Skip to main content

Security Forums

Welcome to the Google Cloud Security Forums! Your ultimate security conversation spot. Collaborate with peers and experts to solve challenges, together.

2528 Topics
N
needbaaNew Member
posted in reCAPTCHA
BAA for Enterprise Recaptcha

Do we need a BAA signed for enterprise recaptcha? If so, how do we obtain it

43
ErikaB
Community Manager
M
MarinusCBronze 2
posted in Google Security Operations
How to get SIEM IOC Matches into SOAR

Hello all, there is no current post regarding this topic, so I open a new post. Is there any chance to ingest the IOC Matches from Google SIEM into Google SOAR as a new alert / case. In the past I thought there was a connector function which allowed to directly create alerts based on the IOC Matches. Or are there anywhere public IOC Detection Rules, which are reporting exactly the IOC Matches.Thank you for your help.~Marinus

13
dlove40
0
0xRPCW-SecOpsBronze 1
asked in Google Security Operations
Multi Tenancy & Forwarder Labels

Greetings--Piggybacking on this post:https://www.googlecloudcommunity.com/gc/SOAR-Forum/Using-Environments-for-Multi-Tenancy/m-p/687636#M1977Are there any guides or syntax about how to link or associateForwarder Labels and Ingestion Labels and/or NameSpacesto their respective Environments to support a multi-tenancy deployment?e.g. I see in yaml:env: devAny advice is helpful.Thank you!!

02
dlove40
H
HSHSWebNew Member
posted in reCAPTCHA
Can I have multiple reCAPTCHA accounts under 1 Enterprise account?

Currently I have a Google account for my organization.Under it I have 2 active api's (HSHSPublicGeocodingAPI and HSHSBizRecaptcha). The reCAPTCHA v2 account is Enterprise. I am being asked if I can add another reCAPTCHA Enterprise account, v3 under HSHSBizRecaptcha. Looking at documentation I think I can but I want to be sure so I can relay that information. If not, I guess the requestor can create another Google account and create their own reCAPTCHA account. Thanks in advance.

31
ErikaB
Community Manager
S
skadavBronze 5
posted in Google Security Operations
How to check Detailed Audit Logs for SOAR Playbooks

I'm trying to access detailed audit logs specifically for SOAR Playbooks. Currently, I can view the audit logs for SIEM rules using metadata.product_name = "Google Cloud Platform", but I'm unable to locate similar logs for SOAR Playbooks.Has anyone managed to find or configure audit logging specifically for SOAR Playbooks? 

114
D
Staff
L
Lakshmi_KunchalNew Member
posted in reCAPTCHA
Getting API error while calling the "Annotate assessments" REST API

I integrated reCAPTCHA Enterprise (score-based) in my web application. Everything is working fine, and I am getting the score. I want to configure "Account Defender" and "SMS toll fraud protection."  For "SMS toll fraud protection", I am sending the account identifier to the API. While configuring the account defender, getting an API error in "Annotate Login Events". Below is my code1. First I created the reCAPTCHA Enterprise assessment, got the assessment_id (name field), and sent that assessment_id to annotate the assessmentconst url = `https://recaptchaenterprise.googleapis.com/v1/${result}:annotate`;const data = {"annotation": "LEGITIMATE","reasons": "REASON_UNSPECIFIED"};fetch(url, {method: 'POST',mode: 'no-cors',body: JSON.stringify(data),headers: {'Content-Type': 'application/json','Authorization': 'Bearer APIKEY'}}).then(response => {if (response.ok) {return response.json();}else if (response.status === 404) {console.error("Assessment ID not found:", assessmentId);// Ha

21
L
rahul7514
rahul7514Bronze 2
posted in Google Security Operations
Metrics usage in Yara L

Hi TeamI am trying to replicate an alert that was built in Splunk .1) Use case is to check an anomaly in the SMB traffic . For this in Splunk we were using firewall traffic over port 139 and 445 and calculating the average and std dev between src and dest in a day and using the outlier concept which is if if traffic observed at a given point is above the (avg +2 std dev ) then an alert should trigger .can we built this alert in YARA L ?

02
rahul7514
rahul7514
rahul7514Bronze 2
posted in Google Security Operations
Oracle cloud with chronicle

Hi Can someone suggest how i can integrate oracle cloud with google chronicle? 

107
rahul7514
I
ironbeaztNew Member
posted in Google Security Operations
Virustotal on SIEM

Hi I would like to ask if its possible to use our VT enterprise api on siem, we want to use it for threat hunting on the logs being ingested into siem.Thanks.  

