Skip to main content

Google Security Operations

Your Security Operations conversation starts here. Ask questions. Share insights. Tell us what you've learned. Or tell us what you're working on. We want to hear about it!

  • 2,124 Topics
  • 6,777 Replies
2124 Topics
ylandovskyy
Staff
ylandovskyyStaff
posted in Google Security Operations
How to use new Data Tables Actions in Google Chronicle Response Integration - Full Guide

Hey folks! In Q3, it was announced that Data Tables are now officially GA and alongside of it, Google Chronicle integration was updated with new actions that allow you to interact with them. In this guide, I will go through all relevant actions and explain how they work. If you are not familiar with Data Tables, please check this documentation. ❗❗Important Note: Data Table actions are only supported for Chronicle API. Backstory API doesn’t support it. To change the integration to work with Chronicle API, you need to adjust the API Root in the integration configuration. Keep in mind that this will affect the whole integration and some action outputs are slightly different, if executed with Chronicle API.❗❗ Initial StateTo make it easier to follow the guide, I am going to create an initial state of a Data Table, which will be used as a reference across the guide:  Get Data Tables ActionThe purpose of this action is to allow you to fetch information about available Data Tables (including

1550
ylandovskyy
Staff
borocausev
borocausevNew Member
asked in Google Security Operations
JSON Result file download

Hi all,I have a custom action that produces a JSON result that is way off the limits. What I get on the case wall is this: JSON ResultThis field contains large amounts of data. Download File to see its content.How can I access/download this file or access its content in my next action?Thanks for any response!Regards,Boro

40
borocausev
Chris_B
Chris_BSilver 2
asked in Google Security Operations
how to quickly find out earliest and latest log per a source - all time

User is asking me when did we start logging their project “my-project” in cloud logs.If I UDM  search on project = “my-project” for the past year ,I get the “too many results” warning and the time graph won’t show up for the whole 1 year I’m searching.“WARNING: Can't show all results because the query is too broad. Events are sampled. Try a more specific query.”In Splunk I’d just use index = foo | fields index and I’d be done in a second.Instead in SIEM I have to spend time researching looking for a field/value pair that doesn’t occur very often  There’s got to be an easier way to do this 

30
Chris_B
rahul7514
rahul7514Bronze 2
posted in Google Security Operations
YARA L query

Hi TeamI am trying to build a YARA L  rule for alert where ""Alerts when one user sends too many emails are sent to a non client domain email over short time period. Can be indication of data exfil .However not sure if this is the right way to do this can some suggest where i am going wrong .This is currently giving lot of results . events: $event.principal.user.email_addresses = $email_sender not $event.target.user.email_addresses in regex %non_client $event.target.user.email_addresses = $email_target $event.metadata.event_type = "EMAIL_TRANSACTION" $event.security_result.action_details = "DELIVERED" match: $email_sender over 10m outcome: $event_count = count_distinct($event.metadata.id) condition: $event and $event_count > 30 

203
FedGreen84
LucaB
LucaBNew Member
asked in Google Security Operations
Webhook ingestion with nested JSON

Hi, I am trying to create a webhook ingestor in Siemplify. I am facing difficulties since the webhook payload contains multiple items, each of which should end up creating a distinct case.Although, when I try to reference a field in the item array, the webhook merges that field of all the items in the list. This results in creating a single case with all the items joined together. What I would be expecting is creating a case for each item in the payload. Is that possible?Thank you for the support.

371
kentphelps
Staff
hisoofun
hisoofunNew Member
asked in Google Security Operations
Custom Field in Close Case Dialog

I have created a new custom field in close case settings for the analysts to enter while closing the case, but it wont show up in the playbook while closing the case. Someone please help

214
hisoofun
MCoelho10
MCoelho10New Member
posted in Google Security Operations
Dependency Errors - QR Code Analyzes with Custom Action

Hi,Im currently working on a way to analyze malicious QR Codes, so i develop a simple script that takes as input a list of base64 of the images and try to return possible links to further submit for analyses in the GTI.The script makes use of the dependency "OpenCV" specially the module "CV2" that interprets the QRCodes, but unfortunately its give me errors of imports.Is there any limitation regarding the use or installation this dependency. 025-07-10,09:38:43,000 INFO] Collecting managers. [2025-07-10,09:38:43,000 INFO] Collecting dependencies. [2025-07-10,09:38:43,000 INFO] Sending remote task package. [2025-07-10,09:38:44,000 INFO] Waiting for remote task 86 to complete. [2025-07-10,09:38:46,000 INFO] Remote task 86 has finished. [2025-07-10,09:38:46,000 INFO] Decrypting results for task 86 [2025-07-10,09:38:46,000 INFO] Task 86 has failed with error message: Traceback (most recent call last): File "/opt/SiemplifyAgent/Integrations/COMPANY_NAME_V18.0/Tasks/Task-RUN_ACTION-86

463
MCoelho10
hmd
hmdNew Member
asked in Google Security Operations
Check the number of detections for a specific custom rule on the native dashboard.

