Skip to main content

Security Forums

Welcome to the Google Cloud Security Forums! Your ultimate security conversation spot. Collaborate with peers and experts to solve challenges, together.

2492 Topics
J
Johnny246New Member
posted in Google Security Operations
Trying to understand sliding window in YARA L

Hello Team New to YARA L and i am trying to understand how to get a rule to alert if there is a "new" event NOT followed by a "resolved" event in a 5 min window. This is what I have currently : rule testAlert {events:$new.metadata.event_status = "new"$new.metadata.vendor_name = "Microsoft"$new.target.user.userid = $targetUser$resolved.metadata.event_type = "resolved"$resolved.metadata.vendor_name = "Microsoft"$resolved.target.user.userid = $targetUsermatch:targetUser over 5mcondition:$new and #resolved < 1}However this still seems to be alerting when there has been a resolved event. 

12
AymanC
C
CyberSnacker82New Member
asked in Google Security Operations
Understanding YARA-L Rules

Hello! I'm working on a YARA-L detection project and need some guidance. I'm trying to create a rule to detect if the same user connects to the same domain at regular intervals. Here's what I have so far:I want to track the times of each connection (for example, if a user accesses Spotify 4 times within 10 minutes) and calculate the time differences between each connection. My goal is to determine if the connections happen at consistent intervals (e.g., every 2 minutes), which could indicate beaconing behavior. If the intervals aren't consistent, I want to ignore them.After researching, I found that YARA-L doesn't support complex functions for this kind of stuff. What do you recommend as an alternative to functions? Any ideas would be greatly appreciated! 

101
AymanC
A
asnewtonNew Member
posted in reCAPTCHA
ReCAPTCHA v3 throwing errors

Not sure if I am in the right forum for this topic - please let me know if I should look elsewhere. I am a web designer with about 60-70 client sites using regular ReCAPTCHA (not Enterprise) v3, with 1-3 forms using it on each client site. Over the last week, I started hearing about errors being thrown when customers would try to fill out the forms. I can't always replicate the problem from my end. Today though, almost every single form test I tried to complete, failed. I've since removed Recaptcha from all sites (hopefully temporarily). Most client sites are using the Wordpress Avada theme but I am seeing the error even on legacy sites using other themes and Contact Form 7 plugin. Did my clients collectively hit some sort of quota that I didn't know about? I've tried googling it and see something about a million queries but I am positive even with 60-70 forms there's no way they are collectively in that ballpark. Any suggestions? Would really like to reinstate Recaptcha ASAP.

39
A
ScottieJ
Staff
ScottieJStaff
posted in Security Validation
MSV Onboarding - Crafty way to establish the Cloud Hosted Actor Allow List

Many MSV deployments include multiple on-premise actors and one or two Mandiant cloud hosted actors. Many use cases like data extraction or malicious file transfers (MFT) will require that the on-premise actors can communicate with the cloud hosted actor. Mandiant requires clients to submit a list of public IP addresses that the on-premise actors will use to communicate with the cloud hosted actor. The MSV operator often does not know this information and may resort to an internal ticket or inquiry to a network administrator to find this information out and that can take more time than wanted. A simple and faster alternative is to create Host-CLI actions utilizing the cURL utility to identify the egress IP address of each on-premise actor. Yes, this works on network actors as they are linux based and can run Host-CLI actions using a bash shell. An action for multiple shell types can be similarly created as cURL is supported on many OS platforms including windows (cmd.exe or powershell)

00
ScottieJ
Staff
Tonio
TonioBronze 5
posted in Google Security Operations
What are the triggers that automatic disable SOAR accounts?

Hello, I have just found a number of collaborators accounts on our SOAR platform been disabled. Since nobody from my team did this, I suppose some kind of conditions were matched, like long absence or similar.Is there a way to know what these conditions are or eventually modify them? Thanks

03
Tonio
ScottieJ
Staff
ScottieJStaff
posted in Security Validation
Using Report Builder to Debrief Executives - Keep it Simple

The MSV Report Builder is a powerful analytics tool. It is easy to get carried away with all the widgets available after running a campaign of attack simulations and emulations when crafting an Executive Debrief Report . A Debrief should be "brief" but also stick to a set of simple principles. In this case less is more for those who are charged with making risk decisions.  The report template should include a text section to record the analysis and just enough data widgets (graphs, charts, tables) to back up and color the analysis. The analysis itself should be recorded in "your" words using concise sections like : Objective, Scope,  Performance Analysis, Key Issues (good & bad), Potential Solutions and/or Next Steps. Using a debrief process that simply presents fair and concise information to  those in charge of risk will help empower them to make decisions in the best interest of your data assets. Example Debrief Report For Details on how to create  and

