Skip to main content

Security Forums

Welcome to the Google Cloud Security Forums! Your ultimate security conversation spot. Collaborate with peers and experts to solve challenges, together.

2471 Topics
J
John_DePalmaNew Member
posted in Google Security Operations
How to create this custom action

Hello fam, got a question for ya'll: Suppose I have an alert that contains an entry like device=xyz Suppose I am able to query historical data and determine information like: device=abc, seen 50 times device=lmk, seen 25 times I'd like to basically answer this question: "is the alerted on device within the typically seen historical devices?" In this case, the answer would be no . I know I can write a custom action to do this, but I'm trying to stay within the Siemplify cage for supportability. Also, this is eventually intended to be sent out with a Cisco DUO MFA Integration, Connector and Usecase that'll be shared Suppose my question would be: How can I do this? Let's say the API query will return all the devices seen, but won't count how many occurrences. So I'll need something to count occurrences, account for a threshold, compare to

06
J
J
Joseph3New Member
posted in Google Security Operations
Differentiating between Group entities and source grouping identifiers

Hello everyone, Please can someone elaborate on this, differentiating between Group entities and source grouping identifiers and what happens when this is toggled on ? Group entities and source grouping identifiers in the same case

05
T
D
Daniel_HarveyNew Member
posted in Google Security Operations
Are there any guides for the TemplateEngine integration?

Hey all, Are there any guides for the TemplateEngine integration (Specifically for the Entity Insight action?) The only writeup I can find are the two previous ones by Rob but they only talk about the "Render Template action" Cheers

01
J
L
Luis_GironNew Member
posted in Google Security Operations
Experience in implementing MITRE ATT&CK on playbooks

Hi community, anyone has experience in implementing MITRE ATT&CK on playbooks, I want to implement it but I don't know how to use it, my log source is a SIEM QRadar.

03
J
M
Mark_RodmanNew Member
posted in Google Security Operations
Search for a sub-string in a string

Hi when using the Filter in the expression builder is it possible to search for a sub-string in a string? The filter operation 'in' seems to match only on the entire string?

18
M
B
Ben_HarrisonNew Member
posted in Google Security Operations
Search filters selection

Hi folks... taking advantage of the community questions support, because you're all so knowledgeable (Thanks in advance) Does anyone know if it's possible to "save a search" in the UI? ...or maybe just a more advanced syntax for the search parameters by URL, e.g. mysiemplify.com/#/main/search?Caseids=256&Caseids=28&Caseids=201&Caseids=4&time=352&tags:Manual,Auto1,Machine2 ...including more than just the basic 4 fields here? (NB. I'm looking for a way which doesn't have to be UI driven through filter selection on the left panel of the search...) View files in slack

05
B
S
Slinger_JamesNew Member
posted in Google Security Operations
Poll a case for open alerts and close the case through a playbook action

Does anyone know if there is a way to poll a case for open alerts and then close the case if there aren't any through a playbook action?

02
C
C
Craig_LeabhartNew Member
posted in Google Security Operations
Playbook placeholders for internal users entity

there are playbook action placeholders for lots of entity types, but not for internal users. is there an easy way to get that same info that i'm overlooking (such as the output from a tool action or similar)?

01
C
C
conan_huNew Member
posted in Google Security Operations
Change and Delete Ontology

Hello, everyone! I’m configuring my CSV connection, and I’ve changed the title of my CSV file multiple times, but Ontology still giving me the initial version of my CSV file, as seen in the first image below, even though I’ve previously changed it.

