Skip to main content

Security Forums

Welcome to the Google Cloud Security Forums! Your ultimate security conversation spot. Collaborate with peers and experts to solve challenges, together.

2471 Topics
M
Marek_KreulNew Member
posted in Google Security Operations
Access the output after a condition

When having a condition in a playbook that performs either action A or action B, and later in the playbook, after the branches are merged again, I want to access the output... is there a better way then putting a "save context value" after action A and B writing to the same ContextValue - and later retrieving this contextvalue again? Basically this is my situation: Action A / \\ Condition Insight \\ / Action B and the insight should print whatever is the outcome of either Action A or Action B

01
Y
M
Miguel_AltuzarNew Member
posted in Google Security Operations
Regex to the String Functions action

Hello colleagues! I'm here again with those weird questions... I'm currently working with regex to the String Functions action. I've tried multiple regex emulators to evaluate in real time my expressions and matches. I've helped myself with Siemplify IDE when I'm evaluating my expressions but this is the weird part. When I run these expressions on simulators or on the IDE I got results... but when I simulate a playbook or run it within a case, I get no results. View files in slack

12
J
M
Marek_KreulNew Member
posted in Google Security Operations
Sanity-checking of values?

Is there a way to do "sanity-checking" of values? We sometimes face the problem that an alert contains wrong information in a field (such as an IP address as a "hostname"), and Siemplify will then create a hostname entity reading "1.2.3.4" due to our mapping. However, further enrichments against this entity may fail, as they only work with hostnames but not IPs. So basically we want to do a check if the value may actually be an IP address (i.e only consists of the characters 0-9 and .) - but how could we do this?

010
E
R
recon_acookNew Member
posted in Google Security Operations
Pull the case close comments out of a case

Has anyone found an easy way to pull the case close comments out of a case? It is buried in the JSON and the only way I can find (inconsistently) is some regex parsing

24
T
J
Jason_BennettNew Member
posted in Google Security Operations
Default Case View

Hello, I'm trying to add a widget to the "Default Case View" in version 6, but when I try and save the view, I get an error "The role doesn't exist". Has anyone seen this before or know how to get past it? View files in slack

03
T
R
Robert_KnutzenNew Member
posted in Google Security Operations
Custom job that gets the configuration of an integration

I'm trying to write a custom job that gets the configuration of an integration and i keep getting errors that saying my integration could not be found. Is there a way to get a list of integrations that exist in an environment? Like a snippet of python I could run that would show me what integrations it sees. I think i'm using the right name but obviously I'm not EDIT: Like is there a list of what I can pass to siemplify.get_configuration()?

34
R
ChrisMitchell
Staff
ChrisMitchellStaff
posted in reCAPTCHA
You’re invited to the Google Cloud Security Summit!

Hey Google Cloud Security Community, Join us for the Google Cloud Security Summit on May 17 to learn from experts, explore the latest tools, and share our vision for the future of security. Discover new ways to define and drive your security strategy and solve for your biggest challenges. During the event, you’ll be able to: Gain insights from Google and partner security professionals on how you can move to zero trust architectures, bolster software supply chain security, and defend against ransomware and other emerging threats. Be among the first to explore new products and enhanced capabilities in cloud governance and digital sovereignty, and discover how Google is building toward our vision for the future of security operations. Uncover innovative approaches from your peers that can help solve your toughest security challenges during customer spotlights. Register today for this digital event and view the full agenda now. We look forward to seeing you there!  

00
ChrisMitchell
Staff
B
Ben_MontourNew Member
posted in Google Security Operations
Ontology OOTB

Is there a place where customers can share ontology visual families and mappings? I wish connectors came with matching ontology families and mappings for their respective product/alerts they ingest.

03
T
P
Pascaru_TudorNew Member
posted in Google Security Operations
2FA for Siemplify version 5.x.x

Hi team, is there a way to enable 2FA for Siemplify version 5.x.x? For example using DUO?

03
P
J
JoelT1New Member
posted in reCAPTCHA
How do I see the assessment result in the dashboard?

Hi!I recently migrated a reCAPTCHA key to enterprise. Will I be able to see assessment results in the portal, or as a reply from the API call?

115
G
B
Ben_MontourNew Member
posted in Google Security Operations
What the difference is between the two Microsoft Graph Security connectors?

Can I ask what the difference is between the two Microsoft Graph Security connectors? One is just plain Microsoft Graph Security Connector and the other is Microsoft Graph Office 365 Security and Compliance Connector .

05
G
M
Marcel3New Member
posted in Google Security Operations
Condition That checks if the second and third letter of a value of a placeholder.

For a condition I need to check if the second and third letter of a value of a placeholder. How can I achieve this?

13
M
M
Miguel_AltuzarNew Member
posted in Google Security Operations
When the action send email is processing, it sends an email twice

Dear Community, I just notice in one of my PB, when the action send email is processing, it sends an email twice. Do you know or have any idea about what this happen? It's so weird since I double check and have no other than the normal action as always. View files in slack

014
T
B
Ben_MontourNew Member
posted in Google Security Operations
trigger a playbook on if a case has been marked Important

is it possible to trigger a playbook on if a case has been marked Important? I was looking at Tags and such but it seems that marking something as Important does something unique.

