Skip to main content

Security Forums

Welcome to the Google Cloud Security Forums! Your ultimate security conversation spot. Collaborate with peers and experts to solve challenges, together.

2530 Topics
A
anurag.q.singhBronze 2
asked in Google Security Operations
Issue with regex pattern

<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4624</EventID><Version>2</Version><Level>0</Level><Task>12544</Task>This is a text. I want to write a regex that checks if the text contains Windows and EventID 4624 or 4625.How am I supposed to do that?regexp : .*Windows.*<EventID>\\b(4624|4625)\\b</EventID>.*my expression is not working. Can anyone help? 

13
AymanC
ORBR
ORBRBronze 5
posted in Google Security Operations
Is it possible to get a notification based on my Role?

Hi everyone,I’ve enabled user notifications in the notification settings (both for notifications and email alerts on case assignments).However, I only receive notifications when a case is specifically assigned to me, but not when a case is assigned to my role.Is there a way to configure it so that everyone assigned to a specific role receives a notification?

23
messier63
dnyaneshwar
dnyaneshwarBronze 5
asked in Google Security Operations
Automating EDR Alerts with a Custom List in SOAR

Hello Security Community Members,I hope you’re all doing well!We are currently working on improving our Endpoint Detection and Response process. We want to use manual analysis for some events or alerts and add summaries of false positive hash values to a custom list for future reference.The idea is that if we encounter the same event with the same hash value in the future, we’d like to pull that analysis from our custom list instead of doing the manual work all over again.I’m looking for some guidance on how to set this up in our SOAR playbook. Specifically:How can we configure the playbook to first check the custom list when an alert is triggered?What’s the best way to implement the logic that allows us to either reference the analysis from the custom list or continue with our normal incident response process? (but first look into custom list)Are there specific conditions we should use to make this work smoothly?I’d appreciate any tips or examples from anyone who has done something si

14
dnyaneshwar
R
Robert_CezarBronze 1
posted in reCAPTCHA
reCaptcha key creation is not working

recaptcha key creation is not working, tried mobile, desktop and 2 browser chrome/mozilla, when i hit "Submit" nothing happens. can someone confirm is not working also for them?

03
R
T
TakaminaNew Member
asked in reCAPTCHA
How to select or check a reCAPTCHA pricing plan

Hello, I would like to know how to select a reCAPTCHA pricing plan.The official website introduces three pricing plans: reCAPTCHA Essentials, reCAPTCHA Standard, and reCAPTCHA Enterprise. Additionally, it mentions that you can start using reCAPTCHA by navigating to the console from "Get started" or "Manage reCAPTCHA." However, I am unsure how to select a pricing plan within the console. I also don't know how to check which pricing plan I am currently using.The following points might be relevant, so I am providing them for reference:I am using a free trial account.The key setup has not been completed yet.The pricing structure may have changed recently, and the documentation or GUI may not be fully updated.Here’s what I’ve tried so far:I created a project with a free trial account and enabled the reCAPTCHA API.I issued a regular key (not for demo or testing purposes), but I haven't implemented it on the website yet.

42
T
rahul7514
rahul7514Bronze 2
asked in Google Security Operations
Increase priority of an alert

There are 20 Critical assets, if there are any alerts for these hosts, it has to been responded with priority compared to others. How can we implement this? In  simple terms how can i have dynamic priority for chronicle alerts based on criticality of the host , can some one help me with a simple example @jstoner  @cmmartin_google :Any suggestions or guidance

63
rahul7514
K
krunalmNew Member
posted in Google Security Operations
How can we grab a specific field and its value from an unparsed JSON ingested from source tools?

