Google Security Operations

I have the following rule, but the $historical_threshold_network_success and $historical_threshold_state_success are not counting the historical networks or states, leading to FPs where the detection triggers for user’s where the $historical_threshold_network_success is NOT unique (see attachment image for example). What do I need to do to make $historical_threshold_network_success count correctly? The goal is to reduce FP’s by telling the rule “if specific user has a Duo login history where the ISP (organization) is seen 1 or less times, detect”. This will reduce FPs by baselining user’s typical ISP and only detecting on anomalous ISPs that successfully authenticated.   rule Duo_ATO_ActivelyCompromised {    meta:        author = "Me"        description = "Detects a risky blocked Duo login followed by a successful, risky Duo login (potential ATO) from an access device in a state that has not been seen in the last 30 days." 

Before I reinvent the wheel here, has anyone created a custom parser for Claude Code they’re willing to share? 

Hi,We want to fetch Ironscales alerts into our SecOps instance. When I visit the Google Chronicle integrations page, it redirects me to the documentation below, but I don't see an actual connector available to configure:https://docs.cloud.google.com/chronicle/docs/soar/marketplace-integrations/ironscalesThe question is: How do we actually ingest these alerts from Ironscales into SecOps if the connector isn't appearing in the integration?Thank you!

The problemI need to answer a straightforward question for licence management: how many GB per day does each CloudTrail eventName (e.g. Decrypt, GetSecretValue, AssumeRole) contribute to total ingestion? This is needed to make informed decisions about which event types to filter without unnecessarily dropping high-value detection signals.What I have tried1. Ingestion metrics data source (ingestion.* in dashboards)ingestion.log_type = "AWS_CLOUDTRAIL"match: ingestion.log_type, ingestion.feed_idoutcome: $total_bytes = sum(ingestion.log_volume)This returns total bytes per log_type and feed_id - useful for total volume, but the ingestion metrics schema has no product_event_type dimension. Byte volume cannot be broken down further by event name. P

How can we automate certain tasks in Google SecOps

Hi everyone,I’m currently working on integrating Microsoft Intune logs into Google Cloud (via the Microsoft Graph API).From what I’ve observed so far, it seems that only audit logs are accessible through this integration.I wanted to ask:Is there a limitation with the Graph API that restricts collection to only audit logs? Are operational logs and compliance logs available through any other endpoint or method? If not, are there any recommended alternatives or workarounds to ingest these logs?Would appreciate any insights or guidance from the community.

Hi All, i have some data in soar custom fields . can anyone guide me how i can use in dashboard for a widget  

I recently created detection rules that look for possible suspicious activities for a terminated user. The idea was to only escalate when we see these rules fire after the termination timestamp. The logic are not complex, essentially single event rules looking at certain event_types along with principal and target userids of the user, and no match section therefore running NRT. I did my tests to exclude possible offboard related events. However, after I enabled Alerting, cases were generated with events that occurred days before the rules were set to Alerting. I noticed that the Alerts tied to the cases had the tooltip information below: Now based from what I’ve gathered, this is something to do with how the detection rules pipeline making sure that even “older” events are properly

is there any action where we can attach block to case/alert ? In ide i can see attach playbook but not block

Hello Community,I am currently building a parser for a custom data source sending CEF logs via Syslog. I’ve encountered a structural issue with the keys in the CEF extension that I’m struggling to map to UDM.The Problem: The logs contain keys that are dynamic and non-static, making it impossible to create individual UDM field mappings for them. Specifically: IP-embedded Keys: I have fields like affected_assets.<ip_address>.hosts and affected_assets.<ip_address>.mac. Since the IP address is part of the key name itself, the potential number of unique keys is infinite. Indexed Keys: I also see fields like priority_events.1, priority_events.2, and so on, where the count varies with every log entry. The Challenge: In Google SecOps, it is not technically feasible to create thousa

 Hi everyone,I’m reaching out to check whether others are experiencing issues with the curated detection ruleset Workspace: Data Exfiltration from Gmail in Google SecOps.We’re using the recommended direct ingestion path for WORKSPACE_ACTIVITY logs (including Gmail). While the ingestion and parsing work, we’ve noticed that the UDM fields produced by the Workspace Activity parser do not align with what the curated detection rules expect — specifically in the Workspace: Data Exfiltration from Gmail ruleset.Examples of mismatches include:principal.application is populated with only the message_info.source.service value (e.g., gmail-ui), while the curated rule expects a concatenated value such as gmail-ui send. The selector value is placed under additional.fields instead of a field the curated rule monitors. metadata.product_name is mapped as gmai

Any one has any idea what is this in chronicle can some one explain in detail  

Hi everyone,I’m working on a POC to ingest on-prem Active Directory logs into Google SecOps.Our current architecture is based on a central Azure VM running a Bindplane agent (Linux), which already collects logs via syslog (firewalls, M365, etc.).For AD logs, since they are not natively sent via syslog, I’m evaluating options like Windows Event Forwarding (WEF) from the Domain Controller to a collector VM.Given that our current collector is Linux-based, I’m trying to understand the best practice here:Is it recommended to introduce a Windows-based collector (for WEF / Windows Event Logs) alongside the existing Linux pipeline?Or is there a way to integrate AD logs efficiently into a Linux-based ingestion architecture without losing data quality?Any feedback or real-world architecture examples would be greatly appreciated.Thanks

We have requirement to change the case status through the data connector script. I am unable to find any function in siemplify module to reopen a case in Google SecOps SOAR. I have refered document: https://docs.cloud.google.com/chronicle/docs/soar/reference/siemplify-module#extract-config-params-siemplifyCan anyone guide me here?

