Skip to main content

Security Forums

Welcome to the Google Cloud Security Forums! Your ultimate security conversation spot. Collaborate with peers and experts to solve challenges, together.

2479 Topics
A
Staff
andras11Staff
posted in Security Command Center
By Your Powers Combined! SCC and Chronicle SIEM Form a Cloud Security Captain Planet

Security Command Center (SCC) and Chronicle Security Information and Event Management (SIEM) are two powerful security tools that can significantly enhance an organization's security posture. When integrated, these products offer a comprehensive and unified view of an organization's security telemetry, enabling more effective threat detection, investigation, and response. Benefits of Integrating Google SCC and Chronicle SIEM Unified Security Visibility: Provides a single pane of glass for viewing all security telemetry, including alerts, events, and investigations, from both SCC and Chronicle SIEM and the rest of your infrastructure and security data reporting to your SIEM. Enhances situational awareness for security analysts, enabling them to quickly identify and respond to threats across the organization's entire security environment. Enhanced Threat Detection: Security analysts can use the integrated platform to proactively hunt for threats across the entire security environment

31
D
Staff
Chris_B
Chris_BBronze 5
posted in Google Security Operations
remote login analysis using IP addresses - unreliable?

@Marie_Chudolij  YouTube video 2-27-24 - Chronicle SOAR to the Rescue: Orchestrate SIEM Reference List Updates for Improved Threat DetectionI suggest IP addresses and info inferred from IP address can be unreliable for remote login analysis as:- the geo location is not 100% reliable per se- logins via VPNs with changing IPs- logins via cloud resources (why is Joe from Chicago coming in from Council Bluffs, IA every few minutes?)In future sessions I'm interested in more behavior based analysis to look for bad remote logins.I enjoyed the YouTube video - thx for your work

01
D
Staff
ORBR
ORBRBronze 5
posted in Google Security Operations
Get Insights \\ Detailed table from JSON results

Hey,I`m struggling with some issues when trying to present insight on the case\\ alert page after enrichment actions, for example, QRadar AQL search or AAD user enrichment.I tried using the "Insights_Create Entity Insight From JSON" action but no luck. I would appreciate it if someone could please share a tutorial.

01
S
D
Staff
dnehodaStaff
posted in Google Security Operations
Empowering Detection Engineering with Chronicle SIEM and Mandiant Security Validation

Empowering Detection Engineering with Chronicle SIEM and Mandiant Security Validation       Introduction   Detection engineers face the relentless task of creating, refining, and validating SIEM rules to keep pace with evolving threats.  Ad hoc testing and reliance on simulated attacks often lead to blind spots and false positives. Mandiant Security Validation (MSV) offers a systematic, attack-centric approach to streamline rule development and proactively uncover weaknesses in your detection logic.   MSV for the Detection Engineer Beyond Vulnerability Scans: MSV tests your entire detection pipeline, not just isolated attack components. This uncovers gaps where SIEM rules may be too narrow or fail to correlate events across the attack lifecycle. Actionable Data: MSV doesn't just tell you if a rule works. It pinpoints exactly why an attack was missed (lack of required logs, flawed rule logic) or identifies the stages where existing rules trigger, highligh

10
D
Staff
A
amalone341Bronze 1
posted in Google Security Operations
Set of Yara-L Rules

Hey everyone, I got inspired and decided to write up a few of the rules i've written in Yara-L. The examples at the bottom of the repository show some of the flexibility Yara-L gives you and are good examples to learn off of. Please let me know if there are any questions, comments, or advice in regards to any of the rules. https://github.com/amalone341/YARA-L-Work

43
F
rav1and3
rav1and3Bronze 3
posted in Google Security Operations
Has anyone come across successful parsing for AWS logs with kinesis firehose format

I have logs in JSON format. Single log line has multiple single json objects delimited by new line. here each json object is one log. This is for AWS_ROUTE_53 parser.{"field1" : "value","filed2" : [ { "field3": "value" } ]}{"field1" : "value","filed2" : [ { "field3": "value" } ]}

