Security Forums

Hi folks,Recently, I got a SecOps implementation project that asked me to ingest some GCP-Native logs, such as CloudSQL, CloudNAT, Cloud Audit Logs and Cloud LOADBALACING (for Cloud Armor WAF) as well as logs for GKE and GCE. For GKE and GCE, I created log sink routing to a Cloud Storage and it is working fine after some replacement for the log queries, but, for the other ones I ingested using the Direct ingestion documentation but I didn`t understand how can I refine those logs in the Google SecOps configuration page.They seem to be like an log query as the log sinks, but I couldn`t find any information or example to refine those logs. With the sugested standard log query we are getting way to much logs and we need to trim those down.Here is how the query for t

I am learning siemplify certified SOAR analyst course on google sec ops i need trial version to get hand son pratice

Hello, I found (URL Removed by Staff) this morning, and I was wondering if there was anyway to integrate it into the SOAR?

Hi Community, I have two questions/doubts. 1. is there any way to pull the search ID for every user search on chronicle(Google Secops) siem? If yes, how do we pull the search ID for the udm and raw_log searches? 2. can we get MD5/Hash() function details for user search(data access logs(gcp cloudaudit)) Please assist me with this. @rafaelramirez  @cmorris  Best regards, Emmie    

Hello Team, id need of your help on below issue. Currently, our scheduled dashboard reports from Chronicle are being sent to our users via LookerMail (noreply@lookermail.com). We would like to explore the possibility of using our own domain email address (i.e., by configuring our own MX record) instead of noreply@lookermail.com for these reports. Can someone please assist me on this? @cmorris , if you could help me on this. Thanks Emmie

Joining the SecOps Slack… I sent requests to invite my team, and got a will be reviewed note….but they have not yet received emails inviting them. how do I expedite getting theser invites sent?

Hello community, I´m new to the SOAR part of Google SecOps and I´m starting with the creation of a playbook for an IOC based detection. I came across the Gemini summary page and noticed the malicious verdict. I was expecting to utilize an VirusTotal enrichment block to get this verdict but now I am wondering how does Gemini/GSOAR come to it and if this can be used inside a playbook/block. Maybe someone already came across this?  Thank you! /Max

Hello Community,I have been struggling for a while setting  up the SMTP for the platform available in advanced setting. The Mailbox that is want to use is on O365 and the default one is Google's own mailbox. This mailbox works perfectly fine with the exchange integration, I am able to send email as well as ingest them as cases. But while configuring it in the platform settings I do not have an option to provide client secret in the Oauth setting. Only client ID and tenant ID parameters are available. Due to this the setup just does not work. The error message complains of Client secret missing in request. Please suggest if anyone has been able to set it up successfully.Error message when I click on Test button: A configuration issue is preventing authentication - check the error me

Hello, I had a look on marketplace and could just find integration for Tenable IO and Tenable SC.Do we have any integration for Tenable AD? (Tenable Identity Exposure)

I would like to retrieve generated alerts in google secops SIEM on daily basis. For that I identified the following API endpoint to get the required data: listAlerts_deprecatedIt seems that this endpoint will be soon deprecated. Is there an alternative endpoint that provides information about generated alerts ?

Hello All,I found the below documentation to integrate Fireeye ETP and Snowflake to Chronicle.Fireeye/Trellix ETP: https://docs.cyderes.cloud/integrations/fireeye-etp/?h=trelSnowflake: https://docs.cyderes.cloud/integrations/snowflake/?h=snowfCould anyone please help in understanding these integrations?Thanks in advance.Aravind Sreekumar

Today, the Mandiant Intelligence Validation Research Team (VRT) published VHR20240904 - Content Expansion, a Security Content Pack focusing on CVE-2024-0778, CVE-2024-3272, and Campaign 24-023.  This content pack includes 12 new Actions and 9 new Files. For full details on this release, see the Release Notes on the Mandiant Documentation Portal.

