Security Forums

Hi Team,Can anyone suggest what is the least version of xcode can be compactable for reCAPTCHA SDK 18.6.0?                                              Thank You.

HiI need clarification on how the metadata.event_type (Enum Value) is mapped to product_event_type. I have observed some data sources (e.g., Windows) where the EventID is mapped under event_type. Under what circumstances do we consider product_event_type to be equivalent to metadata.event_type?Thanks,Sumith

Hi Can someone tell me difference between logs received from Azure AD and office 365 azure AD logs , So if there is a login failure to an outlook or any other o365 app, will that event be seen in both Azure AD and office 365 azure AD logs? 

Hello Everyone,I have implemented Data RBAC feature on my id, but im not able to use the IOC Matches tab. In the official document they have mentioned that Data RBAC doesn't restrict access to IOC Matches tab. Can anyone help me to find out what is the issue if you have implemented the Data RBAC in Google SecOps SIEM.Thanks

Hi I am trying to build the below yara rule and it throws the following error message .Not sure where i am going wrong . As a work around i do know i can remove the user field and keep it in outcome section but i would like to know if this is feasible rule Login_from_BAD_ASN { meta: author = "rahul" description = "Triggers an alert when a user login is observed from a BAD ASN(Autonomous System Number ) " severity = "Medium" priority = "Medium" ruleset = "Adversary Behavior: Credential Access" usecase = "Credential Access: Brute Force" mitre_tactic = "TA0006" mitre_technique = " T1110.001" events: $e.metadata.event_type = "USER_LOGIN" $e.principal.ip = $src_ip $e.principal.ip_geo_artifact.network.asn = $asn ($e.metadata.product_name = "Fortigate" and $e.principal.user.userid = $user) or ($e.metadata.product_name = "Azure AD" and $e.target.user.userid =$user) or ($e.metadata.product_name = "Fireware" and $e.principal.user.user_

Hello,Is there a way to delete unused tags within Google Security Operations?A little explanation: I created a test playbook that would tag new cases depending on different criteria within the alert. These tags were messy and didn't follow a good naming pattern. After fixing the playbook tagging within the action, the previous testing tags now won't go away in the SOAR Search tab, even after removing them all from cases. This is causing a lot of confusion on my team when we go to search for specific case tags. Any help would be appreciated. 

 Hi Everyone,I am just starting with Google SecOps/Chronicle and find creating custom/new parsers interesting. I was wondering if there is a course or clear documentation on how to get started with writing parsers and how to create an efficient one.

Hi everyone,I’m currently setting up a Google Chronicle SIEM system and would like advice on the following:1. Best practices for ingesting data from multiple sources.2. Optimizing alert configurations to reduce false positives.Any insights, documentation, or shared experiences would be greatly appreciated!Thank you,[ Cyberashvin ]

I created a reCAPTCHA site in February 2024 but I am unable to view the site when I log in to the admin console. The site was definitely created as I was able to apply the site and secret keys when deploying captcha to the webpageI created separate reCAPTCHA in Aug 2024 which I am able to see.

Hi team,I'm implementing GSuite integration.During the test, I found out that the "Update User" action allows me to block normal user, but not admin users as screenshots below. Blocking a normal user (Success):Test blocking an admin user (Error): I've added all of the permissions following the document: https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/google-workspaceJust want to check if is it possible to block an admin user using this integration? Do I miss something? 

Cases in Chronicle SOAR were created one hour after the alert was triggered in Sentinel, despite the connector's cron job being set to 10 seconds. What could be the possible reasons for the delayed case creation in Chronicle SOAR? Also, it was observed that under the event tab there were no record present. Attaching a snip 

Hi Guys,I have encountered an issue:A Sentinel Incident was triggered without any associated event. Consequently, a SOAR case was created for this incident, but with 1 hour delay without any alert event.Does anyone knows case of this issue? 

Hi Can reference list have multiple columns ? Lets say i am trying to create a reference list that has 2 columns one is IOC ip and other is its confidence score ? Has anyone used it , if yes please share a use case where this is used ?

Hi AllWe have done creating alerts using GCP with email notification .But still can some one tell me the reasons why i cannot create an Yara L rule for host (asset.namespace) not reporting alert ? I have been asked this question many time and i have been just telling google suggests to use GCP monitoring based alerts for this. @jstoner / @David-French 

rule critical_ioc_detected_ip {  meta:    author = "Anurag Singh"    description = "Rule to check for any traffic coming from suspicious IPs related to known IOCs."   events:    $e.metadata.vendor_name = "Check Point" or $e.metadata.vendor_name = "Fortinet"    $e.metadata.product_name = "VPN-1 & FireWall-1" or $e.metadata.product_name = "Fortigate"    $e.metadata.event_type = "NETWORK_CONNECTION" or ($e.metadata.event_type = "NETWORK_HTTP")    $e.principal.ip = $sourceip and $e.target.ip = $destinationip    $kasperskyti.principal.ip[0] = $sourceip or $kasperskyti.principal.ip[0] = $destinationip    $kasperskyti.metadata.vendor_name = "IOC" and $kasperskyti.metadata.product_name = "IP"    $ioc = $kasperskyti.metadata.product_event_type  match:    $sourceip over 10m  condition:    $e and $kasperskyti}So I have written this rule to check if there is co

Team,I need to receive an email notification if any action in a playbook fails more than 3 times within a 3-hour window. However, since my instance is multitenant, I am receiving notifications for other environments as well. How can I configure it to send email notifications only for playbook failures in a specific environment?

