Skip to main content

Security Forums

Welcome to the Google Cloud Security Forums! Your ultimate security conversation spot. Collaborate with peers and experts to solve challenges, together.

2471 Topics
EJJesse
EJJesseNew Member
posted in Security Command Center
Web Security Scanner authentication failure during actual scan

I'm trying to setup up Web Security Scanner with non-Google account for authorisation. I have a simplified login form that works as expected when saving the scan details, and I can see in our server login it's requesting the page, submitting the form, receiving the cookie, and then viewing the post-login page successfully.However when I try to run the scan it is always return a Login procedure failed error. Checking the logs I can see it's still visiting the sign in page, however no POST requests are being made. This includes both the post for the submit form, and another POST request that runs on page load. Both are called when the scan settings are being saved and verified however.I can see the login form submit is definitely triggering. From reading the documentation I can see custom scans should support POST requests, on managed scans are GET only. We are using the standard tier so these scans can only be custom scans.I've testing using alternate User Agents with no success. Is the

30
EJJesse
D
devashishsinghBronze 2
asked in Google Security Operations
Only enrich domains that are listed in a reference list

Hey friends!So the requirement is to create a detection rule that enriches all domains except for what's added in the reference list which usually have all my internal domains. I know we do $field in %<reference list>, how would I instruct "Only enrich domains which are given in the reference list.This doesn't seem to work:$e1.principal.administrative_domain = $dom$dom not in %<reference_list_name>?

13
R
Staff
R
rohan1804New Member
posted in Google Security Operations
Clarification on Fetching Assets via listassets API – Artifact vs Asset

Hi everyone,I'm trying to fetch assets using the following Chronicle API endpoint:https://backstory.googleapis.com/v1/artifact/listassetsWhile using this API, the input parameters require one of the following:"artifact.domain_name""artifact.destination_ip""artifact.hash"I'm a bit confused about the distinction between artifacts and assets in this context. Also, where can I find valid values for these artifact fields (like "domain_name", "destination_ip", or hash) to use in the request?Could someone please help clarify:What exactly is the difference between an artifact and an asset in Chronicle?Where can I obtain artifact values to query the "listassets" API?Any help or examples would be greatly appreciated.Thanks!

06
James_E
Staff
S
sudeep_singhBronze 1
asked in Google Security Operations
Error while extracting timestamp

Hello Community,I have been encountering an error while trying to parse the timestamps in the log below,To parse the above timesamps, I've attached my code and the error,date {    match => ["created", "UNIX_MS", "UNIX"]    target => "event.idm.read_only_udm.metadata.collected_timestamp"    # on_error => "no_match"  } Snip of error:As per my understanding, the timestamp is in float and not matching with the date functions like "UNIX" or "UNIX_MS"Can someone please help m to figure out this problem?Thanks,Sudeep

01
V
M
mwisenerBronze 1
asked in Google Security Operations
Will Chronicle API (dataplane api) support curated rule exclusions?

Just curious if anyone has any word on if the dataplane api will eventually support exclusion creation for curated rules:I see this type in the documentation, but not any endpoint that accepts or returns its:https://cloud.google.com/chronicle/docs/reference/rest/v1alpha/DetectionExclusionApplicationMaybe this was accidentally added but the support is planned?What i'm trying to do:Programatically add/remove an exclusion for a rule name. (in ui, you would go to Detections > Rule & Detections > Exclusions Tab > Create Rule Exclusion > (fill in details) -> Create ExclusionThanks!\\- Mike  

22
M
smaxs
smaxsNew Member
posted in Google Security Operations
parser for: bindplane dns logs | how to parse hex data to string or ip

 I have a DNS event (Event ID 257) where I want to extract the response data from the hex string in the "PacketData" field. I have obtained the last eight characters from the value, e.g. "0A180366", which represents the IP address 10.24.3.102.0A (hex) is 10 (decimal)18 (hex) is 24 (decimal)03 (hex) is 3 (decimal)66 (hex) is 102 (decimal)Does anyone know how to do this within the parser? I would like to transform the hex value into an IP address or string.Thanks in advance for your help! 

14
smaxs
shubham8agar
shubham8agarNew Member
posted in Google Security Operations
Unresolved Expression in Google SecOps Playbook Output After Action Failure

I'm working with Google SecOps (Chronicle SOAR) playbooks, and I've noticed that when an action fails, the output sometimes still shows the expression in its raw form, like:[Action_Name_Get Question Results_1.JsonResult]Instead of resolving to None or an empty string, it just stays as-is. This causes issues when referencing the output in later steps or logs.My questions are:Is this the expected behavior when an action fails?What’s the best practice to handle such cases ?Are there any built-in functions or patterns in SecOps playbooks to gracefully handle failed action outputs?

