Security Forums

Hi Everyone,I want to fetch user and user related alerts directly from chronicle siem using api. Needed in agent development work using google agent development kit. Does there is any api which can help me in first checking whether user exist or not and 2nd, getting user related alerts.Thanks & RegardsShruti  

Hi,We have granted our users access to Google SecOps via giving the role "Chronicle service admin", however they get 401 and if we look at any errors in the developer tools, we can see the following:POST https://siemplify-soar.com/api/external/v1/auth/siem?format=camel  400 (Bad Request)Can anyone please advise on what the issue could be and why that role is not working as expected? Also, we have tried to add roles/chronicle.editor as provided in the documentation but it returns 400 as if the role is not correct.Thanks,

 Hi folks,I have a question about the behavior of entity enrichment when an entity is enriched using an action in a particular case.When I view the entity in the Entity Highlight section of the x case, I see the enrichment fields.But, when the same entity is associated with y case, I don't see the enrichment fields.Does entity enrichment only apply to the particular case where it was enriched?However, when I refer the entity in the entity explorer I see those enrichment fields.I want to handle a scenario if an entity is already enriched in x case then it shouldn't get enriched again(if it is enriched with in 24 hrs then we should skip the enrichment using the last_enrichment field).Currently, it will enrich the entity again on the y case as the entity of y case does not contains the enrichment fields.Entity in X Case

Hi,I have installed and configured GitSync in my dev instance and ran the "Test" from the configuration page. The test was successful.I have then followed the steps from the documentation and tried to run the "Push Playbooks" job for several folders / playbooks.I had to set the repo URL and all the other values that I have already configured in the integration, within the job Testing tab otherwise it would say that they are not defined. After defining them all, I still get the following error:Reading configuration from Server General error performing Job Push Playbook 400 Client Error: Bad Request for url: http://server:80/v1alpha/projects/project/locations/location/instances/instance/legacySdk:legacyIntegrationConfiguration?identifier=GitSync&format=snake: b'{"errorCode":2000,"errorMessage":"Integration settings for [Identifier: G

I'm experiencing an issue with my Google SecOps (Chronicle) Forwarder where logs are not appearing in the Chronicle UI, even though the forwarder's Docker logs indicate successful uploads.Here's a summary of my setup and the problem:Problem Description: I'm trying to forward SSH logs from /var/log/secure on an Amazon Linux 2023 host using a Dockerized Google SecOps Forwarder.The forwarder's Docker logs show Batch (...) successfully uploaded. messages.When I manually echo data into /var/log/secure, those specific entries do appear in the Chronicle UI.However, SSH login logs generated by rsyslog and written to /var/log/secure are not appearing in the Chronicle UI, despite the forwarder indicating successful uploads.Troubleshooting Steps Taken So Far:Forwarder Configuration:Confirmed the forwarder configuration file (config.conf) for t

Hi everyone,I’m exploring the capabilities of Google SecOps SIEM and its YARA-L language. My question is:Is it possible to use YARA-L to detect spikes or deviations in event counts across an entire log source?For instance, can I create a detection rule that triggers when there’s a sudden increase in the number of events from a particular log source, indicating an anomaly or unusual activity?If so, could you share an example or documentation that explains how to set up such a rule?Thanks in advance!

How does it work? Hash Generation: The system generates hashes for process binary data. VirusTotal (VT) Query: Hashes are used to construct VT links and query the VT database. Link Retrieval: VT link is retrieved and displayed alongside corresponding findings. Risk Assessment: Quickly assess risk based on VT reputation data (e.g., benign, suspicious, malicious). Does customers need a VirusTotal License?VirusTotal License are not required to leve

This feature is subject to the "Pre-GA Offerings Terms" in the General Service Terms section of the Service Specific Terms. Pre-GA features are available "as is" and might have limited support. For more information, see the launch stage descriptions.What it does? Create and scan short-lived snapshots of Linux-and Windows-based Virtual Machines for malware without disrupting the workloads.  Analyzes executables on the VM for known malware signatures. Detected findings are reported to Google SCC. Enabling VM

I am trying to create a job that helps me get all alerts from a specific product (Cortex XDR, for example) that were closed recently. This is what I have for the moment:from SiemplifyJob import SiemplifyJob from SiemplifyUtils import convert_datetime_to_unix_time from datetime import datetime, timedelta def main(): siemplify = SiemplifyJob() # Get alerts closed modified in the last X hours hours = 1 threshold_time = datetime.utcnow() - timedelta(hours=hours) threshold_timestamp = convert_datetime_to_unix_time(threshold_time) recent_alerts = [] case_ids = siemplify.get_cases_ids_by_filter( status="CLOSE", update_time_from_unix_time_in_ms=threshold_timestamp, sort_by="UPDATE_TIME", sort_order="DESC", max_results=1000 ) for case_id in case_ids: case = siemplify._get_case_by_id(case_id) for alert in case.get("cyber_alerts", []): product = alert.get("additional_prop

What is the functionality of "Requests" which is under Homepage while adding a permission in the permission group?Navigation: Settings-> Organization-> Permissions-> Add Permission Group-> Homepage 

Hi, When attempting to download content from any of our blogs/resources (e.g., <URL Removed by Staff> in the Middle East, a 404 error appears. Or website support team suggests Google reCAPTCHA sometimes blocks access for users in certain regions, including parts of the Middle East, if it suspects the traffic may be suspicious. This can sometimes be triggered by factors such as device settings, browser extensions, or the use of a VPN, or the region in general. Is there any solution to resolving this? As we're worried that users in Middle Eastern locations might be affected. If that's the case, we could be missing out on important contacts for our teams, so resolving this is a priority. Regards, NES

We have setup Data RBAC and provided "Chronicle API Restricted Data Access Viewer" and "Chronicle API Restricted Data Access" with required IAM conditions.The expected controls are working as expected but the "Data Access Viewer" role has permissions which provides users to download collection agent config files and  see org details (which contains customer ID and project names) under Profile Section is SIEM Settings.Removing instances.generateCollectionAgentAuth can limit access to Collection agents. What permissions should I remove to limit the user from not seeing org details (which contains customer ID and project names) under Profile Section is SIEM Settings.We're planning to create a custom ro

Is there a way to update the contents of a data table to match against from the actual source, for example, list of users access to particular resource, which is continuously updated with latest data set at the backend?

