Security Forums

How do i resolve thia error? Who do I need to reach out to? { "error": { "code": 403, "message": "Malachite Ingestion API has not been used in project xxxxxx before or it is disabled. Enable it by visiting https://console.developers.google.com/apis/api/malachiteingestion-pa.googleapis.com/overview?project=xxxxxx then retry. If you enabled this API recently, wait a few minutes for the action to propagate to our systems and retry.", 

So I lost my password  to <PII removed by staff>

Hey Team,I'm looking for a way to parse raw logs outside of Chronicle to UDM, does something like that exist? or will we need to make something in-house

Hello everyone,I am trying to develop a new integration/action, and from the IDE documentation I see the 'SiemplifyAction' library, much useful to extrapolate and work with info from the case/alerts. From these pages I see details on its modules but I cannot seem to find any info on the type of objects/classes available in this library.Looking around, I can often see something of the sort:  from SiemplifyAction import SiemplifyAction from SiemplifyDataModels import EntityTypes siemplify = SiemplifyAction() for entity in siemplify.target_entities: if entity.entity_type == EntityTypes.ADDRESS I know somewhat what I can use from 'SiemplifyDataModels' since that documentation page is more detailed. Instead, apart from examples and other actions code, on the 'SiemplifyAction' I would not even know if there were other types of 'entities' that i can use - other than these 'targeted' ones - ; nor what they are exactly.I also tried looking in the script from the 'siempli

I have tried direct, going through marketplace on an integration and from the main SecOps page. Both SOAR and SIEM are unavailable at least for me. 

Hi ,does anyone has any experience to ingest multiple sites linux or windows logs to chronicle SIEM

Hi Community, we are trying to run commands on a remote Server (Windows Server) with openssh installed. We are using the Siemplify Action "SSH Run Command". When doing a simple ipconfig on the remote Server it is working fine and we are getting displayed the output but we need to run a more complex script for adding DNS records and always getting error messages like: operable program or batch file. The full command looks like this: dnscmd.exe . /RecordAdd {domain} {hostname} {record type} {IP address} We have an open ticket but unfortunately even the Siemplify support doesn't know if this is caused by the Siemplify SSH Action (Paramiko SSH Client) or the Windows Server or a Syntax error. Hopefully some of you could help us by solving this.

Team,I am in the process of deploying Google Chronicle in our organization and following the instructions provided in the official documentation at the following link: https://cloud.google.com/chronicle/docs/onboard/configure-authentication?hl=es-419#plan_workforce_identity  However, I have encountered an issue that I am unable to resolve on my own. In our Chronicle tenant, accessible at https://xxxx.backstory.chronicle.security/ , there is no evidence of an organization in the project with the "ORGANIZATION_ID" corresponding to the domain.This issue is preventing us from proceeding with the authentication configuration step, which requires an organization to be set up in the mentioned project. We would greatly appreciate your help and collaboration in resolving this issue.Steps We Have Followed:Accessed the Chronicle tenant.Reviewed the authentication configuration documentation.Verified the existence of an organization in the project with the "ORGANIZATION_ID".

Hi, Does anyone know how send logs from the windows machines to a centralised server where all the windows machines logs resides;

Hi,Wanted to download a file from host where an alert is generated through playbook/block and store on wall.CS integration i guess it get files only from the path in alert and not any file.

Hi How can I detects suspicious links and files that been sending outside of my domain?  

Hi, I tried to use web risk api and also safe browsing api, I found malicious links and from what I saw you this 2 endpoint not recognize them as a malicious compared to many products on the market that recognize them as malicious links. I would love to know a little more about this database, how often is it updated and what exactly does it contain?

Hello,How can I perform a transformation to the data in the environment ?Thank you

I've seen conflicting information on this topic:  Is it required today that a new Google SecOps client bring their own third-party identity provider?Thanks,Eric

How to enable SSO on Mandiant?

Good morning, I have a question about log ingestion via the ingestion API. Initially, my logs contained only 13 fields for testing purposes. However, I later expanded them to include 22 fields. I built a custom parser, and when I preview it, the UDM output appears correct.The problem I am having now is when I go to validate the parser it errors out and indicates that the older raw log with 13 fields is the cause which makes sense as the columns/fields are missing. I was wondering is there a way to remove an individual log or even just remove all entries and start fresh?Thanks in advance

how to integrate  Web Proxy Zscaler into SIEM. Please share the URL.

HiWithin the Kubernetes Node parser, I am trying to split the textPayload into separate fields. The textPayload field contains long text which we're trying to extract and split the field into a key then the output of the field to a value. An example of a raw log (data nullified):"textPayload": "time\\u003d\\"0000-00-00T00:00:00.0000000Z\\" type\\u003d\\"container_app_firewall_audit\\" container_name\\u003d\\"container-name-here\\" image_name\\u003d\\"image-name/here:latest\\"How can I assign lets say for example time and type to its own separate UDM field OR automatically add an array with key and value pairs? I've configured extension parser as shown below here, however it's not splitting the values by spaces. filter{ mutate { replace => { "textPayload" => "" } } if [textPayload] != "" { mutate { split => { source => "textPayload" separator => " " target => "textPayload_array" } } mutate {

Hello Team,Can someone assist me with pattern matching and parsing this type of log in Chronicle?"version account-id interface-id srcaddr dstaddr dstport srcport protocol packets bytes end start action log-status vpc-id subnet-id instance-id tcp-flags pkt-srcaddr pkt-dstaddr region"

 In a predefined parser, 2 different raw fields are parsed to same UDM field:"var_target.resource.resource_subtype" => "%{protoPayload.request.machineType}" "var_target.resource.resource_subtype" => "%{resource.type}"  When raw log has both the values (resource.type and protoPayload.request.machineType)  target.resource.resource_subtype contains value of resource.type  because it’s mapped later on in the parser.How can we extract both the fields?  

Hi Team,Do we have a repository from which we download / export Dashboards ? 

Hi Team,Can anyone provide an insight on how can we create an alert if a log source (Let's assume a principal.hostname) stops sending logs for 30 mins?  

Hello,Does anyone know if the functionality exists to incorporate a reference list into a dashboard visualization? Specifically for a UDM Events visualization?If that is not currently possible does anyone know if it is on a future roadmap?

Hey security pros! 👋  Just catching you up on some exciting Google Cloud Security news that's got me pretty pumped:Q1 Product Roundup:  Google's been hard at work, and their latest security features are 🔥! Seriously, check out the roundup. Some real game-changers in there. Gartner Magic Quadrant:  We made it! Google's a Visionary in the 2024 Gartner Magic Quadrant for SIEM. This is a big deal, folks. Validation that we're on the right track. Your Voice Matters:  Have thoughts on Google Cloud Security? Good or bad, we want to hear them. Share your feedback and you might just get a little reward for your time. 😉

Hi all, I'm in process of ingesting Office 365 feed into chronicle SIEM. I would like to know if there is guidance on how to configure apps on Azure side. Chronicle doc page forward people on Microsoft doc,  Office 365 Management APIs , Microsoft explain the behavior of the setting, but It don't told us what parameter to satisfied the requirements for chronicle feeds ingestion.Any Chronicle customer, that have configure apps on azure and  can share their experience? Best regards,