I want to check the number of detections for a specific custom rule on the native dashboard.I was able to create a dashboard that shows the number of detections for all rules for each user, but I am unable to create a dashboard that shows the number of detections for only a specific rule for each user.Could anyone tell me how to fix this dashboard? $user = group( detection.collection_elements.references.event.src.user.userid, detection.collection_elements.references.event.principal.user.userid, detection.collection_elements.references.event.target.user.userid )$user != ""match: $useroutcome: $count = count(detection.id)order: $count desc 

333
babu_k
Staff
T
therockvalleyNew Member
posted in Google Security Operations
Issues with ingesting EKS audit logs (CloudWatch)

I've set up a AWS CloudWatch feed to ingest EKS audit logs from an S3 bucket. Initially it fetches one file with multiple events and then it goes silent. I've confirmed that the logs are written to the bucket.Anyone else that has experienced the same?

92
jamananman
mikelmi01
mikelmi01New Member
asked in Google Security Operations
Create multiple alerts in the same case from a SecOps job

Hi everyone,I'm trying to send multiple alerts via a webhook to Chronicle SecOps and have them be grouped under the same case. However, when I use my job (see code below), even though both alerts are sent together and share common fields, they always end up in separate cases.import sysimport jsonimport requestsfrom urllib3.util import parse_urlfrom SiemplifyJob import SiemplifyJobfrom SiemplifyUtils import output_handler# ====================# Embedded Constants# ====================PROVIDER_NAME = "HTTP V2"INTEGRATION_NAME = "HTTPV2"API_REQUEST_METHODS_MAPPING = { "GET": "GET", "POST": "POST", "PUT": "PUT", "PATCH": "PATCH", "DELETE": "DELETE", "HEAD": "HEAD", "OPTIONS": "OPTIONS",}AUTH_METHOD = { "BASIC": "basic", "API_KEY": "api_key", "ACCESS_TOKEN": "access_token", "NO_AUTH": None,}DEFAULT_REQUEST_TIMEOUT = 120ACCESS_TOKEN_PLACEHOLDER = "{{integration.token}}"# ====================# Internal Classes# ====================class HTTPV2DomainMismatchExc

371
ddiserens
Staff
malzahnOptiv
malzahnOptivBronze 3
asked in Google Security Operations
Detection Rule Test

Hello,An associate of mine ran a SIEM search and got 4 results. They then ran a test of a YARA-L rule with the same logic and got 2 of those 4 results.  10 minutes later it showed 3 of the results.  30 minutes later it showed all 4 results.  Is there a known lag when using the “RUN TEST” feature in the Detection Rules?  The logic used to search was straightforward -- just filtering on 4 UDM fields. No match section. Thanks,Eric

918
cmmartin_google
Staff
PanosMtln
PanosMtlnBronze 1
asked in Google Security Operations
Metric fields are likely normalized in a different format that the actual udm values

Hello Team,Recently I tried using Chronicle's `metrics.auth_attempts_success` function to analyze successful login activity by country for a specific user over the past 30 days. My goal was to dynamically filter the metric using the country from the incoming event like this:    $ip_country = principal.ip_geo_artifact.location.country_or_region    $historical_threshold_country_success = max(metrics.auth_attempts_success(      period: 1d,      window: 30d,      metric: event_count_sum,      agg: sum,      target.user.userid: $targetAccountId,      principal.ip_geo_artifact.location.country_or_region: $ip_country))Surprisingly, this returned 0 for all users, even though I could confirm there were successful logins from countries like Germany and the UK.After some debugging, I discovered that hardcoding the country like this worked:    principal.ip_geo_artifact.location.country_or_region: "Germany"So it seems the metric function is case-sensitive and expects exact string values for dimensi

372
PanosMtln
Chris_B
Chris_BSilver 2
asked in Google Security Operations
Chronicle on Chronicle? Searching for Chronicle events

