Security Forums

Hey AllIn the workspace user parser my users get the same email added to the entity.user.email_addresses field. This is slightly annoying, so I tried to remove it. My idea was to just dedupe at the bottom of the parser so that I can merge in future changes relatively easily.However, i'm struggling to understand what my options are for dealing with an array/repeated field. It looks like i'm not able to iterate over, reference individual values or flatten it back to a string. The only thing I can find that works is checking for existence, so I can have a bunch of if statements that look something like this:  if [var_email] =~ /.*specificallyExcludedDomain\\.com$/ or [var_email] in [var_entity][user][email_addresses]{ } else { mutate{ merge => { "var_entity.user.email_addresses" => "var_email" } } }  Am I missing an obvious way to interact with these repeated fields in the parser? Any ideas would be awesome. 

Hello everyone,I would like to ask is it possible to search for alerts and their details using the udm search ? If yes, what search query is suitable for this purpose.Thank you in advance !

Hello all, we are using a Google SecOps Instance and try to use the "Approval Link" Feature for our Playbooks. As far as I understand it the approval can also be given from users which do not have an account in the SecOps Instance (First Line "Outside the platform": https://cloud.google.com/chronicle/docs/soar/respond/working-with-playbooks/assign-approval-links-in-actions)After the mail is sent to my inbox and I try to open the approve or decline link in Inkognito mode, the screen stays blank and no error message appears. If I open the link in a browser session where I am logged in into Google SecOps, I can approve/decline the question.Can anybody help me or had the same issue?I created the playbook exactly as in the instructions mentioned above.Thanks, Marinus

Hi I'm a user of Enterprise reCaptcha and considering lowering(?) the level of ChallengeSecurityPreference from "Balance" to "Usability".I can not find any detail especially related toHow you determine which traffic is risky per each enum value; as this is not from the score-based reCaptcha and also want to understand what is the difference, too. (Such as v1 uses this many factors but v2, score-based uses this many factors....)How much increase of risk we have to expect with this change (more chance of bot attack?)And want to know if anyone from reCaptcha team can help with it.Thanks in advance.

Hi folks I just accidentally found that I can comment out a line in SIEM UDM search by ctrl-/ and I can be anywhere on the line to do it.I think that means there are default keyboard shortcuts... maybe?Anyone have a list or a link to a list?Chris Martin has an article from Aug 2024: uses Shortkeys browser etension - but I'd rather not use an extension.https://medium.com/@thatsiemguy/adding-keyboard-bindings-to-secops-using-shortkeys-fb3a18cb284dI found the Martin article  using this searchkeyboard shortcuts (site:www.googlecloudcommunity.com |site:cloud.google.com/chronicle | site:chronicle.security |site:github.com/chronicle) |thatsiemguy

Validation Customers, The Mandiant Intelligence Validation Research Team (VRT) has published VHR20240918 - Content Expansion, a Security Content Pack focusing on Campaign 24-032, Campaign 24-034, and Campaign 24-036. The content pack includes 12 new Actions and 9 new Files. For full details on this release, see the Release Notes on the Mandiant Documentation Portal.

Hi folks, for the sake of learning, I want to understand how the alert overflow mechanism works. In the documentation, it states that the alerts must have same environment, product and rule and should be ingested in a short time period.I have created a connector that generates 2-5 alerts every second. This does fulfill the criteria of 50 alerts within 10 minutes. However, I do not see any overflow case being created.As seen in the code above, I have used the is_overflowed method to test if the alert is an overflow or not. However, I do not see any overflow alert ingested.Finally, the connector execution logs show "No data found for property key: overflow_settings". Does this log justify the behaviour ? Also, how should I set this overflow settings key ?Thanks.

While testing a mobile app in the staging environment against a test reCAPTCHA iOS key we got this error response when attempting to initialize: Only one site key can be used per runtime. The site key you provided **** is different than ****In particular, we are sending the staging site key but it is saying it doesn't match the production site key. I can't find any documentation regarding this but I suspect that the reCAPTCHA SDK sends along the application's ID (iOS bundle or Android APK package name) and if there is already an associated site key that has been used for it only that site key is allowed to be used by that application. This would mean that to successfully use test keys in lower environments we are forced to build variants of the applications for that purpose, which could be identified as distinct from the production version of the applications.Is this correct? Moreover, does this apply to web applications as well owing to the origin domain of calls to ini

Currently, the only way to check the SOAR audit logs is going directly to SOAR Settings->Advanced->Audit. In this console it is possible to see who did what, when, and where. How could I configure an alert so that when somebody deletes or modifies one of the playbooks, an alert is sent? maybe shipping the logs to Cloud Logging? Thank you!  

How can I install TIPCommon Library in a custom integration ?

I want to add longer descriptions in the meta of  some SIEM rules so the info shows up in the related SOAR cases .The description has to be in quotes (""s) I know, but can it have line breaks?E.g.  can I do this without breaking the rule ? Will the whole description present in the SOAR cases  rule some_rule { meta: author = "analyst-name" description = "Failed MFAs. This is available as well as a Saved Search. Make sure to corrrelate time frame with alerted event. Use this SOP (link to SOP) " severity = "Low"  I know this isn't the best way to handle the SOP presentation in the SOAR - just using that to create an example 'multi-line' description string with line-breaks.thanks  

Hey everyone!Our application which uses Recaptcha Enterprise V3 has been throwing errors in some random instances but not always and we can't seem to pinpoint any sort of situation this happens in meaning we can't reproduce the error occurring locally. The error happening is this on line 476:41 of the script. d.charCodeAt is not a function. (In 'd.charCodeAt(l)', 'd.charCodeAt' is undefined)  It seems to happening when we are adding the script on mounted of our vue instance.  const recaptchaScript = document.createElement("script"); recaptchaScript.setAttribute("src",'https://www.google.com/recaptcha/enterprise.js?onload=onloadCallback&render=explicit'); document.head.appendChild(recaptchaScript); Obviously the script is minified so we can't check to see what this "d" which chatAt is being called on.If anyone has any insights then that would be appreciated, thanks!

