Security Forums

We are new to SecOps SOAR. With the SOC team deployed who is monitoring the alerts manually, we like to know what are the common playbooks that every environment should have? Can someone share a list or share use cases to make rhe best use of SOAR platform? We have data sources from AWS, GCP, GWS, AZURE, SentinelOne. 

Since yesterday's patch window, all of our playbooks are no longer automatically applying via custom trigger. After some testing, only the 'Alert.' calls have changed. There appears to be no change with 'event.' calls.[alert.alertname] has to be [Alert.alertname]This requires a full rework of every playbook we have in production(total 458 playbooks, inactive and active). Some heads up on the change being implemented would've been great!

Hello, I have a form on my website that allows non-authenticated users to complete. The form can also be completed by the user logging in. If the user has Google Services turned off, can they still access and complete the form if they are signed-in?Scenarios:1) unauthenticated user navigates to form. Prompted by reCaptcha. Google Services not deactivated. All ok. 2) unauthenticated user navigates to form. Prompted by reCaptcha. Google Services deactivated. User does not see form? What do they see?3) authenticated user navigates from within the application to the form. They will see the form? Thanks for your help. 

Hi All, I have used set content value for a key "No. of emails deleted" and value is set to "count of events [execute udm query .events]" . and i used key-value widget to render it.it works in my lab instance but not in client instance ?] Why?not only this field all fields (event fields, alert fields, action result etc) 

Hi,I’m concerned about finding a cost-effective solution to ingest these logs into Google SecOps. While I want to send this type of log data to Google SecOps, I’ve noticed there is a charge for Cloud Logging. If I agree to pay for the storage and retention costs associated with a Cloud Logging bucket, would there still be any egress charges for transferring these logs to Google SecOps?Thank you!Option 1: Direct ingestionA special Cloud Logging filter can be configured in Google Cloud to send specific log types to Google Security Operations in real-time. These logs are generated by Google Cloud services.Google Security Operations only ingests supported log types. Available log types include:Cloud Audit LogsCloud NATCloud DNSCloud Next Generation FirewallCloud Intrusion Detection SystemCloud Load BalancingCloud SQLWindows Event logsLinux syslogLinux SysmonZeekGoogle Kubernetes EngineAudit Daemon (auditd)ApigeereCAPTCHA EnterpriseCloud Run logs (GCP_RUN)

 Is there any way to view images that have been attached to the case and are on the case wall without downloading and opening in an external app? 

I need to report SOAR cases by bespoke cateogries:A good way to add tags to my SOAR cases uses the SIEM rule syntax meta section ("meta: "; e.g I add something like: report_category = "UnAuthorized Access"But I'm struggling to see how I can use these as tags to define categories in the SOAR...also struggling to see how I can use anything except strings in the alert names for this purpose either. [EDIT: I can't even recall what I meant here - 😞  ]Anyone have any luck creating metrics reporting cases per bespoke category? or even by ATT&CK category.thanks 

I've noticed that even though I have cases that have breached SLA open the SOC status widget does not report any cases that have exceed SLA. I've tried exporting the JSON for a test dashboard that uses this widget but can't find anything in there that might need changing. Does anyone have any ideas on how this could be fixed?

Is there a way to store a value, such as an offset, and subsequently retrieve/update it in consecutive connector-runs? Trying to prevent a custom-connector from re-creating cases/alerts and ensure it checks for unique event/alert IDs/fields against values inside existing cases before creating a new one

If I have a dev, stage and prod instance? Can I use git sync to synchronize components, pull updates, and push playbooks and cases from one instance to another? If not, how would I be able to set certain cases and playbooks to simulated mode or dev by default? 

I have a rule that previously generated detections, but now when I attempt to run a retro hunt, it is not generating any alerts.

Unintended service account impersonation is a significant concern when it comes to service account abuse.While reviewing logs to detect when one service account impersonates another, I noticed that Chronicle does not parse the impersonator service account into a separate field.Instead, the impersonator’s service account email is added to the principal.email_addresses repeated field.This creates challenges in fully detecting impersonation activities, as the impersonator email is not consistently placed in the same order within the repeated field. Even if we assume that the last email in the list could be the impersonator's, it’s difficult to pinpoint the last index when writing detection rules.This makes it challenging to create effective rules for identifying service account impersonation. Has anyone encountered this issue, or does anyone have alternative solutions (other than creating a custom parser)?