Hello,I have some Windows logs that I would like to drop at the forwarder before they are ingested into the SIEM using the regex functionality documented here https://cloud.google.com/chronicle/docs/install/forwarder-linux#set_regular_expression_filtersFor the particular event ID that I am filtering I only want to match raw logs that include the C$, IPC$, or ADMIN$ shares and drop everything else. The problem that I am running into is that negative lookaheads are the go-to way to do something like this with regex, for example... (?!C|IPC|ADMIN) ...which apparently are not supported here. If I understand the documentation correctly I also cannot use a capture group in a filter set to "allow" what I want and then a subsequent filter to "block" everything else since the "blo

Hello,I need to send alerts from one chronicle siem to another.How can I do this?Thank you

I am feeding in Entity-data from Microsoft-AD & CMDB DB. I see the data has lot of info, but out of the box parsing is limited to few fields only.Can anyone suggest how to extend the parsing of Entity dataset? Like "Canonical name" in ASSET entity & Pwd last reset for a USER entity  

Hi,I would like to show the "outcome" variables from YARA-R rule on the UI. (preferably the alert screen under cases).  Please suggest how this can be achieved.

Hi,If I run "retrohunt" for a detection rule, will it delete existing alerts and cases from chronicle SOAR  and generate the fresh detections on evaluating historical events  OR it will create duplication and rednundant alerts and cases ? Thanks !

Hello,I have EPOCH "time": 1723791636 in the raw log which i want to parse and map to the udm.metadata.collected_timestamp.seconds .But, when i try to map it doesn't show in the output, without any error.Can anyone help me with this ? 

Has someone has integrated Chronicle SOAR with any case management for handling the cases and reporting.If so, were the enrichments pushed from the SOAR platform to the case management system?Can any one reply / Help me? 

Hi Guys,i have observed different output in action "Execute Splunk query" if query is beginning with | pipe output is accurate | inputlookup data.csv | head 5and if without | pipe result is different inputlookup data.csv | head 5Any idea why?

Today Mandiant is releasing details of a suspected Iran-nexus counterintelligence operation aimed at collecting data on Iranians and domestic threats who may be collaborating with intelligence and security agencies abroad, particularly in Israel.  The data collected by this campaign may support the Iranian intelligence apparatus in pinpointing individuals who are interested in collaborating with Iran’s perceived adversarial countries. The collected data may be leveraged to uncover human intelligence (HUMINT) operations conducted against Iran and to persecute any Iranians suspected to be involved in these operations. These may include Iranian dissidents, activists, human rights advocates, and Farsi speakers living in and outside Iran.  

Hi Team,  How do I comment something (text or numbers or both) in the raw log search/scan in chronicle SIEM?for example. INC897 (This is incident number which should be commented out) 192.76.0.2(my search query) in UDM search, it can be done using //INC897, however, im not sure how to achieve this in raw log search. please assist me on this. Thanks

Hello all, we are struggeling with the "IsInternalAsset" entity configuration. We mapped a field in the ontology configuration to "DestinationDomains", which in my opinion should be an external Entity.However, if you open a “DestinationDomains” entity in a case, it will appear as “IsInternalAsset” = “True”.Can anybody help or knowns how to configure an entity as internal or external?Thanks a lot!Some screenshots:

Hi Team,We have successfully integrated several supported Threat Intelligence (TI) platforms. However, we need guidance on properly configuring these integrations within our Security Orchestration, Automation, and Response (SOAR) system to ensure their visibility and functionality.Could anyone provide detailed information on how to achieve this? Additionally, if there are specific configurations required within the SOAR system, please outline the necessary steps. Thanks,Neha.H

Good day,Can the reference list be integrated or called in the native dashboard? For example, when we create a use case in the native dashboard, can we call the reference list? On my end, I am unable to call the reference list in the native dashboard due to error something. If it’s possible, could you provide an example? If not, could you suggest a workaround?