Security Forums

I would like to have a rule that tells me if a user has uploaded 100 or more documents to a storage space like dropbox, onedrive or Gdrive.It would also be good if I could the helpful to get the C classifications for the documents, i.e. C3 & C4.Can anybody point me in the right direction for how I may do this?

Hey All, I'm following this https://cloud.google.com/chronicle/docs/ingestion/default-parsers/collect-microsoft365.. to get Microsoft Teams logs > Chronicle.Don't see a pulldown under content type, for Teams.Has anyone got Teams Call Logs > Chronicle?Or Intune MDM?  On a microsoft "third party API" kick! 🙂  

Chronicle Detection Rule CI/CD Pipeline using Bitbucket Overview This project provides a Python script (deploy_chronicle_rules.py) and a Bitbucket Pipelines configuration file (bitbucket-pipelines.yml) to implement a "Detection-as-Code" workflow for managing Google Chronicle detection rules. The pipeline automatically synchronizes YARA-L rules (stored as .yaral files) within a specified directory in a Bitbucket repository with a Chronicle instance. It achieves this by: Fetching rules from the Bitbucket repository via API. Comparing them against existing rules in Chronicle (using the v2 API) based on ruleName. Verifying the syntax of new rules. Uploading the verified new rules to Chronicle.

Hello SOAR Community, I'm testing a scenario that involves simulating multiple events within an Alert in a case. However, the "Simulate Case" feature currently only allows me to create a single event.Can you please advise on how to create multiple events with specific fields in each event, so I can comprehensively test my scenario?

I am working on a Logstash parser for CEF-formatted syslogs, which includes both short and long formats. The long format contains a status field, whereas the short format does not.I extract CEF event attributes using the following Logstash filter:match => {"message" => ["%{abc} CEF: (xxxxxxxxxxx)\\\\|%{GREEDYDATA:cef_event_attributes}"]}overwrite => ["message"]}kv {source => "cef_event_attributes"field_split => "|"value_split => "="target => "cef_fields"}Issue: The cef_fields.status field exists only in the long log format. However, when applying conditional logic to process this field, Logstash throws the following error:"generic::invalid_argument: pipeline failed: filter conditional (13) failed: failed to evaluate expression: generic::invalid_argument: 'cef_fields.status' not found in state data"Current Conditional Logic:

I'm trying to write a nested if then else condition in the outcomes section and I am getting this error: At first I assumed I was missing but I even tested the statement that's been provided by @jstoner for another question see here: https://www.googlecloudcommunity.com/gc/SecOps-SIEM/Else-if-condition-SecOps/m-p/855792/highlight/true Even this one throws the same error in our instance. Is there any chance nesting needs to be enabled further on the backend or is there something I am missing? 

Our team is building a web application where our engineers can write and manage their YARA-L 2.0 detection rules.We want to provide instant syntax validation feedback directly within this web interface.Are there any known JavaScript libraries, public APIs, or recommended approaches specifically for validating YARA-L 2.0 syntax for web integration?

Amazing news with the detection as code!!! https://medium.com/google-cloud/detection-as-code-in-google-secops-with-terraform-646de8967278I have a question regarding this, when I'm deploying a rule, I'm getting the following error: Error: Error creating RuleDeployment: googleapi: Error 409: run frequency already set to RUN_FREQUENCY_REALTIME  The error is referring to these pieces of code:Main file:resource "google_chronicle_rule_deployment" "rule_deployment" { for_each = local.secops_rule_deployment provider = google-beta project = var.secops_config.project location = var.secops_con

Our team is planning to implement the OWASP Top 10 WAF rules using Google Cloud Armor to enhance our application security. What are the best practices?

Heads up, Security Foundation Community! If you're planning to attend Google Cloud Next, don't miss this important session: Want to solidify your Google Cloud security from the ground up? Join @anilnandigam at the Start secure, stay secure: Build a strong cloud security foundation session. Learn how Google Cloud's Security Foundation and shared fate model offer clear guidance for securing your entire cloud environment. Be sure to add this must-attend session to your Next '25 agenda and save your seat. Let us know in the comments if you'll be there. See you at Next!

Hi All,Looking at the following documentation:https://cloud.google.com/chronicle/docs/soar/investigate/working-with-cases/view-the-contents-of-closed-casesStatus is not an option has this been removed and if so how do I provide visibility to Closed Cases? Thanks, Daryll

Hi everyone, A big welcome to all new members joining the Google Cloud Security Foundation forum! This space is dedicated to discussing the core principles, best practices, and essential services for building a secure foundation on Google Cloud Platform. We focus specifically on understanding and utilizing the cloud-first security controls that are integral parts of the Google Cloud platform itself. Topics we often cover here include these core platform controls: Identity and Access Management (IAM) fundamentals Network security basics (VPCs, Firewall Rules, Cloud Armor basics) Data security concepts (Encryption at rest/in transit) Logging and Monitoring essentia

Are there dashboards/queries anyone has run to measure the average or median time between ingestion and normalization on a per log type basis?  

