Skip to main content

Security Forums

Welcome to the Google Cloud Security Forums! Your ultimate security conversation spot. Collaborate with peers and experts to solve challenges, together.

2503 Topics
TheChris
TheChrisNew Member
asked in Google Security Operations
re.capture and timestamp.get_timestamp to match business hours?

Hello,I have the risk_score outcome below that is WORKING as expected, but I had to split the logic into two regex capture. I'm trying to have this in a single line, but due to the single group capture limit, I'm not able to have the intended regex (Mon|Tue|Wed|Thu|Fri) ([8-9]|1[0-8]) that would match both the day of week and hour. I want to match if it's "business hours" in London, between 8:00 and 18:59 Mon to Fri.   outcome: $risk_score = max( 100 - if( re.capture(timestamp.get_timestamp($e.metadata.event_timestamp.seconds, "%a", "Europe/London"), "Mon|Tue|Wed|Thu|Fri") != "" and re.capture(timestamp.get_timestamp($e.metadata.event_timestamp.seconds, "%k", "Europe/London"), "[8-9]|1[0-8]") != "" , 50, 0) )   I tried this, but the single group capture limitation blocks me:   outcome: $risk_score = max( 100 - if( re.capture(timestamp.get_timestamp($e.metadata.event_timestamp.s

02
TheChris
S
sguhaNew Member
posted in reCAPTCHA
reCaptcha enterprise error: Your default credentials were not found.

I have a project developed in .Net MVC, I am trying to implement reCaptcha enterprise. It works fine on my local development environment using Google Cloud SDK Shell. But I am getting the following error when code is deployed on the dedicated windows server on GoDaddy? what am I missing? Code: RecaptchaEnterpriseServiceClient client = RecaptchaEnterpriseServiceClient.Create(); Error message: Your default credentials were not found. To set up Application Default Credentials, see https://cloud.google.com/docs/authentication/external/set-up-adc.

10
S
J
jonathanYaoNew Member
posted in Google Security Operations
For Method: legacy.legacyUpdateAlert, where can I get {instance}

Hi, when I try to use POST https://chronicle.googleapis.com/v1alpha/{instance}/legacy:legacyUpdateAlert to update an alert, I need to specify {instance} in path parameter. For projects/{project}/locations/{location}/instances/{instance}, may I know where I can get location? Besides, I can use either project_name or project_id, is it correct?When I use project ID and customer ID I obtained from Google SecOps - Settings -Profile, the API returns 404 Not Found. Appreciate your kindly comments. 

31
David-French
Staff
J
jjimenezNew Member
posted in Google Threat Intelligence
User management question

Hello, I am a the administrator of a new Google Threat Intelligence group, my question is how many users can we have in a group? and how can I add them?

01
fperdomo
Staff
A
Anonymous
asked in Google Security Operations
Clarification Required Regarding Timestamp in Dashboard

Hi Team,We would like to know if we have an option to delete the timestamp filter field from individual dashboard panels just like any other filters.Additionally, I would like to know if all panels of the same dashboard are updated for the same global time range if a global timestamp filter is being used in the dashboard.Please provide a reference to the relevant documentation for the same.Thank you 

02
A
chicoqueiroga
chicoqueirogaBronze 2
asked in Google Security Operations
Error when trying to create a parser extension

Hello everyone,I'm trying to parse a json object that has several json-like attributes. Also, I'm trying to parse a json array, and after I renamed and merged the fields to UDM, I'm facing this error:generic::unknown: pipeline.ParseLogEntry failed: LOG_PARSING_CBN_ERROR: "generic::invalid_argument: failed to convert raw output to events: failed to convert raw message 0: field \\"idm\\": index 0: recursive rawDataToProto failed: field \\"read_only_udm\\": index 0: recursive rawDataToProto failed: field \\"about\\": failed to make strategy: received non-slice or non-array raw output for repeated field""This is my parser extension:filter {mutate {replace => {"Entities" => """Country" => """City" => """SourceAddressResolution" => """Asn" => """Carrier" => ""}}json {source => "message"array_function => "split_columns"on_error => "not_json_message"}if [Entities] != "" {mutate {replace => {"Entities" => "{\\"js_array\\":%{Entities}}"}}json {source => "En

62
chicoqueiroga
T
tony_shekNew Member
posted in Google Security Operations
Successful login alert without MFA

I wonder if there is any way Google SEIM generates an alert for the users who successfully login bypassing or without MFA?

03
AymanC
Omskirt
OmskirtBronze 2
asked in Google Security Operations
Preview Dashboard/Native Dashboard

I’ve working in Yara-l. Is there any way to get more resources about native dashboard coz I’m confused on other features on doing that because they are different in looker dashboard this was a new to me. Please elaborate this.

