Skip to main content

Security Forums

Welcome to the Google Cloud Security Forums! Your ultimate security conversation spot. Collaborate with peers and experts to solve challenges, together.

2500 Topics
K
KyHudBronze 2
posted in Google Security Operations
SecOps Looker Data Ingest Interval

Hi,Apologies if this has already been asked but i've scoured the forums to no avail. What currently is the schedule for data ingest into Looker - attempting to run reports for the past 24 hours / 7 days produces 0 events - so I think this might be on a weekly schedule. Given the power of the looker reports, is there a plan to make this more near real time?

13
S
Staff
P
preet_mehtaBronze 5
asked in Google Security Operations
Run a same action for multiple events in a single case using playbook

Hi folks,I am developing a custom integration and have an action that takes a single IP address as an input and makes certain API calls and fetches detailed information about this IP.While integrating this action in a playbook, I noticed a use-case, that probably needs to be handled.Suppose, my action is a part of a playbook, that furthers gets run for a case, where I have multiple events. Each event in the case has a unique Source IP Address. In the action step in the playbook, the input parameter is passed as [Event.sourceAddress], then which event's IP Address would be considered ?Also, I assume IP address of only one of the many events will be considered, then what should I do to run this action for all the Source IP addresses of all the events in the case ?Hope the use-case is clear.Thanks.

12
P
schrauf187
schrauf187New Member
posted in Google Security Operations
Clickable Links in Google SOAR Case Comments / Instructions / Insights / Event Details

Hey Team,Is it possible to create a clickable link in Incidents Comments / Instructions or Insights.For example also if you want to create a Link Back to the SIEM Alert / Event Details?

09
C
A
arnodwNew Member
asked in Google Security Operations
Chronicle Soar dashboard timepicker

How can I choose a custom timepicker for dashboards. I am trying to create a report for a specific month but am unable to do so with dashboards as only the default options are available unlike in the cases window where I can specify a custom time range

02
S
Staff
S
samryanturnerBronze 5
asked in Google Security Operations
Ontology Mapping - Microsoft Defender 365

Has anyone had any luck configuring their event mappings in SOAR for this integration?Seems every single event type could relate to a different named incident from Defender which makes this rather painful.With documentation thin on both sides (understandably), I can't help but feel some of us might be mucking through in silence.

07
S
D
dhirajkumar07New Member
asked in Google Security Operations
How can we configure on-prem QRadar (SIEM) to push alerts to Chronicle SOAR

Hello Community Members,To integrate Google Chronicle SOAR with on-premises QRadar, there is an out-of-the-box application available in the Marketplace. This application connector operates on a pull mechanism, meaning that the connector within Chronicle SOAR initiates requests to QRadar at defined intervals and pulls alerts into Chronicle SOAR.However, in my situation, the client restricts inbound connections to their on-premises QRadar SIEM, but they are open to having alerts pushed from QRadar to Chronicle SOAR. Can anyone suggest a solution to achieve this? Thanks in advance.

74
S
Staff
W
Werner_SolorzanNew Member
posted in Google Security Operations
Playbooks loop

hey team! I've a little question about playbooks and loops. There's a process that has a multiple choice question for example if answer is no, I want to the "no" branch does a feedback and get back to a process before the multi choice question. I've tried just to move the previous process to the "no" branch but it can't be added to that branch. Do you have any idea?

06
S
Staff
P
preet_mehtaBronze 5
asked in Google Security Operations
Need a way to find the logs of any action

Currently, I have developed an action in my custom integration and added logs using siemplify.LOGGER object. When tested the action under the Testing tab, I see the logs under Debug Output tab and all's good.But when I run the same action on any case from case wall, all I can see is the Output Message that was returned from the action. I could not find any way to look into the logs. The same case goes for the time when the action fails to execute successfully.Could anyone please guide me to the correct way to look at the logs for the actions.Thanks.

513
D
Staff
T
TheSecOpsGuyBronze 5
posted in Google Security Operations
Ingestion Metric Dashboard

Hi Team,I have configured Ingestion Metric Dashboard. It was showing correct data till yesterday and suddenly it stated showing incorrect stats for ingested GB. No changes has been made in dashboard, I even tried creating new dashboard but still showing incorrect data.Anyone experienced this isssue recently. 