00
ScottieJ
Staff
I
Indrajeet_DNew Member
posted in Google Security Operations
Help! Looking for Video Tutorial on Writing Parsers from Scratch in Google Chronicle

Namaste everyone,I am hoping someone can help me out. I'm trying to learn how to write parsers from scratch in Google Chronicle. I've been searching for video tutorials, but haven't had much luck.Does anyone know of a good video resource that walks you through the process of building a custom parser in Chronicle?Thanks in advance

12
cmorris
Staff
Y
yashsana121New Member
posted in reCAPTCHA
V3 Recaptcha Limit Incorrect

I received the following email about my recaptcha quota :Summary: You are receiving this email because your site key exceeded the free assessments limit in reCAPTCHA V2 or V3. Please use our new migration path to upgrade to reCAPTCHA Enterprise so you can have unlimited assessments for your site key.Thank you for being a reCAPTCHA user. Your site key is currently using reCAPTCHA over the quota limit of 1 million calls per month. If you do not migrate to reCAPTCHA Enterprise, within 30 days following this notice, your site key will not protect your webpage after 1 million calls per month.If a site key exceeds 1000 calls per second, then some requests may not be processed. If a V3 site key exceeds 1 million calls per month, then the site might return a static score of 0.9 and an error message that says `"over free quota."` for the remainder of the month. If a V2 site key exceeds its monthly quota, then the following or a similar message may be displayed to your customers in the reCAPTCHA

20
Y
TomAtGoogle
Staff
TomAtGoogleStaff
posted in Security Validation
Where are my logs?

Probably the most asked question in all of Mandiant Security Validation.  In over 4 years, this question has been asked by customers I work with hundreds of times.  While there's a hundred possible reasons the log wasn't matched to the action, there's only a few questions needed to figure it out. First and foremost, was there actually a log generated? MSV cannot find something that does not exist. Windows group policies and many other types of security protections may not generate a log. Never fear, the next question can help answer this one.  What kind of action is it? Seems kind of simple, but knowing what kind of action it is will narrow the search drastically.  Malicious file transfer actions are not written to disk, so don't expect any EDR logs. Host CLI actions seldom hit the network, so don't expect any firewall, proxy, network appliance logs. DNS actions are simply name resolution requests. If DNS resolutions are not being logged, there are no logs to be fo

00
TomAtGoogle
Staff
chrisproudley
Staff
chrisproudleyStaff
posted in Google Threat Intelligence
API /v1/search/entities/ changes to include all entities without filtering

Previously, when performing API calls to capture entities (/v1/search/entities/), there were two filters which were always enabled with default values, shown in bold below: hidden:false|true scoped:true|false This meant that building API queries to capture all or both required multiple lookups to capture all entities, and some way of concatenating the resultant data. If building an integration with a third-party product, for example, this added significant complexity. Since late May 2024, we have added options to capture 'both' within a single API call (or search within the UI). How these parameters look in a direct API request (without URI encoding): /v1/stats/entities/ips_by_network/last_seen_after:configured_scan_count scoped:both hidden:both How these parameters look within the UI search: We hope that these changes to the API will prove valuable and welcome feedback on their usefulness.

10
chrisproudley
Staff
TomAtGoogle
Staff
TomAtGoogleStaff
posted in Security Validation
Advanced Host CLI Usage

  Shells, shells and more shells!Do’s and don’t for creating Host CLI Actions The Mandiant Security Validation(MSV) platform is distinctly different from attack simulation technologies. Security validation includes vast integrations with defensive technologies and attack execution across the entire enterprise security environment. It is not limited to endpoint security controls. It uses real, active attack binaries to test the effectiveness of security controls.The platform is open and allows users to create custom actions needed in their environment.A little reviewMSV offers four shells for writing command line scripts. This article will speak to three of thosesimply because the last one is very different from the rest and is honestly seldom used. The three shells that we will discuss here are bash, windows command and powershell. Python shell will not be discussed.Each command in the script is standalone and is evaluated for a single result. If any command results in a blocked condit

