Google Security Operations

The title :)

The alert included in the case has a product field.In "SOAR Reports legacy", the product field is available. Where can I find this field when using Dashboards and the "Cases and alerts" data source? https://cloud.google.com/chronicle/docs/reference/soar-data-dashboard#cases-and-alertsI reviewed all the fields, but I didn’t find any product field. Anyone would know?   

Hello team, do you have any guidance on developing a risk analytics rule that identifies when an entity exhibits a sudden spike in risk score? In the rule below, I can generate an alert when an entity’s risk score on the Risk Analytics dashboard exceeds a defined threshold. However, I’m more interested in detecting a sudden spike in the entity’s risk score rather than relying on a static benchmark.i have two use cases one is to alert when any user’s risk score in analytic dashboard crosses a benchmark and the other one to detect on sudden spikeAlso, for Risk Analytics, I could not find a UDM field that represents a normalized risk score. I only see the raw risk_score and the delta_risk_score fields.Which of these fields would be the most appropriate to use for t

I am trying to find API list for SIEM but unable to get it.I have SOAR Swagger API, but not able to find SIEM. Please let me know if anyone has any idea.

I’m excited to share a custom solution I’ve developed that will make our Bindplane Agent monitoring process much easier and more efficient. With this setup, agent status can now be monitored in real time directly from Google SecOps, eliminating the need to repeatedly check the Bindplane console.What This Solution DoesIntegrates Bindplane API with Google SecOps SOAR. Automates ingestion of agent status logs into Google SecOps SIEM. Triggers alerts whenever an agent becomes inactive. Provides a single pane of glass for the SOC team to monitor agent health.Key ComponentsBindplane API. SOAR IDE script to fetch and ingest agent data. SIEM rule to detect inactive agents and generate alerts.Benefits✔ Real-time monitoring without manual console checks.✔ Automated alerts for inactive agents.

Risk Analytics is a crucial feature within Google SecOps SIEM designed to help security teams identify unusual behavior and quantify the potential risk that various entities pose to the enterprise. It empowers analysts to move beyond basic alert triage and focus on the entities that represent the most significant threat. Key Components of the Risk Analytics Dashboard The central hub for this feature is the Risk Analytics dashboard, which provides a holistic view of entity risks, accessible to users with global scope in RBAC systems. Behavioral Analytics: This section lists entities (such as user accounts, servers, or laptops) based on their calculated Google Security Operations Entities risk scores. This allows tracking an entity's risk over time and serves as a metric for detection use c

Hi,I have installed Logstash in few of my servers and trying to send the raw logs to my Google SecOps platform (legacy version). My Google SecOps is a google-managed one.I have shared the Integration API Key from Google SecOps with my application team who is setting up the Logstash in the servers. They are stuck with authentication issue in the logstash pipeline when they tried to send the data via Google SecOps Ingestion API.I would like to understand how logstash will be connected with Google SecOps. I couldnt find any official documentation to follow the setup as well. Thanks.

I am looking to setup SSO with Okta for our Google Secops tenant and following the google doc: https://docs.cloud.google.com/chronicle/docs/soar/admin-tasks/saml-soar-only/saml-configuration-for-okta but this just mentions SOAR.Is that how the SecOps SSO works and moreover, there is no External authentication option under SOAR Setting → Advanced → External Authentication.I also found this doc which mentions about the SSO setup with Okta: https://medium.com/@thatsiemguy/linking-okta-to-chronicle-secops-platform-c88ca530a515 which one should I really follow, would appreciate any responses on this? 

I set up a few months ago a long ingestion for slack audit via S3 bucket. It was working fine up until a few days ago that i went to search for logs and couldnt find the log type or log source or literally anything related to this feed. I checked the S3 side to make sure everything is working as intended, didnt find any discrepancy there, checked the feed to see when was the last time it received logs from the S3 bucket and its actively receiving it. However, where are the logs going? I’m not seeing anything when i try to search it and i dont know how to troubleshoot this issue? is there a last chance source that i can look in? (splunk has something like this) or is there a way to search what may be the issue? i am going to look into the log explorer in gcp console to see if there’s anything i can find on it there. Please help? suggestions? tips appreciated!

