Skip to main content

Security Forums

Welcome to the Google Cloud Security Forums! Your ultimate security conversation spot. Collaborate with peers and experts to solve challenges, together.

2496 Topics
V
vanitharaj1208Silver 2
asked in Google Security Operations
Remote Agent installation

in which scenario we should use Remote Agent and why ?which is best option - remote agent installation via Docker or Manual installation ? Why ?Is there any pro cons when using RHEL vs Docker vs CentOS

11
S
Staff
V
vanitharaj1208Silver 2
asked in Google Security Operations
Environment Setup in Chronicle SOAR

1. Alias What is Alias ? How to leverage this alias , while setting up new environments ?can any one provide an example ?Link :https://cloud.google.com/chronicle/docs/soar/admin-tasks/environments/add-a-new-environment "Make sure to add in an alias if the third party integration has a different tenant name defined."

52
S
Staff
A
Antonino_La2New Member
posted in Google Security Operations
Jira integration Issue

Hello,Has anyone configured the Chronicle SOAR Jira integration to work with Jira service desk on-prem? I've already used it with cloud instances but with the on-prem solution, I keep getting "bad credentials" error. Thanks A

21
S
Staff
D
DahamNew Member
posted in Google Security Operations
How to attach events to case in Google SecOps SOAR?

I am aware that we can include the artifacts like source IP's to the case but what I want to know is cant we attach the exact events we need to a case? For example, we do a threat hunt and we found some suspicious events. Is there a way to attach these suspicious events into a case? Thanks

31
S
Staff
K
khanhnh95New Member
posted in Google Security Operations
Remove unwanted service account key using remote agent

Hello,I have a playbook to monitor unauthorized creation of GCP service account keys, I need to automate the removal of the service account key step once the key is deemed suspicious. Is there any feature from Chronicle that allows for such automation? Or is remote agent needed, if so what is the most efficient way to use remote agent to do so?Thanks in advance

01
S
Staff
A
Antonino_La2New Member
posted in Google Security Operations
Darktrace Connector not ingesting cases

Hi everyone, we configured the Darktrace model breach connector on our SOAR instance. Performing tests all works fine but we got zero cases created.Enabling logging we can't see any log coming from the connector... This is such weird behavior since I can't see any error. Has anyone here had the same problem? ThanksA

01
S
Staff
messier63
messier63Bronze 1
asked in Google Security Operations
Send_mail

 hi team I want to send a mail in a job and I'm using SendEmailWithAttachment but it is showing this error and I'm not able to figure out what the issue is here.putting the code and the error HtmlResult=(Data_.to_html(classes='table table-stripped')) subject="Unaction Data" recipients="my email id" message = HtmlResult attachment_file_name="N/A" attachment_content="N/A" siemplify.send_mail(subject, message, recipients, attachment_file_name, attachment_content)​ ERROR:root:An error occurred: 500 Server Error: Internal Server Error for url: http://server:80/api/external/v1/sdk/SendEmailWithAttachment/?format=snake: b'{"errorCode":2000,"errorMessage":"An error occurred. Please contact your system administrator.","innerException":null,"innerExceptionType":null}'     

32
T
Staff
Tonio
TonioBronze 5
asked in Google Security Operations
Parsing truncated JSON logs

Hello everyone!We are receiving logs containing, among others, a responseBody from API calls. The log generator has a limiter of 2000 chars per field, which is fine for most of the cases, but a specific API calls always generates longer responseBody. This brings me to have always truncated JSONs for calls from that specific API. Unless I am missing something, JSON extraction filter does not work with truncated JSON, which leave me without info at all from those specific logs.Is there any workaround to make Chronicle extract at least those available info in the truncated JSON? ThanksA 

53
Tonio
T
tayvionpNew Member
posted in Google Security Operations
Retro Hunts not populating results

Has anyone experienced your retro hunts not returning any results? However, when you perform a UDM Search, the results are there.Example UDM query: (This returns results ) metadata.product_name = "AWS_CLOUDTRAIL" and target.application = "ec2-instance-connect.amazonaws.com" AND principal.user.user_display_name != /(?i)^.*example.*$/  Example Yara-L Detection: (This does not return results ) rule aws_ec2_ssh_key_uploaded{ meta: author = "test" description = `Example Detection` data_source = "AWS CloudTrail" severity = "High" events: $aws.metadata.product_name = "AWS_Cloudtrail" $aws.target.application = "ec2-instance-connect.amazonaws.com" $aws.principal.user.user_display_name != /(?i)^.*example.*$/ { $aws.metadata.product_event_type = "SendSSHPublicKey" OR $aws.metadata.product_event_type = "SendSerialConsoleSSHPublic" } outcome: $principal_ip = array_distinct($aws.principal.ip) $user_arn = array_distin

04
AymanC
S
soyer2024New Member
posted in Google Security Operations
Hunting for SQL injection

I need to createa hunting query for SQL injection to search in google Security Operation SIEM, what parameter should I use when searching?

