Security Forums

I recently encountered an issue where some of our systems unexpectedly became unavailable. After investigating, we found that the reCAPTCHA token used in our applications had suddenly become invalid.We didn’t deactivate the token ourselves and didn’t receive any notification from Google about its deactivation. Has anyone else faced a similar situation? I’d love to hear your insights or suggestions on where to start investigating this kind of issue.I’m also a bit concerned that this might happen again in the future, so any advice on how to prevent it would be greatly appreciated.Thanks in advance for your help!

Hi, my customer currently stores all their workspace logs in BigQuery on Google Cloud Platform (GCP). They would like to forward all logs from BigQuery directly to Google’s Security Operations (SecOps) solutions. Is this possible? If so, what would be the best approach to achieve this? Also, could you point me to any relevant documentation for this process?@cmmartin_google 

Hello,In https://www.google.com/recaptcha/admin/ I have set up 27 websites.In the last 7 days I have had a total of over 10,000 requests, so I imagine that monthly I get to over 40,000 requests.All these sites are connected to a project on Google Cloud Platform, where I have also activated billing, which is 0€ each month.What is the limit of free requests?Do I get a warning when I exceed this limit?

I went herehttps://www.google.com/recaptcha/admin/createfilled in the blanks and hit createnow I have an email saying my setup isn't complete and sent me herehttps://console.cloud.google.com/security/recaptcha/6LeUgakqAAAAAG1ZGckvSMvRdNWZIqc9Yohr-AEK/integration?project=my-community-calendars I have no idea what this page says. It may use English words which is my native language but I am not a coder and I thought recaptcha was a simple one click install for Wordpress.  why am I being sent to some technical dashboard asking me APIs, JSONs and Http refferrers??  I am not going to coding school just I can put a spam deterrent on a simple WP form

I have a log source that can group json objects into a single raw log. I've checked out - https://cloud.google.com/chronicle/docs/reference/parser-syntax#generating_output_-_multiple_eventsis there a way to dynamically iterate over the index, increment it and output each UDM event? something like - for event in events { mutate { replace => { "index" => 0 } } if [ip] != "" { mutate { merge =>{ "udm_event%{index}.idm.read_only_udm.target.ip" => "ip" } } } mutate { merge => { "@output" => "udm_event%{index}" } } %{index}++ } Additional context is that they come in as json objects within a list. I've got them all split out but would like them to be parsed into sep

Can someone provide a code snippet for parsing unix_ms from the field 'timestamp' in a json log? I'm in a documentation rabbit hole and just need some fresh eyes.I get 'unsupported timestamp value format float64' but can't see a function to convert.

Can ontology/mappings be pre-configured and shipped with our integration, or are events required to make the fields accessible for mapping?For example, I want to map SourceHostName to the field src_host_name(which will be available in the data ingested) in advance, right after installing the integration, without configuring the connector and fetching first event. I noticed there is a MappingRules field in the connector def file with empty list values. Can this field be utilized to achieve this? If yes, please let me know how to configure it.Any feedback is appreciated.@cmorris @f3rz 

I've had an error pop up when setting up reCAPTCHA on a Webflow website. (It’s worth noting that Webflow doesn’t provide support for this.)Webflow includes built-in fields for the site and secret keys in its settings, which usually makes the setup simple. However, I recently received an email from Google Cloud about needing to verify something, and I’m not sure how to approach this within Webflow.Has anyone experienced this issue?

I have noticed that there are no detection rules available for Spanner and Bigtable in the Secops community rules and curated detections,. I would like to explore opportunity to enhance threat visibility around Bigtable and Spanner. Do any one have any recommendations or suggestions for crating detection rules that would help improve monitoring and security of these services.I am particularly interested in ideas or best practices to address potential risks and ensure robust threat detection. I would greatly appreciate any input or feedback from your experience or perspective.

Starting around 13:00 pacific today, we've been getting elevated levels of errors trying to verify recaptcha from our back-end.  The error we're getting back is:{ "success": false, "error-codes": [ "timeout-or-duplicate" ]}Here's a screenshot of stdout from our server showing instaces of "recaptcha":As far as I can tell, we haven't changed anything that would have caused this.The only thing I can think of is converting from a legacy to enterprise key -- that was done last Monday as a direct result of this -- https://www.googlecloudcommunity.com/gc/reCAPTCHA/ReCaptcha-Test-Key-stopped-working/m-p/860259#M346 According to the UI of recaptcha, we're seeing elevated le

I didn't see log type "Island Browser logs" in available log types listed in thrid party API source type. Can someone explain me how to integrate it if you have done it in the past?

We are new to SecOps SOAR. With the SOC team deployed who is monitoring the alerts manually, we like to know what are the common playbooks that every environment should have? Can someone share a list or share use cases to make rhe best use of SOAR platform? We have data sources from AWS, GCP, GWS, AZURE, SentinelOne. 