Hey Folks,I am fairly new to Chronicle's IDE for custom app development. I have developed an app for an unsupported log source to ingest logs from a vendor API. I have managed to create batches and successfully push logs to Chronicle. I do see http response 200 for all batch post requests. However on SIEM I can only find significantly less entries created. Validated this by rerunning the job i created several times. It's like less than 1% of total events getting invested. My events are proper json formatted and structured as per ingestion API specs. How can I isolate the problem? 

Hi Guys,I am trying to integrate On prem Splunk which is hosted on AWS cloud. AWS team allowed communication between Chronicle SOAR (ingress and egress) IPs and Splunk search head public IP over port 8089. But still getting connectivity error:Failed to connect to the Splunk - Ping server! Error is HTTPSConnectionPool(host='x.x.x.x', port=8089): Max retries exceeded with url: /services/search/jobs/export?output_mode=json (Caused by NewConnectionError('<urllib3.connection.HTTPSConnection object at 0x7cce8a7c9710>: Failed to establish a new connection: [Errno 110] Connection timed out'))From the network side, we see traffic accepted from SOAR egress IP but no traffic for ingress IP.We want to integrate Splunk ES - Notable Events Connector to ingest notables.Any help on this will be greatly appreciated.

I want to be able to find successful windows logons, specifically remote logon's, and capture data from fields that are relevant to the event. I would then like to present the data from those fields to the analyst. I am able to use the metadata.product_event_type = "4624" to find Windows Security Events with an event ID of 4624 (successful logon event in Windows) and then I can refine and find remote logon types with extensions.auth.auth_details = "10" or extensions.auth.auth_details = "3" I want to match on the above events, then I want to extract the following fields from any matching event, and display the results of those fields as columns in a table with each row being an instance of the event that matches the rule. The fields I want to capture are: metadata.event_timestampextensions.auth.auth_detailsprincipal.hostnameprincipal.ipprincipal.process.command_linetarget.administrative_domaintarget.user.userid  

I Want to create a dashboard for the alerts that are triggered in SIEM and need to know the case has been created in SOAR arent?Dashboard to find when was the last alert created in SIEM, when was the last case created in SOAR, how many laerts got created and subsequent cases in SOAR

Recently questions have come up related to the discovery context entry of internet archive database and what that represents.  This information is being pulled from the internet archive / wayback machine API.  Sometimes you will find there are references here that still point to your organization's domains.    

Community,How do I bring "Audit Logs" from "ManageEngine Endpoint Central" to SecOps ?Endpoint Central is a supported log type, I don't find an documentation to integrate, please post if there are any docs. 

Hello,I added a list of custom fields to my Qradar connector (Qradar Offenses Connector).When I test the connector I don`t see the custom fields, also I get the following error.Would someone be able to help? 

I’ve set up a custom connector and successfully ingested alerts into the platform. However, when attempting to map entities for the event on the ontology page, it shows "unknown_event_type." I’m uncertain about how to define the event type within a custom connector. Could you guide me on this?

Hello all, I have the issue, that I want to put into the field "Message to assignee" a string which is larger than 250 characters (including the content of the placeholder variables). The field is limited to 250 characters and I am unable to execute the question in a case if the the field contains more than 250 characters.Had anybody the same issue and can help me?Thank you, Marinus

Hi.According to Gemini in Google SecOps documentation, it mentions the capability to use Gemini for generating logs:I'm relatively new to the Chronicle product, and my organization has recently started developing rules and playbooks. However, it appears that we don't have the option to use Gemini for SIEM Search in our interface. we only see options for "Go to Legacy search" and "UDM Lookup"We initially thought this limitation might be related to API enablement in GCP, but we do have access to Gemini AI capabilities under "Gemini Summary" in our cases and "Generative AI" module is active under "License Management". Can anyone clarify if the Gemini AI tool's query capability requires a specific subscription tier within Google SecOps? I'm interested in this feature but unsure if it's included in our current service package or requires an additional subscription.Thank you!

Hello Team,For the 'impossible_travel_login_activity' alert involving from a user, our initial review of the events showed activity from only one country in the SOAR case. However, when we applied the rule in the SIEM, it identified an additional event indicating activity from a different countryWe have a rule for "impossible_travel_login_activity" that flags logins from two different countries within a 3-hour time periodOnce we investigated the alert in the SIEM, we observed 61 events from both countries. However, only 10 events for one country were captured in the case. Is the case section limited to only 10 events, or can we modify this limit? If modification is possible, please let us know how to proceedThanks  

Has anyone tried to map entities in the parser ? (Ex. entity.user.user_id, entity.url, entity.hostname, etc...).What is the possible solution to parse IP, Hostname, URL, etc.. as entities ?

Hi #community,Is there any option to throttle or prevent a rule with same criteria triggers for x period of time since it was last triggered. Let's say we keep receiving bruteforce for multiple user out of which one of them was targeted recently. My rule currently detects more than 3 authentication failure for one user within 10 min. The issue is every 10 min the rule will check for the activity and detects events matching criteria including the one that was already triggered.I do not want to increase the frequency as I want the detection to be almost real time, and want to exclude the same criteria (same source and same user) for the next 1 hours since it was once triggered. This is to prevent analyst from being buried down in anlerts Below is the sample of the rules in-context.  rule google_login_bruteforce { meta: author = "Srijan Kafle" description = "Detects more than 3 authentication failure in google accounts" severity = "Medium" created = "2023-12-1