How can we grab a specific field and its value from an unparsed JSON ingested from source tools? I'm attaching an example unparsed JSON here and I need to grab the value of the field "LastMessageRcptCount" (which is 117). Thank you! {"f3u":"DLITTLE@Null.COM","ev":"DLITTLE@Null.COM","rs":"EmailSendingLimitExceeded;InternalRecipientCountToday=3;ExternalRecipientCountToday=1;ExceedingLimitType=External;Last MessagetraceId=Null;LastMessageRcptCount=117;CIP=Null;AS:45002","adt":"Generated by OBP2SenderRepService - Object Store: 1535;SpamRule=45002;","evnt":"Listed","ts":"2023-06-05T15:36:00.0000000Z","te":"2023-06-05T15:37:00.0000000Z","op":"EmailSendingLimitExceeded","wl":"SecurityComplianceCenter","tid":"Null","tdc":"1","reid":"Null","rid":"Null","cid&

310
F
Staff
L
leodasBronze 1
posted in Google Security Operations
Bangalore: Chronicle SIEM + SOAR Partner Technical Training

Hello,I recently came across past events that are conducted by google cloud security,Title : Bangalore: Chronicle SIEM + SOAR Partner Technical Training is there any recordings available for these sessions ? or when will it happen again in India ? or any virtual trainings available ?can someone suggest me some good learning resources for Secops other than cloudboost and the official documentation ?thanks for your help.

87
L
T
thomasloveNew Member
posted in reCAPTCHA
Key Not Requesting Assessments - Assistance Needed with reCAPTCHA Configuration

Hi there!I hope this message finds you well.I am currently experiencing issues with my reCAPTCHA integration. I have set up a reCAPTCHA key, but I am encountering several specific problems:Backend Verification Incomplete: I received a message stating, "Your key isn't requesting assessments," indicating that the backend verification for reCAPTCHA isn’t fully configured.Key Setup Completion: I also received a notification to "Finish setting up your key: Request scores." This suggests that while my key is requesting tokens (executes), it isn’t requesting scores (assessments), which is essential for fully protecting my site.Authentication Required: Additionally, there’s an error saying, "Before proceeding, you must authenticate with reCAPTCHA. API requests to reCAPTCHA will fail until authentication steps are complete."I have reviewed the instructions for verifying reCAPTCHA tokens but am unsure how they relate to my Salesforce backend, as the reCAPTCHA API Key Pair is also generated there

140
T
D
dfreemanujmNew Member
posted in reCAPTCHA
Can't Create Keys in Recaptcha

Clicking Submit on the Recaptcha key generator is doing nothing; no error, nothing.  Anyone else seeing this? I have tried with 3 machines and on each tried several browses/incognito. https://www.loom.com/share/64320b7f364c416594a86ec10cfe1ea3?sid=8ac9ac2d-f643-452b-8eeb-7d6050fb86f2

02
D
S
Staff
ShashankSecStaff
posted in Security Command Center
Sensitive Data Protection through SCC (Virtual Red Teaming)

Now customers that use Sensitive Data Protection discovery and publish the data profiles to Security Command Center, can configure Security Command Center to automatically set the priority value of certain high-value resources by the sensitivity of the data that the resources contain. To enable data-sensitivity prioritization, customers will need to specify the resources in a resource value configuration. Once enabled, if Sensitive Data Protection discovery classifies the data within a resource as either MEDIUM or HIGH sensitivity, the attack path simulations will, by default, assign a corresponding priority value (MEDIUM or HIGH) to that resource. What that means for our customer is that SCC’s Virtual Red Teaming will now take the type of data stored by the resource into consideration while running simulations for external attack possibilities resulting in higher Attack Exposure Scores for resources containing high sensitivity data . This saves customers the toil involved in classify

140
S
Staff
vanitharaj1208
vanitharaj1208Silver 2
asked in Google Security Operations
what is the Max number or limit of number overflow cases that can be created once rule is triggered?

what is the Max number or limit of number overflow cases with 100 alerts per case .. and rule triggered 10,000 alerts within 24 hours .so 30 alerts in normal cases and will it created 100 overflow cases? just want to know what is the limit ..

