Security Forums

I have logs in JSON format. Single log line has multiple single json objects delimited by new line. here each json object is one log. This is for AWS_ROUTE_53 parser.{"field1" : "value","filed2" : [ { "field3": "value" } ]}{"field1" : "value","filed2" : [ { "field3": "value" } ]}

Security Command Center is Google’s cloud-based security platform that helps you strengthen your security posture by evaluating your security and data attack surface; providing asset inventory and discovery; identifying misconfigurations, vulnerabilities, and threats; and helping you mitigate and remediate risks. In this video, Program Manager Nick Troutini, provides Security Command Center users the information and resources you need to quickly gain cloud security confidence, stay up-to-date with the latest product updates, and find support when you need it.  You can use the timestamp links to quickly navigate to topics in the video that you’re interested in learning more about:  01:06 Where to find self-service support resources: documentation, events, and community 02:03 How to access Security Command Center documentation and guides 02:37 How to get help with your technical questions or issues: reaching Google Cloud support 03:20 Getting Started with Security Command Cent

Part 1: Dipping Your Toe into SOAR: Understanding the Basics The Ocean of Security Threats     The relentless barrage of endpoint alerts your team faces is overwhelming – like a lone lifeguard battling an endless onslaught of waves. Manually sifting through these alerts to identify true threats is both exhausting and risky. To successfully navigate this digital ocean, you need powerful tools. Manual Response: Tiring and Time-Consuming Relying solely on manual processes for endpoint security creates a perfect storm. Analysts spend countless hours juggling alerts from disparate tools (like Tanium or CrowdStrike), struggling to piece together fragmented information, and performing repetitive analysis tasks. This steals precious time and energy away from proactively thwarting the most dangerous attacks.   A Life Raft Called SOAR       SOAR (Security Orchestration, Automation, and Response) is the solution! It's a comprehensive framework that transforms you

1. Is there any way in Yara to count the no. of any characters repeated in the command line?Below is the scenario i am trying to solvehttps://redcanary.com/threat-detection-report/techniques/obfuscated-files-information/  

I am trying to understand the statedump of my parser code.Raw log: { "records": { "hostname": "host" }, "resourceIdentifiers": [ { "tentantid": "a123", "type": "access", "subnet": [ { "ip": "10.1.1.1" }, { "ip": "10.1.1.2" } ] } ] } Parser: filter { json { source => "message" array_function => "split_columns" } for i, data in records.resourceIdentifiers { for j, subnet in data.subnet { mutate { replace => { "target.ip" => "subnet.ip" } merge => { "event.idm.read_only_udm.target" => "target.ip" } } } } statedump {} } Statedump: Internal State (label=): { "@createTimestamp": { "nanos": 0, "seconds": 1708690606 }, "@enableCbnForLoop": true, "@onErrorCount": 0, "@output": [], "@timezone": "", "message": "{\\n \\"records\\": {\\n \\"hostname\\": \\"host\\"\\n },\\

Hello All,We have encountered an error while we trying to parse. Please find the below error.generic::unknown: pipeline.ParseLogEntry failed: LOG_PARSING_CBN_ERROR: "generic::invalid_argument: failed to convert raw output to events: failed to convert raw message 0: field \\"idm\\": index 0: recursive rawDataToProto failed: field \\"entity\\": index 0: recursive rawDataToProto failed: field \\"entity\\": index 0: recursive rawDataToProto failed: field \\"asset\\": index 0: recursive rawDataToProto failed: field \\"ip\\": failed to make strategy: received non-slice or non-array raw output for repeated field"Could anyone please let me know how to rectify this?

Looks like there is a bug in registering for the SOAR free edition, I am unable to find a way after sign in

Hello,I am testing a custom parser for JSON data, but i am unable to get it to work.The log in JSON is as follows:{ "records": [ { "hostname": "host" }, { "hostname": "host1" }, { "hostname": "host2" } ] }The parser code is as follows:filter {for index, data in records {  if index == 0 {    mutate {      replace => { "target.hostname" => "%{data.hostname}" }    }  }  else {    mutate {      replace => { "intermediary.hostname" => "%{data.hostname}" }    }    mutate {      merge => { "event.idm.readonly_udm.intermediary" => "intermediary" }   }  }}}I want to see the output of my code. But I am unable to. I see the message failed: How can I get this to work.  