02
rav1and3
N
Nick_TroutiniBronze 5
posted in Security Command Center
Getting Started with Security Command Center: Your quickstart guide to risk management

Security Command Center is Google’s cloud-based security platform that helps you strengthen your security posture by evaluating your security and data attack surface; providing asset inventory and discovery; identifying misconfigurations, vulnerabilities, and threats; and helping you mitigate and remediate risks. In this video, Program Manager Nick Troutini, provides Security Command Center users the information and resources you need to quickly gain cloud security confidence, stay up-to-date with the latest product updates, and find support when you need it.  You can use the timestamp links to quickly navigate to topics in the video that you’re interested in learning more about:  01:06 Where to find self-service support resources: documentation, events, and community 02:03 How to access Security Command Center documentation and guides 02:37 How to get help with your technical questions or issues: reaching Google Cloud support 03:20 Getting Started with Security Command Cent

42
Ray_a
Staff
D
Staff
dnehodaStaff
posted in Google Security Operations
Part 1: Dipping Your Toe into SOAR: Understanding the Basics

Part 1: Dipping Your Toe into SOAR: Understanding the Basics The Ocean of Security Threats     The relentless barrage of endpoint alerts your team faces is overwhelming – like a lone lifeguard battling an endless onslaught of waves. Manually sifting through these alerts to identify true threats is both exhausting and risky. To successfully navigate this digital ocean, you need powerful tools. Manual Response: Tiring and Time-Consuming Relying solely on manual processes for endpoint security creates a perfect storm. Analysts spend countless hours juggling alerts from disparate tools (like Tanium or CrowdStrike), struggling to piece together fragmented information, and performing repetitive analysis tasks. This steals precious time and energy away from proactively thwarting the most dangerous attacks.   A Life Raft Called SOAR       SOAR (Security Orchestration, Automation, and Response) is the solution! It's a comprehensive framework that transforms you

30
D
Staff
R
Rahul_shah799New Member
asked in Google Security Operations
Yara to count the no. of any characters repeated in the command line

1. Is there any way in Yara to count the no. of any characters repeated in the command line?Below is the scenario i am trying to solvehttps://redcanary.com/threat-detection-report/techniques/obfuscated-files-information/  

02
R
M
mountaincode2Silver 2
posted in Google Security Operations
Trying to understand the statedump of my parser

I am trying to understand the statedump of my parser code.Raw log: { "records": { "hostname": "host" }, "resourceIdentifiers": [ { "tentantid": "a123", "type": "access", "subnet": [ { "ip": "10.1.1.1" }, { "ip": "10.1.1.2" } ] } ] } Parser: filter { json { source => "message" array_function => "split_columns" } for i, data in records.resourceIdentifiers { for j, subnet in data.subnet { mutate { replace => { "target.ip" => "subnet.ip" } merge => { "event.idm.read_only_udm.target" => "target.ip" } } } } statedump {} } Statedump: Internal State (label=): { "@createTimestamp": { "nanos": 0, "seconds": 1708690606 }, "@enableCbnForLoop": true, "@onErrorCount": 0, "@output": [], "@timezone": "", "message": "{\\n \\"records\\": {\\n \\"hostname\\": \\"host\\"\\n },\\

21
M
A
aravind_s12321Bronze 1
posted in Google Security Operations
Urgent: Error occured while parsing

Hello All,We have encountered an error while we trying to parse. Please find the below error.generic::unknown: pipeline.ParseLogEntry failed: LOG_PARSING_CBN_ERROR: "generic::invalid_argument: failed to convert raw output to events: failed to convert raw message 0: field \\"idm\\": index 0: recursive rawDataToProto failed: field \\"entity\\": index 0: recursive rawDataToProto failed: field \\"entity\\": index 0: recursive rawDataToProto failed: field \\"asset\\": index 0: recursive rawDataToProto failed: field \\"ip\\": failed to make strategy: received non-slice or non-array raw output for repeated field"Could anyone please let me know how to rectify this?