Hello,I wanted to check how we can update the change url provided for SecOps, the "https://xxx.xxx.chronicle.security/"  one.As SecOps backend IP is not provided for our instance, do we need to have some sort of CNAME flattening setup in our public DNS or is there any other option available in SecOps?Thanks

Hello, Google support team.I'm trying to crate a or download a json file for firebase push notifications. while creating the json file i'm facing an issue "The organization policy constraint 'iam.disableServiceAccountKeyCreation' is enforced on your organization." which is mentioned in the screenshot.Can you please help or provide us any way of doing things right.Thanks.

We are experiencing a significant delay between alert ingestion into Google SecOps (Chronicle SOAR) and the subsequent creation of a case. Our goal is to have a case created almost immediately when the first alert for a potential incident is ingested, provided a relevant case doesn't already exist. Additionally, we are facing an issue with our playbook automation. Our current setup executes a playbook after a case is created in Google SecOps. This playbook is designed to create a ticket in our external SOC ticketing system. However, when subsequent related alerts are ingested into the same Google SecOps case, the playbook seems to re-trigger (or a similar process does), resulting in multiple tickets being created in our SOC ticketing system for what is essentially the same underlying incident. This creates unnecessary noise and administrative overhead for our SOC team.We have attempted to use ale

 Hello,I currently have several alarms in the SOAR that are based on the same KQL rule in Sentinel. Sometimes, as described in the connector, the KQL is executed and the event data is taken over. In other cases, the SecurityAlert table is read.Connector Description: "Both scheduled and NRT alerts are by default ingested using the log analytics KQL queries to get alert and event data"We're using the Microsoft Azure Sentinel Incident Connector v2 in Version 52, today I've updated to 53As an example, I have two screenshots: both SOAR incidents were generated on different days using the same connector in the same SOAR environment. Both are originating from the same Sentinel Scheduled Alert. 

Hello, I am an Organization Administrator (`roles/resourcemanager.organizationAdmin`) for my Google Cloud Organization, but I'm encountering a persistent "permission denied" error when trying to disable the `constraints/iam.allowedPolicyMemberDomains` organization policy. This issue occurs even when running the command from Cloud Shell. **My Goal:** I need to make a Cloud Run service (`sharky-chat-service` in project `chat-bot-social`) publicly accessible by granting `allUsers` the `roles/run.invoker` role. To do this, I first need to modify or disable the `constraints/iam.allowedPolicyMemberDomains` organization policy, which is currently restricting IAM members to my organization's customer ID. **Details:** * **Organization ID:** `275283949867` * **User Account:** `Admin@sharkteam.[domain-redacted-due-to-filter]` * **Project ID (for context):** `chat-bot-social` * **Cloud Run Service (for context):** `sharky-chat-service` * **Region (

Not sure if this is a permissions issue. I'm logged in with a user that has Chronicle API Admin and Chronicle SOAR Admin roles. The error occurs every time I check an Event from a Case Alert. Do you have any idea what's causing this? 

Is there any way to get the result of the approval link , i mean when the user decide to approve or decline the request where can i get this value?

Hi everyone,I recently contributed a set of GitHub Actions-based ingestion scripts to the open-source Chronicle ingestion-scripts GitHub repo via this pull request. These scripts are designed to provide a lightweight and infrastructure-free way to forward third-party security logs into Google Chronicle using the Unstructured Ingestion API.🛠️️ What’s IncludedThe ingestors are built entirely around GitHub Actions, and support:1Password audit logsGitHub audit logsMicrosoft Entra non-interactive sign-insSnowflake logsThinkst Canary Audit LogsEach connector includes:A standalone main.py for log collection

On June 4, we posted a blog highlighting new features in Security Command Center (SCC) and Security Command Center Enterprise (SCCE). One of the cool new features available to customers is an integration with the Artifact Analysis component of Artifact Registry.  To learn more about this new integration as well as other new developments like agentless scanning for Google Cloud Compute and Google Kubernetes Engine (GKE), check out the below link to the full blog! https://cloud.google.com/blog/products/identity-security/enhancing-protection-4-new-security-command-center-capabilities

JIRA Sync Comment is not working from JIRA to SOAR, any comment updated on the JIRA end by the client is not visible at the case wall. Also, as per the integration a Jira tag is supposed to get added automatically post the incident creation, this is not working as well.Could anyone guide on the troubleshooting approach to be taken to fix this.

In SecOps, I want to use file utilities, where my use case is to create file, add custom data to file and add file to case wall. Need to automate all this process using playbook.

I'm getting the following message.Finish setting up your key: Request tokens To protect your site or app, finish setting up your key. Start by requesting tokens (executes).My website is a Wordpress Site and I'm using the plugin WP Forms.  I have others I setup the same way and they say protected and I didn't have to request tokens.  what am I missing?