120
TomAtGoogle
Staff
TomAtGoogle
Staff
TomAtGoogleStaff
posted in Security Validation
When the Red Team has a surprise!

Your Red Team engagement found a vulnerability. Here’s how you can use Mandiant Security Validation to ensure it gets fixed.     The Mandiant Security Validation(MSV) platform is distinctly different from attack simulation technologies. Security validation includes vast integrations with defensive technologies and attack execution across the entire enterprise security environment. It is not limited to endpoint security controls. It uses real, active attack binaries to test the effectiveness of security controls. MSV has the ability to create scheduled jobs and monitors. This provides a way to repeatedly test a vulnerability until it has been fixed and verify it stays fixed.  The platform is open and allows users to create custom actions needed in their environment.  The action types include: Host command line, port scan, DNS query, email, socket, network (PCAP based), web and cloud. Here are a few examples that might be useful.         An open port i

00
TomAtGoogle
Staff
James_E
Staff
James_EStaff
posted in Security Validation
Testing Strategies with Mandiant Security Validation - Reactive Testing

Mandiant Security Validation (MSV) is an automated and continuous approach to testing the efficacy of an organization's security controls against cyber threats. Security Validation is informed by timely threat intelligence and executes automated and continuous testing of security controls with the use of real attacks. Effective security requires more than just implementing controls. Understanding their real-world effectiveness is crucial for protecting your organization from cyber threats. Mandiant Security Validation tackles this challenge by providing a comprehensive solution to test and evaluate your security posture. Reactive Testing allows you to assess your security posture as it relates to recent events that may have occurred in your environment. Findings from any incident response can be used to create custom actions within MSV. These custom actions can then be used to validate your security controls are able to prevent, detect, and alert against these indicators in t

20
James_E
Staff
M
mksmit79New Member
posted in Google Security Operations
Match window and detections

I have a rule with a match window of 4 hours and have the frequency of the rule set to 1 hour. I expect the rule to run hourly and match on the last 4 hours of data when creating a detection. Instead, I am only getting a detection every 4 hours. How should I set this up instead?

01
A
Staff
R
rpicadizoNew Member
asked in Google Security Operations
Metadata Time Start and End Time Interval is not being followed

Hello,I'm setting up asset enrichment through the ENTITY_CONTEXT. I have configured time interval as below:By concept as stated in EntityMetadata, the enriched asset data is only valid for April 5 - April 6 in UTC. Now, I have ingested some test events in April 10 and the fields are being enriched. Is there something that I did wrong?Please note below screenshot are all test data and are not actual information.Thanks in advance!Kind regards,Raven

02
R
D
Staff
dnehodaStaff
posted in Security Validation
On Prem Director upgrade to Rocky Linux

Directors Follow these steps to upgrade to a 4.14.0.0 Director on Rocky Linux 8 while preserving your data and settings. For an existing Director virtual appliance, on version 4.13 or earlier:  Optional: If using a static IP, go to Settings > Director Settings, click Network and note the following network information for the Director (required for Step 5): Director IP address Director gateway Director DNS server (if applicable) Upgrade your existing Director to version 4.14.0.0. After this step, you will have a 4.14.0.0 Director that is still running on CentOS 7. See Update Security Validation Components for steps to upgrade your Director. After the 4.14.0.0 upgrade, take a backup of the Director virtual appliance. This step preserves your existing settings. See Backup and Restore Security Validation for steps to back up your existing Director. Take the existing Director machine offline, then replace it with the Rocky Linux 8 4.14.0.0 Director virtual a

121
J
Staff
J
jminycricket323New Member
posted in Security Validation
best practices for first actor deployment

We just acquired Mandiant Security Validation. We are starting to deploy actors, but we want to be optimal when deploying them to get as much information out of MSV as quickly as possible to show leadership that the investment was a good one. Does anyone have any tips on how to do this?

74
ScottieJ
Staff
J
jminycricket323New Member
posted in Security Validation
Simple guide for AEDA?

Hello, I'm trying to deploy/make use of the AEDA (advanced environmental drift analysis) module. How do i use it effectively in my environment?