713
ScottieJ
Staff
V
vanitharaj1208Silver 2
asked in Google Security Operations
Splunk Integration with Chronicle SOAR

while installing splunk integration it's asking for to select ontology mapping , which option should we select and why ?

11
K
V
vanitharaj1208Silver 2
asked in Google Security Operations
Environment Setup in chronicle SOAR

How this option works need more information to understand  : Append to all Users and API Keys?"Make sure to click Append to all Users and API Keys if you want to add this new environment directly to existing users and API keys"link :https://cloud.google.com/chronicle/docs/soar/admin-tasks/environments/add-a-new-environment 

01
K
L
lexrzasa1Bronze 4
posted in Google Threat Intelligence
Important Notice: Mandiant ASM Discovery Engine Scanner Expansion

To enhance the scalability and performance of the Mandiant ASM Discovery Engine, we are expanding our scanner network. Please allowlist the following new scan ranges in preparation for their release later this quarter: 34.19.127.192/28 34.19.116.48/28 34.19.127.208/28 34.19.127.176/28 34.68.34.64/27 8.34.210.32/27 Allowlisting these ranges will ensure uninterrupted scanning and optimal performance of the Mandiant ASM Discovery Engine. We appreciate your cooperation as we continue to improve our services. Visit the documentation for information on the Mandiant ASM scan rages.

60
L
R
Roberto_LioBronze 2
posted in Google Security Operations
SOAR MSSP and customer access

HI allwe have configured our Secops MSSP tenant using  Workforce Identity Pool  and MS365 as backend IdP as explained herehttps://www.googlecloudcommunity.com/gc/Onboarding-Journey/Security-Operations-SIEM-Step-1-OnBoarding/ta-p/743443posted by @jstoner .I am trying to figure out if there is a different way to delegate access to SOAR using a customer IdP as well, without going through my IdP.Would it be possible to use CIAM aka "Identity Platform" to be able to have a single point of configuration of different SAML IdPs?Thanks!Roberto  

42
R
N
NEIOBronze 3
asked in Google Security Operations
How to embed data source from chronicle SIEM to Google Looker.

Hi All,I wanted to know if we can embed chronicle SIEM data source to Google Looker so that it helps us to create dashboards and reports in chronicle SIEM.Thanks,Neha.H

02
N
T
TheSecOpsGuyBronze 5
posted in Google Security Operations
Limit S3 Ingestion to Particular Date

Limit S3 Ingestion to Particular DateAs per below URL https://cloud.google.com/chronicle/docs/ingestion/ingest-aws-logs-into-chronicle we can use datetime by appending S3 URL however do we have to enter actual date or just YYYY/MM/DD format(unable to copy exact format as it is giving error)

01
M
Staff
mw_lee
mw_leeNew Member
posted in Google Security Operations
Ingestion API with MA-ASM outbound integration

I'm trying to integrate MA-ASM with Chronicle SIEM and am working on outbound integration in the MA-ASM settings.I have created an OAuth client for the Google Cloud Service Account used in the Ingestion API and delegated GWS permissions, but it shows "credential fail."I have already verified the Service Account's Key JSON. The scope and API endpoint have also been set correctly for the Singapore region.Is there anyone who has experienced the same issue or can provide a detailed explanation of the Ingestion API and Service Account?

11
M
Staff
Tonio
TonioBronze 5
asked in Google Security Operations
Sharepoint parser or not?

Hello everybody!A client requested to inject "Sharepoint" into their SIEM instance so, as usual, the first thing I have done was to check with the supported log type list. Here I can find, as supporter but not available: "Microsoft SharePoint - SHAREPOINT" (damn).Then I move onto Feed configuration and I learn that SharePoint is part of the Office 365 package, injectable via API, with channel "AUDIT_SHARE_POINT". Fastforward to after all the configuration magic, I was in for a nice surprise: all logs injested were already parsed using the "Office 365" built-in parser of Chronicle.As far as this is nice and beautiful, I have learnt that things rarely are this easy... So: are they really been parsed correclty, or I am just daydreaming? It's just a matter of updating the supported log types list, or am I mistaking something big? What do you think? Thanks very much for your replies everyone!A 

23
M
Staff
I
Indrajeet_DNew Member
posted in Google Security Operations
Requesting Assistance : Identifying Unparsed Logs in Chronicle SIEM UI

Namaste everyone,Since the raw search function has a limitation of 10,000 logs, it's difficult to identify which logs are failing to parse. Does anyone know how to find unparsed logs using the SIEM UI? We don't have CLI access, so solutions that leverage the SIEM UI would be greatly appreciated.

