Security Forums

Hello Team, I need help building a SOAR playbook using a custom list in the Google SecOps platform. I’ve added the entity details with categories to the custom list and created a playbook to check those values against alerts. However, when I run the playbook, it seems to fail and goes to the 'else' condition instead of recognizing the matches.I’ve tried adding the category and the actual values into the previous action condition block using both OR and AND conditions, but it still fails. Although I’ve defined the category in the custom list, it doesn’t seem to work.Can anyone assist me in defining the conditions in the block to match these scenarios for false positive alert flows? I’ve also been working on use cases for EDR false positive alerts and certain cloud accounts where we expect a couple of alerts, and I want to ignore those alerts from the custom list.I even tried running a simulator to test the flow. In the custom list option, I can see that it is taking the value I inp

HiIs there a solution to keep an active tracking of connector health. So that we know whenever a connector is not healthy. Lately we have experienced secret expiration with one of our connectors, and we came to know about it after significant delay as part of manual review exercise.  

I started with recaptcha free https://www.google.com/recaptcha/admin/create. I included all required fields, creating a new Google Cloud Project Name. Hit enter, nothing happened. No error, no change on page. Tried multiple browsers. Same result.  I thought may I need to create the Project before referencing its name. I did that on https://console.cloud.google.com/security/recaptcha/. Found no secret key. How can I create recaptcha for my site with a secret key? 

Am using the last version of EVE-NG Community edition.I have added Fortigate's Iso and fix permissions without errors but when I try to start the Fortigate Object nothing happenHow could I solve this issue ?

HiIf we have by any reason have duplicate logs for example a log source like 0365 (emails) , while building a rule how can i remove deduplication of events  .

Is there anyway to have 2 y-axis in native dashboard chart line graph? Just want to confirm if it’s applicable. Want to convert dashboard from looker to preview dashboard. 

Hi all,I’m currently working on testing playbooks in my environment and looking for the best practices when it comes to running simulated cases. Specifically, I’d like to know if there’s a way to automatically create cases based on actual events occurring within my environment to help simulate more realistic scenarios.If anyone has experience with this or can provide guidance on how to automate these test cases effectively, that would be greatly appreciated. I’m also interested in hearing how others approach playbook testing in general.Thanks in advance!

I would like to get a clarification on How to iterate through all the values if a field consist multiple values in comma separated array format. For example if I use this line the $mesgid = re.capture($e2.network.email.mail_id, "[^,]+")- re.capture will assign only first entry of the array to $mesgid. If I want to assign each values of the array to $mesgid and match it with another variable. What could be the ideal solution? I would be grateful if  anyone could help me here 

Hello Everyone,I'm developing/testing a block which summarizes the results from multiple TIs like AbuseIPDB, Virustotal etc from a playbook and prints the result in CSV file in case wall.I'm getting this error from when I'm testing the playbook with this block and if I try to structure JSON I'm not getting the expected result. Could anyone please let me know what am I doing wrong here?Result:Please ignore the domain data.Thanks a bunch in advance,Aravind Sreekumar

I'm adjusting an on call escalation playbook that can be attached by another playbook into various cases The first step is a question asking for manual action to execute the rest of the playbook. I can adjust said on call escalation playbook to look at conditions such as case criticality or whether a particular datetime falls in a time like a stat holiday when we might want to escalate all cases anyway. I'm also looking for a way to add a switch/toggle somewhere that could be flipped by a manager manually to indicate that all cases should be escalated until the switch is flipped back manually.I was thinking about adding doing so via reference lists (if certain value is present in certain list, then always run the playbook), but what permissions changes do I need to make so that the average user gets access to edit reference lists only (rather than being able to change everything in the environments tab for example)?

Hi TeamI am trying to build a query which uses office 365 and crowdstrike together My event section looks like this events:                    $event.metadata.vendor_name = "Crowdstrike" nocase        $event.metadata.product_name = "Falcon"        $event.metadata.log_type = "CS_DETECTS"        $user = $event.principal.user.user_display_name                $email.metadata.product_name = "Office 365"        $email.metadata.event_type = "EMAIL_TRANSACTION"        $email.metadata.product_event_type = "TIMailData"        $email.about.labels["DeliveryAction"] = "Delivered"        $email.security_result.category = "MAIL_PHISHING"        $email.network.email.to =assistance i want here is in the email address  i wish to remove the dom

what if a case is migrated  from prod instance to dev instance-mapping and modeling is done in prod instancedo we have to re-do the mapping and modelling in dev Instance? 

Oct 15 17:08:29 |Check Point|VPN-1 & FireWall-1|Check Point|Log|http|Unknown|act=Accept app=HTTPS cn1Label=Elapsed  server_outbound_packets=30 service_id=https sig_id=4 src=10.25.18.12So I have this textI want to check if the text. I want to write a regex for log filtering to check if the text has the following conditions : 1. contains Check Point2. act=Accept  (or Allow) [small or caps]3. src should not be privateThis is the regex I have written,regexp: .*(?i)(Check Point|fortigate).*act=(?i)(Deny|Drop).*src=(?!(10[.]|172[.](?:1[6-9]|2[0-9]|3[0-1])[.]|192[.]168[.])).*but this is not working. Can anyone help?

