Skip to main content

Security Forums

Welcome to the Google Cloud Security Forums! Your ultimate security conversation spot. Collaborate with peers and experts to solve challenges, together.

2484 Topics
A
ArthyNew Member
asked in Google Security Operations
Multiple events are not getting generated

Content backfill required

33
rajukg11
Staff
Y
YanGuilhermeNew Member
asked in Google Security Operations
It is possible to use the same Siemplify agent (SOAR) to send Forwarders logs (SIEM) ?

I need to use a syslog server to send firewall to SecOps via the Fowarders agent, but i also want to use in this server the Connectors logs of the firewall.It is possible to use the same Siemplify agent (SOAR) to send Forwarders logs (SIEM) or the only way to this work in the Syslog server is to use two agents?

01
mikewilusz
Staff
messier63
messier63Bronze 1
posted in Google Security Operations
Need help to run manual action via Api

Hi team  i want to run any action with the help of the API endpoint api/external/v1/cases/ExecuteManualAction,and the payload for this is given below , I want to run virus total ping action if anyone can provide the correct value for this is much appreciated{"caseId": 59203,"targetEntities": [{"caseId": 59203,"identifier": "string","entityType": "string","isInternal": true,"isSuspicious": true,"isArtifact": true,"isEnriched": true,"isVulnerable": true,"isPivot": true,"environment": "string","fields": [{"isHighlight": true,"groupName": "string","hideOptions": true,"items": [{"originalName": "string","name": "string","value": "string"}]}],"isManuallyCreated": true,"sourceUrl": "string"}],"properties": {"additionalProp1": "string","additionalProp2": "string","additionalProp3": "string"},"actionProvider": "string","actionName": "string","scope": "string","alertGroupIdentifiers": ["string"],"isPredefinedScope": true} 

01
vaskenh
Staff
V
vanitharaj1208Silver 2
asked in Google Security Operations
Can we execute a retro hunt using the playbook based on the provided timeline?

is it possible to run retrohunt from playbook ?

12
V
ORBR
ORBRBronze 5
posted in Google Security Operations
A Shared Space for Ideas, Integrations, and Playbooks

Hello Community & Google staff,Could we set up a dedicated page or platform where we can freely share ideas, integrations, actions, and playbooks with one another? I couldn't find anything like this in the forum.

01
matthewnichols
Community Manager
M
MrTricky98New Member
asked in Google Security Operations
Playbook dynamic instance selection

Hi,I have a use case where there are multiple instances of the same integration in my environment, let's say for example, some firewalls (same technology) each with its configuration and API endpoint.Given an alert, I want to execute an action on a specific firewall via a playbook. When I add the action to the playbook I need to select the specific instance I want the action to be executed on.This is fine if I have few different instances, but let's say I have 10. Is there no way to dynamically select the instance for which I want the action to be executed? Do I really need to create 10 identical playbooks with only the instance parameter changing?Thanks.

02
M
T
Ty_SirilukNew Member
posted in Google Security Operations
How to send notification to slack when an alert changed, Assign changed, or Case closed.

I would like to send a notification to slack when an alert changed, Assign changed, or Case closed.Have an any notification setting or I could create a playbook, If yes can you share me a how to do it?

01
cmorris
Staff
A
agar_sNew Member
posted in Google Security Operations
How to Use Regex for Variable detected Google Chronicle

Hello,I’m trying to create a save search in Google Chronicle where a field matches a regex pattern instead of performing an exact match.Specifically, my query looks like this:metadata.log_type = "MCAFEE_WEBPROXY"target.url = ${URL} nocase However, I want target.url to match a regex pattern rather than being equal to a specific value.How can I achieve a regex-based search on the save searches with using Variable detected  in Google secops? Thanks for your help!

22
A
manoj610
manoj610New Member
asked in Google Security Operations
Assistance Required for Configuring Silent Log Alert for Palo Alto Firewall

Hi Team,I have configured a Silent Log Alert based on the log type (Palo Alto Firewall). Currently, the firewall is ingesting logs from 10 different devices. I need assistance in setting up an alert that will trigger if even a single device stops sending logs.Please let me know how if this can be achieved.Thank you!

02
manoj610
R
Roni11Bronze 2
posted in Google Security Operations
Parser code snippet

Hello,How do i parse the values from the raw log which is viewed in a JSON format into a code snippet whether the value is a top level or nested? In the example - {  "textPayload": "  customer: 12345,",  "insertId": "avhvhjmk",  "resource": {    "type": "k8s_container",    "labels": {      "cluster_name": "test-gke",      "project_id": "project-gke",      "location": "me-west1",      "container_name": "test-container",      "namespace_name": "default",      "pod_name": ”test-pod"    }  },  "timestamp": "2025-01-07T13:29:46.060650557Z",  "severity": "INFO",  "labels": {    "k8s-pod/app": "test-app",    "k8s-pod/pod-template-hash

44
sudeep_singh
K
kpmarquez_10Bronze 1
asked in Google Security Operations
Relations Entity Group not showing as enrichment

Trying to use the User Group Membership in entity enrichment using Relations Entity Group, it was configured on our Azure AD Context feed to also include groups which I did confirm by looking at the raw data, it did contain user groups and the parser was able to normalize it assigning to Relations Entity.

