Skip to main content

Security Forums

Welcome to the Google Cloud Security Forums! Your ultimate security conversation spot. Collaborate with peers and experts to solve challenges, together.

2528 Topics
A
anurag.q.singhBronze 2
posted in Google Security Operations
Issue with yara L rule

So I have written this rule : rule linux_user_account_created_and_deleted_in_short_time_interval {  meta:    author = "ABC"    description = "New user created and deleted in short time interval"  events:    $e1.metadata.vendor_name = "Linux"    $e1.metadata.product_name = "AuditD"    $e1.metadata.product_event_type = "useradd" nocase    $e1.metadata.description != /failed/ nocase    $user1 = re.capture($e1.metadata.description, "new\\\\suser:\\\\sname=([^,]+),\\\\sUID=")    $e1.principal.hostname = $srcHost    $ts = $e1.metadata.event_timestamp.seconds    $user1 != ""    $e2.metadata.event_timestamp.seconds > $e1.metadata.event_timestamp.seconds    $e2.metadata.vendor_name = "Linux"    $e2.metadata.product_name = "AuditD"    $e2.metadata.description = /delete user/ nocase    $user2 = re.capture($e2.metadata.description,

13
AymanC
messier63
messier63Bronze 1
asked in Google Security Operations
How to know which type belong to what in wase wall data

hi teamI have extracted case wall data and there I see  that each comment has a type for ex- 'actionTriggerType': 0, 'integration': 'Flow', 'executingUser': None, 'playbookName': 'IMPORT 1 - DB13-PlaybookAssignment By TP01-MasterTriggering', 'playbookIsInDebugMode': False, 'status': 2, 'actionProvider': 'Flow', 'actionIdentifier': 'Output_3', 'actionResult': 'NestedWorkflowOutput: \\n', 'alertIdentifiers': [], 'creatorUserId': None, 'id': 5752376, 'type': 3, here what type 3 mean , is there any way I can get the list of  the type and its corresponding values ?thanks Messier63

01
F
Staff
messier63
messier63Bronze 1
posted in Google Security Operations
Not able to find time zone in advanced reporting

hi teami want to change the time zone in the advanced reporting but I'm unable to find itas per doc, it should be left of Run button but here I don't see itis there any way I can change the Time zone? 

01
F
Staff
vanitharaj1208
vanitharaj1208Silver 2
asked in Google Security Operations
overflow cases

Overflow Cases and Alert Grouping Questions :1. Can you link an overflow case back to the original case? How do you identify what the original case is when dealing with an overflow case?2. When you have an overflow case, the ontology mapping and entity mapping are both skipped. How can you recover this data? 3. Can you break out an alert from an overflow case, and bring it to a different case? Can you recover the alert data 4. When a playbook is attached to an overflow case alert, can this playbook refer back to the original overflowed case?5. How do playbook runs change with overflow cases? What will break?

62
vanitharaj1208
D
danish_abuNew Member
asked in Google Security Operations
Data Export to GCP Bucket

Hi All,We are getting below error when we are trying to export Chronicle data to GCP bucket as per the documentation .{'dataExportId': '6xxxxffb-xxxx-xxxx-xxxx-82xxxx11f758', 'startTime': '2024-06-04T00:00:00Z', 'endTime': '2024-10-02T00:00:00Z', 'logType': 'XXXX', 'gcsBucket': 'projects/proj-XXXXX/buckets/xxx-chronicle-xxx', 'dataExportStatus': {'stage': 'FINISHED_FAILURE', 'error': 'An internal error has occurred for data export ID 6xxxxffb-xxxx-xxxx-xxxx-82xxxx11f758, please contact your Chronicle representative.'}}Any resolution for this issue ?

03
D
messier63
messier63Bronze 1
posted in Google Security Operations
How to rerun any Action if it got failed due to some reason via job

Hi team,I want to know if there is any possibility that I can rerun any failed action via the jobAlso, can I check if any action failed and rerun via script? Thanks 

14
messier63
rahul7514
rahul7514Bronze 2
posted in Google Security Operations
Is data lost of connectivity lost in Ingestion APi

HiI have couple of questions relating to ingestion API1) if logs are send via Ingestion API if connection breaks does data get lost during that time period or is it saved anywhere2) assuming i am planning to send Meraki logs (unstructured) to chronicle via Ingestion APi, what are the steps that i should follow  (if there is any article or blog would help a lot). 3) Which mechanism is better using forwarder or ingestion API, how do we determine ? 