Since I created a Google Cloud account, recaptcha no longer works on our website. The error says "browser-error". Googling around, apparently the website needs to be whitelisted in Recaptcha Enterprise, this was quite a shock, and there was no indication when I signed up that this would be an issue. Right now, we are not being billed, as we are using no billable services. I don't want to have to pay for recaptcha when the free version was working perfectly.  What can I do about this? UPDATE: Turns out, the problem was in our CSP. We needed to allow https://www.google.com in the frame-src section. Who knew that that would cause this problem? I don't see a way to mark this as solved, or I would. P.S. Speaking of recaptcha, having the 'check the boxes with traffic lights' thing seems archaic, especially here, of all places!

Hello, I enabled some curated detections and now chronicle is saying that I'm reaching the full capacity that will prevent enable further rules.But I did not enabled all curated rules, there are some missing windows threats to enable.Is there anyway to upgrade curated rules capacity? How can I use these rules if I cannot enable all of them? 

Utilizing Chronicle's first seen and last seen feature to create somewhat of an anomaly-based detection. The detection should take when an event was first seen if seen at all, and if the alert has been seen after 14 days then we should be alerted. However, I have to utilize a regex to retrieve the username. This then needs to be pulled into the entity graph, which means I have to utilize a variable for this to happen. here's a copy of the logic I have so far rule ripple_auth0_anomaly_ldap_vault_creds { meta: author = "tpayton" description = "Detects anomalous issuance of vault credentials to ldap users." events: // Retrieve all Auth0 events regarding the issuance of vault temp creds for ldap users $event.metadata.log_type = "AUTH_ZERO" $event.principal.hostname = /^Temp Vault Client auth=ldap/ nocase // Extract LDAP user $ldap_user = re.regex($event.principal.hostname, "auth=([^ ]+) expires") $entity.graph.entity.hostname = $ldap_user

In this community post, we’ll take a closer look at Event Threat Detection (ETD) in Security Command Center Premium, with a focus on the ability for customers to create custom ETD modules. SCC Premium provides a framework for creating custom modules for ETD using module templates.  In this post, we’ll take a closer look at using one of these templates to create a finding that is triggered when a user provisions a virtual machine in an unauthorized GCP region. In Google Cloud, a region is a geographical location that can host resources.  Regions are further divided into distinct deployment areas called zones, which ensures infrastructure redundancy within the context of a region.   In GCP, resources that reside in a specific region, like compute instance VMs, are called regional resources. SCC Premium administrators have the ability to detect the provisioning of VMs in specific regions and to trigger a finding based on that activity.  Let’s take a closer look at how

  I'm currently building a detection that needs to extract data from one field and pass it to a variable to match events for that particular user over 30 days and add the user to the outcome section.Essentially this rule should look for LDAP users who have not received vault temp credits over the last 30 days. here's the error message semantic analysis: match variable event is not assigned to an event field rule auth0_anomaly_ldap_vault_creds { events: // Retrieve all Auth0 events regarding the issuance of vault temp creds for ldap users $event.metadata.log_type = "AUTH_ZERO" $event.principal.hostname = /^Temp Vault Client auth=ldap/ // Extract LDAP user $ldap_user_extract = re.regex($event.principal.hostname, "auth=([^ ]+) expires") $ldap_user = $ldap_user_extract match: $ldap_user over 30d outcome: // Alert Meta $alert_severity = array_distinct("HIGH") // Alert Details $principal_ip = array_

Hopefully this is the right place - looking for some insight on what you all are doing for log source monitoring in Chronicle SIEM?

Hello,I'm currently exploring the various dashboard options to distinguish between logging hosts and non-logging hosts.For instance, I'm interested in applying a 7-day filter to the hostname field, comparing it with the results from the last 2 days, and determining which hosts haven't generated any logs in the SIEM. My goal is to set up an alert for such cases.Would you be able to assist me with this task?Thank you

how to integrate the Network VPN / SSL VPN for Zscaler .please share any documents if you have.