74
R
V
vyshakvNew Member
asked in Google Security Operations
Chronicle SOAR Free Edition

Looks like there is a bug in registering for the SOAR free edition, I am unable to find a way after sign in

02
V
M
mountaincode2Silver 2
asked in Google Security Operations
Why is the validation of my custom parser failing?

Hello,I am testing a custom parser for JSON data, but i am unable to get it to work.The log in JSON is as follows:{ "records": [ { "hostname": "host" }, { "hostname": "host1" }, { "hostname": "host2" } ] }The parser code is as follows:filter {for index, data in records {  if index == 0 {    mutate {      replace => { "target.hostname" => "%{data.hostname}" }    }  }  else {    mutate {      replace => { "intermediary.hostname" => "%{data.hostname}" }    }    mutate {      merge => { "event.idm.readonly_udm.intermediary" => "intermediary" }   }  }}}I want to see the output of my code. But I am unable to. I see the message failed: How can I get this to work.  

39
M
J
JamminJamesNew Member
posted in reCAPTCHA
After creating Google Cloud account, recaptcha no longer works, returns browser-error

Since I created a Google Cloud account, recaptcha no longer works on our website. The error says "browser-error". Googling around, apparently the website needs to be whitelisted in Recaptcha Enterprise, this was quite a shock, and there was no indication when I signed up that this would be an issue. Right now, we are not being billed, as we are using no billable services. I don't want to have to pay for recaptcha when the free version was working perfectly.  What can I do about this? UPDATE: Turns out, the problem was in our CSP. We needed to allow https://www.google.com in the frame-src section. Who knew that that would cause this problem? I don't see a way to mark this as solved, or I would. P.S. Speaking of recaptcha, having the 'check the boxes with traffic lights' thing seems archaic, especially here, of all places!

21
lawrencenelson
P
Paulo-LopesBronze 2
asked in Google Security Operations
Curated detections capacity

Hello, I enabled some curated detections and now chronicle is saying that I'm reaching the full capacity that will prevent enable further rules.But I did not enabled all curated rules, there are some missing windows threats to enable.Is there anyway to upgrade curated rules capacity? How can I use these rules if I cannot enable all of them? 

03
DAPerry
Staff
T
tayvionpNew Member
asked in Google Security Operations
Using Regex Fields as Variable

Utilizing Chronicle's first seen and last seen feature to create somewhat of an anomaly-based detection. The detection should take when an event was first seen if seen at all, and if the alert has been seen after 14 days then we should be alerted. However, I have to utilize a regex to retrieve the username. This then needs to be pulled into the entity graph, which means I have to utilize a variable for this to happen. here's a copy of the logic I have so far rule ripple_auth0_anomaly_ldap_vault_creds { meta: author = "tpayton" description = "Detects anomalous issuance of vault credentials to ldap users." events: // Retrieve all Auth0 events regarding the issuance of vault temp creds for ldap users $event.metadata.log_type = "AUTH_ZERO" $event.principal.hostname = /^Temp Vault Client auth=ldap/ nocase // Extract LDAP user $ldap_user = re.regex($event.principal.hostname, "auth=([^ ]+) expires") $entity.graph.entity.hostname = $ldap_user

12
T
vaskenh
Staff
vaskenhStaff
posted in Security Command Center
Using Event Threat Detection to Detect VMs in Unauthorized Regions

In this community post, we’ll take a closer look at Event Threat Detection (ETD) in Security Command Center Premium, with a focus on the ability for customers to create custom ETD modules. SCC Premium provides a framework for creating custom modules for ETD using module templates.  In this post, we’ll take a closer look at using one of these templates to create a finding that is triggered when a user provisions a virtual machine in an unauthorized GCP region. In Google Cloud, a region is a geographical location that can host resources.  Regions are further divided into distinct deployment areas called zones, which ensures infrastructure redundancy within the context of a region.   In GCP, resources that reside in a specific region, like compute instance VMs, are called regional resources. SCC Premium administrators have the ability to detect the provisioning of VMs in specific regions and to trigger a finding based on that activity.  Let’s take a closer look at how