01
D
Staff
I
IAMstuckNew Member
posted in reCAPTCHA
reCAPTCHA admin console shows different content than cloud console

Has anyone else ran into a problem where the reCAPTCHA admin console shows different things than the enterprise cloud console? One of my reCAPTCHA sites appears to be orphaned into a different project that doesn't show in my enterprise cloud account. So now I'm having licensing issues with the site saying its over the agreement amount. If I attempt to use CLI  gcloud config set project abcdefg - I'm told my owner account doesn't have access to the projects instance. I'm simply trying to move it somehow so I don't have to reconfigure another one. Any tips tricks or help would be greatly appreciated!

82
I
Omskirt
OmskirtBronze 2
posted in Google Security Operations
Formatted Count in metadata.id

Hello, I am currently struggling with the native dashboard. I want to know if there’s a way to format the metrics with commas for easier reading, such as 12,000,000 instead of 12000000. This would make it easier to read the counts.

15
Omskirt
N
NEIOBronze 3
asked in Google Security Operations
Request for Assistance with O365 Rule Enhancement

Dear Team,I am seeking assistance in adding a parameter to one of my Office 365 rules to identify the specific user to whom the rule applies.For example, we received an alert stating that "User Permission has changed." However, the raw logs for this alert do not contain information on which user's permission was changed or which account had administrative access altered. The only available parameter is "Object ID," which helps us locate Office 365 logs but does not provide definitive results.I would like to enhance my rule to include the necessary details to identify the impacted user. Could someone please assist me with this?For reference, I have included the relevant rule below:rule O365_USER_CHANGE_PERMISSIONS {meta:author = "Google Cloud Security"description = "This rule tracks and monitors USER_CHANGE_PERMISSIONS for email identities or mailboxes within an Office 365 environment. The event is triggered when a mailbox, email alias, or user account associated with an email address i

23
jstoner
Staff
A
anurag.q.singhBronze 2
posted in Google Security Operations
Extract a substring from a string | Yara L

So I am facing a situation which is as follows : I have this field, metadata.description"new user: name=swiagent, UID=995, GID=749, home=/opt/SolarWinds/Agent, shell=/sbin/nologin"I want to extract this name swiagent and strore it in a variable say $user. Can I do something to store the part after "=" and before ","How am I supposed to do that in yara L ?I need this to make a usecase user account created and deleted in a short interval. Similarly, I want to extract the 2 strings after the usermod -aG command i.e. testgroup and testuser_hehe1 in 2 different varaibles. metadata.description"root : TTY=pts/0 ; PWD=/home ; USER=root ; COMMAND=/usr/sbin/usermod -aG testgroup testuser_hehe1"Can someone tell me how to code for the same?

213
jstoner
Staff
B
BorisHNew Member
posted in reCAPTCHA
ReCaptcha / Billing

Hello,I am a webdesigner. For many of the websites I build for my clients, I set up a ReCaptcha for the website forms. In 2019, this turned into a "paid" service, for which I get an invoice for €0,00 every month, as the number of clicks stays well below the number from which actual payments are incurred. In most cases, I set this up with a gmail account of my client, and added my own Google account so I could manage the ReCaptcha for them if necessary. Bottom line: about 30 different recaptchas in my account. To my dismay, this month I received an invoice for an actual payment. I checked on the site, but the setup is so unbelievable unclear for these Google tools, I cannot make out which sites incurred this traffic, and why it would be billed to me, instead of the the client's Google account.Can someone explain to me please which account(s) is/are billed on incurring costs with a recaptcha? I hope I selected the proper Cloud Form, but it was unclear to me which one I should use.Thank y

20
B
vanitharaj1208
vanitharaj1208Silver 2
posted in Google Security Operations
SecOps - Alert Throttling

Q 1:  limitations around the alerts ingested into SecOpsQ 2: Different options to perform grouping by different conditions

