Security Forums

Hi everyone,We’re currently implementing SecOps and I’m struggling with a specific scenario where I couldn’t find clear documentation. At the moment, we have a single environment that centralizes all open cases. Our requirement is to segment these alerts so that, for example, firewall events are separated by client, in different environments, based on criteria such as IP addresses, domain names, or even email addresses.My questions are: What would be the best way to automatically assign these cases to the right environment? Should this be handled with rules, or is it better to use playbooks for this type of segmentation? If anyone has faced a similar situation or can share best practices, I’d really appreciate your input.

Do we have any matrix for Informational, Low, Medium, High, Critical that exactly tells the range for all these fields accurately 

Hi, is it possible to aggregate another aggregation? My goal is to get the average time for the maximum and minimum time. But since there’s a limitation I’m not getting the correct result. Is there any workaround to get avg? 

The Mandiant Security Validation (MSV) team is pleased to announce version 4.14.4.0 of the MSV platform.EnhancementsAdjusted Report Builder to work with sub-dimensions. Upgraded nginx SSL directive. Added additional Alternate name support for Actors to match multiple possibilities in the security controls and SIEM. Added MFA Registration Status in the User Management page. Upgraded the inetsim image in Protected Theater. Updated Actors to OpenSSL3. Updated reported Actor OS information in Director web interface. Newly-released Actor images have an /opt location with 20 GB of space. MSV requires encryption in the database.yml file using vconfigdb or vsetdb without providing a root certificate.Bug fixesFixed an issue where Directors showed an error when trying to pull content through an NTLM proxy connection.

Hi,I need to create a playbook that creates Jira tickets based on alert priorities. If an alert's priority is high, it should create a high-priority ticket and so on. However, my condition doesn't match anything, and the playbook always chooses the last step. How should I create the condition to make that work correctly?"

Hi All,Any idea what does this means?  

Calling all Security Operations Enthusiasts! Google Cloud is offering a beta for the new Professional Security Operations Engineer certification! The exam will be available until August 8.  Check out the post in News & Announcements. 

Olá, comunidade,Estou enfrentando um problema  e preciso muito de ajuda. Sou estudante e estou tentando usar uma API do Gemini, mas minha conta parece estar bloqueada.Resumo do problema: Estou aceitando um erro "429 - Quota Exceeded" na primeira requisição que faço para a API do Gemini, mesmo em um projeto totalmente novo e configurado do zero.O que já foi feito (sem sucesso): 1. Meu código Python está correto e só faz uma requisição por vez (não está em loop). 2. Criei uma conta de faturamento e o vinculei corretamente ao meu projeto ativo. 3. Confirme que a "Generative Language API" está ATIVADA no projeto. 4. Criei mais de um projeto e chaves de API novas; o erro persiste em todos eles. Tudo indica que a cota padrão gratuita da API do Gemini não foi provisionada corretamente para minha conta Google Cloud. Não importa o que eu faça, meus projetos herdam esse status de "cota zero".Alguém do Google poderia, por f

author = "XXX XXX"    description = "Detects a successful logon immediately following multiple failed logon attempts from the same IP or user, using specific Windows Event IDs."    severity = "High"    priority="High"    mitre = "T1110.001"    yara_version = "YL2.0"    tactic = "Credential Access"    technique = "Brute Force"   events:    // Event 1: Failed authentication attempts from Windows logs (4625).    $fail.metadata.event_type = "LOGIN_FAILED" and    $fail.principal.asset.ip = $ip_address and    $fail.target.user.userid = $user_id        // Event 2: A single successful authentication from the same IP (Windows 4624).    $success.metadata.event_type = "LOGIN_SUCCESS" and    $success.principal.asset.ip = $ip_address and    $success.target.user.userid = $user_id    match:    $ip_address, $user_id over 5m 

Hi Team,can someone help me with forwarding Zoom logs via API to secops SIEM?

Is there a way to account for null/zero values that show up when you run a match window? For example this query - ingestion.log_type != ""$log_type = ingestion.log_typematch:$log_typeoutcome:$event_count = sum(ingestion.event_count)$event_type_count = count_distinct(ingestion.event_type)$event_types = array_distinct(ingestion.event_type)order:$event_count desc Gives results back like the followinglog_type - Testevent_count - 4event_type_count = 3event_types - USER,,EDRas you can see it accounted for the zero value but I do not want it to account for the empty value in that count for event_type_count

Is there a way to account for null/zero values that show up when you run a match window? For example this query - ingestion.log_type != ""$log_type = ingestion.log_typematch:$log_typeoutcome:$event_count = sum(ingestion.event_count)$event_type_count = count_distinct(ingestion.event_type)$event_types = array_distinct(ingestion.event_type)order:$event_count desc Gives results back like the followinglog_type - Testevent_count - 4event_type_count = 3event_types - USER,,EDRas you can see it accounted for the zero value but I do not want it to account for the empty value in that count for event_type_count

I see this was already asked here, but the "solution" is strange and counters the whole purpose of having actual tables with columns. If I need to do a concat of all my columns into a SINGLE column for comparison, aka, a single dimension, aka exactly how it worked with reference lists, then this is useless! This exact same behaviour was possible with reference lists as you could have a line like `john@example.com_1.1.1.1` and do a concat on the UDM fields in the rule to compare them against the value from the reference list! My use case: I have a data table `common_behaviour` that is populated according to a business logic. That table contains the following columns:user:

