Security Forums

Hi everyone,I'm working on creating dashboards in SecOps Preview Dashboards and encountering an issue with line and area charts.When I create a query and run it, the line or area chart displays data correctly. However, after saving the panel to the dashboard, the chart no longer populates any data.Screenshot in edit mode (data visible)Screenshot after saving to the dashboard (no data displayed) Has anyone experienced this issue before? Is there a known solution or any workaround for this?Thanks in advance for your help!Regards,Prashant Nakum

This is a brief post outlining one of the available Processors in Bindplane called the Google SecOps Standardization Processor. The Google SecOps Standardization Processor is used to add telemetry to logs shipped to SecOps via Bindplane.  Specifically, it sets the log_type ingestion label so that logs sent to SecOps via Bindplane can be parsed and interpreted correctly. For more information about this Processor, see the associated documentation below. https://bindplane.com/docs/resources/processors/google-secops-standardization To re-familiarize yourself with available parsers and their associated log types, also see the following documentation. https://cloud.g

Hi all,  While working on playbook actions (specifically manual playbooks), I came across an issue when attempting to close them via the Siemplify Close Case action within a playbook. When attempting to add this action to a manually created case, SecOps fails with an error stating: Reason":["The specified condition was not met for \\'Reason\\'."]},"type":null,"title":"One or more validation errors occurred.","status":400Steps to Reproduce:Create a manual caseAttack the Close Case action to the case, ORCreate a playbook which contains the Siemplify Close Case action and run the playbook on the case.Temporary Workaround:This bug has been raised with Google support and it is being worked on. If you do come across this issue in the meantime, you can create an action targeting the  "/api/external/v1/

Hi Team,We are facing issue when logging the Standalone SOAR platform. The error message reads "no healthy upstream" and We can see 503 error code on the network tab. We have raised some support ticket. Wanted to check if this is isolated to us only or is it global.  

Hello,I was wondering if there was a method to erase data from SecOps entirely. We understand that it is not possible to remove one certain log type, and so were wondering if it is possible to remove all data associated to our instance of SecOps (i.e. like deleting an entire MySQL database). Would this be possible, and indeed easier than removing one single log type?Thank you in advance.

Hi, i was wondering why sometimes in the curated detection rules, for example, severity is medium and Incident criticality level is only informational?Any ideas?Thanks!

If I'm the admin of the GCP account without having a role assigned in chronicle can I still have permission to forward data to the Chronicle using the API and a JSON cred file?

I created a new rule in Chronicle SIEM and used Test Rule, where I can see past detections. Now, I need these detections to generate alerts in Chronicle SOAR so I can build playbooks.How can I:Convert these detections into alerts in SOAR?Manually trigger alerts in SOAR from past detections?Use an API or another method to resend these detections to SOAR as alerts?My SIEM-SOAR integration is working fine, and new alerts are coming into SOAR. I just need a way to turn these past detections into SOAR alerts.Any guidance would be appreciated! Thanks.

I want to do a UDM search like this:email IN %regex_ref_listThe above ref list currently contains only one entry: .*suspiciousdomain.comThe documentation online (https://cloud.google.com/chronicle/docs/investigation/udm-search#use_reference_lists_in_udm_searches) states that all types of reference lists are supported. However, when trying to run the above search, I get this error:compilation error validating query: validating reference list: cannot use list regex_ref_list List of type REGEX with function InReferenceList line: 1 column: 1-43 : invalid argumentWhy would I be getting this error if regex lists are supported?

Hi Google SecOps community! My name is Chris Bentley and I’m a SOC analyst at a healthcare company in Chicagoland. I’m new to Chronicle | Siemplify and looking forward to sharing knowledge, especially with Splunk users. I’m interested resources for Google SecOps along the lines of SplunkAnswers, gosplunk, etc. Please share Chronicle |Siemplify community sites you may know. thx

Hello Community , I'm developing a dashboard in chronicle , this dashboard shows Gigabyte sum by log type : As you see in the screenshot , the legend is ordered in alphabetic order , but i want the order in legend from max value to minimal value .Thanks

Hi,I’m scanning multiple URLs in my alert using Urlscan.io. Each URL is successfully scanned, and I receive the results, including their screenshot URLs. However, when I try to send the screenshot URLs via email, the placeholder combines all URLs into a single comma-separated value, like "https://example.com, https://example2.com".This is placeholder = [UrlScanIo_Url Check_1.JsonResult| "EntityResult.task.screenshotURL"]And this is the sample result; 0 - EntityResult - task - screenshotURLHow can I add a placeholder in the email for each URL ind

