Skip to main content

Security Forums

Welcome to the Google Cloud Security Forums! Your ultimate security conversation spot. Collaborate with peers and experts to solve challenges, together.

2500 Topics
D
denisbyrneNew Member
posted in reCAPTCHA
Unable to see reCAPTCHA site in admin console

I created a reCAPTCHA site in February 2024 but I am unable to view the site when I log in to the admin console. The site was definitely created as I was able to apply the site and secret keys when deploying captcha to the webpageI created separate reCAPTCHA in Aug 2024 which I am able to see.

11
A
N
nick_nattaponNew Member
posted in Google Security Operations
Block an admin user using Gsuite integration

Hi team,I'm implementing GSuite integration.During the test, I found out that the "Update User" action allows me to block normal user, but not admin users as screenshots below. Blocking a normal user (Success):Test blocking an admin user (Error): I've added all of the permissions following the document: https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/google-workspaceJust want to check if is it possible to block an admin user using this integration? Do I miss something? 

01
D
Staff
D
dhirajtecBronze 1
posted in Google Security Operations
delay in case creation in Chronicle SOAR

Cases in Chronicle SOAR were created one hour after the alert was triggered in Sentinel, despite the connector's cron job being set to 10 seconds. What could be the possible reasons for the delayed case creation in Chronicle SOAR? Also, it was observed that under the event tab there were no record present. Attaching a snip 

22
D
Staff
V
VictorSOARNew Member
asked in Google Security Operations
Delay in ingesting Sentinel incident having no associated event

Hi Guys,I have encountered an issue:A Sentinel Incident was triggered without any associated event. Consequently, a SOAR case was created for this incident, but with 1 hour delay without any alert event.Does anyone knows case of this issue? 

33
D
Staff
R
rahul7514Bronze 2
posted in Google Security Operations
Reference List multiple columns ?

Hi Can reference list have multiple columns ? Lets say i am trying to create a reference list that has 2 columns one is IOC ip and other is its confidence score ? Has anyone used it , if yes please share a use case where this is used ?

43
raybrian
Staff
R
rahul7514Bronze 2
posted in Google Security Operations
Why cant we create if an logsource is not reporting as an alert ?

Hi AllWe have done creating alerts using GCP with email notification .But still can some one tell me the reasons why i cannot create an Yara L rule for host (asset.namespace) not reporting alert ? I have been asked this question many time and i have been just telling google suggests to use GCP monitoring based alerts for this. @jstoner / @David-French 

21
raybrian
Staff
A
anurag.q.singhBronze 2
posted in Google Security Operations
Facing an issue with YARA L rule

rule critical_ioc_detected_ip {  meta:    author = "Anurag Singh"    description = "Rule to check for any traffic coming from suspicious IPs related to known IOCs."   events:    $e.metadata.vendor_name = "Check Point" or $e.metadata.vendor_name = "Fortinet"    $e.metadata.product_name = "VPN-1 & FireWall-1" or $e.metadata.product_name = "Fortigate"    $e.metadata.event_type = "NETWORK_CONNECTION" or ($e.metadata.event_type = "NETWORK_HTTP")    $e.principal.ip = $sourceip and $e.target.ip = $destinationip    $kasperskyti.principal.ip[0] = $sourceip or $kasperskyti.principal.ip[0] = $destinationip    $kasperskyti.metadata.vendor_name = "IOC" and $kasperskyti.metadata.product_name = "IP"    $ioc = $kasperskyti.metadata.product_event_type  match:    $sourceip over 10m  condition:    $e and $kasperskyti}So I have written this rule to check if there is co

11
raybrian
Staff
N
Nagarjuna15New Member
posted in Google Security Operations
Enable playbook monitoring for failure actions

Team,I need to receive an email notification if any action in a playbook fails more than 3 times within a 3-hour window. However, since my instance is multitenant, I am receiving notifications for other environments as well. How can I configure it to send email notifications only for playbook failures in a specific environment?

12
N
vaskenh
Staff
vaskenhStaff
posted in Google Security Operations
How to identify integrations that are running outdated versions of Python

As part of the routine management of your SecOps platform, you should ensure that any configured integrations that are running an outdated version of Python get updated.  In this post, I'll show you how to identify whether these integrations are present in your SecOps platform, and how to go about upgrading them. First, navigate to the Marketplace.  The first clue that you are running an integration with an outdated version of Python is that you'll see a banner similar to the one below showing up toward the top of the Marketplace. From this banner, we can see that there are some affected integrations, and that there is an associated documentation link which I've included here for completeness.  Our goal is to identify which of our integrations are affected by this issue, so let's now navigate to Integrations from within the Marketplace and use the Status: Installed filter to only show installed integrations. For each installed in

05
donkos
W
wonjuleeBronze 1
asked in Google Security Operations
Spammed by 'Overflow Case'

