Security Forums

Hello Community I'm working on a custom parser and i see that the ip in the raw log is in this format :"AUDIT_SOURCE_IP": "147.1.1.1,34.1.1.7", As you see two IP's in single field and getting this error while parsing : generic::unknown: invalid event 0: LOG_PARSING_GENERATED_INVALID_EVENT: "field type check failed: field backstory.Noun.ip[0] \\""147.1.1.1,34.1.1.7\\" does not match type IP: invalid argument" how i can resolve that please ?

This is a sample data :  { "ts": "2025-04-28T12:56:43.765882Z", "adminName": "PRA.DE@abc.com", "adminEmail": "PRA.D@abc.com", "adminId": "6693xxxx6693", "networkName": null, "networkId": null, "networkUrl": null, "ssidName": null, "ssidNumber": null, "page": "Policy objects", "label": "Policy object group object ids", "client": { "id": null, "type": null } }  I have written a parser for this,  filter { json { source => "message" array_function => "split_columns" on_error => "not_json_format" } mutate { replace => { "event1.idm.read_only_udm.metadata.event_type" => "GENERIC_EVENT" } } json { source => "message" array_function => "split_columns" } if [networkId] != "" { mutate { replace => { "networkId_label.value.string_va

We are trying to have a remote agent communicate with a firewall management console on prem but we're getting certificate validation errors. it looks like we need to amend the default CA bundle in the docker container, I believe.Here's the error:curl: (60) Peer's certificate issuer has been marked as not trusted by the user.More details here: http://curl.haxx.se/docs/sslcerts.htmlThe below message comes up when we try to curl to the console IP. curl performs SSL certificate verification by default, using a "bundle"of Certificate Authority (CA) public keys (CA certs). If the defaultbundle file isn't adequate, you can specify an alternate fileusing the --cacert option.If this HTTPS server uses a certificate signed by a CA represented inthe bundle, the certificate verification probably failed due to aproblem with the certificate (it might be expired, or the name mightnot match the domain name in the URL).If you'd like to turn off curl's verification of the certificate, usethe -k (or

Hi experts,I have doubt on how to ingest logs for checkpoint harmony to google chronicle, as I couldn't find any option to ingest these logs via API

I have a log : Sample :  { "ts": "2025-04-26T01:45:26.126095Z", "adminName": "", "adminEmail": "", "adminId": "", "networkName": "Delhi", "networkId": "", "networkUrl": "", "ssidName": null, "ssidNumber": null, "page": "Overview", "label": "", "oldValue": "", "newValue": "", "client": { "id": , "type": }I want to use the ts variable and put it in metadata.event_timestamp variable . How can I parse it? Below is a sample parser : filter {        json {            source => "message"            array_function => "split_columns"            on_error => "not_json_format"        }        mutate {            replace => {                "src_present" => "fals

I am currently working on a custom action to copy entities from a source case to the current case. Despite the source case (ID: 18545, which I added as a parameter) having entities, the action reports that zero entities were added. Here's the code I'm using: from SiemplifyAction import SiemplifyAction from Siemplify import Siemplify from SiemplifyUtils import output_handler @output_handler def main(): siemplify_action = SiemplifyAction() # Retrieve the source case ID from the action parameters source_case_id = siemplify_action.extract_action_param(param_name="source_case_id", is_mandatory=True) # Get the current case current_case = siemplify_action.case # Create an instance of Siemplify to access get_case_by_id siemplify = Siemplify() # Retrieve the source case try: source_case = siemplify._get_case_by_id(int(source_case_id)) except Exception as e: siemplify_action.LOGGER.error(f"Error retrieving case with ID {sourc

Say I have a block with 4 possible paths, but only 1 path will ever run. The way secops blocks are set up I have an output for each path, so output_1 - output_4. When I try pulling the json result of this block in a parent playbook, I'm able to select any of these 4 possible json outputs as input. This requires me to add an additional step to go through all 4 and see which one isn't empty, making my playbook much larger than it needs to be. Is there a way to make a block only return the output from the path that was run? In other words, say my block as those 4 possible outputs, is there a way to "collate" my results into one output so the playbook can just pull from this same output every time? Thanks!