Hello,We got a notification from Google stating that we exceeded the free quota and we were asked to add billing information. We added the billing information and the CAPTCHA - v3 started working again.Got a question on this :When we go to reCAPTCHA admin console, when I see the analytics it says we received 816K requests this week (that is from Jan 9th to 15th Jan) and 14% of it were suspicious. Especially, if we take 15th Jan - it says 97,156 requests were legit and 16,320 were suspicious. If I view this project in Google Cloud for Jan 15th: the max. requests we got is 155 and high risk is 1. Why is there a difference between these two dashboards? Could you please give me a detail on what these numbers are? 

We are having an application which is exposing it's findings in it's own API, we have been provided with their endpoint URL and API token.I'm unable to see any integration options available in SIEM/SOAR where we can pull such data from the 3rd party API except those already defined like Microsoft Graph/Crowdstrike etc.,What should be our approach here?  

Content backfill required

I need to use a syslog server to send firewall to SecOps via the Fowarders agent, but i also want to use in this server the Connectors logs of the firewall.It is possible to use the same Siemplify agent (SOAR) to send Forwarders logs (SIEM) or the only way to this work in the Syslog server is to use two agents?

Hi team  i want to run any action with the help of the API endpoint api/external/v1/cases/ExecuteManualAction,and the payload for this is given below , I want to run virus total ping action if anyone can provide the correct value for this is much appreciated{"caseId": 59203,"targetEntities": [{"caseId": 59203,"identifier": "string","entityType": "string","isInternal": true,"isSuspicious": true,"isArtifact": true,"isEnriched": true,"isVulnerable": true,"isPivot": true,"environment": "string","fields": [{"isHighlight": true,"groupName": "string","hideOptions": true,"items": [{"originalName": "string","name": "string","value": "string"}]}],"isManuallyCreated": true,"sourceUrl": "string"}],"properties": {"additionalProp1": "string","additionalProp2": "string","additionalProp3": "string"},"actionProvider": "string","actionName": "string","scope": "string","alertGroupIdentifiers": ["string"],"isPredefinedScope": true} 

is it possible to run retrohunt from playbook ?

Hello Community & Google staff,Could we set up a dedicated page or platform where we can freely share ideas, integrations, actions, and playbooks with one another? I couldn't find anything like this in the forum.

Hi,I have a use case where there are multiple instances of the same integration in my environment, let's say for example, some firewalls (same technology) each with its configuration and API endpoint.Given an alert, I want to execute an action on a specific firewall via a playbook. When I add the action to the playbook I need to select the specific instance I want the action to be executed on.This is fine if I have few different instances, but let's say I have 10. Is there no way to dynamically select the instance for which I want the action to be executed? Do I really need to create 10 identical playbooks with only the instance parameter changing?Thanks.

I would like to send a notification to slack when an alert changed, Assign changed, or Case closed.Have an any notification setting or I could create a playbook, If yes can you share me a how to do it?

Hello,I’m trying to create a save search in Google Chronicle where a field matches a regex pattern instead of performing an exact match.Specifically, my query looks like this:metadata.log_type = "MCAFEE_WEBPROXY"target.url = ${URL} nocase However, I want target.url to match a regex pattern rather than being equal to a specific value.How can I achieve a regex-based search on the save searches with using Variable detected  in Google secops? Thanks for your help!

Hi Team,I have configured a Silent Log Alert based on the log type (Palo Alto Firewall). Currently, the firewall is ingesting logs from 10 different devices. I need assistance in setting up an alert that will trigger if even a single device stops sending logs.Please let me know how if this can be achieved.Thank you!

Hello,How do i parse the values from the raw log which is viewed in a JSON format into a code snippet whether the value is a top level or nested? In the example - {  "textPayload": "  customer: 12345,",  "insertId": "avhvhjmk",  "resource": {    "type": "k8s_container",    "labels": {      "cluster_name": "test-gke",      "project_id": "project-gke",      "location": "me-west1",      "container_name": "test-container",      "namespace_name": "default",      "pod_name": ”test-pod"    }  },  "timestamp": "2025-01-07T13:29:46.060650557Z",  "severity": "INFO",  "labels": {    "k8s-pod/app": "test-app",    "k8s-pod/pod-template-hash

Trying to use the User Group Membership in entity enrichment using Relations Entity Group, it was configured on our Azure AD Context feed to also include groups which I did confirm by looking at the raw data, it did contain user groups and the parser was able to normalize it assigning to Relations Entity.