03
rajukg11
Staff
dnyaneshwar
dnyaneshwarBronze 5
asked in Google Security Operations
Troubleshooting Mandiant Threat Intelligence Integration in Google Chronicle for IOC

Hi Team,For the past week, we’ve noticed that there haven’t been any alerts or results related to Mandiant Threat Intelligence in Google Chronicle, particularly for IOC matches.We’ve see that the credentials provided are working, but we haven't received any successful results during this time. When reviewing past IOC alerts and matching them with recent logs, we did find a couple of IOCs that meet the criteria. However, these results are not being flagged under the IOC alerts section as expected.Could anyone advise on how to verify the integration or troubleshoot this issue within Chronicle? We’re looking for ways to ensure that the IOC feed is properly integrated and that it’s actively generating the necessary alerts and logs.Thanks in advance for your help!Thanks,DN

13
dnyaneshwar
D
DanLLNew Member
posted in Security Command Center
Extension Installation Denied

Trying to install an extension I get a message saying something like my admin  policy won't allow the installation. I've been trying to do something about this for some time to no avail. If this is the wrong place to ask this question I apologize.

11
AaronR
Staff
ahnna
Staff
ahnnaStaff
posted in Google Security Operations
📢 MITRE ATT&CK Whitepaper Hot off the Press!

Hey Google Cloud Security Community! 👋 We're excited to announce our latest whitepaper: “Beyond checking boxes: Unlocking the full potential of MITRE ATT&CK with Google.” As @ipninichuck highlighted in his recent blog, “Beyond the Matrix Reloaded," MITRE ATT&CK is incredibly powerful, but let's face it – putting it into practice can be overwhelming. Inside this whitepaper, you'll discover 5 best practices for SecOps teams to: Move Beyond Coverage: Don't just check boxes. Continuously refine your security posture with threat profiling, gap analysis, and more. Prioritize Like a Pro: Use real-time intelligence to focus on the threats that matter most to your organization. Predict Attacker Moves: Harness the power of the Technique Inference Engine to anticipate and counter attacks before they happen. Conquer the Cloud: Dive deep into MITRE's cloud matrices to understand and mitigate cloud-specific threats across AWS, Azure, and GCP. Team Up for Success: Fost

11
matthewnichols
Community Manager
O
OmskirtBronze 2
posted in Google Security Operations
Demo Backstory Link Not Working

Hi folks, Currently, the link to the demo backstory is not working. Do you have any information about a new link for the demo backstory? The goo.gle/chroniclelab link isn't working on my end. Could someone check it?Thank you!

12
O
chrisf
Staff
chrisfStaff
posted in Security Validation
Validation Content Update - January 15, 2025

VHR20250115 - January 15, 2025 The Mandiant Intelligence Validation Research Team (VRT) has published VHR20250115 - Content Expansion. This content pack requires Director version 4.12.1.0-0 or higher. If you’ve enabled the Content Service, this content pack will automatically download and be applied to your Director. Otherwise, you can download the security content pack from the Mandiant Documentation Portal. Summary of Changes 10 Actions added 8 Files added Release Highlights New Actions demonstrating malware identified in an ongoing campaign targeting vulnerable Ivanti Connect Secure VPN appliances. This campaign involves the exploitation of a zero-day vulnerability, as detailed in Google Cloud's Threat Intelligence report: Ivanti Connect Secure VPN Targeted in New Zero-Day Exploitation. New Actions demonstrating Campaign 24-073, a financially motivated campaign distributing infostealer malware via fake software installers. For full details on this release, se

20
chrisf
Staff
P
Prasanna23New Member
posted in reCAPTCHA
reCaptcha - Error - '403' PERMISSION_DENIED

Hi,I'm trying to create assessment in my app by salesforce, it returns an error like "{ "error": { "code": 403, "message": "Requests from this referrer are blocked.", "status": "PERMISSION_DENIED" } }" from backend.