Hello,I have a question about the "Quick Action" Feature. I understand that you can use quick action buttons linked to integration actions. But is there a way to link it to a playbook block? I tried using the "Attach playbook to alert" But this workaround does not allow for custom input for the playbook.Is this something that is on the road map for the "Quick Actions"?https://cloud.google.com/chronicle/docs/soar/investigate/working-with-cases/quick-actions?hl=en

Hello, I am creating a custom alert view for a playbook - which should be available to view for all roles I have in Secops. However, when I view the alert and click on the overview tab , it seems to only show me the "Default Alert View" not the custom one I have created. Is there any reason why it is doing this? Thanks 

In a playbook that was activated by an alert from a specific Product, I am trying to create an alert in a different environment. I've been trying to do that through an Execute HTTP Request Action.That action, which includes the following json in the Body Payload, is able to create an alert:{    "name": "CRITICAL DOMAIN DETECTED FROM Px",    "environment": "MetR",    "rule_generator": "Playbook MetR Px",    "alert_identifier": "Px-[Case.Id]-[EntityIdentifier]",    "priority": 90,    "start_time": "2025-04-15T14:00:00Z",    "events": [      {        "event_name": "Event_No_Name",        "type": "Event_No_Name",        "severity": 4,        "source": "Px",        "device_product": "Teleg"      }    ],    "entities": [      {        "ident

Hi,looking through some of the new Native Dashboards and noticing that the EDR-related ones define the SENTINEL_EDR parser made me question if we are using the wrong parser for one SentinelOne EDR -> SecOps SIEM integration.Looking through the documentation I see four different parsers/feeds for SentinelOne:The way I understand it SENTINEL_DV is a legacy parser and SENTINELONE_ALERTS is a simple feed with alerts with incidents from within SentinelOne.Then things become a bit more unclear.What's the difference between SENTINEL_EDR and SENTINELONE_CF, provided we only use SentinelOne for EDR?Currently we have SecOps ingestion setup with SENTINELONE_ALERTS and SENTINELONE_CF, but since some SecOps out of the box features such as those Native Dashboards and maybe also some Curated Detections specify the SENTINEL_EDR parser, is this the preferred parser?This thread was inspired by a similar thread on CrowdStrike parsers.

I think I have a syntax issue. Or I am doing this wrong?I want to filter out all message ID's that are rejected.I haven't found anything that shows how to use this function.

for example:AzureActivity| where Caller in (```user```)| where SubscriptionId == "subscriptionID"| where ResourceGroup in (```Resource Group```) Is there a way to do this now, or a feature in the works? We use KQL queries in "Execute a custom hunting query in Microsoft 365 Defender." We have a need to also be able to run them in Azure

Hello, we recieved an email saying that we will need to change the recaptcha and create a google cloud project for it to keep working. The email said that in the last 3 months my recaptcha average 327 assesments, but when I go to the recaptcha admin page I see 98,000 requests for the last 90 days.How does the pricing work for this? Does it charge when you reach X amount of requests or X amount of assesments? In this case assesments and requests are the same? If not what's the difference?Kind regards,  

Hi everyone,I'm trying to figure out how to restrict access to specific playbooks or blocks in our environment so that only selected SOC team members can view and run them.Currently, by default, all users in our SOC have access to view and run all playbooks. I want to change this behavior so that certain sensitive or specialized playbooks are only visible and executable by specific users in SOC.I tried using the access control options within the playbook settings and specified certain usernames, but it didn’t work as expected. It seems like the default global access is overriding these specific restrictions.Has anyone successfully configured access controls for playbooks or blocks at a more granular level? Is there a way to override or customize the default permissions?

This function no longer seems to be working correctly. We use this in several playbooks all of which are no longer functioning correctly.