I am attempting to parse the following log by using UDM mapping but I am facing the following error:generic::unknown: pipeline.ParseLogEntry failed: LOG_PARSING_CBN_ERROR: "generic::invalid_argument: failed to convert raw output to events: failed to convert raw message 0: field \"idm\": index 0: recursive rawDataToProto failed: field \"read_only_udm\": index 0: recursive rawDataToProto failed: field \"security_result\": index 0: recursive rawDataToProto failed: field \"action\": failed to make strategy: received non-slice or non-array raw output for repeated field" This is the log piece:{"threatType": "General Malware","status": "Blocked"}and this is the parsing code:json { source => "message" array_function => "split_columns" on_error => "error_not_json" } if [status] == "Allowed" { mutate { replace => { "security_result

Hi!We are trying to exclude the MS XDR portal from showing up as a entity in our cases. Tried these 3 variants, but it does not filter it out..What is the correct formatting? (The entities in cases are urls to incidents, so I need to catch all variants of the URL with a wildcard.  

Hi Team, We have integrated CrowdStrike via remote agent. For ‘Submit File’ action we need to give the file path. What is the process of submitting file- is it possible to attach the file to case wall and then pass that file to CrowdStrike for analysis?For Analyst, they only have access to case wall, they don't have access to remote agent server. File may be malicious, is it safe to upload such files on case wall?

I’m trying to build a dashboard for SOAR Case Data.I couldn’t find a field in the `case_history` object that will allow me to filter by the environment name. Any suggestions?

Now that multi-stage queries are available as pre-GA, is it possible to create a dashboard KPI for MTTX using case_history data? An easy example would be a measure of the avg time cases were in Triage before going to Investigation.My organization has been trying various yara-l approaches but to no avail.  The examples in the multi-stage documentation do not seem to be related to this type of use case. Thanks

The Chronicle re.capture() function only returns the first match in the text, and it supports only 0 or 1 capture group. If the regex contains 0 capture groups, Chronicle returns the first full substring that matches the expression. If the regex contains 1 capture group, it returns only the first captured value from that match. Chronicle never scans beyond the first match and cannot return multiple matches like extracting all regex on the statement. If the regex contains two or more capture groups, Chronicle throws a compiler error.Used Regex : (?:%3A%3A|::)?[?&][^=]+=([A-Za-z0-9+/]{8,}(?:={0,2})|[0-9]{1,3}(?:\.[0-9]{1,3}){3})Error : compilation error compiling query: generating predicates: regex passed to capture() must have 0 or 1 capture groups, but got: 4 capture groups line: 7 colum

Hello,I have a bindplane configuration that collects logs from Active Directory and Windows Events. However, I noticed that some events are not being sent to the blindplane, but are generated on the server.For example, event 4740. I can see this event in the event viewer, but at no point is it consumed by the bindplane.What could be causing these events not to be brought in?

Hi All,I have a use-case to list out the cases where SLA’s were breached and I am trying to use the dashboard to achieve this.Due to limitations with customising SLAs in chronicle with both case priority and  case stage I cannot use the default SLA definition settings.The idea is to get the handling time of each stage and list down the case IDs which breaches the required conditions in the dashboards. Does anyone know how I can get the handling time per case in the new native dashboards? Or should this be tried another way?

Hey all! We are trying to get a two-way sync between MSXDR (microsoft 365 defender) and SecOps cases. We have the 365 defender integration configured, and we get secops cases created based on MSXDR incidents.  However, we need the following:Secops case closed > XDR incident is set to resolvedXDR incident is resolved (in XDR) > Secops case is closed The need here is:The analyst does not need to close a case in two portals (secops and XDR portal) XDR sometimes does merging or autoclosing, this incident status change should reflect in Secops 

Hi everyoneI’m currently testing log ingestion from a Linux VM to Google SecOps (Chronicle) using Bindplane (no Chronicle Forwarder, only the Bindplane agent and gRPC).In the Bindplane destination, I’m using: Protocol: gRPC Endpoint: malachiteingestion-pa.googleapis.com Auth: json, with the Ingestion Authentication File from SecOps Correct Customer ID But on the VM, the Chronicle exporter always shows:"error": "upload to chronicle: Permanent error: 403 Forbidden" Any idea what can cause a 403 in this case, or anything that must be enabled/checked on the SecOps side?Thanks!

Hi All,Would like to know if there is a possibility to monitor the changes made to a reference list such as adding / deleting a value from the reference list? As we have for changes made to rules from GCP console. Thanks!

Hey Community, I'm working on configuring a detection rule in SecOps to monitor and generate an alert when a file owned/signed by my company is uploaded to VirusTotal. Has anyone worked on a similar task in the past?