11
I
Staff
R
russell_pfeiferBronze 5
posted in Google Security Operations
IOC Hunt Using Chronicle Detection

Good morning--Over the years one of the concerns that our security team has had is around the use of "EDR bypass". If you're not familiar, EDR bypass is just as it sounds: hackers deploy tools to either turn off your Endpoint Detection and Response entirely or greatly diminish it's detection capabilities. Today I came across a post from a trusted partner with a host of EDR bypass IOC's. My question is two-fold:1. What is the efficacy / practicality of building out a custom detection using only IOC's ( mostly hashes and .exes) in Chronicle? Is detecting this type of activity better accomplished using our hunting platform?2. If building out a detection is the proper path, is it as easy as creating a list of the IOC's I'd like triggered on and then building the detecting to reference that list?Thank you in advance for any help your able to provide. 

176
R
vanitharaj1208
vanitharaj1208Silver 2
posted in Google Security Operations
Alert description

How to update alert decryption using playbook/blocks i used tools- add/update alert - and passed json{"description": "test -updated description"}it showed -successand i used fetch original alert ... but i could see previous description How can i see the new updated description ?is there any other standard way of doing? 

08
S
rahul7514
rahul7514Bronze 2
asked in Google Security Operations
help with Query

Hi Has anyone experience this issue this field when copied or exported will show as security_result.action The challenge as a result is when i am writing the query in SIEM search  security_result.action != "QUARANTINE" the above logs (security_result[1].action[0]:"QUARANTINE") are not getting captured . If I type security_result[1].action[0] != "QUARANTINE" in SIEM search it throws error message . What should be the query in such cases ?

1711
rahul7514
Prjct2501
Prjct2501New Member
posted in Google Security Operations
Time Chart: Requests per minute of Top 10 IPs

Hi all,I'm coming over from Splunk where this type of query would be pretty trivial, but I'm struggling to make it work in SecOps dashboards;I've read through this article about pivoting on data to create a basic time chart, but I'm not quite getting the data I want: https://www.googlecloudcommunity.com/gc/Community-Blog/New-to-Google-SecOps-Dashboarding-Using-Pivot-to-Create-a-Time/ba-p/735476I'd like to see the number of requests per minute of the 10 highest-volume IPs connecting to the network. So far I can easily make a "requests per minute by IP" chart, but it organizes the IPs numerically, (i.e 1.1.1.1, 1.1.1.2, 1.1.1.3, etc.) not by total count, even if I toggle the Count field to display in descending order. Anyone have any ideas? Thank you!

32
Prjct2501
vanitharaj1208
vanitharaj1208Silver 2
posted in Google Security Operations
udm fields -start date and discovered date

start date vs discovered date ?

03
S
M
minkayaNew Member
posted in Google Security Operations
How to add workspace activity to Chronicle via 3rd party API?

Hi, I want to add workspace activity to Chronicle via Add feed --> 3rd party API and log type workspace Activities. However, I have some information but these are not completely fit to support documentation. https://us.v-cdn.net/6031969/uploads/editor/yi/awkiwyu7r61e.png

930
yasinmnk
rahul7514
rahul7514Bronze 2
posted in Google Security Operations
Cisco NDR with chronicle

HiCan someone suggest how i can integrate cisco NDR with chronicle?  

11
brodsky
Staff
rahul7514
rahul7514Bronze 2
posted in Google Security Operations
Deleting ingested data

Hi Is it possible to delete data that is ingested to google chronicle. If i have accidentally onboarded PII data and want to remove it, is it possible? And how to do it?

01
AymanC
jansch
janschBronze 1
posted in Google Security Operations
SecOps Forwarder failing gs://chronicle-distribution

Hello everybody,We have an urgent problem with a SecOps Forwarder instance from one of our customers.The error message looks as follows:Does anyone know what might be causing this issue?Could it be a missing connection to storage.googleapis.com over TCP/443?I appreciate any responses.Many Thanks

63
jansch
V
vamsi_nrvNew Member
posted in Security Command Center
GCP Security Command Center (Premium) vs Prisma Cloud

Dear Community,We are contemplating enabling GCP Security Command Center premium version at Org level. At the same time we are using Prima for vulnerability.Now the question i have is, how do we do trade off between the 2 tool in terms of  features, pricing, ease of use etc to present a case for management?Our Org has multi cloud strategy and we have AWS & Azure as well. Prima being cloud native is one advantage over SCC any other pointers you can provide to determine the same?Thank you!