Since yesterday's patch window, all of our playbooks are no longer automatically applying via custom trigger. After some testing, only the 'Alert.' calls have changed. There appears to be no change with 'event.' calls.[alert.alertname] has to be [Alert.alertname]This requires a full rework of every playbook we have in production(total 458 playbooks, inactive and active). Some heads up on the change being implemented would've been great!

Hello, I have a form on my website that allows non-authenticated users to complete. The form can also be completed by the user logging in. If the user has Google Services turned off, can they still access and complete the form if they are signed-in?Scenarios:1) unauthenticated user navigates to form. Prompted by reCaptcha. Google Services not deactivated. All ok. 2) unauthenticated user navigates to form. Prompted by reCaptcha. Google Services deactivated. User does not see form? What do they see?3) authenticated user navigates from within the application to the form. They will see the form? Thanks for your help. 

Hi All, I have used set content value for a key "No. of emails deleted" and value is set to "count of events [execute udm query .events]" . and i used key-value widget to render it.it works in my lab instance but not in client instance ?] Why?not only this field all fields (event fields, alert fields, action result etc) 

Hi,I’m concerned about finding a cost-effective solution to ingest these logs into Google SecOps. While I want to send this type of log data to Google SecOps, I’ve noticed there is a charge for Cloud Logging. If I agree to pay for the storage and retention costs associated with a Cloud Logging bucket, would there still be any egress charges for transferring these logs to Google SecOps?Thank you!Option 1: Direct ingestionA special Cloud Logging filter can be configured in Google Cloud to send specific log types to Google Security Operations in real-time. These logs are generated by Google Cloud services.Google Security Operations only ingests supported log types. Available log types include:Cloud Audit LogsCloud NATCloud DNSCloud Next Generation FirewallCloud Intrusion Detection SystemCloud Load BalancingCloud SQLWindows Event logsLinux syslogLinux SysmonZeekGoogle Kubernetes En

 Is there any way to view images that have been attached to the case and are on the case wall without downloading and opening in an external app? 

I need to report SOAR cases by bespoke cateogries:A good way to add tags to my SOAR cases uses the SIEM rule syntax meta section ("meta: "; e.g I add something like: report_category = "UnAuthorized Access"But I'm struggling to see how I can use these as tags to define categories in the SOAR...also struggling to see how I can use anything except strings in the alert names for this purpose either. [EDIT: I can't even recall what I meant here - 😞  ]Anyone have any luck creating metrics reporting cases per bespoke category? or even by ATT&CK category.thanks 

I've noticed that even though I have cases that have breached SLA open the SOC status widget does not report any cases that have exceed SLA. I've tried exporting the JSON for a test dashboard that uses this widget but can't find anything in there that might need changing. Does anyone have any ideas on how this could be fixed?

Is there a way to store a value, such as an offset, and subsequently retrieve/update it in consecutive connector-runs? Trying to prevent a custom-connector from re-creating cases/alerts and ensure it checks for unique event/alert IDs/fields against values inside existing cases before creating a new one

If I have a dev, stage and prod instance? Can I use git sync to synchronize components, pull updates, and push playbooks and cases from one instance to another? If not, how would I be able to set certain cases and playbooks to simulated mode or dev by default? 

I have a rule that previously generated detections, but now when I attempt to run a retro hunt, it is not generating any alerts.

Unintended service account impersonation is a significant concern when it comes to service account abuse.While reviewing logs to detect when one service account impersonates another, I noticed that Chronicle does not parse the impersonator service account into a separate field.Instead, the impersonator’s service account email is added to the principal.email_addresses repeated field.This creates challenges in fully detecting impersonation activities, as the impersonator email is not consistently placed in the same order within the repeated field. Even if we assume that the last email in the list could be the impersonator's, it’s difficult to pinpoint the last index when writing detection rules.This makes it challenging to create effective rules for identifying service account impersonation. Has anyone encountered this issue, or does anyone have alternative solutions (other than creating a custom parser)?

Hello,We got a notification from Google stating that we exceeded the free quota and we were asked to add billing information. We added the billing information and the CAPTCHA - v3 started working again.Got a question on this :When we go to reCAPTCHA admin console, when I see the analytics it says we received 816K requests this week (that is from Jan 9th to 15th Jan) and 14% of it were suspicious. Especially, if we take 15th Jan - it says 97,156 requests were legit and 16,320 were suspicious. If I view this project in Google Cloud for Jan 15th: the max. requests we got is 155 and high risk is 1. Why is there a difference between these two dashboards? Could you please give me a detail on what these numbers are? 

We are having an application which is exposing it's findings in it's own API, we have been provided with their endpoint URL and API token.I'm unable to see any integration options available in SIEM/SOAR where we can pull such data from the 3rd party API except those already defined like Microsoft Graph/Crowdstrike etc.,What should be our approach here?