83
I
migueltubia
migueltubiaBronze 1
posted in Google Security Operations
Multi Tenant SIEM instances

Hi all,As far as I know, it is possible to use Chronicle SIEM in multi-tenant environments, and using labels you can "separate" the information for each client. I would like to ask some doubts about this approach:Since several clients use the same Chronicle instance, how is the information for each client separated? We understand that it is not a physical separation, but a logical one. Are there any details on this?Do you recommend using the "environment" field for this separation of clients or does it have another function?Also, since the rules are executed for "all events" matched in the rule, what would be the good practice to delimit/not mix the analysis between clients? Is it done automatically based on some field? Should this logic be added to each rule? We have not seen any documentation on this but we understand that the logic of the rules must contemplate this multi-tenancy, it does not seem to be something internal.Thanks for your help.Regards.M.

145
A
Staff
I
ITStaffSupportNew Member
posted in Security Validation
IAM advisory notification permissions

Hi All,I'm receiving the following error when attempting to access an advisory notification."you have insufficient permissions to access the resource, or because a Principal Access Boundary policy is blocking your access to the resource. "Clicking the link using any account including super admin gives the same error.Thanks,-BPIT

11
Rob_P
Staff
O
ohoxhaBronze 1
posted in Google Security Operations
Enriching S-1-5-18 System Account

Does anyone else have an issue with the SID S-1-5-18 (System / LocalSystem)? It's not being pulled from our AD logs, and as a result, it's just showing up as the SID within Chronicle. Has anyone successfully mapped this to the Local System username?

01
J
C
chroniclearnerNew Member
posted in Google Security Operations
SIEM search filter by numeric additional.fields

I have a log source which parses out a field into additional.fields["Num_cloned_repos"]. The value is parsed as a numeric value. The parser code is as follows if [Num_cloned_repos] != "" { mutate { replace => { "Num_cloned_repos_label.key" => "Num_cloned_repos" } rename => { "Num_cloned_repos" => "Num_cloned_repos_label.value.number_value" } } mutate { merge => { "additional.fields" => "Num_cloned_repos_label" } } }  While searching in SIEM search, I want to add a filter to only display events where Num_cloned_repos = 2When I try below query, I get an error metadata.log_type = "<LOG_TYPE>" and additional.fields["Num_cloned_repos"] = 2 compilation error validating query: type mismatch between "query.udm.additional.fields[Num_cloned_repos]" of type string and "2" of type int line: 1 column: 46-79 : invalid argumentWhen I try below query

21
JeremyLand
Staff
kaushalpatel
kaushalpatelNew Member
posted in Google Security Operations
Exporting Windows AD Logs (user_context & asset_context) - NXLog Issue

I'm configuring a PowerShell script and Task Scheduler to export Windows AD logs (user_context & asset_context) to a TXT or CSV file. I'm attempting to read this with NXLog but haven't had success.Has anyone else encountered this issue?Are there alternative methods or best practices to consider for exporting and centralizing these AD logs?

11
RanjithHegdeK
R
Roberto_DelNew Member
posted in Google Security Operations
Can someone help me with the Microsoft Windows AD data integration?

Hello, I'm having issues with this integration https://cloud.google.com/chronicle/docs/ingestion/default-parsers/collect-windows-ad . It seems like if NXLog is running, the export file is locked and the script cannot delete/write the file itself. So it doesn't work

11
RanjithHegdeK

Badge winners

  • Solution 1
    Rmosshas earned the badge Solution 1
  • Authored Posts 1
    Umairbadar39has earned the badge Authored Posts 1
  • Comments Posted 1
    Rmosshas earned the badge Comments Posted 1
  • Comments Posted 1
    Gabby23has earned the badge Comments Posted 1
  • Authored Posts 1
    Gabby23has earned the badge Authored Posts 1
Show all badges
Terms & ConditionsCookie settings
Privacy Policy Terms of Service Gen AI Policy Community Guidelines Cookie Settings

© 2025 Google. All rights reserved.