11
Y
Staff
Aphex2in
Aphex2inNew Member
asked in Google Security Operations
Issue with Run Test button in Google SecOps

Hi all,Anyone having issue with this button?I'm not sure if this is associated with my SecOps instance only or the issue is happening to everyone. I would like to use retrohunts but they generate alerts unfortunately and I don't want many alerts pop up in my cases page.

02
Aphex2in
G
GcpsecopsBronze 1
posted in Google Security Operations
IOC Matches show lot of ip addresses mapped with GKE asset

Our SIEM dashboard show lot of GKE assets with IOC type IP addresses mapped to it in the dashboard.I am trying to find out why these are reported on the  Global Threat Map with and how these assets are identified as IOC Matches. Customer is also asking for an explanation if these are threats. Can someone give an overview how to correlate this and understand whats going on?

03
S
P
palevelmodeNew Member
posted in Google Security Operations
Capture an Event and Put it on Custom View

I'm working on simplifying things to my team by creating a playbook to grab information from cases "events" and put them on a custom view. But I'm not sure how to do it. I can't find anything help me understand this process from documentation. I have attached sample screenshots for what I'm trying to achieve here.

12
P
PaulHarvey
PaulHarveyNew Member
posted in reCAPTCHA
Finish setting up your key: Request scores

Hi,I created a website through Webflow web builder. I have used reCAPTCHA (v2) for my submission form. The site has been live for 2 weeks, and am able to receive submission forms.I received an email today from Google Cloud saying "You aren't protected". (snip below)In my Google Cloud console, the status reads - Unprotected: Finish setting up your key: Request scoresTo fully protect your site or app, finish setting up your key. Your key is requesting tokens (executes), but isn't requesting scores (assessments).I clicked "request scores" but this refers to code, which I don't have experience using/ implementing.Any assistant would be gratefully received to make status - Protected.Thanks

63
PaulHarvey
Y
Staff
ylandovskyyStaff
posted in Google Security Operations
[Important] Response Integration RNs are available publicly in Google Cloud Documentation now!

Hey folks, If you've struggled to understand what were the changes done to the Response Integrations every week, then this new resource should hopefully make it easier. It doesn't have the full history, but moving forward, it will be updated and you can refer to it as source of truth. Here is the link.

10
Y
Staff
nikhilpurwant
Staff
nikhilpurwantStaff
posted in Google Security Operations
Improving Customer Security Efficiency with Google Security + Third party MCP Servers

This post is co-authored with @DanDye. We are working on a video that demonstrates all topics from this post. Contents 1. Introduction2. Scope3. Agent4. Goal5. Running Google MCP Servers using the prebuilt agent 6. Integrating Google MCP Servers with Third party  MCP Servers (under ADK Based Agent)7. Local run and deployments8. Securing runs and deployments9. Runbooks (for carrying out SOC tasks)10. Evaluating agent functionality11. Improving response time / performance and optimizing costs.12. Demo Links13. Appendix Introduction Google recently published a suite of MCP servers for the following security products Google SecOps (SIEM and SOAR) Google Threat Intelligence (GTI) Security Command Center (SCC) You can find them on GitHub. They enable customers to interact with security products using natural language, break silos (with unified access) and also help bridge the cybersecurity skills gap. Please check out the following demo to learn more about how customers can

270
nikhilpurwant
Staff
A
Alex3Lee5New Member
asked in Google Security Operations
Attribute mapping in SAML

Im trying to integrate the AzureAD as a thirdparty IDP, but when comes to set the google.groups  attributes i got the error : "The mapped attribute 'google.groups' must be of type LIST<STRING>".How was suppose to be the valor passed ?

81
Eoved
benpeven
Staff
benpevenStaff
posted in Google Security Operations
Build with Google Cloud Security MCP Servers

Google Cloud Security announced open source Model Context Protocol (MCP) servers for Google SecOps (SIEM and SOAR), Google Threat Intelligence and Security Command Center.  These MCP servers allow you to easily connect Google Cloud Security products and LLMs to create your own AI-powered workflows. Below is a video from Software Engineering Lead Brian Ray that connects Gemini to Google SecOps and Google Threat Intelligence with the Anthropic Cline AI coding assistant.  If you have questions, want to contribute to the GitHub repo (for GitHub instructions check out our Community-Driven Detection Content for Google SecOps blog) or get feedback on a use-cases you're designing, respond to this post or create your own post use and use the MCP tag. Our engineering team is here to help.  We look forward to seeing what you build with these open source MCP servers. 

2217
S
C
chronicleDDsrBronze 2
posted in Google Security Operations
SOAR Playbook actions to process case wall/comments

Hi team,We are working on developing playbooks from scratch and was wondering what would be the best way to read a case wall note/comment and process specific data and pass it as input to another action?Ex: Lets say we have a servicenow action configured in playbook workflow - 1, which would fetch a record details based on place holder values given and now i want to pass a specific value from JSON output returned (which i can see in the case wall tab) from servicenow action within workflow 1as input to another workflow -2 or to same workflow - 1Any insights would be helpful to address this problemThanks.