Hello everyone!Looking at the detections for a specific rule, it gives you back only a specific timeframe, like last months or so.I cannot set any other specific time window for the search, nor filters on other fields.A couple of examples:-  I see a rule has been triggered like 100 times in January (3 months ago), I see notghing at all.- I am checking a draft rule with more than 10.000 detection, need to focus on a specific day. I can't, because that day is outside the first 10.000 shown in the panelIs it just me missing some peculiar button or function? Shouldn't be possible to "search" on the detections as we do on the events? A

You may already be aware that  we announced Google SecOps API Wrapper SDK last month. There are couple of posts here and here. The SDK provides a comprehensive command-line interface (CLI) that makes it easy to interact with Google Security Operations products from your terminal. I'm using a simple command-line workflow that bridges the gap. It uses the standard SecOps SDK CLI tool and a custom Python script (gemini-shell.py) acting as a wrapper for the Gemini API.  We have 2 components 1-SecOps SDK CLI: Provides access to query SecOps data. We use it here to run queries (like SecOps stats ...) and export structured data summaries (JSON). It's our way to get the needed data out. 2-gemini-shell.py (Appendix 1) (Custom Script you can find it below): A Python script that acts as a command-line interface to the Gemini API.(you need to Get a Gemini API key) Now, let's get into the action I want to analyze the logs ingestion trends over time using stat

Security Practitioners, you do not want to miss this one! We have an exciting webinar coming up tomorrow in our Security Foundation webinar series - it's on Virtual Red Teaming topic.https://www.brighttalk.com/webcast/18282/639711 Security Command Center (SCC) delivers the best protection for Google Cloud and its unique virtual red teaming capability continuously simulates millions of attack permutations against a digital twin of your cloud environment - helping you to effectively manage risk!  Join and hear from our experts - Doug Ko @pandamoose and Gary Oppel.

I think reCAPTCHA has a bug for meim Trying to log into steam and I forgot my username, so I type my email and click I’m not a robot. It gives me what feels like thousands of prompts and then it tells me I’m a robot. I’m just trying to play my video games, I’m not a robot.

Does anyone have experience reconciling Splunk event counts vs SecOps event counts? I’m running queries in both platforms and noticing large discrepancies by log type(Splunk typically has far more events). The webhook feeds I am using to send to SecOPs don’t show any obvious issues sending data.

The Mandiant Intelligence Validation Research Team (VRT) has published VHR20250423 - Content Expansion. This content pack requires Director version 4.12.1.0-0 or higher. If you’ve enabled the Content Service, this content pack will automatically download and be applied to your Director. Otherwise, you can download the security content pack from the Mandiant Documentation Portal. Summary of Changes 37 Actions added 30 Files added Release Highlights New Actions demonstrating Campaign 24-078, an India-nexus espionage actor UNC1687 campaign leveraging CVE-2017-0199 and CVE-2023-38831 to target government, defense, and maritime shipping entities in South and East Asia. New Action demonstrating Campaign 24-079, a campaign leveraging FAKETREFF to deploy and execute the VOLTMARKER downloader along with the NIGHTROPE dropper. New Actions demonstrating Campaign 24-080, a suspected China-nexus actor UNC59

I have trouble to figure out why the columns in the Events panel are blank, while the ontology seems to map correctly at least the Name, StartTime, EndTime and CategoryOutcome.In Cases, Overview, Events table, the columns are blank.In the Events tab, Name is showing up.When using "Configure Event", and looking at the related mapping, the system fields seem to be correctly mapped for Name, StartTime, EndTime and CategoryOutcome.What am I missing? 

Hi,We are building a form service similar to Google Forms, where users can create custom forms and embed them into their websites via <iframe>.We’re currently implementing reCAPTCHA v3 to protect these embedded forms. Using the default implementation, the reCAPTCHA badge at the bottom left is as expected. We’d like better to localize the UI for Japanese users and our service.Current:What we’re trying to achieve We want to:1. Display the attribution text in Japanese, e.g.:```<div>  <img src="https://www.gstatic.com/recaptcha/api2/logo_48.png">  <div>    このサイトはreCAPTCHAによって保護されており、    <br>    Googleの    <a href="https://policies.google.com/privacy">プライバシー ポリシー</a>と    <a href="https://policies.google.com/terms">利用規約</a>が適用されます。  </div></div>```2. Show the reCAPTCHA icon next to or near the attribution text, ideally allowing us to position both elements i

Hello,I run YARA-L queries in the SecOps Native Dashboards to obtain variety of metrics. In this case, I am trying run a query that returns byte size for Defender logs, but broken down by product event type (e.g. DeviceProcessEvents) and ingestion label; since we have multiple feeds for certain event types and I'd like to check on a per feed basis. Is there any guidance on what syntax I could use for bytes?Thank you