113
A
Staff
N
navinkumarcNew Member
posted in reCAPTCHA
Google captcha V2 callback not triggered after challenge is completed

Hi Team,We use google captcha V3 for bot detection and when the score is low, we fallback to V2 to challenge the user. We have setup both v3 and v2 as per the docs. We use javascript to programmatically execute V3 and V2 using `grecaptcha.execute( )` method. The issue here is that, the registered callback for V2 is not getting triggered for some cases due to which the users are stuck in the captcha step. It gets triggered for staging environment but not in production. Need to understand what is missing here. TLDR; Registered the callback in `render` method of V2 as per docs. Calling `execute` invokes the challenge but the callback is not triggered post that.  

30
N
vaskenh
Staff
vaskenhStaff
posted in Google Security Operations
Visual Guide - Integrate Mandiant Attack Surface Management (ASM) into Google SecOps

In this brief guide, I'll show you how to integrate Mandiant Attack Surface Management (ASM) into Google SecOps. With Mandiant Attack Surface Management, organizations can discover and track vulnerabilities and threats across their public-facing infrastructure.  As part of this function, ASM is able to build a robust catalog of Entities that represent the various resources that are identified during the course of scans.  We can easily query this catalog of Entities and the list of known Issues that ASM has identified about them in Google SecOps. Let's first install the Mandiant ASM Marketplace integration.  You can find it using the label Mandiant ASM, and you can verify you're installing the correct one by noting that it has the Certified label as shown here. Once the integration is installed, you can proceed to fill in the corresponding parameters that SecOps will use to connect to ASM.  Before we can do this, we need to generate an API keypair in ASM so tha

70
vaskenh
Staff
Omskirt
OmskirtBronze 2
posted in Google Security Operations
Cumulative

Is there any other way to manually compute the cumulative year, similar to how the running total works in the preview dashboard in Looker? Or is there a workaround to calculate it? I’m struggling to think of a solution for that in Yara-L. 

12
Omskirt
L
lexrzasa1Bronze 4
posted in Google Security Operations
Detection and Intelligence Updates | FortiManager Zero-Day Exploitation

Check out the latest blog on the FortiManager exploitation. This high risk vulnerability has confirmed exploits and we want to make sure you are prioritizing this vulnerability to keep your organization protected.  Google Cloud Security is on a mission to support all of our customers with timely and actionable intelligence gathered from the frontlines. Google Security Operations and Google Threat Intelligence customers can benefit from the intel today directly within the products.  Google SecOps Enterprise+ users will find the rules released to the Mandiant Intel Emerging Threats rule pack (within the Windows Threats group), and IOCs are available for prioritization with Applied Threat Intelligence. Enterprise+ users are encouraged to enable the Mandiant Intel Emerging Threats and Applied Threat Intelligence curated detections rule packs.  Google SecOps Enterprise and Standard users can create single or multi-event custom rules using the information shared in the blog.&n

10
L
S
SimaoRibeiroNew Member
asked in Google Security Operations
Yara-L search first login

Hi eveyone, I want to create a search to give me the time of the first login, why the query bellows give-me an error ?   principal.user.userid = "xpto-bind" OR target.user.userid = "xpto-bind" match: principal.user.userid, metadata.event_timestamp order: metadata.event_timestamp desc limit: 1   thanks

62
hzmndt
Staff
rahul7514
rahul7514Bronze 2
asked in Google Security Operations
SIEM Dashboard in Google Secops

Hi I like to have a panel that shows all my ingested log sources and its last ingested time . i do see a panel "Recently Ingested Events" under Data Ingestion and Health but it shows only some log sources and not all the ones .I want panel showing all the log sources and its time , can some one help me understand how i can build it . @jstoner any suggestion .

1911
rahul7514

Badge winners

  • Authored Posts 1
    ericv-avahas earned the badge Authored Posts 1
  • Comments Posted 1
    EJJessehas earned the badge Comments Posted 1
  • Comments Posted 1
    kin.chanhas earned the badge Comments Posted 1
  • Authored Posts 5
    Jez_Khas earned the badge Authored Posts 5
  • Comments Posted 1
    reubanisaachas earned the badge Comments Posted 1
Show all badges
Terms & ConditionsCookie settings
Privacy Policy Terms of Service Gen AI Policy Community Guidelines Cookie Settings

© 2025 Google. All rights reserved.