012
M
E
Esmeralda_LaraNew Member
posted in Google Security Operations
Wait for email Action

Hi Everyone! Someone has been worked with the action "Wait for email"? we are having some issues, that when we use the action two times on the same playbook the second instruction it doesn't work, we set the timeout but the action do not wait for the email.

11
T
M
Marek_KreulNew Member
posted in Google Security Operations
Maximum allowed "file" size of a json

can someone quickly help me out with a tip? I want to change the maximum allowed "file" size of a json that is printed into an insight, to get rid of the "This field contains large amounts of data. Download File to see its content." message. Thanks!

12
M
A
Anonymous
posted in Google Security Operations
Splunk Cloud integration

Does the Splunk Cloud integration support with Siemplify which is having self signed certificate while accessing REST API thro 8089 port?

35
G
S
striderNew Member
posted in Google Security Operations
Questions on Chronicle Asset Prevalence

As per https://cloud.google.com/chronicle/docs/investigation/investigate-asset#:~:text=Prevalence%20measures%20the%20number%20of,are%20unlikely%20to%20require%20investigation. Prevalence measures the number of assets within your enterprise connected to a specific domain over the past seven days. More assets connecting to a domain means that the domain has greater prevalence within your enterprise. High prevalence domains, such as google.com, are unlikely to require investigation. I have few questions on prevalence:Is it unique assets?How do you define assets(ie asset id as per chronicle, user, IP address, etc.)?Is it calculated per day for last 7 day and maximum of that or calculated on overall 7 days? 

04
S
D
David_ChhuonNew Member
posted in Google Security Operations
Scan URL from emails.

Hi community, I am working on a playbook where I want to scan URL from emails. I have setup the exchange connectors and alerts are working pretty fine. The field named “urls” contains all the urls found in the emails. Basically, Siemplify separates each url by a semi-colon and uses this semi-colon as a delimiter in the ontology. My issue is that I have a semi-colon in my url resulting splitting my URL into 2 which makes no sense. Is there a way to solve this? Thank you.

03
T
M
Miguel_AltuzarNew Member
posted in Google Security Operations
Slow behavior when I'm running playbook simulator

Hi Community, excuse me, I'm working rn in a playbook but I've experimented a really slow behavior when I'm running the simulator. This playbook has more than 89 steps and I guess it could be a reason why this is behaving like that... additionally, when the simulation is running on step 70 (approx) the thread of processes looks like is frozen then doesn't respond any manual action or next step... it's just frozen. Do you know if there is any specific number of limited steps or something else? Thanks in advance

05
M
L
Luis__GonzalezNew Member
posted in Google Security Operations
Error message when I try to run a playbook

Hi community, I'm having this error message when I try to run a playbook after I setup a custom trigger to use 2 different values in the Alert.Name property, like in the picture below. Anybody had the same issue? I'm using the custom trigger wrong? Thanks for your help! View files in slack

02
L
T
thechronicleNew Member
posted in Google Security Operations
Non-English characters in logs not rendering in Chronicle?

Windows Event logs from servers configured in a language using non-English character set are not rendering in Chronicle. Is there support for this in Chronicle or any ideas on what to change locally? How are others handling non-english text in their logs?

01
K
Z
Zack_PNew Member
posted in Google Security Operations
FortiSIEM integration broken?

HiAm trying to use the FortiSIEM connector+integration but get the below error when using the test button.Username: adminVerify SSL: False----------------- Main - Started -----------------General error performing action Fortinet FortiSIEM - PingAn error occurred: 401 Client Error: Not authorized for url: https://[redacted]/phoenix/rest/deviceInfo/monitoredDevices b'GlassFish">http://www.w3.org/1999/xhtml">GlassFish Server Open Source Edition 5.1.0 - Error report HTTP Status 401 - Not authorizedtype Status reportmessageNot authorizeddescriptionThis request requires HTTP authentication.GlassFish Server Open Source Edition 5.1.0 '----------------- Main - Finished -----------------I've triple-checked the password and it's correct. What am I missing? Is there a toggle somewhere to enable the API?

20
Z
M
Marek_KreulNew Member
posted in Google Security Operations
Alerts group

I my understanding correct that if e.g. a malware alert contains the affected system in a field mapped to "DestinationHostName", and an alert for a system reaching out to a malicious IP indicator contains the affected system as "Source HostName", then Siemplify would not group them together because they may be identical (hostname) values, but in different entity types?

02
M
R
recon_acookNew Member
posted in Google Security Operations
Remove or rename a dynamic environment variable

How do I remove or rename a dynamic environment variable?

01
M

Badge winners

  • Authored Posts 5
    leodashas earned the badge Authored Posts 5
  • Authored Posts 5
    delstonhas earned the badge Authored Posts 5
  • Authored Posts 1
    SaDaVFhas earned the badge Authored Posts 1
  • Authored Posts 5
    hzmndthas earned the badge Authored Posts 5
  • Solution 10
    hzmndthas earned the badge Solution 10
Show all badges
Terms & ConditionsCookie settings
Privacy Policy Terms of Service Gen AI Policy Community Guidelines Cookie Settings

© 2025 Google. All rights reserved.