13
T
A
aravind_s12321Bronze 1
asked in Google Security Operations
Chronicle Parser - JSON

Hi All,Can we parse a log with the below mentioned format with out making any changes while ingesting?[ { "header": { "name": "EcoScope Data", "well": "35/12-6S", "field": "Fram", "date": "2022-06-14", "operator": "GeoSoft", "startIndex": 2907.79, "endIndex": 2907.84, "step": 0.01 }, "curves": [ { "name": "MD", "description": "Measured depth", "quantity": "length", "unit": "m", "valueType": "float", "dimensions": 1 }, { "name": "A40H", "description": "Attenuation resistivity 40 inch", "quantity": "electrical resistivity", "unit": "ohm.m", "valueType": "float", "dimensions": 1 } ], "data": [ [2907.79, 29.955], [2907.80, 28.892], [2907.81, 27.868], [2907.82, 31.451], [2907.83, 28.080], [2907.84, 27.733] ] } ] 

53
M
R
rajaachatterjiNew Member
posted in reCAPTCHA
ReCAPTCHA Score determination

Hi all,When I am trying to fetch a month's ReCaptcha score, I see 2 options coming up:Assessment Request ScoresExecute Request Score ScoreI am confused about which one I should use to determine the ReCaptcha score for the month. Both the scores have slightly different values.Also, it would be helpful if someone could explain the difference between "Assessment Request Scores" and "Execute Request Scores." Some short descriptions for each would be helpful.

00
R
S
srijankafleBronze 2
posted in Google Security Operations
Office365 Feed API is creating duplicate entries in Chronicle

Hi Team,We are utilizing Chronicle Feed to ingest Office 365 logs. We have integrated Audit.AzureActiveDirectory, Audit.Exchange, Audit.SharePoint, Audit.General, and DLP.All as the sources. We are seeing duplicate entries of the authentication logs. This was verified as logs with same raw log (all characters) and same value in metadata.product_log_id is repeated  2-3 times on average (up to 16 times) increasing false positives and data misrepresentation on the dashboard. Has someone discovered this issue and if yes is there any solution to this?

31
D
Staff
AfvanJaffer
AfvanJafferBronze 5
asked in Google Security Operations
Onboarding orgs to chronicle

how can I onboard logs from two organizations into the chronicle?I have an organization that is currently set up native ingestion to chronicle, and everything is fine there. I have a requirement to send logs from a different organization now to the same chronicle instance, how can I do that?  

17
R
Staff
T
TheSecOpsGuyBronze 5
posted in Google Security Operations
Reduce AWS S3 Bucket cost - Integration with Chronicle Secops SIEM

Hi Team,We have integrated AWS CloudTrail and AWS Guardduty with Chronicle Secops SIEM and our AWS S3 cost has been spiked.Is there a way we can reduce the cost (apart from creating new S3 bucket or limiting S3 bucket data) ?

78
T
P
preet_mehtaBronze 5
asked in Google Security Operations
Need to install Siemplify SDK locally

Hi,I am developing a custom integration and need to write unit tests using pytest framework for an action.However, my action starts by importing Siemplify modules and they cannot be found in my local environment. On the other end, I cannot run the unit tests on the SOAR IDE.Is there any way that I can get some .whl file for siemplify-sdk or any way that I can download and install the siemplify package locally ?Thanks.

92
P
P
preet_mehtaBronze 5
asked in Google Security Operations
Support for Dropdown fields for Configuration Parameters of an Integration

Hey guys, currently, I am in the process of creating a new custom integration for Chronicle SOAR platform. My requirement is to create a configuration parameter field for the integration that must be a dropdown. However, I do not see any support for it.Am I missing something, or is there any workaround where I can use a dropdown field for a configuration parameter in my custom integration ?If possible, I would like to add a parameter with radio buttons. Need to know about the supprot for the same.Thanks.

36
P
M
Mufa_shahBronze 2
posted in Google Security Operations
Key_value_UDM_fields

Hi All, Any type of  key-value UDM fields when used multiple time with  "AND" condition in YaraL it doesn't work. but when i try the same in UDM search it works.// Sample ExampleUDM Search , Events are getting detected But when i try the same thing in Rules Editor in YARA L doesn't seem to work  Sample Rule to Test  rule Yara_L_Bug_Testing {   meta:    author = "Rahul Shah"  events:    $e.metadata.log_type = "GCP_CLOUDAUDIT"    // Key Value pair fields used multiple times with AND conditions doesn't work        // Testing UDM works    ($e.target.resource.attribute.labels.key = /event type/ nocase and $e.target.resource.attribute.labels.value = "auth")    AND    ($e.target.resource.attribute.labels.key = /event name/ nocase and $e.target.resource.attribute.labels.value = "authorize")  condition:    $e}