Hi,In a custom action i have the following code:siemplify.add_attachment(file_path=file_name,description=comment,is_favorite=True) The file is attached to the case wall, but the "description" is not visible and the attachment is not marked as a favourite? I've looked at the github for the sdk (url/screenshot below) and i'm confused as to why the attachment is not showing as a favorite.  https://github.com/chronicle/soar-sdk/blob/main/SiemplifyAction.py#L167  

Hi there, I am having trouble with the Crowdstrike action in Secops SOAR - specifically the execute command action. I am having the action remove a file from an endpoint, which the action successfully runs. However, the playbook appears to hang on the action and does not progress further into the playbook once the command has been executed. Anyone experienced this issue before? Thanks

Hi,Our customer has connected their Workspace to SecOps using the default connection method and currently only sees Workspace activity logs in Google SecOps. They would like to see the following additional log sources as well:Workspace AlertsWorkspace ChromeOS DevicesWorkspace GroupsWorkspace Mobile DevicesWorkspace PrivilegesWorkspace UsersIs the default connection method sufficient for all of these log sources, or does each log source need to be connected separately?

Hello Everyone,I have ingested several logs with different formats into Chronicle under the same log source type. I discovered that the actual logs are Syslog in CEF format rather than JSON. I have built a parser, and it is working fine. However, when validating the parsing, it fails because there are different log formats in Chronicle under the same log source type, causing the validation to fail.Is there a way to delete all logs—whether JSON, raw, or any other format—associated with the same log source type from SecOps Chronicle? Alternatively, is there another way to avoid this validation error?

Hi,I applied for access to the Chronicle SOAR Community Edition but haven't received any response yet. Could you please help us in getting access?Looking forward to your support.

Is GTI natively ingested into SecOps or do I need to configure that? How can I write rules using it (assume it's in entity graph)?

Hi everyone,I’m working on building native dashboards in Google SecOps and need to create a specific visualization. I have an SQL query that provides the required data, but I’m unsure how to achieve the same result using a YARA-L query in Google SecOps.Pseudo SQL Query:WITH user_table AS ( SELECT ARRAY_TO_STRING(ARRAY_AGG(DISTINCT user)) AS users FROM events GROUP BY id, destination_ip ) SELECT AVG(STRING_LENGTH(users)) FROM user_table;For example, my dataset looks like this:iddestination_ipuser1dest_ip_1user_12dest_ip_2user_21

Once a key is created, I'm not finding how to add a domain to an existing enterprise key.I tried asking Gemini and providing it screenshots and it is stuck too, so I'm thinking this feature doesn't exist yet. If it does, please let me know where that is administered.

Hello,With the new Recaptcha dashboard, I am unable to generate the SECRET KEY and WEBSITE KEY to be entered on the Wordpress CONTACT FORM 7 plugin.Can you please help me out?Thank you very much.

This is a question that has come up more than once, particularly when DTM Research Tools is being used. It can also occur when viewing Compromised Credential Monitor Alerts. tl;dr this is by design, to protect any entity whose compromised credentials appear in DTM. There are steps you can take to view your own compromised credentials in a safe, controlled way.   First, a word on Research Tools: Research Tools enables users to safely explore open-source, dark web, and raw data that Google Threat Intelligence has collected for Digital Threat Monitoring. Providing raw threat and related data in an easy interface, Research Tools helps you find what matters, see what is happening in the cyber realm, and thus better protect your business. We recommend you use Research Tools as a precursor to creating a Monitor. This will help you create

Hi All,I am using the "Create Siemplify Task" from the Tools Power Up which works really well however, when pausing the playbook for Manual Execution there are a number of items displayed:Message to AssigneeTarget EntitiesInstanceAction Parameters I was wondering if there is any way to hide:Target EntitiesInstanceAction Parameters Or if not configure them to be collapsed so the content is not displayed as it clutters the screen and pushes the Execute button down so you need to scroll.Also can you force this by removing the Skip Button?Thanks, Daryll

Hi there, how u doing!So, im with this block where im trying to find if a domain is suspicious or not. I receive an domain as input, create the entity, do a whois, and then is there any posibility with siemplify or google chronicle to check if the domain is suspicious or not?I mean, i dunno if im doing right or not, but i tried the enrich domain from chronicle and it doesnt work. Probably im doing it wrong.Any ideaas? Thanks!