Security Forums

I am looking to save a count of how many times a particular funciton ran within a job. How can I do that within the IDE? 

I recently tried to upgrade from recaptcha v2 to v3 as my FE needs to call multiple API from BE and it's difficult to implement it via v2. I want all my BE calls to be secured by recaptcha token. So, chose V3 to not interrupt users. But I can see all the recaptcha tokens get verified without any issue event when I created 200 requests using chrome dev tools in incognito mode. I created 200 tokens using execute function and send the requests to the API. all of them verified successfully with score of 0.9. So, my questions are:Is that because I use localhost for testing? the behaviour might be different in production? Is v3 supposed to detect those sort of requests? automated via a script in dev tools?Is v3 is less secure in compare to v2 as there is no human interaction needed?Is there any other way to use version 2 for multiple API calls? but with one user challenge? Regards,Ali

Hi Has anyone created a dashboard that highlights the mitre mapped tactics and techniques mapped use cases in the environment.? 

Hi, I think the line graph is having a problem when I use a single match, specifically with the date. The line graph shows a value of zero, even though when you switch it to table chart it has accurate values for each date. So, ending the line graph is zero only which it is not good. Is there any way to fix this? Thank youwhen the date is in match only it’s not getting the accurate values of line graph. example query:$Date = timestamp.get_date($event.timestamp) example only match:$Date outcome:$COunt = count($event.metadata.id)

Hello Everyone,We developed an application that has been using reCAPTCHA for over a year and started acting up stating the certificate is not valid. Even though the expiration date is until 2027 we had to refresh/retrieve a new certificate to get it working again, after that we noticed the fingerprint change, so I was wondering if anyone is aware of this issue.The problem happened 3 days ago and yesterday started happening again but now the fingerprint is the same, we've noticed the problem now is happening randomly in our site and doesn't seem to be an internal issue, more like a problem with reCAPTCHA.I would really appreciate any assistance or direction in the matter... ahead you will find the error thrown by our server:I/O error on GET request for "https://www.google.com/recaptcha/api/siteverify": com.ibm. jsse2. util. j: PKIX path building failed: com.ibm.security.cert.IBMCertPathBuilderException: unable to find valid certification path to requested target; nested exception is jav

Hello ,Has anyone developed a dashboard that highlights the MITRE-mapped tactics and techniques along with the associated use cases in the environment?"Thanks

How to find cryptomining bad domain related threat feed names? for  building rules using graph entity in yara L. 

Does anyone use git based source control management of their content in Google Sec Ops SOAR? Use CI/CD pipelines on new content?

Hello, community, Today I'm facing something weird and can't figure out how this is possible...I've implemented a custom detection rule on my Chronicle SIEM instance that detects when a particular user deletes more than 20 files over 10 seconds. To test the rule I've deleted 26 files. On the SIEM side the rule correctly detects file deletion events and raises an alert grouping all 26 file deletions.On the SOAR side I correctly received a new case with an alert but inside the alert, I can see 120 events... Looking at these events I can find a lot of duplicates... I can't figure out why this strange behavior. The Chronicle connector has been configured from a while and with other alerts works fine pulling the correct number of events. What I'm missing? Thank you!A

Hi Folks,The default parser in Google SecOps (Chronicle) does not parse attributes inside cfgattr= (such as uuid, status, name, comments) from FortiGate firewall logs. In statedump, it extracts cfgattr but I couldn't map these to udms.Using Grok Debugger, I created a parser that correctly extracts these attributes and maps them to the appropriate UDM fields. I would appreciate your support in troubleshooting this issue.%{DATA}cfgattr="uuid\\[%{UUID:uuid}\\]status\\[%{WORD:status}->%{WORD:status_new}\\]name\\[%{DATA:name}\\]srcaddr\\[%{DATA:srcaddr_old}->%{DATA:srcaddr_new}\\]schedule\\[%{DATA:schedule_old}->%{DATA:schedule_new}\\]comments\\[%{DATA:comments_old}->%{DATA:comments_new}\\]"<190>date=2025-02-07 time=10:55:36 devname="DEVICENAME" devid="FGVM123123123" eventtime=1738914936223542976 tz="+0300" logid="0101010101" type="event" subtype="system" level="information" vd="root" logdesc="Object attribute configured" user="username" ui="GUI(1.1.1.1)" action="Edit

Hello Community , Can you help me how can i develop a dashboard that shows the status of API connections in chronicle if its possible ? Thanks