23
D
Staff
J
jscNew Member
asked in Google Security Operations
Filter incoming logs

Hi, we want to filter out some fields in the incoming raw logs from AWS cloudtrail. Is there an option that we can configure somewhere like this ?

02
J
paolocarrara
paolocarraraBronze 4
posted in Security Validation
Operationalize MSV Library with MITRE ATT&CK Navigator

Hello everyone,I'd like to share with the community a thing we did internally to use the MSV Library with the MITRE ATT&CK Navigator (https://mitre-attack.github.io/attack-navigator/).This job was made in collaboration with my colleagues from the CSIRT team.We had two objectives:"plot" the MSV Library on the MITRE ATT&CK matrix using layers (https://github.com/mitre-attack/attack-navigator/tree/master/layers).overlaying the MSV library with custom layers or layers from MITRE to extract the list of actions corresponding to the techniques that are common to the two layers.The approach we developed is very simple and it's the following:analyse MSV Library and collect a list of VIDs for every technique.create a MITRE ATT&CK navigator layer where for each technique the metadata field contains the list of VIDs.import the MSV layer in the Navigator.import in the Navigator the other layer (e.g. mapping of an incident, TTPs from APT41, ...).combine the two layers to see where they o

182
N
N
NEIOBronze 3
asked in Google Security Operations
Optimizing the rule Recon activity

Hi Team,I require assistance with fine-tuning the rule: ["recon activity detected from internal host"] to minimize false positives and optimize its performance. Your support in this matter would be greatly appreciated.PFA. rule recon_activity_detected_from_internal_host{  meta:     subject = "recon activity detected from internal host"     description = "This rule is to identify instances where a local host initiates port scan against single internal IP over at least 50 different port or port sweep against more than 99 internal IP address over same port. Port scanning activities within the internal network may indicates that adversary attempting to identify vulnerable services on target systems after gaining an initial foothold on the network."     tactic = "Discovery"     technique = "Network Service Scanning"     subtechnique = ""     tool = ""     datasource = "Network

58
N
M
Mufa_shahBronze 2
posted in Google Security Operations
Splunk function equivalent Yara L

Hi All,Good morning ,I am trying to convert Splunk rules which uses complex functions and thier equivalent YARA L or other way for approach.Splunk Syntax | rex max_match=0 "(\\s+)foreach\\s*\\((?<foreach_clause>.*?)\\)\\s*\\{(?<foreach_loop>.*?\\\\\\r\\\\\\n\\1)\\}"| rex field=foreach_loop max_match=0 "(\\s+)foreach\\s*\\((?<foreach_clause>.*?)\\)\\s*\\{(?<foreach_loop>.*?)\\\\\\r\\\\\\n\\1\\}"| search foreach_loop=""*Add-content*""I think max_match cannot be achieved in Chronicle as of now.  How to approach this?  

102
M
A
Aravind3Bronze 2
asked in Google Security Operations
Info Needed: Playbook Environment

Hello Team,Could anyone please let me know if its possible to import a playbook to anyother environment other than default?And, Is it possible to change the environment of a deployed playbook?Thank you in advance,Aravind Sreekumar

33
A
pontorieroa
pontorieroaNew Member
asked in Google Security Operations
SecOps - Incident Manager Deprecated

Hi, I am looking into the SecOps platform and seen that the incident manager will be deprecated in 2025. is there a replacing tool introduced instead?Thanks,

111
D
Staff
vanitharaj1208
vanitharaj1208Silver 2
posted in Google Security Operations
Alert Grouping -Overflow case

if alert grouping criteria is set toGrouping Condition: XYZ Rule Name and UserOverflow Condition: Max 100 AlertsGrouping Duration: 24 hoursEvent Breakdown:9:30 AM - 50 Alerts for User ABC30 Alerts moved to Case XYZ20 Alerts moved to Overflow CaseBalance for Overflow: 809:45 AM - 50 Alerts for User ABCAll 50 Alerts moved to Overflow CaseBalance for Overflow: 3010:00 AM - 10 Alerts for User ABCAll 10 Alerts moved to Overflow CaseBalance for Overflow: 2010:15 AM - 500 Alerts for User ABC20 Alerts moved to Overflow CaseOverflow threshold exceededBalance for Overflow: 0Remaining Alerts: 480Question:What happens to the remaining 480 alerts when the overflow threshold is exceeded? How does the system handle these alerts, and what are the possible actions taken?