25
Omskirt
C
ChicaBronze 3
posted in Google Security Operations
Email preview

In SOAR playbooks, is there a way to validate the (email content, recipient) details before sending it out directly as part of an automated action? Steps:The action should pull the recipient details automatically from the alertPopulate the email template and present that to AnalystAnalyst validates the content and makes correctionsHits the execute to send an email 

46
vanitharaj1208
matthewnichols
Community Manager
matthewnicholsCommunity Manager
posted in Google Security Operations
Two Part Series Blog: Detecting Impossible Travel

Hey SecOps SIEM enthusiasts. We just published a part 1 of two part series blog about detecting impossible travel using SecOps SIEM. It dives into implementing detection methods using custom YARA-L Detection rule, leveraging GeoSpatial and GeoIP enrichment. Check it out here. Part 2 SecOps SOAR coming next week.

51
matthewnichols
Community Manager
S
skadavBronze 5
asked in Google Security Operations
Issue with "Set Case SLA Action" - Timer Not Reflecting Placeholder Time

I'm encountering an issue with the "Set Case SLA Action" in our system. The time captured by the Placeholder isn't being reflected correctly in the Case SLA Timer. However, when I check the View Result, the timing appears to be correct.Has anyone else experienced this problem? If so, could you please share any solutions or workarounds that might help?Thanks in advance!

05
S
P
paczzNew Member
posted in Google Security Operations
How to set up a mail alert when a SOAR collector stops generating cases within a certain time?

Hello everyone, my question is the one mentioned in the title.I know that it is possible to create Jobs that can monitor if any of the connectors present errors when ingesting alerts.But I can't find a way (if there is one) to send these alerts by email so that action can be taken in the case of data loss as soon as possible.

53
S
Staff
AfvanJaffer
AfvanJafferBronze 5
asked in Google Security Operations
Chronicle Playbook Queued for long...

Hello everyone,I have a script that attaches a playbook to an alert, but once the playbook is attached, playbook moves to a queued state and doesn't recover.I checked other alerts to see if any playbooks are running or have failed, but that doesn’t seem to be the issue.

42
S
Staff
TheChris
TheChrisNew Member
posted in Google Security Operations
How to build a YARA-L metrics for average daily outbound bytes vs actual?

I'm trying to build a rule that will check our VPN logs which contains the username and bytes out of all the users connections. I want to know the average of bytes out / day / username to be able to compare it against "$yesterday". The idea is that I will detect if johndoe had a "bytes out" of 50GB in a day while his average is only 20GB.I understand that I need to use metrics.network_bytes_outbound, but I always get an error. Suggestions?Run frequency: 24 hours $avg_bytes_out = max(metrics.network_bytes_outbound(period:1d, window:30d, metric:value_sum, agg:avg, principal.user.userid:$e.principal.user.userid)) {"code":400,"statusText":"Bad Request","message":"cannot identify time window in the rule","details":[],...

12
jstoner
Staff
vanitharaj1208
vanitharaj1208Silver 2
asked in Google Security Operations
How to send log from Kinesis Stream to Google chronicle via Lambda Function with log segregation

Hi All,we are trying to send logs from AWS Kinesis Stream to Google chronicle via Lambda Function.that Kinesis stream(5 streams) contains logs from multiple sources (Guard duty, winevt etc)we are trying to segregate the logs based on log types and send it to chronicle SIEM via webhookcan any one help us in this ????????(with supporting documents and links)

35
A
C
citrenoBronze 1
asked in Google Security Operations
Error in YARA-L Metrics function for resource_read_success

Hi Team,I'm trying to build some example YARA-L Metrics functions and one of the ones is resource_read_success/resource_read_fail. There's something strange about this one because in the documented supported filters it says principal.user (which is a proto not a string) and not the usual principal.user.userid which is a string. When I try to use principal.user in various flavors it starts giving random errors. Using principal.user.userid doesn't work because it says it excepts message not string, using principal.user doesn't complain but says that message can't be compared to string. If i try to capture the principal.user as $user then it says i can't use message as a match variable. I can't win!In general using principal.user seems like a bug but maybe there's a way of using it that we are just not aware of. Here is a sample rule below:rule aws101_increase_in_api_usage {meta:author = "Citreno"description = "UEBA - monitors a large increase in API calls from a specific u

24
jstoner
Staff
D
dooyoungNew Member
posted in Google Security Operations
what the Last modified time in the Detection Alerts menu in Google SecOps means?

Hi AllCan someone tell me what the Last modified time in the Detection > Alerts menu in Google SecOps means?What changes from the first detected Detection Time of a detected event cause the Last modified value to be displayed?Can someone explain what each field means?

