Security Forums

Olá, Temos uma solução Google reCAPTCHA (não enterprise) em nossas soluções que funcionam como SaaS e para cada cliente existente são geradas suas próprias chaves, e em 23/10/2024 houve uma crítica no retorno do reCAPTCHA para algumas páginas consideradas “não clássicas” (não sei o que torna clássicas) informando que atingiu a cota. Em 30/10/2024 voltou a operar normalmente sem alterações, tentamos contato com o suporte sem sucesso. Gostaríamos de suporte em alguns pontos: 1 - Qual a causa da crítica (já que nunca ocorreu)? 2 - É provável que aconteça novamente? 3 - Quais os passos para regular o cenário? 4 - O que são chaves clássicas?

Hi Folks!,Can anyone clarify what the logs from abuseevent.googleapis.com in GCP represent?The name gives some indication, but I'd like to know how to enable them.Is there any documentation available that explains this in detail?

Hello everyone,While reviewing the ingestion filter for our organization, we discovered that we are unable to add a filter to exclude ErrorGroup type logs in Chronicle.Is this behavior expected? 

I have a rule that is looking for emails sent to a specific domain and i would like to filter out the events where a particular group inbox is the target. The UDM fields for an example event look like this: target.user.email_addresses[0] = account1@domain.com, target.user.email_addresses[1] = group1@domain.com, etc. My rule has a line like this target.user.email_addresses != "group1@domain.com". However, these events are not being filtered out. Any ideas why? I was thinking it may be related to this being a multi-value repeated field, so != on the one address may not work...

someone please let me know if i ingest Microsoft 365 logs via Feeds to SIEM, Does it charge me extra cost.

Hello,I have two logs that share a common field: IDI need to create a single table with the following columns:The ID fieldField X from the first logField Y from the second logHere's what I have so far:From the first log, I ran a search that produced a table containing the ID and X fields.From the second log, I ran a different search that produced a table containing the ID and Y fields.Now, I want to combine these results into one table that includes all three fields (ID, X, and Y).How can I achieve this in Chronicle?Thank you!

Hey everybody!Is anyone successfully ingesting entities via the createentities-Endpoint of the ingestion API (https://cloud.google.com/chronicle/docs/reference/ingestion-api#createentities) and able to find those entities in their bigquery datalake or able to use those entities via the entitiy_graph in detection rules?After ingesting the entities, receiving a 200 from the api, none of the entities can be found. Any experiences here and caveats I might have not thought of or low hanging fruits I can try to get the desired outcome?Thank you in advance and best regardsTim

Whats the process to request a community license for Chronicle SOAR?

 I have some doubts about the parsing, I am new to the tool and I am wondering how to update the parsing and if there are conflicts when performing these updates, I currently have a parsing of a Trend Micro DDI product, which I need to activate beforehand. Make a personalized parsing, if you could help me with the steps to follow to make these updates and possible consequences that could arise from these updates

Hi everyone, I noticed the ReCaptcha test key seems to stop working this morning, is this a known issue or down time?   

https://downdetector.com/status/recaptcha/According to this, seems like there's a big ReCAPTCHA outage. My own site, which was working fine and untouched, broke today. I'm trying to figure out if this is a real outage, something google changed without telling anyone, or if it's actually a "me" issue. Any insight would be appreciated!Update: This issue fixed itself!

How can I retrieve the customer ID associated with a Chronicle SIEM using the Chronicle API?

Hi Security Community,I’m currently working on a custom detection rule in my security operations environment, specifically focusing on tracking user file sharing activities and permission changes. The goal is to automatically notify users if they share files more broadly within the organization, prompting them to review the action. In addition, I want to monitor if any changes are made to file permissions by users over time. This involves integrating with the Google Chronicle platform and using SOAR playbooks to automate the entire workflow.To build this, I’ve been trying to leverage the Google Chronicle UDM search functionality to identify and track these file permission changes by users. My workflow begins by detecting when a file is shared more widely than usual, which triggers an email notification to the user, alerting them about the action. The second phase of the workflow aims to verify whether any modifications are made to the file’s permissions after it’s shared. This informat