I am running the following UDM search:$e.metadata.vendor_name != ""$log_type = $e.metadata.vendor_namematch:$log_typeoutcome:$count = count($e.metadata.id) Getting following error: ERROR: Search has encountered an error and could not load data. Please try again, and contact support if this error continues. Please help

I'm a website tester for a promotions company and I am getting regularly blocked from submitting forms for our own campaigns? I seem to be the only person who has this problem at my company and the developers can't figure out why? When I hit submit I get the 'reCAPTCHA error.' return error. Has my I.P or email / mobile details been flagged with recaptcha or something? No idea how it works. But it's very frustratingly stopping me from working. Do I contact Google? Any help would be hugely appreciated. I'm quite willing to build a shrine to you.

Hello,I’m currently exploring the preview dashboards in SecOps, and I would like to add markdown visualization to dashboard. However, I noticed that markdown support is not available at the moment. Are there any alternative methods for achieving this?Additionally, is there any plan to introduce markdown functionality in future updates?Any guidance or suggestions would be greatly appreciated!Thanks,Prashant

Hi,I am new at using the Google recaptcha thing.First, I have to say that Google knows how to make things complicated!!! I cannot find my way around the recaptcha dashboard? It looks like a big mess to me.Anyhow, I have made some recaptcha keys for websites of mine. I am now trying to strengthen my website security after having been hacked over and over.The plugin in I am using asks for both the recaptcha main key and the security key. I seem to be able to find the main keys but I don't seem to have any access to the security keys?Do I need to start over or is there a way to find the security keys once having been made?If so, how?Thanks,John

 Hello Team,I recently integrated Oracle Cloud Audit logs via an S3 bucket. The logs are in JSON format, and while SecOps is successfully pulling them, I’m encountering an issue with the log format. The logs are breaking incorrectly—either after each line, comma, or curly brace {}—resulting in improper ingestion.I’ve already verified the basics but haven’t been able to identify the root cause.Could someone help me troubleshoot this issue, or suggest alternative methods to ingest Oracle Cloud Audit logs into SecOps?Thanks in advance for your help!

I have problems with my logs since they are ingesting in the SIEM with a schedule that is not appropriate, these logs have the correct schedule. I have verified this because it is ingesting in another SIEM and it sends them to me correctly, in Google Chronicle when modifying the location to UTC-6 does not match the information in my records, could you help me modify this or give suggestions on what to do?

Hi Everyone ,Do you know or had experience for CISCO SASE log ingestion ? Any recommend. 

Lets say I bring in context data, which contains the entities of a asset(hostname, username, mac, IP, agents installed, etc...).I have created a parser to parse all the required entities.Will this help me in enriching other missing entities in other log sources ? for example I have a firewall log, where only the hostname and username is present in the log. Will it enrich the remaining entites associated to the host and username like mac and its associated IP ?

Hello Google Community Members,I wonder if there is way to search for logs that were part of an alert.Example query:target.ip = "random_ip_that_triggered_an_alert"magicAlertFlag =/true/ ?is something like that possible?

HiI was unable to log in and when I tried to reset password using the "Forgot your password?" option, I am not receiving any reset link. However, I am still encountering an error stating that my user is inactive.Would it be possible to register a new user with the same email address? I would like to have my team members sign up for access as well.Can anyone help us with the Chronicle SOAR access?

Hi Team,So there is  a requirement.Can we have a rule in SecOps SIEM that will trigger whenever there is a log stoppage from that particular log source (product & vendor) for a period of 1 or 2 hours?

Hi,I have been struggling to find the right approach to ingest 1password audit events into Chronicle SIEM. Upon checking with Chronicle support, they mentioned they don't have a direct integration at this moment. Has anyone managed to ingest the 1password audit logs using other approaches such as GCS or webhook?

Hey everyone,I'm trying to set up an alert in Google SecOps to notify us if a specific device stops sending logs. We want to monitor individual endpoints and get an alert if they stop reporting for a defined period (e.g., 24 hours).Does anyone know the best way and how to configure this? Appreciate any insights or best practices!Thanks!

Hi All,We're soon to be moving to SecOps and have a significant On-Prem footprint with a number of log sources.I'm curious to learn what sort of logging infrastructure others in similar situations are using in your environment. I'm investigating options like fluentd, logstash, cribl etc. One of the requirements is that I don't have budget for big expensive solutions.