Skip to main content

Security Forums

Welcome to the Google Cloud Security Forums! Your ultimate security conversation spot. Collaborate with peers and experts to solve challenges, together.

2489 Topics
M
malzahnOptivBronze 2
posted in Google Security Operations
SIEM Identity

I've seen conflicting information on this topic:  Is it required today that a new Google SecOps client bring their own third-party identity provider?Thanks,Eric

01
R
Staff
S
skadavBronze 5
asked in Google Threat Intelligence
How to enable SSO on Mandiant?

How to enable SSO on Mandiant?

01
Rob_P
Staff
SoarMike
SoarMikeBronze 1
asked in Google Security Operations
Raw logs (ingestion API) + custom Parser

Good morning, I have a question about log ingestion via the ingestion API. Initially, my logs contained only 13 fields for testing purposes. However, I later expanded them to include 22 fields. I built a custom parser, and when I preview it, the UDM output appears correct.The problem I am having now is when I go to validate the parser it errors out and indicates that the older raw log with 13 fields is the cause which makes sense as the columns/fields are missing. I was wondering is there a way to remove an individual log or even just remove all entries and start fresh?Thanks in advance

22
SoarMike
M
muniraja1New Member
posted in Google Security Operations
Web Proxy Zscaler

how to integrate  Web Proxy Zscaler into SIEM. Please share the URL.

12
J
A
ad9001Bronze 1
posted in Google Security Operations
Kubernetes textPayload Split

HiWithin the Kubernetes Node parser, I am trying to split the textPayload into separate fields. The textPayload field contains long text which we're trying to extract and split the field into a key then the output of the field to a value. An example of a raw log (data nullified):"textPayload": "time\\u003d\\"0000-00-00T00:00:00.0000000Z\\" type\\u003d\\"container_app_firewall_audit\\" container_name\\u003d\\"container-name-here\\" image_name\\u003d\\"image-name/here:latest\\"How can I assign lets say for example time and type to its own separate UDM field OR automatically add an array with key and value pairs? I've configured extension parser as shown below here, however it's not splitting the values by spaces. filter{ mutate { replace => { "textPayload" => "" } } if [textPayload] != "" { mutate { split => { source => "textPayload" separator => " " target => "textPayload_array" } } mutate {

09
R
Staff
A
Anonymous
posted in Google Security Operations
parser

Hello Team,Can someone assist me with pattern matching and parsing this type of log in Chronicle?"version account-id interface-id srcaddr dstaddr dstport srcport protocol packets bytes end start action log-status vpc-id subnet-id instance-id tcp-flags pkt-srcaddr pkt-dstaddr region"

07
I
I
ivarBronze 1
asked in Google Security Operations
Parser extension Multiple Raw field to same UDM Field

 In a predefined parser, 2 different raw fields are parsed to same UDM field:"var_target.resource.resource_subtype" => "%{protoPayload.request.machineType}" "var_target.resource.resource_subtype" => "%{resource.type}"  When raw log has both the values (resource.type and protoPayload.request.machineType)  target.resource.resource_subtype contains value of resource.type  because it’s mapped later on in the parser.How can we extract both the fields?  

03
I
T
TheSecOpsGuyBronze 5
posted in Google Security Operations
Dashboard - Chronicle SIEM

Hi Team,Do we have a repository from which we download / export Dashboards ? 

26
N
S
srijankafleBronze 2
posted in Google Security Operations
Alert for silent log source

Hi Team,Can anyone provide an insight on how can we create an alert if a log source (Let's assume a principal.hostname) stops sending logs for 30 mins?  

75
S
JaredBloomberg
JaredBloombergNew Member
asked in Google Security Operations
Reference Lists and Visualizations

Hello,Does anyone know if the functionality exists to incorporate a reference list into a dashboard visualization? Specifically for a UDM Events visualization?If that is not currently possible does anyone know if it is on a future roadmap?

02
JaredBloomberg
M
Staff
MarieStaff
posted in Google Security Operations
🔥 Hot Off the Press: Google Cloud Security News & Updates

Hey security pros! 👋  Just catching you up on some exciting Google Cloud Security news that's got me pretty pumped:Q1 Product Roundup:  Google's been hard at work, and their latest security features are 🔥! Seriously, check out the roundup. Some real game-changers in there. Gartner Magic Quadrant:  We made it! Google's a Visionary in the 2024 Gartner Magic Quadrant for SIEM. This is a big deal, folks. Validation that we're on the right track. Your Voice Matters:  Have thoughts on Google Cloud Security? Good or bad, we want to hear them. Share your feedback and you might just get a little reward for your time. 😉

