Security Forums

Hello,I'm looking for best practices/tips on crafting SentinelOne EDR Cloud Funnel queries / field selection for exporting to SecOps.We're perhaps not surprisingly running into issues due to the huge amounts of data being generated by SentinelOne and are looking for ways to slash the data without losing detection capability.Thus far we've reduced the number of fields to only include those mapped by the SecOps UDM parser and we're investigating if we can make do with only the "Behavioral Indicator" type of events.I would greatly appreciate if anyone here with hands-on experience of using SentinelOne CloudFunnel could share some of their experiences and advice!

Hi Experts,I understand that Bindplane can be used as a Manager to manage the rest of the collectors via an agent, and at the same time, the Bindplane manager can also be a forwarder itself. Is it possible to incorporate both forwarder and collector into a single application? What are the steps to achieve that?

Hi all,I find BindPlane Agent and BindPlane OP a great solution to manage log collection process.I have an issue with the auditd log: the agent sent the data without any information about the host that generated the log. So, inside the Google SecOps SIEM, I cannot understand which server sent that log.I use the file receiver to read the /var/log/audit/audit.log file and the chronicle exporter to send it to the SIEM.Had anyone the same issue?Thank you all.Best, Matteo

Hi Everyone,We are trying to deploy a BindPlane collector and we want to know if we could build a centralized management console for all our BindPlane forwarders which are sending logs to Google SecOps SIEM. Could anyone please help us with documentation for building same? Thank You in advance!Shruti Kumari

I want to use BindPlane agent to send Windows Event logs to Chronicle as in here: https://cloud.google.com/chronicle/docs/ingestion/use-bindplane-agentAfter following the instructions, I get "Invalid Argument" error in the Open Telemetry collector log.I am struggling to make this work. Can someone point me in the right direction?Some of the things I see in the error log are the following:"level":"error","caller":"internal/queue_sender.go:92","msg":"Exporting failed. Dropping data.","kind":"exporter,"data_type":"logs","name":"chronicle","error":"not retryable error: upload to chronicle: Permanent error: upload logs to chronicle: rpc error:code = InvalidArgument desc = Request contains an invalid argument."According to my research, the problem may be related to invalid log type but I don't think this

What is the difference between an agent and a configuration?

Dear All,Could anyone please give a documentation for how to use "BindPlane OpenTelemetry collector" for syslog collection and how to collect metric logs with the collector?Thanks,

Hello community , I'm facing a issue that my zscaler logs are ingested with a latency around 60 miutes and more.The difference between ingested timestamp and event timestamp is around 560 minutes.Who can tel this can be due to what exactly ? Thanks for help

Prerequisites:Admin access to SOAROpen Content Hub Repository and find required TIPCommon version  Install prerequisites (dependencies) listed in GitHub repository pyproject.toml with exact versions one by one prior installing TIPCommon: Example: dependencies = [ "google-api-python-client==2.188.0", "google-auth==2.47.0", "google-auth-httplib2==0.3.0", "httpx==0.28.1", "pycryptodome==3.23.0", "pyopenssl==25.3.0", "requests==2

Hello Community , How i can identify parsing and normalization errors in Chronicle SIEM please ? Thanks

Hello,I am working on SecOps (Chronicle), tool in GCP, in SecOps I want to integrate AWS S3 logs bucket (AWS CloudTrail configuration). To configure feed I have provided following details : 1. Feed Name, 2. Access Key, 3. Access Key ID, 4 CIEM : True (lable). 5. S3 Bucket URL, 6. S3 bucket regionIn AWS I have created user for the same who has access to read all the bucket data as well as kms: decrypt permissions.But still I am getting the error of "INTERNAL_ERROR: Unable to process the feed due to an internal error., Click on View feed to know more."Please reply.Thank you

In this guide, I am going to showcase, how to use the HTTPV2 integration to execute API requests to Azure products like Microsoft Graph. Main emphasis will be on the authentication, as everything else is covered by this guide. Azure Authentication In Azure, authentication is done via an App that you need to create inside "App Registration" section of Azure portal. Depending on the specific API within products, you will need to either define delegated or application permissions to the App, to be able to execute necessary API requests. How to create an Azure App 1. Press on "New registration" under "App Registration Section"

Hi everyone,I am working on SecOps Native Dashboards and encountered an issue while using the avg function in YARA-L.Below is my query:metadata.vendor_name="ABC" $uid=about.labels["uid"] match: $uid outcome: $duration=avg(duration.seconds)The result values are automatically rounded down to the floor value, but I want the values to retain floating-point precision.I tried using the window.avg function and also applied the round function, as shown below:metadata.vendor_name="ABC" $uid=about.labels["uid"] match: $uid outcome: $duration=math.round(avg(duration.seconds), 3)However, the results still return the floor value.Why is this happening? Is there any alternative or solution to achieve the desired results?Thanks,Prashant Nakum

We're setting up the SecOps Chronicle and want to monitor our SQL db for security events.What logs should we send? 

Does anyone know the pull rate for Event Hub feeds? For bucket feeds, I know it is 15 minutes. 