16
C
S
Simon_King_79Bronze 1
asked in Google Security Operations
Playbook failure watcher

I'm looking to build a watcher to run via a scheduled alert type to look for any cases where the playbook status is failed.  Surprisingly, the search API doesn't return the playbook status, and the GetCaseCardsByRequest doesn't seem to allow you to filter on playbook status.  Any thoughts or pointers would be appreciated!

14
S
A
Aravind3Bronze 2
posted in Google Security Operations
ruleExecutionErrors in Yara-L

Hi Team,Do we have a documentation for all ruleExecutionErrors in Yara-L?eg: Error code 3- too many ORs or ANDs Thanks,Aravind Sreekumar

04
V
gregkay
gregkayNew Member
asked in Google Security Operations
JSON widget - remove or replace quotes

Hi all,Is it possible to get the JSON widget to not display the quotations for string values?Tried the expression builder replace but that does not remove the quotes.eg.  [Get MyJSON.JsonResult| replace(‘”’,’’)]Really like simplicity for using this widget for dynamic KVs as well as default appearance for this widget looks great.  I’ve not been able to nicely recreate in HTML.Cheers

12
gregkay
Tonio
TonioBronze 5
asked in Google Security Operations
Curated detection source code

Greeting folks!I rememeber some news, around the end of 2024, about the curated detection code being made available to all, sometime this year. Is there any update about it? Will we be able to actually understand exactly how those works? Cheers,A

12
Tonio
A
abdul_sacumenNew Member
posted in Google Security Operations
Unable to Locate "Feeds" in Community Edition

I’m currently exploring the Community Edition and noticed that under Settings, I can only see Connectors and Webhooks. I’m trying to locate the Feeds section but haven’t been able to find it.Could you please confirm if the Feeds feature is available in the Community Edition?

03
Y
Staff
kaushalpatel
kaushalpatelNew Member
posted in Google Security Operations
Filter Workspace Logs

Is there a way to filter the workspace logs and reduce it before sending it to secops ?It is consuming too much storage of the tenant storage limit.

02
kaushalpatel
N
Nagarjuna11New Member
posted in Google Security Operations
JIRA sync comments issue

Hi All,We have integrated Jira Cloud with SOAR. However, we've observed that in some cases, Jira comments are not syncing and reflecting in the case wall, while in other instances, the comments are successfully reflected. Could you assist how to fix this do i need to make any changes in code for sync comments job?

11
hzmndt
Staff
N
NASEEFBronze 5
posted in Google Security Operations
google secops feature analysis

Hello Team ,greetingsI’m creating a Google SecOps onboarding document for new clients who is getting onboarded to secops siem and soar.one section of from the documents outlines core features and limitations of key SecOps functions. Could you please help me identify and clearly explain the current limitations or gaps for the  SecOps features If there is any document i can easily refer that will be very helpfulEntity GraphMulti-Stage RulesMetricsRisk ScoringRisk AnalyticsNative DashboardingComposite RuleReference Lists (Search, String (Plain Text), String (Integers), RegEx, CIDR)Data Tablesthanks in advance@jstoner @dnehoda @raybrian 

01
hzmndt
Staff
jeffbezos42
jeffbezos42New Member
posted in Google Security Operations
MISP SecOps Rules issues with Time Matches

Hi All,I am having issues with MISP rules in SecOps. We have integrated via the documentation here using a Webhook: https://cloud.google.com/chronicle/docs/ingestion/default-parsers/mispThe parser itself whilst it does extract some fields is still raw and doesn't correlate timeframes. We aren't interested in the time the IoC was ingested from MISP but rather the time ti was published from the third party threat provider in a field known as extracted.fields["Event.date"])Using this field we can concatenate '00:00:00' to it to convert it into UTC: strings.concat($g.extracted.fields["Event.date"], " 00:00:00")The issue is that it is supposed to look for all fields of this value within the past 6 months and then correlate these to new events of other log sources with field 'IP'. The date of ingestion for MISP events really isn't important here. You can see the code snippet for this below: events: $ip = $e.principal.ip $userid = $e.target.user.userid // MISP IOC

032
jeffbezos42

Badge winners

  • Authored Posts 5
    leodashas earned the badge Authored Posts 5
  • Authored Posts 5
    delstonhas earned the badge Authored Posts 5
  • Authored Posts 1
    SaDaVFhas earned the badge Authored Posts 1
  • Authored Posts 5
    hzmndthas earned the badge Authored Posts 5
  • Solution 10
    hzmndthas earned the badge Solution 10
Show all badges
Terms & ConditionsCookie settings
Privacy Policy Terms of Service Gen AI Policy Community Guidelines Cookie Settings

© 2025 Google. All rights reserved.