Hello Community , How i can identify parsing and normalization errors in Chronicle SIEM please ? Thanks

I have few questions about submission process for the SecOps SIEM custom integration:Can I publish my SecOps SIEM custom integration in Content Hub? It is containing these componants: Ingestion Script Dashboard Detection Rules Search Queries Is there any public repository to submit these componants or any of them as part of content hub?

What is the specific PowerShell command used to prevent external entities from sending emails to your tenant using your own domain names?Why is it necessary to enable "Enhanced Filtering for Connectors" when you have already locked down your tenant to only accept mail from a third-party gateway?If an organization enables RejectDirectSend $true but forgets to update their SPF record to include their legitimate third-party sending services, what is the likely impact on outbound mail delivery?

Hello,I am experiencing an issue related to the use of Data Tables for data enrichment in SOAR. Currently, we have several tables containing IP addresses along with their corresponding hostnames (and in some cases, additional information such as VLAN or other attributes).The goal is to query these tables using the “Is Value In Data Table” action, so that when searching for an IP address, the associated values from the corresponding columns are returned. However, a limitation arises because we need to query three different Data Tables simultaneously, each with different structures and fields.The expected output would be something like:IP (hostname, vlan) if associated information exists IP only, if no match is foundAdditionally, we encounter issues when multiple IPs are present in the same alert. The output does not preserve the relationship between each IP and

Hi,I’m working on enriching AWS CloudTrail logs with Organization Unit (OU) information. Since CloudTrail logs (except for the “CreateAccount” event) do not natively include the OU, I’ve implemented the following workflow:I created a Data Table that maps Account ID to OU and I wrote a detection rule that triggers on the “CreateAccount” log and uses the write_row function to update the mapping in the Data Table.I need the OU information to be available in every case opened for a specific account, even though the logs triggering those cases don't contain the OU field. What is the best practice to enrich a case with a field from a data table in this situation?Can I leverage the outcome section to fetch the OU from my data table and then promote it to the case level?I’m looking for the standard procedure to handle the Alert-to-Case mapping for these enriched values.Or, is graph_override a better approach for this type of enti

Use caseWe want to implement a mechanism in Google SecOps (Chronicle SOAR) where, if the same entity (user, IP, or host) accumulates 3 or more alerts within a given time window (e.g. last 24h), the severity is automatically escalated to High — regardless of whether the individual alerts came from Chronicle SIEM, Cortex XDR, Microsoft Defender, or Entra ID.The individual alerts may be Low or Medium on their own, but the accumulation pattern signals a higher risk that warrants immediate attention.QuestionWhat is the recommended approach to achieve this in Google SecOps?We are evaluating:A SOAR Playbook that counts open alerts per entity and escalates if threshold is met Risk Score Analytics — does this support alerts from third-party connectors (Cortex, Defender) or only Chronicle detections? Any 

Hello,I have integrated the Azure Organizational Context and noticed that some log sources are now being enriched based on this data. For example, my Netskope logs are successfully using principal.user.userid for enrichment.However, in other log sources that contain the same principal.user.userid value—such as my FortiGate logs—the enrichment does not occur.Is there any additional configuration required to enable enrichment for these sources?

Hello Team,I am working with logs in Google SecOps where the IP address fields (such as SourceIPV4, TargetIPV4, and AnalyzerIPV4) are received in decimal (integer) format instead of the standard dotted IPv4 format.For example:750176699 → expected to be converted to a standard IPv4 format (e.g., x.x.x.x)Could anyone please advise on how to convert these decimal IP values into normal dotted IPv4 format within the Google SecOps parser (UDM mapping)?sample log: EPO_Events.EPOEvents 20XX-03-XXT05:XX:33 HOST123 EPOEvents{"AgentGUID": "XXXX12345678","Analyzer": "_1000","AnalyzerHostName": "HOST001","AnalyzerIPV4": "3232235777","AnalyzerIPV6": "AAAAAAAAAAAAAP//wKgBAQ==","AnalyzerMAC": "001122AABBCC","AnalyzerName": "Drive Encryption","AnalyzerVersion": "7.4.0.11","AutoGUID": "ABCDEF12-34567890AB","AutoID": "123456789","DetectedUTC": "2026-03-17T05:48:33","Received

Hi all,Can anyone help me with this query?I need to fetch cases that have the tag “xyz”. Some cases contain multiple tags stored together, like “ABC, xyz, qwerty”.At the moment, I’m unable to retrieve cases where “xyz” appears as part of a multi-tag value.Any suggestions would be appreciated.

Hi everyone,We are working on integrating Google SecOps SOAR with an external application security platform, and wanted to validate our approach as well as explore better alternatives.Use Case1. Incident Sync (Bi-directional)Sync status and comments: From SecOps SOAR → external platform From external platform → SecOps SOAR Current ApproachUsing a scheduled job (polling) to: Fetch updates from both systems Compare changes Push updates accordingly QuestionsArchitecture Validation Is a polling-based approach considered acceptable for this use case? Or is any other approach recommended? Webhook Capabilities in SecOps SOAR Are there limitations on w

We are developing a B2B agentic AI workflow and have received architecture guidance from Google. The proposed stack includes: Google Identity Platform and App Engine for secure ingress; Cloud Storage with Customer-Managed Encryption Keys (CMEK) for document persistence; Document AI for extraction; Vertex AI for enterprise inference; Cloud DLP for data loss prevention; and Cloud Logging and Monitoring for observability. We have been advised to execute a Business Associate Agreement (BAA) with Google prior to launch.Our core question: is this architecture sufficient to protect client data at scale, and are there any known vulnerabilities in AI systems we should be addressing? Key questions:Is our proposed stack the right foundation for a secure B2B AI product, and are there any obvious gaps? How do we make sure one client's data cannot be seen or accessed by another? Does the system monitor and flag sensitive data in both do