Hi everyone,We’ve noticed that for the past week, we haven’t seen any alerts or results related to Mandiant Threat Intelligence in Google Chronicle, particularly in terms of IOCs matches.Could anyone share how we can check if the Mandiant feed is working correctly or if it’s integrated properly? (We've checked and seen that the credentials we've provided are working, but we haven't been getting any successful results for the past week.) We’re specifically looking for any IOC matches that should be triggering alerts or logs.Is there a way for us to verify or troubleshoot this on our own within Chronicle, such as running specific queries or reviewing any logs to ensure the integration is active and functioning as expected?Appreciate any help or guidance on this!Thanks in advance!Thanks,Dnyaneshwar 

Hello,We have configured two separate export filters to send GCP Cloud Audit Logs from two different GCP organizations to a single Chronicle instance.Is there a way to add a field, label, or tag to these logs to identify the originating organization?Thank you in advance for your support!

Has anyone figured out how to use Chronicle SOAR free edition? I have an account and it shows my profile and then when I use my credentials to login to the SOAR site, it says "invalid email and password, Where is says "Don't haev a user yet? Get here", I've already done that as well"

I have a value which if 0 is unsigned and anything else would be adhoc signed. I'm trying to do a count of these values, but when I do something like: $flags = additional.fields["target.codesiging_flags"] match: $flags outcome: $type = array_distinct(if(additional.fields["target.codesiging_flags"] = "0", "unsigned", "adhoc")) $type_count = count(if(additional.fields["target.codesiging_flags"] = "0", "unsigned", "adhoc"))  I get something the following output:flagstypetype_count0unsigned30570556419adhoc10512adhoc23570425859adhoc500Is there some way that I can combine the adhoc values so instead I get flagstypetype_count0unsigned30570556419,512,570425859adhoc533This way I can build visualizations off type and type_count.

Hello Experts,Any one integrated or Enable Saltminer API integration through Google SecOps (SIEM)please help with steps and relevant document.Thanks,PG

Hey Security & Google Threat Intel enthusiast! We have a great webinar coming out next week on January 14th at 17:30CEST. It’s an exclusive live briefing on valuable insights into the threat landscape specific facing financial institutions, inferred from the curated real-time actionable threat intel from Google Threat Intelligence. Topics to be covered are… emerging threats and attack trends, and applying this intel to strengthen your orgs security posture. Check it out here to register. Enjoy!Matt

I have set a context value for a filed Threat_type = "URL" and used action get context value to verify if it was set.(Scope was alert level)i was able to see and it was set to URL.my question : Where Can see context value in case wall?

Hi, I attempted to use the Chronicle API (legacySearchAlerts ) to retrieve alert information, but I'm unsure how to apply pagination. I set the startTime, endTime, and pageSize query parameters, but I don't know how to set the pageToken for the first call. Additionally, the response body only contains alerts and user_alerts without a next_page_token, which is not match to the API document, so I can't retrieve the next page.

One of the common tasks we perform is troubleshooting integrations between MSV and various SIEM solutions. In this example, I'll provide a custom Splunk audit query used to troubleshoot legacy integrations. The same concept applies to other SIEM solutions. Beyond the initial configuration and connection phase, it's beneficial to track the queries executed by the MSV Director. This helps troubleshoot advanced issues or estimate the required query rate limit. For legacy Splunk integrations, providing the API username in this query displays MSV search activities with a human-readable time format. The query returns multiple "count" fields because it yields several events that Splunk's time filters later refine. The minimum count value is what MSV receives.   index=_audit user=<MSV API User> | eval search_et_ts=strftime(search_et ,"%m/%d/%y %H:%M:%S") | eval search_lt_ts=strftime(search_lt ,"%m/%d/%y %H:%M:%S") | eval indextime_ts=strftime(_indextime ,"%m/%d/%y %H:%M:%S") | eval

We are creating Widgets and the Tag Filter is taking forever to return results. Is this normal? We don't have that many tags (maybe 15-20).  

Hello,Is it possible to get mandiant, digital threat monitoring alerts into google secops? I have been trying to leverage the api with the following website: https://gtidocs.virustotal.com/reference/get-alertsI am trying to find a more streamlined way to get these alerts live in secops that does not involve a script.Thanks.

Hello , actually i'm searching for dropped logs on my forwarderIn gcp monitoring ( metric explorer ) i can see the value of total logs dropped which is 0.053/s ( mentionnedin the screenshot ) i can't understand the value , what does that mean 0.053/s can any one help ?