56
S
Z
ZorghostBronze 5
posted in Google Security Operations
Ingesting Zoom logs into Chronicle

Hello everyone,I am planning to ingest Zoom operation and activity logs into Google SecOps (Chronicle) and would like your insights on the most efficient way to achieve this.My proposed approach involves using Cloud Functions in conjunction with Google Cloud Scheduler to run jobs that will fetch the logs from Zoom API endpoints. However, I am uncertain about the optimal receiving point. Here are the options I'm considering:Pub/Sub: I could create a topic and establish a direct feed from Chronicle to that topic. The Cloud Function would publish the fetched logs to this topic.Cloud Storage: The Cloud Function would dump all the logs into a bucket, and Chronicle would fetch them using a direct feed from the bucket.Log Ingestion API: The Cloud Function would post the logs directly to Chronicle using the available log ingestion API.Which solution do you think is the most efficient? I plan to adopt the approach you suggest for similar situations in the future.Thank you in advance for your as

22
Z
JaredBloomberg
JaredBloombergNew Member
asked in Google Security Operations
Risk Score Based on Distinct Criteria

Hello,I've been wrestling with the correct syntax to calculate a risk score based on unique, not repeated, values across multiple logs.For example, let's say there are several different discovery commands run on the command line of a single host over the course of five minutes such as ipconfig, whoami, and systeminfo; for this example let's also say that ipconfig is run twice in that five minute window.Technically only three distinct commands have been run but if you use a sum aggregation (and let's say you give each one an arbitrary value of '5') then in this case the sum will be 20 instead of 15. Is there a way to calculate the risk score based solely on each unique occurrence of a command and not the total number of commands in the match window?I know there is the array_distinct aggregation which would show only the three distinct commands but I cannot figure out how to incorporate that into a risk score and subsequently a condition statement.Is this something that is even possible

02
JaredBloomberg
K
KaramatsuNew Member
posted in Google Security Operations
Proper JSON Format for an Entity such as a Server

Hello,I need to develop some code to that will export the characteristics of servers and various network elements to Chronicle SIEM as entities so it can use the information to enrich events (and later for use with Chronical SOAR). I'm told that normally this is done by interfacing with Active Directory or some sort of EDR solution, but that's not an option, so we have to roll our own, and it's proving difficult because there seems to be no concise documentation for entity processing.What I have now is software on our side that generates JSON documents with a structure that tries to be compliant with the Entity documentation, but it's proving difficult. So two questions to begin with:(1) Is there somewhere I could find examples of the JSON documents produced by other solutions (like AD or EDR products) for ingestion into Chronicle? I don't mean on the AD/EDR side but rather the final JSON that is ready to be ingested.(2) Is there documentation on the Chronicle-side parser to actually i

01
DanDye
Staff
K
kpmarquezNew Member
posted in Google Security Operations
Stats in search not working

Recently trying stats in search (Preview) but it seems not working on our end. Tried the sample in documentation. 

21
DanDye
Staff
D
Dev_ChoudharyBronze 1
posted in Google Security Operations
Google Threat Intelligence integration with SIEM Sentinel

How we can integrate Google Threat Intelligence  GTI to SIEM specially to Microsoft Sentinel or Splunk

11
DanDye
Staff
D
davidjandersonNew Member
posted in Google Threat Intelligence
Migration from MATI to GTI

I'm a current MATI customer. What will the migration process to Google TI look like? Will there be any downtime or interruption to my service?

21
fperdomo
Staff
D
detection42New Member
posted in Google Security Operations
Can i use role authentication to AWS instead of token based auth?

Does anyone know if it's possible to use role authentication to AWS instead of token based auth?

03
I
S
Suraj_RNew Member
posted in Google Security Operations
Is there a way we can solve this roadblock webhook.site limit without using a third party?

Hi All, We are currently using webhook.site as our webhook provider to integrate Slack with Chronicle SOAR but there is a roadblock here as webhook.site has limit on number of requests we can send on an URL for free... Is there any other way through which we can solve this issue without using a third party?

05
D
Staff

Badge winners

  • Authored Posts 5
    maxjunkerhas earned the badge Authored Posts 5
  • Comments Posted 1
    hytech_sghas earned the badge Comments Posted 1
  • Solution 1
    Rmosshas earned the badge Solution 1
  • Authored Posts 1
    Umairbadar39has earned the badge Authored Posts 1
  • Comments Posted 1
    Rmosshas earned the badge Comments Posted 1
Show all badges
Terms & ConditionsCookie settings
Privacy Policy Terms of Service Gen AI Policy Community Guidelines Cookie Settings

© 2025 Google. All rights reserved.