As a Splunk user I got used to the _index and being able to search on user activity and other events in Splunk. I don’t see as a clear a path to search for Chronicle activity in ChronicleThe following search is for a user creating a rule, but including the match fields shows no results even tho commenting them out does.metadata.log_type = "GCP_CLOUDAUDIT"target.application = "chronicle.googleapis.com"principal.user.attribute.permissions.name = "chronicle.rules.create"$time = timestamp.get_timestamp(metadata.event_timestamp.seconds)$user_email = principal.user.email_addresses$prod_event = metadata.product_event_type$user_perm = principal.user.attribute.permissions.name$req_type = target.resource.attribute.labels["request_type"]// match:// $time , $user_email , $prod_event , $user_perm , $req_type//outcome: // $event_count = count_distinct(metadata.id) // $user_perms = array_distinct($user_perm)  I’m curious if other users monitor rule creation, edits  using searches for managing

354
chrisd2
Vaishnoodevi
VaishnoodeviBronze 1
asked in Google Security Operations
Dynamic Whitelist - Sentinel Connector on the Google SecOps SOAR

Hi All, I have added few use case name to the dynamic whitelist on the Sentinel connector at the Google SecOps SOAR,but some of these alerts are not getting ingested as a SOAR case even though a security incident is created at Sentinel

256
ylandovskyy
Staff
hisoofun
hisoofunNew Member
asked in Google Security Operations
Custom Field in Close Case Dialog

I have created a new custom field in close case settings for the analysts to enter while closing the case, but it wont show up in the playbook while closing the case. Someone please help

41
ylandovskyy
Staff
shashank_bindulbavi
shashank_bindulbaviNew Member
asked in Google Security Operations
Unable to parse Forcepoint WebProxy Logs

Forcepoint WebProxy logs goes into the S3 bucket(Format: export_timestamp.csv.gz) from where Google Chronicle pulls it in and within Chronicle>Settings>Feeds we have give the path to the S3 bucket.I am able to see the raw logs within SIEM but it isn't getting parsed. I click on the Raw log>Manage Parser>Create New Custom Parser>Start with Exisiting Prebuilt Parser>I am using the Forcepoint Web Proxy Parser. Error: generic::unknown: invalid event 0: LOG_PARSING_GENERATED_INVALID_EVENT: "generic::invalid_argument: *events_go_proto.Event_Webproxy: invalid target device: device is empty" The raw log doesn't have quotes. When I directly give a single row input after manually downloading the S3 log file which consists of double quotes, the issue gets fixed. When I view the raw log as CSV in the parser I get additional coulmns, reason is one user can be part of multiple groups. This is the main reason for the error! The column count should remain same. Example:Category:

294
shashank_bindulbavi
mwisener
mwisenerBronze 1
asked in Google Security Operations
searchRawLogs endpoint in dataplane api

Ok, I can’t figure it out and could not find any good examples on the internet, how do I use searchRawLogs endpoint? Use case:  For research, we want to export a “small” subset of data that matches a rawLog. Time is usually paramount, so I cannot use the data-export-api, as that gets queued for DAYS sometimes. So I’m attempting to see if searchRawLogs will fulfill our needs for targeted export of raw logs via api calls. (I understand that we can use raw log search and export csv from the UI, but I need to do it via the API for integrations). I’m trying this:POST https://us-chronicle.googleapis.com/v1alpha/projects/<project>/locations/us/instances/<uuid>/:searchRawLogs BODY: {   "baseline_query":  "/ASA/",   "baseline_time_range": {       "start_time": "2025-08-11T01:00:01Z",      "end_time": "2025-08-12T02:00:01Z”   }no matter what I try, I just get 400, Request contains an invalid argument. I’m doing something stupid, but I can’t figure out what it is. also unclear from th

263
mwisener
ahnna
Staff
ahnnaStaff
posted in Google Security Operations
Announcing a New Forrester Consulting Study: The Total Economic Impact of Google SecOps

We know that demonstrating the Return on Investment (ROI) of your security tools can be a challenge. That's why we commissioned Forrester Consulting to conduct an independent Total Economic Impact™ (TEI) study on Google Security Operations, and the results are in!The study reveals that a composite organization using Google Security Operations experienced a 240% ROI over three years, with a net present value (NPV) of $4.3 million! This isn't just about saving money; it's about making your security posture stronger, faster, and more efficient.Here are some of the key benefits highlighted in the study: 70% reduction in the risk and cost of a breach by boosting event ingestion, onboarding more log sources, and implementing more detection rules. 50% faster Mean Time To Respond (MTTR) and 65% faster Mean Time To Investigate (MTTI) for SecOps teams, empowering you to tackle threats quicker. Empowering junior security analysts, shifting 35% of SecOps work and reducing time to productivity

260
ahnna
Staff
TobiasRadford
TobiasRadfordNew Member
asked in Google Security Operations
Does Google SecOps have a CTF simulation that can be used to train new analysts?