00
vaskenh
Staff
T
tayvionpNew Member
asked in Google Security Operations
Variable Within Yara L 2.0

  I'm currently building a detection that needs to extract data from one field and pass it to a variable to match events for that particular user over 30 days and add the user to the outcome section.Essentially this rule should look for LDAP users who have not received vault temp credits over the last 30 days. here's the error message semantic analysis: match variable event is not assigned to an event field rule auth0_anomaly_ldap_vault_creds { events: // Retrieve all Auth0 events regarding the issuance of vault temp creds for ldap users $event.metadata.log_type = "AUTH_ZERO" $event.principal.hostname = /^Temp Vault Client auth=ldap/ // Extract LDAP user $ldap_user_extract = re.regex($event.principal.hostname, "auth=([^ ]+) expires") $ldap_user = $ldap_user_extract match: $ldap_user over 30d outcome: // Alert Meta $alert_severity = array_distinct("HIGH") // Alert Details $principal_ip = array_

76
T
J
joshgmiNew Member
posted in Google Security Operations
Looking for some insight on the log source monitoring in Chronicle SIEM?

Hopefully this is the right place - looking for some insight on what you all are doing for log source monitoring in Chronicle SIEM?

011
maxjunker
V
vivekramrsBronze 1
posted in Google Security Operations
Logging Hosts Vs Non Logging Hosts

Hello,I'm currently exploring the various dashboard options to distinguish between logging hosts and non-logging hosts.For instance, I'm interested in applying a 7-day filter to the hostname field, comparing it with the results from the last 2 days, and determining which hosts haven't generated any logs in the SIEM. My goal is to set up an alert for such cases.Would you be able to assist me with this task?Thank you

15
C
M
muniraja1New Member
posted in Google Security Operations
Network VPN / SSL VPN for Zscaler

how to integrate the Network VPN / SSL VPN for Zscaler .please share any documents if you have.

00
M
M
muniraja1New Member
posted in Google Security Operations
EDR & DLP Server TrendMicro and Database (MSSQL, Oracle, Sybase)

How to integrate EDR & DLP Server TrendMicro and Database (MSSQL, Oracle, Sybase)in SIEM.Could you please share SOP's URL's

00
M
M
MSYBronze 1
posted in Google Security Operations
Parser Custom "FortiSwitch"

Hello everyone,I come from years of experience from Qradar where to create a custom parser was almost child's play...unfortunately with Chronicle I am having a lot of problems....can you help me? specifically i am trying to create a custom parser for a "Forti Switch" is there a place where i can find a base already created for custom parsers or do you have to create them right from scratch? thanks to anyone who will answer.

04
Tonio
Ferdi_Birgül
Ferdi_BirgülNew Member
posted in Google Security Operations
event correlation

 Dear SIEM Group,I am trying to set up event correlation in Siemplify (version 5.2.3) to detect possible unauthorised access attempts on a critical server. In particular I would like to identify the following scenarios:User A (username: John Doe, employee ID: 12345) logs into the corporate network via VPN from an unknown or high-risk location.Within 15 minutes after this login, User A establishes an RDP connection to the critical server (server name: "Prod-Database").Immediately after the RDP connection, User A tries to modify sensitive files or configurations on the server, triggering the "Unauthorised_Modification" event.To achieve this I am considering creating correlation rules based on the following:Event sources:"VPN_Login" for User A's VPN activity, including location information."RDP_Connection" for User A's connection to the critical server."Unauthorised_Modification" for suspicious file/configuration changes.Criteria:User A's identity and login time.Time difference betwe

00
Ferdi_Birgül
D
Donald_MunengiwNew Member
posted in Google Security Operations
Is there a Chronicle Trial for the SIEM part that allows you to test ingestions?

Is there a Chronicle Trial for the SIEM part that allows you to test ingestions?

15
A

Badge winners

Show all badges
Terms & ConditionsCookie settings
Privacy Policy Terms of Service Gen AI Policy Community Guidelines Cookie Settings

© 2025 Google. All rights reserved.