Does anyone have a wrapper or code sample to easily run integrations in Pycharm or a debugger not within SOAR? It's brutal building in the IDE.

giám sát jp khách hàng tiềm năng bằng thời gian thực

Hey everyone!I am trying to create an alert using a webhook. This is the json sample I used for my webhook:{ "name": "Alert test", "environment": "EnviName", "rule_generator": "Test rule", "alert_identifier": "Alert-Test-1", "priority": 10, "display_id": "[Case.Id]", "start_time": "2025-08-14T14:00:00Z", "end_time": "2025-08-14T14:00:00Z", "device_product": "RULE", "events": [ { "name": "Event_No_Name1", "type": "Event_No_Type1", "severity": 1, "source": "Origin", "device_product": "RULE" }, { "name": "Event_No_Name2", "type": "Event_No_Type2", "severity": 1, "source": "Origin", "device_product": "RULE" } ], "custom_fields": { "detected_from": "Perseus", "source_case": "[Case.Id]", "playbook_origin": "Create Cortex Alert", "extracted_domains": "[Entity.Identifier]" }}In

Hi,I have a use case where an IP address is blocked based on the button clicked by the end user in an approval link. If the user declines, the playbook ends.However, I also need to add a timeout that sends a follow-up email to the user. The problem is that both "decline" and "timeout" currently behave the same way in my flow.Is there a way to separate these two flows so that the timeout triggers a different path from the decline?I've attached an image of my current setup for better understanding. Any guidance would be appreciated! 

Hello, I've been noticing email raw logs from Office 365 does not contain the recipient email address or user name. How to resolved this issue or are there configurations needs to be fixed?

Timeframe:Since 09:00 on 28/08/2025 (GMT) we have been getting errors which seem to be related to google reCAPTCHACall is made to:https://www.google.com/recaptcha/api2/clr?k=6LeeZmsfAAAAAK-SB2w-6_XpkLha7vsRLlRvH8e1 Issue:Because of the errors it is blocking our endpoints from being successful. This call is being made immediately after an internal server call that we make, example below Question:

Previously, we experienced an issue where cases were not created due to a bug in Google secops.This was resolved by updating the connector to the latest version.We are currently considering preventative measures and solutions for this issue.For example, is it technically possible to use a playbook or something to issue an alert when an issue occurs where a case is not created? If the above is not possible, we would appreciate it if you could share any ideas you have for checking the latest update announcements as a preventative measure, or for quickly noticing bugs like this one.

Hello,I’m trying to create a rule that detects alerts from Check Point firewall, but excludes alerts related to authorized pentest activities.For this, I created a data table named authorized_scanners with the following columns: activity_name source_ip destination_ip start_date end_date I want the rule to reference this table, but I’m running into the following error:"validating intermediate representation: event variables are not all joined by equalities, the joined groups are: (authorized_scanners), (e)" Could someone help me resolve this? Here is my rule rule checkpoint_fw_medium_alert{ meta: ... priority = "Medium" events: $e.metadata.vendor_name = "CheckPoint" nocase

Hey folks, In version 64 of Google Chronicle Response Integration, we updated the “Execute UDM Query” action to support Aggregated Queries and YL2 functions. ❗❗Important Note: Aggregated Queries are only supported for Chronicle API. Backstory API doesn’t support it. To change the integration to work with Chronicle API, you need to adjust the API Root in the integration configuration. Keep in mind that this will affect the whole integration and some action outputs are slightly different, if executed with Chronicle API.❗❗ Example 1. Basic Matchingprincipal.hostname = "siemplify"match: target.file.vhash UI JSON Result

On reCAPTCHA I do see two domains that I once used, but they are not valid/available anymore; they do not use reCAPTCHA anymore. How to delete those entries from the reCAPTCHA portal?

We have a number of clients who have access to their reCAPTCHA keys currently via the console. We usually create the keys, then invite the client as an owner of the site. Other clients may even have multiple owners in their organisation. Presumably anyone with access to a reCAPTCHA key will be getting emails about keys for migration.If no action is taken and the keys are migrated automatically, where will the GCP project be created and who will have access to the new project? If there is a single owner, how is the owner determined as reCAPTCHA’s existing admin console doesn’t seem to provide a way of determining who the person who originally created the key is?

The logs on Cloud Logging can be ingested directly to Google Secops using export filters. You set a sink filter (e.g., logName:"syslog" AND textPayload:("auth failed")) and Secops only receives logs matching that. Although export filters are pretty straightforward and powerful, they have some limitations:Filters are static – you can only control inclusion/exclusion at the time of sink creation. You can’t easily enrich, transform, or route logs differently once they leave Cloud Logging. Scaling is limited – a single sink can push to Secops but lacks intermediate processing. An alternative way to  ingest logs from Cloud Logging is to use Pub/Sub. A Pub/Sub topic is a named resource in Google Cloud Pub/Sub that acts as a channel for sending messages from publishers to subscribers.Publishers send (or "publish") messages to a topic.