I recently did a CTF with a tool I had no experience with (Obsidian) and I found it very useful to very quickly get up to speed on how to use the platform. We need to get our analysts trained on how to use SecOps (both SIEM and SOAR components) and any resource that could be leveraged to make the process easier would be helpful. Any thoughts?

421
ErikaB
Community Manager
Q
QuentinMNew Member
asked in Google Security Operations
Custom rule - Run test - 4 hours delay

Hello, During testing a custom rule, we are not able to test the rule against logs for the latest 4hours.https://cloud.google.com/chronicle/docs/detection/manage-all-rules Point 8.The end time available is 4hours ago.Example: UTC Time: 6pm. Possiblity to select only 2pm as end time.If I changed my preferred timezone to EST, I ‘ll also get a 4 hours delays.Is it an expected behavior ? Thanks

312
Q
samryanturner
samryanturnerBronze 5
asked in Google Security Operations
Dynamic List Filtering - Google SecOps SIEM Connector

Has anyone successfully filtered on key/values being NULL with the dynamic list on the ingestion connector?Use case, I want to route all Google SecOps SIEM alerts to one SOAR environment if a specific key/value doesn't exist whatsoever in a rule meta block. https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/google-chronicle#dynamic-list-filter The above documentation doesn't seem to talk about it. 

287
samryanturner
S
satya_sakethBronze 3
posted in Google Security Operations
automate re-run playbook

I am unable to loop the playbook.i have created the playbook for automating the eml analysis If eml file is not uploaded it should notify the again. For notifing again ihave 2 optionsLooping as shown in imageRerun the playbook if failes. (Configure action retries in playbooks  |  Google Security Operations  |  Google Cloud)Regarding Rerun(retries) feature do i need to raise a techinical ticked to enable it.Thanks in advance.

313
S
NASEEF
NASEEFBronze 5
asked in Google Security Operations
secops native dashboard for silent host monitoring

Hello team, I'm encountering an issue with the native dashboard I created for silent host monitoring. The same host keeps repeating with the same timestamp. My goal is to visualize hosts that have recently stopped sending logs — for example, a host that was active around 20 minutes ago. However, it seems that the time-based aggregation in my query isn't working as expected. The same host keeps appearing repeatedly with the same timestamp. thanks in advance  

637
SoarAndy
Staff
ericv-ava
ericv-avaNew Member
asked in Google Security Operations
Setting up and using SQS v2 via Federated IDs to ingest logs to GSecOps

I’m aware there is a new Feature: SQS V2 to ingest logs to Google SecOps using Federated ID as stated in this update.https://cloud.google.com/chronicle/docs/release-notes#May_26_2025 At the moment I’m using SQS and static keys and I’m interested in moving over to Federated IDs.  However,   I can’t seem to figure out how STS play a role here. Current documentation assumes  STS its already present.    Do I need to set STS before I can migrate over? if so how can I set up to ingest into my current Google SecOps instance.    I’ve opened a support ticket, look for docs to help me get this going.    Seems support its lost and so I’m. I can’t find clear docs on this.Has anyone use STS + SQSv2 yet?  and or also looking into this? Thanks in advance for any pointers in the right direction.   

384
ericv-ava
ahnna
Staff
ahnnaStaff
posted in Google Security Operations
Announcing New SecOps Maturity Assessment

In today's threat landscape, a robust security operations posture is no longer a luxury—it's a necessity.  That's why we are thrilled to announce our new SecOps Maturity Assessment! This free assessment will help you: Identify your SOC's strengths and weaknesses. Benchmark your security operations against industry best practices. Gain actionable insights to improve your overall security posture. Level up your defenses and stay ahead of the curve.   Ready to put your SOC to the test? Take the Assessment today.

270
ahnna
Staff

Badge winners

Show all badges
Terms & ConditionsCookie settings
Privacy Policy Terms of Service Gen AI Policy Community Guidelines Cookie Settings

© 2025 Google. All rights reserved.