83
JoshD
Staff
C
chrisd2Bronze 5
asked in Google Security Operations
Mysterious URL parameter in some v1alpha API endpoints path

Hello guys,I noticed that for some API endpoints, the URL path is : https://chronicle.googleapis.com/v1alpha/{api_version}/projects/{project_id}/locations/{region}/instances/{instance} (instances.get), but I could not figure out what the api_version parameter is supposed to be. I tried to simply ignore it but the URL is then invalid (HTTP 404).For reference, the vast majority of the API endpoints I used yet have a path like so : https://chronicle.googleapis.com/v1alpha/projects/{project}/locations/{location}/instances/{instance}/ruleExecutionErrors  (ruleExecutionErrors.list). The api_version parameter is not present in those.What should I put for api_version in the URL path ? If this variable can change through time, how can I get the correct/current value for it ?Regards

04
C
R
RickaNew Member
posted in Security Command Center
Web Security Scanner fails to authenticate (Non-Google account)

I have been trying to create a new Scan with "Non-Google account" authentication for a while and always fails with a FAILED_TO_AUTHENTICATE_TO_TARGET error code.According to the documentation, the possible issues could be:Using non-standard HTML form fields, for example, not using a password type.Using a complicated login form, for example, a form that has more than a single username and password field.Not saving an authentication cookie on successful login.In some situations, the scanner is denied by counter-measures that are meant to protect against bots, DDOS, and other attacks.I can confirm that a simple form is being used, it has no more that a single username and password field, a cookie is created after a successful login and the scanner is not denied access in any form.Moreover, checking the application logs I can confirm that the Web Security Scan is able to login and a session cookie is created, but I'm still receiving a FAILED_TO_AUTHE

04
A
Staff
Rached1996
Rached1996Silver 1
posted in Google Security Operations
Silent forwarder rule

Hello , it's possible to create a rule to detect silent forwarders in chronicle ? i don't want to create a policy in gcp monitoring .Which UDM should i use ? can you help please ?Thanks

13
Rached1996
D
dithmerNew Member
posted in Google Security Operations
Custom development of SIEM Feeds

Hey everybody,Before I am going to open a case in the cloud console, I thought I'd ask the community if somebody faced the same question/also wondered.SIEM Feeds imho are a very powerful feature. The time to onboard stuff with them is incredibly small and there is no additional infrastructure needed to ingest data with this. In a world, where more and more security products become SaaS-based respectively cloud-based it is a no-brainer to use SIEM Feeds instead of a custom piece of code to pull the data from a third party product and ingest it via the Ingestion API.Does someone know, why it isn't possible to add your own custom Feeds or even modify existing ones, like you can build parser extensions?There are a few feeds which are NEARLY sufficient for our use cases, but not quite there to use them properly. Let it be a missing attribute which can't be added to the request even though the third party API would allow it. To be a little bit more concrete: E.g. The Qualys VM Feed does not

32
D
dlove40
dlove40Bronze 2
asked in Google Security Operations
SecOps Authentication Error and Solution

We, at Foresite, ran into a SecOps authentication error with some instances we support after the recent January 11th SecOps release. https://cloud.google.com/chronicle/docs/secops/release-notes#January_11_2025The change affected how IDP group names are passed to SecOps for SOAR authentication, preventing access to some instances.Cause:The issue arises from the format of group names in "IDP Group Mapping" in SOAR settings. Group names previously required brackets and quotation marks (e.g., ["soar-users"]). This formatting is no longer valid.Solution:To regain access, remove the brackets and quotation marks from the group names in "IDP Group Mapping" (e.g., soar-users).Workarounds for Lost Admin Access:Create a Matching IDP Group: Create a new group in your IDP that exactly matches the name of an existing group with admin permissions in SOAR.Contact Google Support: Google Support can also add a group name to restore admin access.

12
matthewnichols
Community Manager
J
JonatasGhizi1New Member
posted in reCAPTCHA
ReCaptcha - Quota

Olá, Temos uma solução Google reCAPTCHA (não enterprise) em nossas soluções que funcionam como SaaS e para cada cliente existente são geradas suas próprias chaves, e em 23/10/2024 houve uma crítica no retorno do reCAPTCHA para algumas páginas consideradas “não clássicas” (não sei o que torna clássicas) informando que atingiu a cota. Em 30/10/2024 voltou a operar normalmente sem alterações, tentamos contato com o suporte sem sucesso. Gostaríamos de suporte em alguns pontos: 1 - Qual a causa da crítica (já que nunca ocorreu)? 2 - É provável que aconteça novamente? 3 - Quais os passos para regular o cenário? 4 - O que são chaves clássicas?

11
G
AfvanJaffer
AfvanJafferBronze 5
asked in Security Command Center
Abuseevent logs from GCP

Hi Folks!,Can anyone clarify what the logs from abuseevent.googleapis.com in GCP represent?The name gives some indication, but I'd like to know how to enable them.Is there any documentation available that explains this in detail?

01
A
Staff
AfvanJaffer
AfvanJafferBronze 5
posted in Google Security Operations
Not possible to include ErrorGroups in the Chronicle Ingestion filter

Hello everyone,While reviewing the ingestion filter for our organization, we discovered that we are unable to add a filter to exclude ErrorGroup type logs in Chronicle.Is this behavior expected? 

02
AfvanJaffer

Badge winners

Show all badges
Terms & ConditionsCookie settings
Privacy Policy Terms of Service Gen AI Policy Community Guidelines Cookie Settings

© 2025 Google. All rights reserved.