32
ankitsynx
A
anurag.q.singhBronze 2
asked in Google Security Operations
Convert a time to IST in YARA L

rule linux_user_account_created {  meta:    author = "ABC"    description = "User created"    severity = "Low"    priority = "Low"  events:    $e.metadata.vendor_name = "Linux"    $e.metadata.product_name = "AuditD"    $e.metadata.description = /new user/ nocase    $e.principal.user.userid = $user    $e.principal.hostname = $srcHost  match:    $user over 1m  outcome:    $risk_score = max(20)    $alertDescription = array_distinct(strings.concat("'A new user '", $user , "' was created on the linux server with the hostname'", $srcHost))  condition:    $e}So I have this field called, metadata.event_timestamp"2024-10-05T10:15:18Z"I want to convert this timestamp into IST (preferably in DD/MM/YYYY h:m:s format) and use it in the alertDescription variable. How am I supposed to do it? 

101
AymanC
H
HuangWeigangNew Member
posted in Google Security Operations
About Alert Data Source and Research Usage

Hi, I’d like to ask where the alert data on SecOps is sourced from. Additionally, is this data available for further research and use in developing tools related to alert analysis?These data are from this page, which is the demo website of SecOps:https://demo.backstory.chronicle.security/alerts?filtersOperator=AND&filters=%5B%7B%22type%22:%22feedback_summary.status%22,%22operator%22:%22!%3D%22,%22values%22:%5B%22CLOSED%22%5D%7D%5D&timeRange=%7B%22start%22:%222024-09-25T05:25:48.090Z%22,%22end%22:%222024-09-28T05:25:48.090Z%22%7D

02
H
A
anurag.q.singhBronze 2
posted in Google Security Operations
yara L rule

So I am writing few rules for detcting windows events.The first one is : rule A_security_enabled_local_group_was_deleted {    meta:    author = "ABC"    description = "This event generates every time a new security-enabled local group was deleted."    severity = "Low"  events:    $e.metadata.vendor_name = "Microsoft"    $e.metadata.product_event_type = "4734"  outcome:    $risk_score = max(20)  condition:    $e}Any suggestions? so as how to do this. Like what details can I include and how to proceed. @AymanC  @jstoner 

03
malvarez12
rahul7514
rahul7514Bronze 2
posted in Google Security Operations
Sending Syslog data via Google Chronicle forwarder

Hi If i am onboarding a log source via syslog using Chronicle forwarder , is it encrypted when in transit towards the Secops . Also if i want to onboard a log source which does not have internet connection ,how is this achievable ? 

163
cmorris
Staff
A
Staff
andras11Staff
posted in Security Command Center
Dynamic mute rules are now generally available

Security Command Center now supports dynamic mute rules, which allow you to mute future and existing findings temporarily until a specified date or indefinitely until a finding no longer matches the configuration. We are adding these rules as an alternative to the original static mute rules that only mute future findings indefinitely. We recommend using dynamic mute rules exclusively in your mute rule configurations because they are more flexible than static mute rules. Compared to static mute rules, dynamic mute rules have three key benefits: Dynamic mute rules apply to existing and new findings. Dynamic mute rules automatically mute both existing and new or updated findings that match your filter criteria. Dynamic mute rules offer an expiration option. Dynamic mute rules also allow you to set a custom expiration period to temporarily match specific findings. If no expiration period is set, dynamic mute rules mute findings indefinitely until they no longer match the rule. Dynamic mut

20
A
Staff
TomAtGoogle
Staff
TomAtGoogleStaff
posted in Security Validation
Helping SecOps with monitoring Actors

One common use case that I have seen at several customers is that they want their SecOps or Operations folks have the ability to monitor that MSV Actors are up and available. To prevent false alarms, a script was created to "ping" the actors.  The script can be put on a scheduled CRON or be ran manually as a part of the playbook.  Feel free to take a look at the Python below and use as needed. For simplicity, I did not include the code to create the HTTPs session to the Director. # Get the list of non-protected actors def setup_data_fields():     global nodeData, evalData     response = session.get(f'https://{director_ip}/topology/nodes.json')     if response.status_code != 200:          print('Unable to get node information from director.')          sys.exit(-1)     nodeData = json.loads(response.text) # get the list of protected actors def setup_data_fields2():&nbsp