20
M
Staff
P
phaubertinBronze 2
asked in Google Security Operations
Office 365 apps configuration

Hi all, I'm in process of ingesting Office 365 feed into chronicle SIEM. I would like to know if there is guidance on how to configure apps on Azure side. Chronicle doc page forward people on Microsoft doc,  Office 365 Management APIs , Microsoft explain the behavior of the setting, but It don't told us what parameter to satisfied the requirements for chronicle feeds ingestion.Any Chronicle customer, that have configure apps on azure and  can share their experience? Best regards, 

15
P
tameri
Staff
tameriStaff
posted in Security Validation
How to create Web Actions - Google Chrome 78.0.3904.70 (CVE-2019-13720) as an example

In this post, I will show you how to use Mandiant Security Validation (MSV) and available exploits to validate whether your internet security controls can detect and/or prevent a Chrome browser exploit. As a Network Security Administrator or Red Teamer, your task is to validate whether your network security controls can detect and/or prevent a Remote Code Execution exploit targeting Google Chrome 78.0.3904.70 (CVE-2019-13720)The steps will be as follows: Find the exploit that will be used to test the security stack. Create network action, in this case it will be Web Action. Run the network actions between an internal actor (representing a victim PC) and a cloud actor (representing the adversary exploit kit server). Validate the efficacy of the internet security controls and address any gaps. 1-Find the exploit that will be used to test the security stack: A quick research, you came through the exploit targeting that vulnerability (in https://www.exploit-db.com/exploits/50917) 2-Creat

00
tameri
Staff
A
Anonymous
asked in Google Security Operations
Info needed: Latest Webhook update

Hi Team,Could anyone please provide the detailed documentation of the latest update Webhook integration.When I attempt to push "hello world" string to chronicle Via webhook it is throwing me 404 error. I used curl in Linux for the same. $curl https://**-chronicle.googleapis.com/v1alpha/projects/*******/locations/**/instances/*****-***-****-******-******/feeds/*****-***-****-******-******/:importPushLogs?key=*****************&secret=************************************* -X POST --data "hello world"The same url format I tried to configure a cribl webhoon destination. Please find the below snip.Could anyone please let me know what am I doing wrong here?Thank you in advance.Thanks,

28
A
A
Anonymous
asked in Google Security Operations
Json parsing inside Message

Hello Team, we are trying to parse fields from json log format, but there are nested fields  Within the "Message".we user the json filter and other different steps.All the fields inside the "Message" are not being parsed, Please chek the sample log for reference.{"EventReceivedTime": "202*-0*-** 21:44:45","SourceModuleName": "in_json_log","SourceModuleType": "im_file","Message": ",{\\"_id\\":\\"66**c7d23afb**6e6*0f2\\",\\"serialNum\\":0,\\"acknowledged\\":***,\\"time\\":\\"202*-0*-**T14:14:04.657Z\\",\\"hostname\\":\\"e-d**-g**l-cluster-normal--7-mm.q-gcp-00-d-g-24-02.181862379",\\"fqdn\\":\\"\\",\\"containerName\\":\\"bu\\",\\"containerID\\":\\"2a91f881c8075c4f34db5*****3d6e\\",\\"imageName\\":\\"d***.io/google/cloud-:l\\", please suggest a way to parse the fields insite Message.

34
A
J
janpokorny5635New Member
posted in Security Validation
dobrý den, prosím o reset hesla na e-mail (<PII removed by staff> ) děkuji, napište mi prosím na e-m

Bdobrý den, prosím o reset hesla na e-mail (<PII removed by staff>) děkuji, napište mi prosím na e-mail <PII removed by staff> nebo <PII removed by staff>  děkuji Jan Pokorný

01
AaronR
Staff
A
Staff
andras11Staff
posted in Security Command Center
AWS threat and vulnerability detection in SCCE

Today's enterprises rarely rely on a single cloud provider. Hybrid and multi-cloud strategies have become the norm, offering flexibility and avoiding vendor lock-in. However, this diversity can make security management complex. Google Cloud's multi-cloud security initiatives aim to address this challenge head-on. You can now connect Security Command Center to Amazon Web Services for the following capabilities: Detect threats and vulnerabilities Assess the risk exposure of your high-value AWS resources Assess compliance with security standards Connect to AWS for threat detection Certain threat investigation capabilities in the Enterprise tier of Security Command Center are powered by Google Security Operations, including curated detections which enable you to identify patterns in both Google Cloud and AWS data. If you plan to use curated detections, make sure to review information about supported log types. Each rule set requires certain data to function as designed, including one or

31
vaskenh
Staff
M
Staff
MarieStaff
posted in Google Security Operations
Want to Modernize Your Security Operations? Don't Miss This Webinar! 🚀