Hello,Could someone provide an example of the table HTML for the predefined views?I would like to use this template to display JSON results from a QRadar AQL query.The current template uses static results. What modifications are needed to configure it to use dynamic JSON results and include fields such as Source IP, User-Agent, and Location?Thank you! 

Hi guysI have myproject v3 keys(pub and priv) and have myproject2 v3 keys(pub and priv)The problem is that when the "grecaptcha.executed();" instruction is executed, in the case when myproject v3 keys are used, a check for a fire hydrant(etc) appears on page if reCAPTCHA has the slightest doubt, but in same case with using myproject2 v3 keys - the check does not appear when working from the same browser and from the same tabDid according to docs# head<script src="https://www.google.com/recaptcha/api.js" async defer></script># body<div class="g-recaptcha"id="g-recaptcha"data-sitekey="{myproject v3 pub key}"data-size="invisible"># jsfunction execCaptcha(){try {    grecaptcha.execute();

Hello to I want to build a Parser extension for Semperis logs,This is the log:<110>Mar 20 15:21:46 sem-adsm.mac.org.il Semperis.DSP [AdChanges@51802] [ForestId] 2235788be69a48a2b189a544112eebab [ChangeId] 349228170 [PartitionNamingContext] DC=mac,DC=org,DC=il [DistinguishedName] CN=IDMTest,OU=Left2024,OU=LeftUsers,DC=mac,DC=org,DC=il [ClassName] user [AttributeName] userAccountControl [ObjectModificationType] ModifyObject [AttributeModificationType] Modify [LinkedValueDN] [ValidUntil] 2100-01-01T00:00:00.000Z [OriginatingServer] MACDCPRD01.mac.org.il [OriginatingTime] 2025-03-20T12:21:59.000Z [OriginatingUsers] MAC-AD\\sandach_r; [OriginatingUserWorkstations] [StringValueFrom] AccountDisabled, PasswordNotRequired, NormalAccount, PasswordDoesNotExpire [StringValueTo] PasswordNotRequired, NormalAccount I want to add the values:StringValueFromStringValueTocan you help me with that

Ever wondered who the friendly Googlers are behind the helpful answers and insightful comments in the Google Cloud Security Community? We're excited to continue our series that pulls back the curtain and introduces you to the dedicated Google team members who make this community so valuable. Welcome to the April edition of our Spotlight Series! Each month, we highlight a Googler who actively engages with our community. Come and discover their role at Google, their key areas of expertise within cloud security, and a fun personal tidbit. It's your chance to get to know the people who are passionate about supporting your success with Google Cloud Security. Head over to News & Announcements to read the latest Spotlight Series interview!

Hi All,I am looking for a way to manage attachments other than on the Case Wall if such a thing exists? If not is there an elegant way to read a case for all attachments and then display them in an HTML Table with the ability to download? Having them on the case wall means they are missed once there are numerous Actions, Status Changes etc... A simple solution would be an Attachments option to pin them as with other items such as "Status Changes"Thanks, Daryll

Hi,im currently in the process of building parser extension to pull an ip address from a palo alto fw logi have in the raw log "From: x.x.x.x" that specifies the source ip - but it doesnt get parsed to Principal.ip UDM field.when i change the field to "principal.artifact.ip" it does work.is there a way to pull a value to "principal.ip"? or is it somehow blocked for parser extensions?

Hi everyone,I am working on SecOps Native Dashboards and encountered an issue while using the sum function in YARA-L while creating visualizations.Below is my query:metadata.vendor_name="ABC" principal.ip!="" target.ip!="" $query=query match: $query outcome: $total_bytes=sum(bytes)The result values are 4 times the expected values. For example, if the required result is 30, the query returns 120 (4 × 30).I also observed that, When I remove the principal.ip and target.ip filters from the query, I get the correct result.metadata.vendor_name="ABC" $query=query match: $query outcome: $total_bytes=sum(bytes)Why is this happening? Is there any alternative or solution to fix this?Thanks,Prashant Nakum

Hi everyone, I'm currently working on a detection which has "additional_fields" for permissions that were added to a user, e.g.:$udm.additional.fields["permissions_added_permissionA"]$udm.additional.fields["permissions_added_permissionB"]$udm.additional.fields["permissions_added_permissionC"]Each permission will then contain a specific permission type, e.g. Read, Write, Admin, etc. as shown below:I can create a detection by explicitly extracting each and every field and creating a regex to look for the permission types individually, but that can lead to missed fields either now or in the future if a

Hello! When a deployment is created in Kubernetes, it is possible to add a field as part of the securityContext named runAsUser. If the value in this field is 0, that means the deployment is run as root, which is not good at all from a security perspective. So, we would like to detect when this happens using Chronicle.In the documentation (https://cloud.google.com/chronicle/docs/ingestion/default-parsers/collect-audit-logs), it is possible to see an entry that ends with runAsUser, so that means the parser is able to do so. Also in the code it is shown:But when I create the deployment and SecOps process it, the field

Hi,As you can see in the first image chronicle has considered the following IP was from brazil location but when i checked with the user he denined the travel and when i cross checked the ip location with VT,IP void and abuse ipdb they were showing the ip belongs to USA. can you tell me how to overcome these issues