Google Security Operations

I’m trying to authenticate to the new Chronicle API using PowerAutomate. It’s been working using the old API, but I’m not sure how to set it up for the new API. Has anyone done it or have any advice? The issue is the authentication methods I see all involve client libraries or the CLI, but in PowerAutomate there is not a pre-built integration that I see, so I’m just using HTTP requests.  Previous MethodURL: https://REMOVED.siemplify-soar.com/api/external/v1/cases/CreateManualCaseAuthentication Method: AppKey New MethodURL: https://us-chronicle.googleapis.com/v1alpha/proje

Is it possible to trigger a playbook based on a new case being created? I’m working on building a case notification system that alerts a security analyst when a new case is created.The intended workflow is:Send an initial notification when a new case is created After a delay, allow a triage phase so all related alerts can be grouped into the case Send a follow-up “case summary” notification that includes all relevant case details to help the analyst determine whether the case is a true or false positiveThe issue I’m running into is that when multiple alerts hit the SOAR system at the same time, multiple playbook executions occur, which results in duplicate notifications.

Hello everyone, I am trying to ingest mimecast v2 api logs into googlesecops, however integration available in content hub expects app id, V2 API does not have app id, Can anyone help me on this please. 

Simple Question:Is there any way to identify which raw logs ingested into Google SecOps do not yet have a parser?There are many teams ingesting logs into my Google SecOps, and I would like to identify which logs do not yet have an active parser. Is there a way to view or report on logs that are not yet parsed?

 Hello everyone, I need some help regarding Google SecOps Case Management. In the Case Wall, we can see all activities related to a case such as actions taken, comments, status changes, tasks , and other events that happened during the life-cycle of the case. I would like to know if there is a way to export or extract the Case Wall activity into a table format or CSV file.Our team focus to review response time of each assigned case and what happen to that case.  Any suggestions or guidance would be greatly appreciated.Thank you.

Hello, I am working on a parent-child multitenant solution.  Child alerts are pulled by the Parent SOAR and a new case is created, however the original case ID (the one created by the Child) is missing.  Is there any way to find the original case ID (ID created by the Child) in the Parent SOAR?  Thank you!

Hi All, I need some guidance to map ontology at product level with an example so i can follow with regex or transformation usage 

Microsoft Intune Context Log Feed — ingesting via GCS instead of Azure Blob Storage?Product: Google SecOps (Chronicle) Log type: Microsoft Intune Context Log FeedHi everyone,Following up on a previous thread where @hzmndt confirmed that cloud storage ingestion is the correct method for Intune Context logs (and that there's an open feature request for Third Party API support: https://issuetracker.google.com/issues/369896058 and previous post here:).We've implemented exactly that a Cloud Function that collects Intune data and writes it to Google Cloud Storage, which is then picked up by a SecOps feed. This was a deliberate choice because we have no Azure infrast

Hi Community,Our team is looking to build a unified dashboard in Google SecOps (Chronicle) that enables analysts to search for Indicators of Compromise (IOCs) across all available data sources from a single interface.Use Cases:Username search: Enter a username and retrieve all events associated with that user across all ingested data sources within a configurable time range (e.g., last X days). IP address search: Query an IP address and see all related network activity, authentication events, alerts, etc. Hash value search: Look up a file hash and identify all occurrences across endpoint, proxy, and other relevant log sources.Essentially, we're looking for a centralized IOC pivot dashboard that aggregates results from multiple log types and presents a consolidated view for faster investigation and threat hunting.

Hi,We need to transform the structure of an JSON array into another JSON array with different fields and structure using the 1st array values in order to POST it into an API.In a playbook starting with a “Siemplify_Get Case Details” step, we retrieve all the entities from the case, using  [Siemplify_Get Case Details_1.JsonResult| "entityCards"], as far as we see is where the case entity fields are located, and has an structure like this: "entityCards":[    {        "identifier":"XXXXXXXXXXX",        "type":"HOSTNAME",        "suspicious":false,        "linkedEntities":[        ]    },    {        "identifier":"1.1.1.1",        "type":"ADDRESS",        "suspicious":false,        "linkedEntities":[        ]    },    {        "identifier":"XXXXXXX",        "type":"HOSTNAME",        "suspicious":false,        "linkedEntities":[            {