210
vanitharaj1208
vanitharaj1208
vanitharaj1208Silver 2
posted in Google Security Operations
How to set a padding period for the connector?

 A delay can occur between the time that Google SecOps SIEM indexes an alert and when indexing completes. To mitigate the risk of missing alerts, set a padding period for the connector. Additionally, increase the connector timeout. A significant padding period can negatively impact connector performance.https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/google-chronicle#overview 

04
vanitharaj1208
rahul7514
rahul7514Bronze 2
posted in Google Security Operations
VT feeds not working

Hi With regards to Google Chronicle, I do have a doubt and would like to know if anyone can assist or guide me .Is Virus total available with Google Secops by default or is there a separate cost involved ?Based on the below diag I was able to use the GCTI TOR Feeds and wish to use the VT if its availableI can see entity summary . I wish to use this information in my alerts . However when i am running the query it showing 0 results       

01
mikewilusz
Staff
ORBR
ORBRBronze 5
posted in Google Security Operations
Similar cases Predefined widget does not work

The predefined widget for Siemplify_Get Similar Cases doesn`t seem to work at all.I mean I do see the table headlines, And I do see that there are actual similar cases in the action results. But the table is empty.Does anyone else face this issue? 

34
ORBR
T
Staff
TonyHStaff
asked in Google Security Operations
Changes to Exchange Online from Microsoft

Hello Everyone, Quick note if you are currently using the Exchange Integration for SOAR. Per Microsoft "Today we are announcing that we will begin blocking the assignment of the ApplicationImpersonation role in Exchange Online to accounts starting in May 2024, and that in February 2025, we will completely remove this role and its feature set from Exchange Online." So starting in May of 2024, you will be unable to assign the ApplicationImpersonation role in Microsoft Exchange Online. For details of the changes that Microsoft is making to the ApplicationImpersonation role, see Retirement of RBAC Application Impersonation in Exchange Online. We recommend that you use Microsoft Graph Mail to work with Exchange Online. Documentation has been updated to warn of this change here

15
C
kaushalpatel
kaushalpatelNew Member
posted in Google Security Operations
Cloud SQL - Unusual Data Activity

what are the main events that can be used to detect following kind of unusual activity ?Unusual Data Transfer like copying large data outside the instanceAny sql queries that export or copy the data from unauthorized users or ips 

26
AbdElHafez
Staff
donkos
donkosNew Member
posted in Google Security Operations
Convert from UDM Search JSON Result to CSV

I'd like to convert the JSON result from a UDM Search into a csv string. The current issue I'm having is that if I just specify JsonResult|"udm.events", then the csv sheet seems to merge all the sections into one big single row blob - would be curious to see some suggestions without using some custom action code.

43
AbdElHafez
Staff

Badge winners

  • Comments Posted 1
    etherweavehas earned the badge Comments Posted 1
  • Authored Posts 1
    jadavpur08has earned the badge Authored Posts 1
  • Comments Posted 1
    Rosiehas earned the badge Comments Posted 1
  • Authored Posts 1
    ericv-avahas earned the badge Authored Posts 1
  • Comments Posted 1
    EJJessehas earned the badge Comments Posted 1
Show all badges
Terms & ConditionsCookie settings
Privacy Policy Terms of Service Gen AI Policy Community Guidelines Cookie Settings

© 2025 Google. All rights reserved.