04
paolocarrara
A
anurag.q.singhBronze 2
asked in Google Security Operations
YaraL to detect Landspeed Anomaly

So I have this code written to detect a landspeed anomalyrule  impossible_travel_activity{  meta:    author = "Anurag Singh"    description = "Detects potential account compromise by identifying logon attempts from two different geo locations within a short span of time, indicating impossible travel between the locations."    severity = "High"  events:    $e1.metadata.event_type = "USER_LOGIN"    $e1.metadata.product_event_type = "UserLoggedIn"    $user = $e1.target.user.userid     $e1_lat = $e1.principal.location.region_coordinates.latitude    $e1_long = $e1.principal.location.region_coordinates.longitude    $location1 = $e1.principal.ip_geo_artifact.location.country_or_region    $e2.metadata.event_type = "USER_LOGIN"        $e2.metadata.product_event_type = "UserLoggedIn"    // match variables    $user = $e2.target.user.userid &nbs

115
AymanC
rahul7514
rahul7514Bronze 2
posted in Google Security Operations
Filter logs in forwarder and ingestion api

Hey TeamHow can i filter logs before sending it via chronicle forwarder and Chronicle ingestion API, is it possible? For example i want to discard some maintenance specific logs  from Palo alto .if i am doing it via Forwarder how can i achieve this and if i am doing via ingestion APi how can i achieve this. 

41
mikewilusz
Staff
vanitharaj1208
vanitharaj1208Silver 2
posted in Google Security Operations
Alert Grouping

1) Grouping can be done for how long (Duration)2) Can it support the grouping rule by rule basis (Every rule has its own criteria)3) On every frequency does it create a new case? or the alerts will be throttled for amount of time specified.. 

15
vanitharaj1208
N
NEIOBronze 3
asked in Google Security Operations
How to add x axis and y axis while creating SOAR Dashboard in Chronicle SOAR

Hi Team,I want to create a replica of Executive summary report to Dashboard and it requires the x axis and y axis fields to create a dashboard, can someone assist me whether we have any option to do so.Thanks,Neha.H

16
N
K
Krishna-YangaleBronze 1
posted in Security Command Center
How to Enable SCC Premium Programmatically?

Hi @All,I’m trying to enable Security Command Center (SCC) Premium programmatically for my Google Cloud project. However, I couldn’t find a clear way to do this in the documentation. If it’s possible to enable SCC Premium programmatically, could someone guide me on how to do it?Any code snippets, API references, or step-by-step instructions would be greatly appreciated.Thanks in advance for your help!

26
K
A
anurag.q.singhBronze 2
asked in Google Security Operations
how to use Or Condition

So I have a code for Lateral Movementrule Lateral_Mov {  meta:    author = "Anurag Singh"    description = "Vertical Lateral Movement"    severity = "Medium"events:    $e1.metadata.vendor_name = "Microsoft"    $e1.metadata.product_event_type = "4625" // Failed Logon    $e1.principal.hostname = $hostname    $e1.target.user.userid = $user        $e2.metadata.event_timestamp.seconds > $e1.metadata.event_timestamp.seconds    $e2.metadata.vendor_name = "Microsoft"    $e2.metadata.product_event_type = "4624" // Successful Logon    $e2.principal.hostname = $hostname    $e2.target.user.userid = $user    $e3.metadata.event_timestamp.seconds > $e2.metadata.event_timestamp.seconds    $e3.metadata.vendor_name = "Microsoft"    $e3.metadata.product_event_type = "4720" // New Account Creation    $e3.principal.hostname = $h

03
jstoner
Staff

Badge winners

  • Authored Posts 1
    ericv-avahas earned the badge Authored Posts 1
  • Comments Posted 1
    EJJessehas earned the badge Comments Posted 1
  • Comments Posted 1
    kin.chanhas earned the badge Comments Posted 1
  • Authored Posts 5
    Jez_Khas earned the badge Authored Posts 5
  • Comments Posted 1
    reubanisaachas earned the badge Comments Posted 1
Show all badges
Terms & ConditionsCookie settings
Privacy Policy Terms of Service Gen AI Policy Community Guidelines Cookie Settings

© 2025 Google. All rights reserved.