As part of the routine management of your SecOps platform, you should ensure that any configured integrations that are running an outdated version of Python get updated.  In this post, I'll show you how to identify whether these integrations are present in your SecOps platform, and how to go about upgrading them. First, navigate to the Marketplace.  The first clue that you are running an integration with an outdated version of Python is that you'll see a banner similar to the one below showing up toward the top of the Marketplace. From this banner, we can see that there are some affected integrations, and that there is an associated documentation link which I've included here for completeness.  Our goal is to identify which of our integrations are affected by this issue, so let's now navigate to Integrations from within the Marketplace and use the Status: Installed filter to only show installed integrations. For each installed in

Hi all,New to SecOps, so forgive me if this is already a known issue.I was fixing up a rule that was bugged, and tested it by running a YARA-L retrohunt using my new rule. It worked - it found something like 9000 cases over a month, but since then, I have been getting spammed by 'Overflow Cases', with empty events that are named after my rule. There are no timestamps on these or any event or log info. I do know that for the first 2-3 mins after I finished the retrohunt one of my playbooks went crazy and started spamming too, but that stopped quickly and now I only get these 'ghost' cases that are generated from empty alerts. I was wondering if there is a way to reset the queue of alerts that are waiting to be pooled into cases.From what I've seen, retrohunts should not generate alerts, so I'm not even sure if the retrohunt is the cause, but it was fine before I ran it. I know that the rule itself is not the problem, because it still finds (correct) matches as shown in the Alerts and IO

I'm adding new properties to entities via playbooks or manual actions and I am looking for a way to have those changes propegated to the SIEM side for the same entity. Is there a way to do this? This way, when a new connector alert is created with that entity, the new property is included and can be used for filtering, etc.

Hello Guys, Is there any integration solution available to integrate BMC Helix Business Workflows with SOAR?. There is BMC Helix Remedyforce integration available in marketplace, but its a different tool. Can we use webhook for this? Thanks,

The Alerts Grouping Settings page lets you create grouping rules controlling the exact type of alerts which are grouped together into cases, Alert Type: For example, a phishing alert.However, when reviewing the provided dropdown list, it only shows unique alert names, not types.Is it possible to configure a type for each alert?We handle multiple clients across different SIEMs, each with its own alert naming conventions. If the dropdown is based on alert names, why is it labeled "alert type"? Is there a way to configure a type for each rule generator?QRadar SIEM ExampleIn QRadar, each alert or rule generates a unique offense ID along with the alert name. This makes it impractical to configure grouping based on types, as the current mechanism is driven by specific identifiers.Feature Request: Tag-based GroupingWould it be possible to introduce a new criteria option in the mechanism settings based on tags? This enhancement could improve flexibility and allow better alignmen

Hi,A couple of days ago, the theme of our SIEM/SOAR became light and in some screens (like Rules & Detections), it's masking the text. I want to make it dark blue again, but unlike the independent Chronicle SOAR, where it's configurable when clicking on the user icon, I can't find the option to switch themes.Does anyone know where that option is hidden?Thanks

Hello, when searching for an event, how can I join the value of the key and its value? For example, I have the next two events, but I'd like to search only those that are res_kind = Deployment Event 1:...about[0].labels[1].key: "res_kind"about[0].labels[1].value: "Deployment"about[0].labels[2].key: "operation_first"about[0].labels[2].value: "true"... Event2:...about[0].labels[1].key: "res_kind"about[0].labels[1].value: "Service"about[0].labels[2].key: "operation_first"about[0].labels[2].value: "true"... When running with the same value, it does not work: It should be generic, so it would be something like:about.labels.key = "res_kind" and about.labels.value = "Deployment" but then any of the about.labels.value would have "Deployment" and not the one with the res_kind in the key  Thank you! 

Hi Can i have a asset namespace value like this "cisco-meraki-sd-wan-logs-italy" or it will not accept it , is there any naming restriction for it ?

Hi I am trying to build the below rule , where in i am trying to compare the different target SHA 256hash value appearing in any product (Crowdstrike, windows,meraki ,defender etc)  with Google Safe browsing . If i have to do this individually for each product then i would need to build multiple alerts as the event type is different for different products Crowdstrike - metadata.event_type = "PROCESS_UNCATEGORIZED"Meraki - metadata.event_type = "SCAN_FILE"Defender - "USER_UNCATEGORIZED" rule_google_safebrowsing_file_process_creation { meta: description = "Detection of process/file events that match Safe Browsing hashes , which are files deemed to be malicious" severity = "Critical" priority = "High" events: ($execution.target.process.parent_process.file.sha256 = $sha256 or $execution.target.process.file.sha256 = $sha256 or $execution.target.file.sha256 = $sha256 ) and // join execution eve