Hi everyone,I’m currently working on preview dashboards in Google SecOps and facing an issue when trying to use one placeholder within another in the meta (upper) section of a query.Here’s an example of my query:event_type="xyz"$version = if(version != "", version, "Unknown")$version_status = if($version = "v1", "vs1", "vs2")match:          $version_statusoutcome:          $count = count(id)The issue arises when I reference $version inside the calculation for $version_status. This results in an error, which I have attached as a screenshot.Is there any guidance or documentation available on how to handle such cases? Any help would be greatly appreciated!Thanks,Prashant

Hi everyone,If you know anything about this phenomenon where the reCAPTCHA is cut off, please give us some advice.This mainly occurs on Android devices using Web View.

Hi everyone,I’m using reCAPTCHA v3 for bot detection, but recently, I noticed that about 26% of requests are flagged as suspicious. Today, a customer reached out saying he was wrongly blocked during registration despite being a legitimate user. I’d like to understand what could be causing these low scores and whether there are any effective remedies. For example, is it possible to implement a secondary verification step, such as falling back to reCAPTCHA v2 (image selection) when the v3 score is too low? Any insights or best practices would be greatly appreciated. Thanks!

Explore the latest AI innovations across the Google Cloud Security product portfolio, threat intelligence best practices, detection engineering to secure the Edge, and more. Check out the details here!

Our alerts have stopped grouping. When I review the group rules all the entities values are blank, if I try to re-add and save them they do not save. Is anyone else seeing this?  

 Hi Folks,I’m trying to create a custom integration by duplicating a marketplace integration. I exported the built-in integration’s dependencies to import them into my custom integration, but I encountered an error. I couldn’t find any relevant information or posts about this issue.Has anyone else experienced this or know how to resolve it? 

I am looking to save a count of how many times a particular funciton ran within a job. How can I do that within the IDE? 

I recently tried to upgrade from recaptcha v2 to v3 as my FE needs to call multiple API from BE and it's difficult to implement it via v2. I want all my BE calls to be secured by recaptcha token. So, chose V3 to not interrupt users. But I can see all the recaptcha tokens get verified without any issue event when I created 200 requests using chrome dev tools in incognito mode. I created 200 tokens using execute function and send the requests to the API. all of them verified successfully with score of 0.9. So, my questions are:Is that because I use localhost for testing? the behaviour might be different in production? Is v3 supposed to detect those sort of requests? automated via a script in dev tools?Is v3 is less secure in compare to v2 as there is no human interaction needed?Is there any other way to use version 2 for multiple API calls? but with one user challenge? Regards,Ali

Hi Has anyone created a dashboard that highlights the mitre mapped tactics and techniques mapped use cases in the environment.? 

Hi, I think the line graph is having a problem when I use a single match, specifically with the date. The line graph shows a value of zero, even though when you switch it to table chart it has accurate values for each date. So, ending the line graph is zero only which it is not good. Is there any way to fix this? Thank youwhen the date is in match only it’s not getting the accurate values of line graph. example query:$Date = timestamp.get_date($event.timestamp) example only match:$Date outcome:$COunt = count($event.metadata.id)

Hello Everyone,We developed an application that has been using reCAPTCHA for over a year and started acting up stating the certificate is not valid. Even though the expiration date is until 2027 we had to refresh/retrieve a new certificate to get it working again, after that we noticed the fingerprint change, so I was wondering if anyone is aware of this issue.The problem happened 3 days ago and yesterday started happening again but now the fingerprint is the same, we've noticed the problem now is happening randomly in our site and doesn't seem to be an internal issue, more like a problem with reCAPTCHA.I would really appreciate any assistance or direction in the matter... ahead you will find the error thrown by our server:I/O error on GET request for "https://www.google.com/recaptcha/api/siteverify": com.ibm. jsse2. util. j: PKIX path building failed: com.ibm.sec

Hello ,Has anyone developed a dashboard that highlights the MITRE-mapped tactics and techniques along with the associated use cases in the environment?"Thanks

How to find cryptomining bad domain related threat feed names? for  building rules using graph entity in yara L.