 2 results, each with the max timestamp for its group.However, if I change the over value to 1 hour, it is supposed to return only one result, with the max timestamp equal to the max timestamp from Group B. But th

I’m trying to integrate reCaptcha v 3 into our checkout page. It seems that no matter what I do the call to grecaptcha.enterprise.execute is always returning a token of 0.Here is the button event: function OnCCCard(e) {            e.preventDefault();            grecaptcha.enterprise.ready(async () => {                console.log('Getting Token');                const token = await grecaptcha.enterprise.execute('MyKey', { action: 'checkout' });                console.log('Got Token:' & token);            });        }No matter what I try the second console.Log always says : “Got Token: 0”I’m not sure what I’m doing wrong. 

There are two endpoints for log ingestion into SecOps:europe-malachiteingestion-pa.googleapis.comchronicle.googleapis.comWhether using the APIs directly, or via the bindplane agent, we can get successfully logs into our SecOps instance.The "legacy" Malachite API works perfectly. The logs, labels, and base_labels are added, meaning Data RBAC works as expected.metadata.base_labels.allow_scoped_access = true metadata.base_labels.ingestion_kv_labels[0].key = "attempt_id" metadata.base_labels.ingestion_kv_labels[0].value = "597901e6cbfb490e8903fb660da2b4e0" metadata.ingestion_labels[0].key = "attempt_id" metadata.ingestion_labels[0].value = "597901e6cbfb490e8903fb660da2b4e0"The v1alpha, chronicle API allows our logs to be ingested. The ingestion labels are visible in SecOps, but the

Hi, We are in the process of setting up Google reCAPTCHA and are facing an issue related to URL filtering on our Palo Alto firewall. We created URL filtering rules to allow only recaptchaenterprise.googleapis.com, but reCAPTCHA is still not functioning as expected. During troubleshooting, access began working immediately after we removed the URL filtering restrictions, which confirms that the firewall had been blocking one or more additional Google domains required for reCAPTCHA validation. However, when we re-enabled the URL filtering policy and permitted only recaptchaenterprise.googleapis.com, the issue returned. This indicates that reCAPTCHA Enterprise relies on multiple backend Google domains, and allowing just this single URL is not sufficient for the complete validation workflow. To fully restore functionality, we may need to allow the complete Google reCAPTCHA domain set as recommended by Google, instead of permitting only a sing

I can't add a timezone setting to the timestamp.The part of the parser that extracts the timestamp is below.----------date {match => ["eventtime1", "UNIX", "UNIX_MS"]on_error => "not_eventtime1_valid"}----------I tried the following settings:①----------date {match => ["eventtime1", "UNIX", "UNIX_MS"]timezone => "Asia/Tokyo"on_error => "not_eventtime1_valid"}----------Result:No change.②----------date {match => ["eventtime1", "yyyy-MM-dd HH:mm:ss"]timezone => "Asia/Tokyo"on_error => "not_eventtime1_valid"}----------Result:Syntax error.The current time is stored in UNIX time in timestamp.Is it possible to reflect the time zone setting in the above settings?

Hi,I am developing a custom parser for a email-security product with JSON logs.Everything is working as intended, except for information I want to include under “security_result.action_details” UDM field, which does not get populated whatever I try.My code is as follows:if [event][scan][indicators] != "" { for indicator in [event][scan][indicators] { mutate { replace => { "action_details" => "indicator" } } mutate { merge => { "security_result.action_details" => "action_details" } } mutate { merge => { "udm_event.idm.read_only_udm.security_result" => "security_result" } } }}With the json log having information in this format (redacted all other information about the email and left only the structure and relevant field):

Hello Google Cloud Community,I would like to clarify a point regarding Google SecOps licensing.I have been reviewing the official documentation, including the "Applied Threat Intelligence overview" and "Emerging Threats overview." The documentation states that the Applied Threat Intelligence (ATI) and Emerging Threats features are available with the Google SecOps Enterprise Plus license.However, it is not entirely clear whether these features are excluded from the Enterprise license.Could someone please confirm my understanding?Is it correct that the Applied Threat Intelligence and Emerging Threats features are unavailable with the Enterprise license? Is the Enterprise Plus license strictly required to use them?Thank you in advance for your help.

Hi All,Struggling to find "graph.metadata.threat.threat_feed_name"  for info stealers. Also , how to get those list of threat feeds , we can leverage. for both VT and Mandiant.Thanks in advance  

Hi.I have three questions.①The email from Google Cloud said:“If you do not take action within 90 days of receiving this notice, your keys will automatically be associated with your Google Cloud project.”Even after 90 days have passed, they have not been automatically associated with a Google Cloud project.When will this happen? Did that notification have any meaning?②The email stated, “You will receive a notification when the association process is complete.”When the association is finished, will a notification be sent to the same address specifying which domain the process has been completed for? ③I understand that billing will begin with the month in which we exceed the free tier.Will the billing statement be sent by email or by postal mail?

 Hi everyone,I’m reaching out to check whether others are experiencing issues with the curated detection ruleset Workspace: Data Exfiltration from Gmail in Google SecOps.We’re using the recommended direct ingestion path for WORKSPACE_ACTIVITY logs (including Gmail). While the ingestion and parsing work, we’ve noticed that the UDM fields produced by the Workspace Activity parser do not align with what the curated detection rules expect — specifically in the Workspace: Data Exfiltration from Gmail ruleset.Examples of mismatches include:principal.application is populated with only the message_info.source.service value (e.g., gmail-ui), while the curated rule expects a concatenated value such as gmail-ui send. The selector value is placed under additional.fields instead of a field the curated rule monitors. metadata.product_name is mapped as gmai

Hi everyone, I've been exploring Google Cloud's Confidential Computing products like Confidential VMs, GKE Nodes, and Confidential Space. The potential for protecting data-in-use is very promising, especially for sensitive AI workloads. My question is:How can we securely integrate third-party AI models (e.g., from open source or external vendors) into Confidential Space or Confidential VMs without compromising data privacy or the TEE trust boundary? Are there recommended architectural patterns, isolation practices, or attestation tools we should use when the model provider is not part of our organization? Appreciate any insights, resources, or examples you can share! Thanks,

Estou criando um webhook no SIEM para configurar com o Tenable. É  necessário criar um fluxo? Qual seria esse fluxo? Google Translate: "I am creating a webhook in the SIEM to configure with Tenable. Is it necessary to create a workflow? What would that workflow look like?"

Hi All,We are utilizing Webhooks to ingest alerts from various sources into SIEM and it's working fine.Can we also utilize it to ingest raw logs in json format into SIEM. w.r.t alerts, there will be only 20-30 events per day but in case of raw logs, the volume is high. Is it recommended to use webhooks for the same?

I am looking to setup SSO with Okta for our Google Secops tenant and following the google doc: https://docs.cloud.google.com/chronicle/docs/soar/admin-tasks/saml-soar-only/saml-configuration-for-okta but this just mentions SOAR.Is that how the SecOps SSO works and moreover, there is no External authentication option under SOAR Setting → Advanced → External Authentication.I also found this doc which mentions about the SSO setup with Okta: https://medium.com/@thatsiemguy/linking-okta-to-chronicle-secops-platform-c88ca530a515 which one should I really follow, would appreciate any responses on this?