Hi !  I’m trying to ingest workday audit logs according to the google supported guide:https://docs.cloud.google.com/chronicle/docs/ingestion/default-parsers/workday-audit#create_pubsub_topic However, when I get up to step 2 in “Configure Workday Custom Report”, I am unable to find data source “Audit Trail - Business Process”, I have full access and license isn’t an issue. Is this an outdated data source name? If so, whats the new name / method for collecting these logs? Also the guide notes storing WD_USER and WD_PASS into the container, is there another way for this to be complete ? Basic Auth would not be the best method in my opinion. Thanks Finn

Hi, I want to get a report using the dashboards for a time period exceeding 92 days that is currently permitted for stats dashboards. i cant do this using a UDM search result since the requirement i have is to only get the latest login which is not possible through the CSV file that i can get by doing a udm search. The query i need is this:events: $e.metadata.log_type = <logtypevalue> $e.metadata.product_log_id = <value> $e.principal.user.userid = $userid $userid != "" $e.principal.user.group_identifiers = $group $seconds = $e.metadata.event_timestamp.seconds $date = timestamp.get_date($e.metadata.event_timestamp.seconds) match: $userid, $groupoutcome: $event_count = count($e.metadata.id) $Last_login_date = timestamp.get_timestamp(max($e.metadata.event_timestamp.seconds) + 19800) //adding +5.30 in minutes to utc time

Adversarial misuse of AI has changed the speed and scale of attacks, marking an evolution that demands a shift in defensive strategy. We recently released a new special report, our Mandiant AI risk and resilience report, detailing what we are seeing on the front lines and how defenders need to adapt. By combining the frontline experience of Mandiant with the deep adversarial research of Google Threat Intelligence Group (GTIG), this report offers a unique perspective. In the report we cover three key areas:Adversarial use of AI: Threat act

Hi,I am relatively new to Google SecOps/SOAR.   The use case is to integrate SecOps SIEM with Splunk to enable the ability to have alerts triggered in SecOps to be forwarded to Splunk ( currently being used by the SOC ).  Basically, as part of the operations migration, the requirement is to have the SOC receiving the alerts as the log sources continue to be migrated to Google SecOps.I have had a look at the Splunk App under Response Integration ( Splunk Integration ) but based on my understanding, it looks to support curating or forwarding alerts from Splunk towards Google SecOps - instead of the other way round. Please, anyone have an idea on how this use case can be achieved?

# SOAR Bulk Case CloserA resilient Python script designed to search for open cases in Siemplify / Google SecOps SOAR and close them in bulk based on a matching case title. While SecOps SOAR contains an action under tools > case close based off search it can only process 50 cases at a time. If like me in lab testing or due to a miss configuration you have created 1000’s of cases this script may help.## The Code - https://github.com/Darrenswift/soar_automation/tree/main## Overview This script is optimized for handling a large number of cases and network instability by utilizing connection pooling, automatic retries, and exponential backoff.## Features* **Efficient Bulk Operations:** Uses `requests.Session()` to keep the underlying TCP connection aliv

​​​​hello Team , could any one help me understand why IOC MATCHES tab on alerts and ioc ciew  list benign websites like cloud.google.com as an IOC  

Author: Adam Eehan (Security Researcher)​1. The Core Problem​Most AI models fail when an attacker uses "Roleplay" or "Token Smuggling" to bypass the core system instructions (The System Prompt). Once the system prompt is compromised, the AI leaks sensitive data or ignores safety guardrails.Subject: [Opportunity Seeking] Innovative AI Red Teaming Logic: Recursive Honey-potting & Active Defense Architecture​Dear Google VRP / Red Team,​I am writing not just to report a vulnerability, but to propose a proactive security architecture I’ve designed called the Adam Cyber-Guardian System. As a self-taught security researcher (Age 17, turning 18 on April 19), my approach focuses on Cognitive Traps—outsmarting attackers by leading them into a recursive decoy environment.​1. The Strategic Architecture (The Adam Logic)​Instead of static filtering, my system uses a multi-layered psychological and technical defense:​Layer 1: The Intelligent Interceptor: Logic-based intent

New to Google SecOps, so I might not be looking in the right place, hoping to get some help.I setup 2 Feeds to pull from the Rapid7 Insight Cloud console one  for assets and one for vulnerabilities. https://docs.cloud.google.com/chronicle/docs/reference/feed-management-api#rapid7-insightData started to be ingested but there does not appear to be individual vulnerability findings per system.There’s vulnerability definitions which just give you information on a vulnerability and then there is the asset information along with vulnerability information such as it has 10 critical but no information on what they are. There does seem to be a new[] and remediated[] field which is always empty even in the raw event.Am I missing something to be able to get the actual vulnerab

Calling all developers!  Register now for Google Cloud Next in Las Vegas, April 22-24, to experience the latest in AI, security, and product launches. Make sure to grab your seat before registration closes soon HERE!