72
D
M
Mufa_shahBronze 2
posted in Google Security Operations
VT and Mandiant TI threat feeds list

Hi All,Struggling to find "graph.metadata.threat.threat_feed_name"  for info stealers. Also , how to get those list of threat feeds , we can leverage. for both VT and Mandiant.Thanks in advance  

64
hzmndt
Staff
V
vishnu_manuBronze 2
asked in Google Security Operations
Error in Parsing Arrays in JSON Logs for UDM Mapping

Hello , I have been trying to parse an array from JSON log, where the size of the array is varies in different logs. I have attached the sample of the log below.I’ve run into an issue that I haven’t been able to resolve when trying to parse "name" from the log and  merge it to the UDM "security_result.threat_feed_name", which accepts string (repeated) values.Here's the screenshot of the code and error:  At a high level, the code uses a "for loop" to fetch all JSON elements from the array as "elem." The "elem.name" is used to parse only the name and then merge it into the UDM. Similarly I'm facing the same error when trying to parse the "confidenceLevel" as "security_result.confidence_score" in the UDM, which accepts float (repeated) values.I’ve tried various possibilities to solve the error to the best of my knowledge, but I haven’t found a solution yet. If anyone has a solution or suggestion that I can use to resolve this, please share it in a r

45
C
JensW
JensWBronze 2
asked in Google Security Operations
Enrichment with delayed data freshness reduces data quality

We use rapid7 insight feed (asset enrichment) to enrich our entity data model. The feed seems to run once a day. But this is an issue because rapid7 also enriches the ip (entity.asset.ip). In an environment where static ip addresses are not used, the mapping from ip address to hostname is quickly outdated. This results in enrichment with false hostnames (because of the outdated rapid7 data, that is used to enrich events).What is the best way to deal with the issue?Two ideas that came to my mind are to change the ingest schedule of the rapid7 feed, so that more recent data is available. This will shift the issue to rapid7 (where the data freshness is 6 hours). Or I could customize the parser and drop the ip addresses. Then I guess the mapping will only run via mac addresses.Has anyone experienced similar issues  and how did you solve them?

27
D
Staff
maxjunker
maxjunkerBronze 4
asked in Google Security Operations
Port Reference List in Chronicle

Hey folks, I wanted to dive into some network related use cases in Chronicle and stumpled upon a problem regarding managing ports in reference lists. When trying to query the ref-set inside YARAL, I receive a mismatch error, because ports are parsed as int: $network.target.port in %uncommon_portsvalidating intermediate representation: type mismatch between "%uncommon_ports" of type string and "network.udm.target.port" of type intAs there is no type casting/conversion function available, what other options exits besides inputting all entries/ports inside the rule seperated by ORs? Thanks!   

42
maxjunker
V
vishnu_manuBronze 2
asked in Google Security Operations
Parsers using Python

Is it possible to create custom parsers by using only "Python" and not "Logstash"?I have seen few pre-built parses which are written in Python, curious to know how to do this.If yes, please post the documentation links that I can look into.

01
mikewilusz
Staff
V
vishnu_manuBronze 2
asked in Google Security Operations
Error while extracting timestamp

Community,I have been encountering an error whenever I try to parse the timestamps in the log below,"about.artifact.last_seen_time" and "about.artifact.first_seen_time" are the UDMs I'm trying to map.To parse the above timesamps, I've attached my code and the error, I tried to use "replace" and "merge" function to parse the timestamp, still face the same error.Is there a specific way that I'm supposed to parse the timestamps ?

13
V
vanitharaj1208
vanitharaj1208Silver 2
asked in Google Security Operations
Email template

I have few questions related to Email template in chronicle SOAR,1) what is difference between Email templates and Email HTML Templateif Email HTML template is selected while sending an email we cant view the template or change placeholder.if Email template is selected we can view the template and change the placeholder.Am i Correct?2) If if i create send a email as a block , is it possible to select template (which is given as input in the block)make it dynamic which ever template analyst selects or gives as input in the block that email has to b sent to target(i know the one answer by making action as manual but i dont want it that way is there any other solution )  

610
S
P
preet_mehtaBronze 5
asked in Google Security Operations
Facing 500 status code error when using API to fetch Logs

Hey folks,I am trying to access logs using the /api/external/v1/logging/python endpoint from my Chronicle SOAR instance swagger.However, I receive a response of 500 status code, no matter what data I send in the response body.Do I have to tweak some settings for this to work, or am I passing some incorrect data in the request body ?NOTE: Currently, I am using a trial instance of Chronicle SOAR, and not the commercial one. I am not sure if this is causing this issue.Thanks.

72
P

Badge winners

  • Authored Posts 5
    ayush_gupta_oakhas earned the badge Authored Posts 5
  • Comments Posted 1
    jetheridgehas earned the badge Comments Posted 1
  • Solution 1
    _eohas earned the badge Solution 1
  • Comments Posted 1
    utshas earned the badge Comments Posted 1
  • Authored Posts 5
    maxjunkerhas earned the badge Authored Posts 5
Show all badges
Terms & ConditionsCookie settings
Privacy Policy Terms of Service Gen AI Policy Community Guidelines Cookie Settings

© 2025 Google. All rights reserved.