In this post, I will show you how to use Mandiant Security Validation (MSV) and threat intelligence from Virustotal to validate whether your endpoint security controls can detect data exfiltration using curl on windows. Your task is to validate whether your endpoint security controls can detect and/or prevent a data exfiltration using curl . The steps will be as follows: Find the malicious curl use case on virustotal. Create and run the curl Windows Host CLI action. Validate the efficacy of the internet security controls and address any gaps. 1-Find the malicious curl use case using virustotal: I will use sigma rules to find the needed sample,  browse https://www.virustotal.com/ui/sigma_rules and search for curl.exe , you will the get the following entry: Right click on the ID and open in another Tab, where you will get the list of samples matching the sigma rule. You can see that the second sample looks interesting, let’s explore more about that sample   For “Matche

Hi everyone,can someone please help me write rule for below scenario?if any logsource which is placed in on prem  is not streaming to chronicle SIEM in last 24 hours, it should trigger an alert.I read somewhere to use cloud monitoring for that but how does that work, as in if my device is on prem or on azure and i have used forwarder  how will cloud monitoring identify the not reporting part. Can someone help me with this?  

Hi Team, I have a question regarding one of the requirements we are working on. We have integrated Chronicle with our GCP (Via web hook) to get the cloud armor logs. We leveraged pub-sub with Cloud Armor to push the logs to Chronicle. Once integration is successful, we started getting messages in Chronicle but the data was encoded with base63 encoding. Does it has to be this way for data transmission? Second questions is how to we decode it on chronicle (any parser) so that we can read it and trigger some alerts/further actions ? Any help would be greatly appreciated. Thanks in advance! View files in slack

<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4624</EventID><Version>2</Version><Level>0</Level><Task>12544</Task>This is a text. I want to write a regex that checks if the text contains Windows and EventID 4624 or 4625.How am I supposed to do that?regexp : .*Windows.*<EventID>\\b(4624|4625)\\b</EventID>.*my expression is not working. Can anyone help? 

Hi everyone,I’ve enabled user notifications in the notification settings (both for notifications and email alerts on case assignments).However, I only receive notifications when a case is specifically assigned to me, but not when a case is assigned to my role.Is there a way to configure it so that everyone assigned to a specific role receives a notification?

Hello Security Community Members,I hope you’re all doing well!We are currently working on improving our Endpoint Detection and Response process. We want to use manual analysis for some events or alerts and add summaries of false positive hash values to a custom list for future reference.The idea is that if we encounter the same event with the same hash value in the future, we’d like to pull that analysis from our custom list instead of doing the manual work all over again.I’m looking for some guidance on how to set this up in our SOAR playbook. Specifically:How can we configure the playbook to first check the custom list when an alert is triggered?What’s the best way to implement the logic that allows us to either reference the analysis from the custom list or continue with our normal incident response process? (but first look into custom list)Are there specific conditions we should use to make this work smoothly?I’d appreciate any tips or examples from anyone who has done something si

recaptcha key creation is not working, tried mobile, desktop and 2 browser chrome/mozilla, when i hit "Submit" nothing happens. can someone confirm is not working also for them?

Hello, I would like to know how to select a reCAPTCHA pricing plan.The official website introduces three pricing plans: reCAPTCHA Essentials, reCAPTCHA Standard, and reCAPTCHA Enterprise. Additionally, it mentions that you can start using reCAPTCHA by navigating to the console from "Get started" or "Manage reCAPTCHA." However, I am unsure how to select a pricing plan within the console. I also don't know how to check which pricing plan I am currently using.The following points might be relevant, so I am providing them for reference:I am using a free trial account.The key setup has not been completed yet.The pricing structure may have changed recently, and the documentation or GUI may not be fully updated.Here’s what I’ve tried so far:I created a project with a free trial account and enabled the reCAPTCHA API.I issued a regular key (not for demo or testing purposes), but I haven't implemented it on the website yet.

There are 20 Critical assets, if there are any alerts for these hosts, it has to been responded with priority compared to others. How can we implement this? In  simple terms how can i have dynamic priority for chronicle alerts based on criticality of the host , can some one help me with a simple example @jstoner  @cmmartin_google :Any suggestions or guidance

How can we grab a specific field and its value from an unparsed JSON ingested from source tools? I'm attaching an example unparsed JSON here and I need to grab the value of the field "LastMessageRcptCount" (which is 117). Thank you! {"f3u":"DLITTLE@Null.COM","ev":"DLITTLE@Null.COM","rs":"EmailSendingLimitExceeded;InternalRecipientCountToday=3;ExternalRecipientCountToday=1;ExceedingLimitType=External;Last MessagetraceId=Null;LastMessageRcptCount=117;CIP=Null;AS:45002","adt":"Generated by OBP2SenderRepService - Object Store: 1535;SpamRule=45002;","evnt":"Listed","ts":"2023-06-05T15:36:00.0000000Z","te":"2023-06-05T15:37:00.0000000Z","op":"EmailSendingLimitExceeded","wl":"SecurityComplianceCenter","tid":"Null","tdc":"1","reid":"Null","rid":"Null","cid&

Hello,I recently came across past events that are conducted by google cloud security,Title : Bangalore: Chronicle SIEM + SOAR Partner Technical Training is there any recordings available for these sessions ? or when will it happen again in India ? or any virtual trainings available ?can someone suggest me some good learning resources for Secops other than cloudboost and the official documentation ?thanks for your help.

Hi there!I hope this message finds you well.I am currently experiencing issues with my reCAPTCHA integration. I have set up a reCAPTCHA key, but I am encountering several specific problems:Backend Verification Incomplete: I received a message stating, "Your key isn't requesting assessments," indicating that the backend verification for reCAPTCHA isn’t fully configured.Key Setup Completion: I also received a notification to "Finish setting up your key: Request scores." This suggests that while my key is requesting tokens (executes), it isn’t requesting scores (assessments), which is essential for fully protecting my site.Authentication Required: Additionally, there’s an error saying, "Before proceeding, you must authenticate with reCAPTCHA. API requests to reCAPTCHA will fail until authentication steps are complete."I have reviewed the instructions for verifying reCAPTCHA tokens but am unsure how they relate to my Salesforce backend, as the reCAPTCHA API Key Pair is also generated there