Security Forums

Good Day,Is there a way to turn on Geo IP location for the logs that have Source IP data in them?  So for example I can see the Caller IP in the following log but no country code or GEO location and we want to add this.  Is there way to do this without using Chronicle or anything like that?"requestMetadata": {"callerIp": "174.95.10.102","callerSuppliedUserAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36,gzip(gfe),gzip(gfe)","requestAttributes": {"time": "2023-09-09T13:35:56.357323112Z","auth": {}},

How do we query the list of unparsed logs from the SIEM?

Hi All, I'm currently in the process of integrating the forwarder with the SIEM system. I've successfully installed the forwarder on my Ubuntu machine, and I also have administrative access to the SIEM platform. Could someone please provide guidance on how to forward logs from the source to the forwarder and then from the forwarder to the SIEM? If there's any documentation or a guide available, I would greatly appreciate it. Thank you in advance. View files in slack

Hi all, Could I please obtain a default parser or a sample parser for Aruba Wireless logs?

Hi all, Can I ingest firewall traffic logs with Google Cloud Audit and how? Is there a link or feed about that? I saw firewall rule logging but it is I guess about configuration changes about firewall not related to trafic logs.

Hi Team, when using the search chronicle api, is there a way to get more than 10,000 events? or some type of paging functionality? https://cloud.google.com/chronicle/docs/reference/search-api As per doc, it says What is the Page Size Property? - For each API call, you can specify the page_size property to limit the maximum number of returned results. As there's no next page token, to limit the volume of data returned, specify a narrower time range. Any help would be appreciated? Thanks!

Hello Team, Do we have any option to mute the SCC alerts for list  of users who are not enforced MFA in a specific organisation units.? Thanks in advance Regards, Arun

I have a Google Enterprise ReCaptcha accountI am trying to setup a Organization for a new Workspace but when I put in my domain it says:"This domain name is already in use. If you own this domain and would like to use Google Workspace, please follow the steps here"I am not sure who used my company domain, I am with Web support implementing recaptcha for the company, how do I find out the owner email who set the Workspace up for "epsilon.com"?Are there tools that help find out the email owner so I can reach out to use this Workspace account?

How to parse security_result for any severity

Hi! We’d like to ingest some UDM data about group creation events (specifically linux groups created on a host via a cmdline process or other similar means), and we were wondering if you guys have any recommendations for how best to represent this kind of group in the UDM? I initially wanted to use the Group entity ( link ), but upon closer inspection of the fields, it seems like that entity is more intended for organizational groups (eg. LDAP groups)? So, we were wondering if anyone has any suggestions for a good way to represent linux group data in UDM?

Has anyone been able to use "filter" function within the JSON result pop-up? I've tried multiple times but I'm getting error saying invalid key, not found. Any working examples would be much appreciated! Thanks!

@Dmitry_Sarakeev , Please another question, the priority column in the Environment - Networks, for subnet upload in settings, please can you explain what the function of this is? Thanks

Any ideas on this error? It's occurring after the connector returns from the integration. The connector states it created Connector Execution: Dynamic script connector <Connector Name> Connector_d007badf-5245-45f3-97f4-4edfce9caa3d returned unexpected output. No cases created; Exception: Newtonsoft.Json.JsonReaderException: Unexpected character encountered while parsing value: {. Path 'cases[0].environment', line 1, position 28. at Newtonsoft.Json.JsonTextReader.ReadStringValue(ReadType readType) at Newtonsoft.Json.JsonTextReader.ReadAsString() at Newtonsoft.Json.JsonReader.ReadForType(JsonContract contract, Boolean hasConverter) at Newtonsoft.Json.Serialization.JsonSerializerInternalReader.PopulateObject(Object newObject, JsonReader reader, JsonObjectContract contract, JsonProperty member, String id) at Newtonsoft.Json.Serialization.JsonSerializerInternalReader.CreateObject(JsonReader reader, Type objectType, JsonContract contract, JsonProperty mem

How do you deal with nested JSON when creating a parser? I see that JSON filter does not support nested JSON.

Hello everyone, we need to add the logs from a software that is still not supported in Chronicle, we will write our own parser. How can we add a new log type? Do we have to contact google?

I have a question about search page result limit on chronicle. Even I changed the time interval, I can just see 10K event result. Is there any suggestion to increase the limit? Or is there any limitation for search result per search

Dear Community, Please, has anyone utilized the Re-Attach Playbook under Tools before and can explain how it works? I noticed at my end that trying to execute the action within the same playbook you want to re-attach doesn't seem possible and that's what would have made sense logically.

After I deploy Chronicle Forwarder on Linux or Windows. Does Chronicle Forwarder transmit my OS data to Chonicle through the Internet?Can I establish a secure tunnel such as IPSec VPN between our data center and Chonicle to ensure data security and link stability?

I am working on implementing reCAPTCHA Enterprise and was wondering what the difference in performance is when using reCAPTCHA Enterprise out of the box v.s. providing annotations. I also am curious where the annotation data that your provide goes. Does it only go toward training your site specific model, or does the information also train the global model?

Google Cloud | reCAPTCHA Frequently Asked Questions (for additional FAQs visit our support page!)   Question: Can I use reCAPTCHA Enterprise globally? Answer: Yes, please use www.recaptcha.net in your code in circumstances when www.google.com is not accessible. First, replace <script asrc="https://www.google.com/recaptcha/enterprise.js?render=<SITE_KEY>" async defer></script> with <script src="https://www.recaptcha.net/recaptcha/enterprise.js?render=<SITE_KEY>" async defer></script>, substituting your Site Key for <SITE_KEY>. After that, apply the same logic to everywhere else that uses www.google.com/recaptcha/ on your site.   Question: Does reCAPTCHA Enterprise use cookies? Answer: reCAPTCHA Enterprise sets a necessary cookie (_GRECAPTCHA) when executed for the purpose of providing its risk analysis. If you prefer to not use the www.google.com domain which may have other cookies set, you can use www.

Hi everyone!We've seen a sharp uptick in Spam sent via our Application which is behind reCAPTCHA v3 (non interactive) on about August 18th.Since then (according to the reCAPTCHA metrics) nearly every interaction has been classified as "Low Risk".In the graph below (showing 2 weeks) you can very clearly see a 'daily' ebb and flow of users as well as lower low-risk traffic on Weekends (August 12th and 13th).However on the 18th that daily pattern very abruptly stopped and so did any "Medium" or "High" classifications.Since then we've been getting complaints from customers that our application is sending out spam.It looks like within the last 2 or 3 hours ratings seem to have finally come back.I just wanted to put this out here and see if anyone else has seen a similar pattern during this time?Here's another chart, this time going about a month back:Cheers,Dominik

Hi,I would like to read the  article “How to Use GitSync” provides full details!" that was published in the newsletter March Newsletter! — SecOps Community. However, I get the message Request access, or switch to an account with access. I have requested access, but I don't get response. Could you help me with this issue?

Who here uses namespaces ?

Hello People is there any documentation related to pricing for siem and soar available or any contact to which i can connect. I am interested in the product from an MSP prospective.

With current features, is there a way we can control number of simultaneous playbook runs per environment? For example, we're facing issues where multiple playbooks run if multiple cases are ingested for a single environment and that skews our playbook steps that look for duplicates. So I was wondering if we can set something up so that per environment only one case/playbook runs at a time and others wait in some sort of a queue?