21
J
Staff
K
kallenNew Member
posted in Security Command Center
Web Security Scanner fails with "An internal error occurred during the scan"

Our web scans stopped working. I'm not sure when, but I'm trying to debug. SCC is set to premium tier on the project. Web scanner is enabled. When I run the scan, I get "An internal error occurred during the scan. If the error continues, contact support." I know that the username and password work on this test.The only decent debug info I have is from Cloud Logging. I see a lot of 'resource not found' errors in the log. What are these errors about? There are 18 of them during my scan timeframe. Here are some examples: "Resource "projects/PROJECT_ID/rapidVulnerabilityDetectionSettings" (Type: "rapidVulnerabilityDetectionSettings") Not Found: "\\"projects/PROJECT_ID/rapidVulnerabilityDetectionSettings\\" not found"" "Resource "projects/PROJECT_ID/virtualMachineThreatDetectionSettings" (Type: "virtualMachineThreatDetectionSettings") Not Found: "\\"projects/PROJECT_ID/virtualMachineThreatDetectionSettings\\" not found""  Thanks in advance!

04
P
messier63
messier63Bronze 1
asked in Google Security Operations
how to get actions in jobs using IDE in Chronicle SOAR

hi ,i want to call few action items in jobs to validate some data and then run the jobs using the jobs scheduler but I'm getting some errors Below is the sample code I'm using   from SiemplifyJob import SiemplifyJob from SiemplifyAction import SiemplifyAction INTEGRATION_NAME = "Automations" SCRIPT_NAME = "JobTemplate" def main(): siemplify = SiemplifyJob() siemplify.LOGGER.info("A - ".format(siemplify)) sm = SiemplifyAction() siemplify.LOGGER.info("B - ".format(sm)) siemplify.script_name = SCRIPT_NAME # In order to use the SiemplifyLogger, you must assign a name to the script try: get_case_creation_time = sm.get_case_context_property('caseCreatedTime') print(get_case_creation_time) # .... CUSTOM LOGIC HERE.... # .... CUSTOM LOGIC HERE.... # .... CUSTOM LOGIC HERE.... except Exception as e: siemplify.LOGGER.error("General error performing Job {}".format(SCRIPT_NAME))

62
S
ORBR
ORBRBronze 5
asked in Google Security Operations
Email Notifications on Case and Task Assignments

Hello,Is it possible to receive an email notification from the SOAR system whenever I or my role are assigned to a case by another analyst or role, or when a new task is assigned to me? (not by playbook).

01
S
J
JedWalNew Member
posted in reCAPTCHA
reCaptcha v2 - invisible constantly triggers challanges

Hi Community,I'm looking for help & advice about reCaptcha v2 type invisible which for one of the sites we've set this one up started couple of months ago triggering challenges multiple times. It could be 10 times even when user solves it correctly.We did a check of IP addresses calling for our web application and their reputation using one of available on the web sites offering such a service. And reputation seems to be OK.No idea then what else could cause that.Any suggestions/ hints would be more than welcome.Jed.

102
J
E
ev13New Member
posted in Google Security Operations
Workday Integration to Chronicle SIEM

Do you have any documentation on the integration of Workday with CSIEM? I understand this typically involves a third-party API, but are there any resources available that could be shared with the client to guide them through the process?

33
A
SitaRam
SitaRamBronze 4
asked in Google Security Operations
Skipping Playbook Flow (Multi-Choice Question)

Hi, noticed the option on step failures is missing. Is there any alternative for this?@Soar team, please add them. So that we can create new kinds of playbook patterns. 

12
SitaRam
Z
zz_New Member
posted in reCAPTCHA
Recaptcha enterprise - invalid API key response

I am attempting to set up enterprise Recaptcha integration, and have reached the stage of making the assessment call from our application server via a REST API call. However when making this API call I'm receiving the following error response: { "error": { "code": 400, "message": "API key not valid. Please pass a valid API key.", "status": "INVALID_ARGUMENT" } }  Can you please clarify the difference between the values required for the KEY_ID and API_KEY fields, and where to find the required values for both? The "use an API key" section of the documentation doesn't give sufficient detail.

131
JoshD
Staff

Badge winners

  • Comments Posted 1
    CBMascarenhashas earned the badge Comments Posted 1
  • Comments Posted 150
    ylandovskyyhas earned the badge Comments Posted 150
  • Authored Posts 1
    patelrdhas earned the badge Authored Posts 1
  • Authored Posts 10
    Rob_Phas earned the badge Authored Posts 10
  • Comments Posted 1
    sivahas earned the badge Comments Posted 1
Show all badges
Terms & ConditionsCookie settings
Privacy Policy Terms of Service Gen AI Policy Community Guidelines Cookie Settings

© 2025 Google. All rights reserved.