How to integrate EDR & DLP Server TrendMicro and Database (MSSQL, Oracle, Sybase)in SIEM.Could you please share SOP's URL's

Hello everyone,I come from years of experience from Qradar where to create a custom parser was almost child's play...unfortunately with Chronicle I am having a lot of problems....can you help me? specifically i am trying to create a custom parser for a "Forti Switch" is there a place where i can find a base already created for custom parsers or do you have to create them right from scratch? thanks to anyone who will answer.

 Dear SIEM Group,I am trying to set up event correlation in Siemplify (version 5.2.3) to detect possible unauthorised access attempts on a critical server. In particular I would like to identify the following scenarios:User A (username: John Doe, employee ID: 12345) logs into the corporate network via VPN from an unknown or high-risk location.Within 15 minutes after this login, User A establishes an RDP connection to the critical server (server name: "Prod-Database").Immediately after the RDP connection, User A tries to modify sensitive files or configurations on the server, triggering the "Unauthorised_Modification" event.To achieve this I am considering creating correlation rules based on the following:Event sources:"VPN_Login" for User A's VPN activity, including location information."RDP_Connection" for User A's connection to the critical server."Unauthorised_Modification" for suspicious file/configuration changes.Criteria:User A's identity and login time.Time difference betwe

Is there a Chronicle Trial for the SIEM part that allows you to test ingestions?

Hello All,Could anyone please let me know why there are more than one last heartbeat days, since the last heartbeat should be only one? Please find the below snip.Also, could anyone please let me know why there is a difference in the data when we take the ingestion_metrics? The comparison is given in the below snips. Thanks,Aravind S 

We are excited to announce the availability of Google Cloud Security Customer Success subscriptions.   Optimize your Google Cloud Security experience to achieve desired business outcomes together with a team of security experts. Choose the right success offering that best fits your organizational objectives and acquired security subscriptions. Standard: Offers digital and self-service resources, including onboarding, subscription walkthroughs, documentation, and access to knowledge base with product trainings. Expert: Offers a designated Customer Success Manager and Technical Solutions Consultants, providing customized success plans, and strategic guidance. Expert+: Includes everything from Expert and more, including a designated Security Advisor (SA) focused on advanced adoption and helping your security operations. Learn more about Cloud Security Customer Success on the Google Cloud site.

  We are excited to announce the availability of Google Cloud Security Customer Success subscriptions.   Optimize your Google Cloud Security experience to achieve desired business outcomes together with a team of security experts. Choose the right success offering that best fits your organizational objectives and acquired security subscriptions. Standard: Offers digital and self-service resources, including onboarding, subscription walkthroughs, documentation, and access to knowledge base with product trainings. Expert: Offers a designated Customer Success Manager and Technical Solutions Consultants, providing customized success plans, and strategic guidance. Expert+: Includes everything from Expert and more, including a designated Security Advisor (SA) focused on advanced adoption and helping your security operations. Learn more about Cloud Security Customer Success on the Google Cloud site.

We are excited to announce the availability of Google Cloud Security Customer Success subscriptions.   Optimize your Google Cloud Security experience to achieve desired business outcomes together with a team of security experts. Choose the right success offering that best fits your organizational objectives and acquired security subscriptions. Standard: Offers digital and self-service resources, including onboarding, subscription walkthroughs, documentation, and access to knowledge base with product trainings. Expert: Offers a designated Customer Success Manager and Technical Solutions Consultants, providing customized success plans, and strategic guidance. Expert+: Includes everything from Expert and more, including a designated Security Advisor (SA) focused on advanced adoption and helping your security operations. Learn more about Cloud Security Customer Success on the Google Cloud site.

We are excited to announce the availability of Google Cloud Security Customer Success subscriptions.   Optimize your Google Cloud Security experience to achieve desired business outcomes together with a team of security experts. Choose the right success offering that best fits your organizational objectives and acquired security subscriptions. Standard: Offers digital and self-service resources, including onboarding, subscription walkthroughs, documentation, and access to knowledge base with product trainings. Expert: Offers a designated Customer Success Manager and Technical Solutions Consultants, providing customized success plans, and strategic guidance. Expert+: Includes everything from Expert and more, including a designated Security Advisor (SA) focused on advanced adoption and helping your security operations. Learn more about Cloud Security Customer Success on the Google Cloud site.