Ready to embrace the power of Detection-as-Code and take your SecOps to the next level? Join David French and the Google SecOps (formerly known as Chronicle) team on May 29th at 9 AM PST for our Security Spotlight: "Modernizing SecOps with Detection-as-Code and Chronicle." Register now and secure your spot!  Get a head start by diving into our two-part blog series on Getting Started with Detection-as-Code and Chronicle Security Operations: Part 1:Getting Started with Detection-as-Code and Chronicle Security Operations (Part 1 of 2) Part 2: Getting Started with Detection-as-Code and Chronicle Security Operations (Part 2 of 2) In the webinar, you'll discover: The fundamentals of Detection-as-Code and its key benefits How to manage detection rules using Chronicle's REST API, code, and CI/CD tools Real-world strategies for implementing Detection-as-Code in your organization

10
M
Staff
N
NEIOBronze 3
posted in Google Security Operations
Azure AD SSO integration with Google Chronicle Secops

I am trying to integrate Azure AD SSO with Chronicle SIEM , The relevant team has provided the required keys to support the integration, yet its getting failed.I request someone to please help me on this.I have selected options as "Azure AD" as log type and Third party API respectively.Still facing same issue, can someone please guide me to resolve this issue ASAP.

31
J
T
TheSecOpsGuyBronze 5
posted in Google Security Operations
How can we integrate Microsoft Defender for O365 with Chronicle SIEM ?

How can we integrate Microsoft Defender for O365 with Chronicle SIEM ?Is it using Microsoft Graph Alert (Third Party API) ?https://cloud.google.com/chronicle/docs/preview/siem-integrations/microsoft-graph-alert.

03
J
G
gbamNew Member
posted in Google Security Operations
Passing Entities into an HTML Widget

How can I pass Entries into an HTML widget?  I've tried every combination of Entity.  For example:EntityEntity.variouskeysEntitiesWhen you view the placeholder menu, it shows the list of Entity options but none of them render data when there is a valid entity - or a valid entity with those parameters.  Is this a bug / feature or is there nuance to getting to work? 

01
mokatsu
S
s_shubhNew Member
posted in Google Security Operations
Got an error as - "udm and entity are both non-nil"

Hi Team, While parsing UDM Entity and UDM Event for under the same parser, I got following error.   generic::invalid_argument: udm and entity are both non-nil"  Code is working perfectly while removing entity related confg blocks

01
M
Staff
JaredBloomberg
JaredBloombergNew Member
asked in Google Security Operations
Searching Entity Data

Hello,If I understand correctly you currently cannot use UDM search to look at entity data directly? For example, if I type in metadata.entity_type != "" I get an error saying that that field does not exist. Is there some other way to directly query/search the entity data in Chronicle?

43
M
tameri
Staff
tameriStaff
posted in Security Validation
How to use Security Validation and VirusTotal to measure your Internet Security Controls

In this post, I will show you how to use VirusTotal and Mandiant Security Validation to validate that your internet security controls can detect and/or prevent command and control communication for a malware sample. As a security analyst, you have been tasked with validating whether your network security controls can detect and/or prevent Cobalt Strike Command and Control communication.. The steps will be as follows: Find the Cobalt Strike malware sample that triggered both crowdsourced IDS and YARA rules. Download the PCAP artifacts of the malware. Create network actions by importing the PCAP. Run the network actions between an internal actor (representing a victim PC) and a cloud actor (representing the adversary C2 server). Validate the efficacy of the internet security controls and address any gaps. Having access to VirusTotal you can search using the following filter: crowdsourced_ids:"Cobalt Strike" crowdsourced_ids:"Beacon" crowdsourced_yara_rule:CobaltStrike The filter will r

20
tameri
Staff
aivaras
aivarasBronze 1
asked in Google Security Operations
Ingesting custom log data to Chronicle SIEM - Not existing Log Source and Log type

Hi Community,Did anyone try to ingest a completely custom log data to Chronicle SIEM?I mean log data which does not fall under any log sources (JSON, KV, etc.) and does not fall under any log types (Azure AD, Linux Auditing System (AuditD), etc.)?I can write a parser after ingestion, but it is not too clear how to inject data which cannot be attached to any of current categories (log sources or log types).P.S. Log data type was created without consideration of existing log types and sources.

173
cmorris
Staff

Badge winners

  • Authored Posts 1
    patelrdhas earned the badge Authored Posts 1
  • Authored Posts 10
    Rob_Phas earned the badge Authored Posts 10
  • Comments Posted 1
    sivahas earned the badge Comments Posted 1
  • Authored Posts 1
    sivahas earned the badge Authored Posts 1
  • Authored Posts 15
    TheSecOpsGuyhas earned the badge Authored Posts 15
Show all badges
Terms & ConditionsCookie settings
Privacy Policy Terms of Service Gen AI Policy Community Guidelines Cookie Settings

© 2025 Google. All rights reserved.