03
C
C
conan_huNew Member
posted in Google Security Operations
Trouble setting up local CSV connector

Hi, Hello, I’m attempting to run a basic local case to test my playbook, but I’m having trouble setting up my local csv connector. Can someone assist me with this error? thanks a lot. [13:48:29,000 INFO] Csv Folder Path: /root/conantest.csv [13:48:29,000 INFO] CSV Limit: 10 [13:48:29,000 INFO] DeviceProductField: device_product [13:48:29,000 INFO] Time Field Name: timestamp [13:48:29,000 INFO] Time Field Timezone: UTC [13:48:29,000 INFO] Environment Field Name: conantest [13:48:29,000 INFO] Environment Regex Pattern: .* [13:48:29,000 INFO] Rule Generator Field Name: conantest [13:48:29,000 INFO] CSV Has Header: true [13:48:29,000 INFO] File Encoding Types: utf-8, latin-1, iso-8859-1 [13:48:29,000 INFO] Alert Field Name: conantest [13:48:29,000 INFO] Severity Field Name: 10 [13:48:29,000 ERROR] Unable to create folder: [Errno 13] Permission denied: '/root/conantest.csv' LOGGER: loadCon

03
C
J
Joseph3New Member
posted in Google Security Operations
Entity Selection

Hello, Please I have a question on the entity selection, is there a way to display or use those entities selected in the playbook step individually?

06
M
J
Joseph3New Member
posted in Google Security Operations
Query Joiner

Hello, please can someone direct me on how the query joiner works? These are the screenshot below of what i tried and error i was getting. Just trying to explore the action to see if it can accomplish my aim

01
J
G
Gary_TanNew Member
posted in Google Security Operations
Need help: Bridged Adapter doesn't work on Community OVA in VirtualBox

Hey community, I am new to siemplify, I just installed Community OVA in VirtualBox, chose Bridged Adapter, en0: Wi-fi. But when ssh to the vm to ip addresses show, I don't see an IP address from enp0s3 interface, as explained in step 14 as below https://www.manula.com/manuals/siemplify/quick-start-guide/5.6.x/en/topic/deploy-community-ova-in-virtualbox My VirtualBox is running on a MacBook Pro host, using wifi. Any suggestions?

02
S
Staff
L
Luis88New Member
asked in Google Security Operations
Unified Data Model?

Ok last question (for now).  What is UDM (Unified Data Model)?

02
K
S
SevenBridgesNew Member
posted in Google Security Operations
Security Command Center scan for projects that are deleted

Hi,When projects in GCP are in shut-down state, will Security Command Center remove all project-related vulnerabilities (vulnerabilities for all resources within the project)?As far as I see, non of them is removed, vulnerabilities still remain.Should we wait for 30-day period for the projects to be deleted, after which vulnerabilities will be automatically removed? Or will we have to mark them one-by-one with security marks?Thanks in advance for an answer.Best Regards,SBG

01
N
V
vinnie17New Member
posted in Google Security Operations
Getting started with Chronicle?

Is there any documentation on how to get started with Chronicle?

02
darrenswift
Staff
L
Luis88New Member
posted in Google Security Operations
Getting colleagues access to Chronicle?

I have a new team member, how do I get them access to Chronicle?

01
N
L
Luis88New Member
asked in Google Security Operations
Chronicle support?

One more question - how can I contact Chronicle Support?

01
N
M
MNlsNew Member
posted in Google Security Operations
AbuseCH Malware Bazaar Integration

Does anybody have an AbuseCH Malware Bazaar integration up and running yet? I am working on one and wondering if there would be interest from others to integrate into their environment.

02
S
Staff
S
sankarakumar_RNew Member
asked in Google Security Operations
How the grouping of alerts happening if am using arcsight SIEM ?

I know the grouping based on the entities and the time frame. to be more precise which time will it consider for the grouping? Is the base event (start time/ end time) or the alert ingestion time into Siemplify like (Triage time) . Kindly confirm?

03
S
Staff
L
luis_zamoraNew Member
posted in Google Security Operations
Endpoints

How or witch tool should I use to monitore por example seven endpoints at my local network

15
L

Badge winners

  • Authored Posts 5
    leodashas earned the badge Authored Posts 5
  • Authored Posts 5
    delstonhas earned the badge Authored Posts 5
  • Authored Posts 1
    SaDaVFhas earned the badge Authored Posts 1
  • Authored Posts 5
    hzmndthas earned the badge Authored Posts 5
  • Solution 10
    hzmndthas earned the badge Solution 10
Show all badges
Terms & ConditionsCookie settings
Privacy Policy Terms of Service Gen AI Policy Community Guidelines Cookie Settings

© 2025 Google. All rights reserved.