Hi all,New to SecOps, so forgive me if this is already a known issue.I was fixing up a rule that was bugged, and tested it by running a YARA-L retrohunt using my new rule. It worked - it found something like 9000 cases over a month, but since then, I have been getting spammed by 'Overflow Cases', with empty events that are named after my rule. There are no timestamps on these or any event or log info. I do know that for the first 2-3 mins after I finished the retrohunt one of my playbooks went crazy and started spamming too, but that stopped quickly and now I only get these 'ghost' cases that are generated from empty alerts. I was wondering if there is a way to reset the queue of alerts that are waiting to be pooled into cases.From what I've seen, retrohunts should not generate alerts, so I'm not even sure if the retrohunt is the cause, but it was fine before I ran it. I know that the rule itself is not the problem, because it still finds (correct) matches as shown in the Alerts and IO

61
A
_eo
_eoBronze 1
posted in Google Security Operations
Syncing Entities From SOAR to SIEM

I'm adding new properties to entities via playbooks or manual actions and I am looking for a way to have those changes propegated to the SIEM side for the same entity. Is there a way to do this? This way, when a new connector alert is created with that entity, the new property is included and can be used for filtering, etc.

04
D
Staff
V
VictorSOARNew Member
asked in Google Security Operations
BMC Helix Business Workflows integration with Google SecOps SOAR

Hello Guys, Is there any integration solution available to integrate BMC Helix Business Workflows with SOAR?. There is BMC Helix Remedyforce integration available in marketplace, but its a different tool. Can we use webhook for this? Thanks,

06
V
ORBR
ORBRBronze 5
posted in Google Security Operations
Alerts Grouping settings issues with unique alert name

The Alerts Grouping Settings page lets you create grouping rules controlling the exact type of alerts which are grouped together into cases, Alert Type: For example, a phishing alert.However, when reviewing the provided dropdown list, it only shows unique alert names, not types.Is it possible to configure a type for each alert?We handle multiple clients across different SIEMs, each with its own alert naming conventions. If the dropdown is based on alert names, why is it labeled "alert type"? Is there a way to configure a type for each rule generator?QRadar SIEM ExampleIn QRadar, each alert or rule generates a unique offense ID along with the alert name. This makes it impractical to configure grouping based on types, as the current mechanism is driven by specific identifiers.Feature Request: Tag-based GroupingWould it be possible to introduce a new criteria option in the mechanism settings based on tags? This enhancement could improve flexibility and allow better alignmen

02
hzmndt
Staff
JuLenny
JuLennyBronze 2
asked in Google Security Operations
SecOps Platform Theme became light

Hi,A couple of days ago, the theme of our SIEM/SOAR became light and in some screens (like Rules & Detections), it's masking the text. I want to make it dark blue again, but unlike the independent Chronicle SOAR, where it's configurable when clicking on the user icon, I can't find the option to switch themes.Does anyone know where that option is hidden?Thanks

24
A
keso
kesoBronze 5
posted in Google Security Operations
SIEM search query on key:value

Hello, when searching for an event, how can I join the value of the key and its value? For example, I have the next two events, but I'd like to search only those that are res_kind = Deployment Event 1:...about[0].labels[1].key: "res_kind"about[0].labels[1].value: "Deployment"about[0].labels[2].key: "operation_first"about[0].labels[2].value: "true"... Event2:...about[0].labels[1].key: "res_kind"about[0].labels[1].value: "Service"about[0].labels[2].key: "operation_first"about[0].labels[2].value: "true"... When running with the same value, it does not work: It should be generic, so it would be something like:about.labels.key = "res_kind" and about.labels.value = "Deployment" but then any of the about.labels.value would have "Deployment" and not the one with the res_kind in the key  Thank you! 

93
jstoner
Staff
R
rahul7514Bronze 2
posted in Google Security Operations
Namespace in Chronicle forwarder

Hi Can i have a asset namespace value like this "cisco-meraki-sd-wan-logs-italy" or it will not accept it , is there any naming restriction for it ?

21
cmmartin_google
Staff
R
rahul7514Bronze 2
posted in Google Security Operations
YARA L doubt

Hi I am trying to build the below rule , where in i am trying to compare the different target SHA 256hash value appearing in any product (Crowdstrike, windows,meraki ,defender etc)  with Google Safe browsing . If i have to do this individually for each product then i would need to build multiple alerts as the event type is different for different products Crowdstrike - metadata.event_type = "PROCESS_UNCATEGORIZED"Meraki - metadata.event_type = "SCAN_FILE"Defender - "USER_UNCATEGORIZED" rule_google_safebrowsing_file_process_creation { meta: description = "Detection of process/file events that match Safe Browsing hashes , which are files deemed to be malicious" severity = "Critical" priority = "High" events: ($execution.target.process.parent_process.file.sha256 = $sha256 or $execution.target.process.file.sha256 = $sha256 or $execution.target.file.sha256 = $sha256 ) and // join execution eve

010
jstoner
Staff
R
rahul7514Bronze 2
posted in Google Security Operations
Yara L help

I am trying to build the below YARA L rule and i am seeing the same IP triggering after every couple of hours , how can i suppress them to avoid duplicate ticket creation . events: $e.metadata.event_type = "NETWORK_CONNECTION" $e.metadata.vendor_name = "Check Point" $e.security_result.action != "BLOCK" ( $e.target.ip != "" and $e.target.ip != "0.0.0.0" and $e.target.ip in cidr %cidr_rfc_1918 and $dip = $e.target.ip ) and ($e.principal.ip != "" and $e.principal.ip != "0.0.0.0" and not $e.principal.ip in cidr %cidr_rfc_1918 and $sip = $e.principal.ip) $sip in %IOC_IP match: $sip over 60m  

02
jstoner
Staff
R
rahul7514Bronze 2
posted in Google Security Operations
Splunk to chronicle conversion

Hi TeamI have a Splunk query which i am trying to convert to Chronicle  Splunk Query | tstats summariesonly=true allow_old_summaries=true count as count values(Authentication.user) as user values(Authentication.dest_nt_domain) as dest_nt_domain values(Authentication.app) as app values(Authentication.src) as src values(Authentication.dest) as dest values(host) from datamodel="Authentication" WHERE nodename=Authentication.Successful_Authentication AND Authentication.app = win:remote AND ([ | inputlookup UCL-Monitored_Server_List | fields host | rename host AS Authentication.dest] OR [ | inputlookup UCL-Monitored_Server_List | fields ip | rename ip AS Authentication.dest]) AND ([ | inputlookup UCL-Monitored_Server_List | fields ip | rename ip AS Authentication.src] OR [ | inputlookup UCL-Monitored_Server_List | fields host | rename host AS Authentication.src]) AND NOT ([ | inputlookup UCL-Service_Account | fields domain, use

32
jstoner
Staff
S
suryanmenonNew Member
posted in Google Security Operations
Ingesting Proofpoint On Demand logs

Does anyone have experience ingesting PROOFPOINT_ON_DEMAND logs? I found this documentation for Proofpoint TAP and I see Proofpoint On Demand as another API ingestion option under SIEM feeds but couldn't find relevant documentation. The input parameters are also different for ON_DEMAND compared to TAP, so was wondering if anyone had done this before

51
mikewilusz
Staff
K
Khushboo14New Member
posted in Google Security Operations
Log Stoppage

Hi Team,Can someone help in understanding how we can monitor log stoppage from collectors/forwarders and webhook through GCP. 

01
mikewilusz
Staff
G
Greg_BammelNew Member
posted in Google Security Operations
When passing a event variable to a widget - is there any way to prevent it from deduplicating?

When passing a event variable to a widget - is there any way to prevent it from deduplicating. For example, I have event_names = "[Event.headline]".split(',') event_descriptions = "[Event.description]".split(',') event_product_name = "[Event.product_name]".split(',') However, since product name is a duplicate... I end up with less values in the list and their index doesn't correlate to the other lists. Bug?

05
P
M
Mufa_shahBronze 2
posted in Google Security Operations
graph.metadata.threat.threat_feed_name equivalent in secops for anonymous_vpn

Hi all,what would be the anonymous_vpn threat feed name equivalent in GCTI ?

21
hzmndt
Staff
R
rahul7514Bronze 2
posted in Google Security Operations
MFA alert

Hi Can someone tell me where i am going wrong , i getting this error  events: $event.metadata.product_event_type = "Update user" $event.metadata.log_type = "AZURE_AD_AUDIT" $event.principal.application = "Azure MFA StrongAuthenticationService" $targetuser = $event.target.user.userid ( $event.src.resource.attribute.labels["StrongAuthenticationMethod"] != "" and $event.src.resource.attribute.labels["StrongAuthenticationMethod"] = $OldRememberTrustedDevices and $NewRememberTrustedDevices = $event.target.resource.attribute.labels["StrongAuthenticationMethod"] ) or ( $event.src.resource.attribute.labels["StrongAuthenticationPhoneAppDetail"] != "" and $OldRememberTrustedPhone = $event.src.resource.attribute.labels["StrongAuthenticationPhoneAppDetail"] and $NewRememberTrustedPhone = $event.target.resource.attribute.labels["StrongAuthenticationPhoneAppDetai

23
jstoner
Staff
S
skadavBronze 5
posted in Google Security Operations
Where to find API list for SIEM

I am trying to find API list for SIEM but unable to get it.I have SOAR Swagger API, but not able to find SIEM. Please let me know if anyone has any idea.

43
A

Badge winners

  • Comments Posted 1
    hytech_sghas earned the badge Comments Posted 1
  • Solution 1
    Rmosshas earned the badge Solution 1
  • Authored Posts 1
    Umairbadar39has earned the badge Authored Posts 1
  • Comments Posted 1
    Rmosshas earned the badge Comments Posted 1
  • Comments Posted 1
    Gabby23has earned the badge Comments Posted 1
Show all badges
Terms & ConditionsCookie settings
Privacy Policy Terms of Service Gen AI Policy Community Guidelines Cookie Settings

© 2025 Google. All rights reserved.