Being playbooks so critical, there should be a way to alert when they are created/updated/deleted (CUD). There was a way, at least of checking Create and Update by creating an alert in GCP and searching for  protoPayload.methodName =~ "malachite.*?(?:Create|Update)Rule" But that’s not the case anymore. The log was simple removed. The answer of a support case was -Sorry, that’s not supported, here is a feature request-. The logs do exist in SecOps, but there is no way to run a playbook on them or send alerts when they have been CUD. Again, for being so critical and powerful, in the sense that playbooks have the power to do things, they should be a way to know when they have been CUD.  More than one year ago I highlighted the same situation: Asking to see if I might be missing something.

Integration version: SCCEnterprise_V18.0Platform: Google SecOps SOAR (Siemplify)Jira: Atlassian CloudProblemThe SCC Enterprise - SyncSCCJiraTickets job fails on every execution with an HTTP 410 error when attempting to search for Jira issues:JiraError HTTP 410url: https://<tenant>.atlassian.net/rest/api/2/search?jql=...text: The requested API has been removed. Please migrate to the /rest/api/3/search/jql API. Atlassian has permanently removed the /rest/api/2/search endpoint on Cloud tenants. The integration is hardcoded to use API v2 and does not fall back to v3.Steps to reproduce1. Install SCC Enterprise V18.0 on Google SecOps SOAR2. Configure the SyncSCCJiraTickets job against an Atlassian Cloud Jira instance3. Run the job, it fails immediately after fetching create issue metadataExpected behav

I’m looking at Crowdstrike events and trying to get an overview of all the detections by first getting a count of unique severity, tactic, technique, description, product event type combinations. events: $e.metadata.log_type = "CS_ALERTS" $e_product_evtype = $e.metadata.product_event_type $e_desc = $e.metadata.description $e_tactic = $e.security_result.attack_details.tactics.name $e_technique = $e.security_result.attack_details.techniques.name $e_severity = $e.security_result.severity match: $e_severity, $e_tactic, $e_technique, $e_desc, $e_product_evtypeoutcome: $event_count = count_distinct($e.metadata.id)order: $event_count descHowever I noticed that there are several severities with the value “UKNOWN_SEVERITY” 

Hi Community,Our team is looking to build a unified dashboard in Google SecOps (Chronicle) that enables analysts to search for Indicators of Compromise (IOCs) across all available data sources from a single interface.Use Cases:Username search: Enter a username and retrieve all events associated with that user across all ingested data sources within a configurable time range (e.g., last X days). IP address search: Query an IP address and see all related network activity, authentication events, alerts, etc. Hash value search: Look up a file hash and identify all occurrences across endpoint, proxy, and other relevant log sources.Essentially, we're looking for a centralized IOC pivot dashboard that aggregates results from multiple log types and presents a consolidated view for faster investigation and threat hunting.

We are currently experiencing an issue where some users are unable to access Google SecOps.Could you please comment on possible causes?■Premise- Cloud Identity is used as the IdP.- SOAR Migration is complete, and SOAR permissions have been migrated to IAM.- Users belonging to the group granted the Chronicle SOAR Admin permission can log in.- During SOAR Migration, a custom role equivalent to Basic was created in SOAR Permissions, but users in the group to which this custom role was granted cannot log in.- We have confirmed that the custom role includes the instance.get permission.■Actions Taken- After granting IAM roles to each group, we registered the groups and members in SecOps' IAM Role Mapping following the procedure below:https://docs.cloud.google.com/chronicle/docs/soar/admin-tasks/user-secops/map-users-in-the-secops-platform-first-party■Desired OutcomeWe would like to differentiate permissions betwee

Hello,  This might be a very simple request (forgive me) - but how do you SIEM search for a single user to see every alert that user has triggered in the past 7-days. I know you can see the results in the “alerts” tab next to the SIEM results. But I don’t know what the UDM search would be specifically for alerts.  I’d like to include this UDM search into a playbook which checks how many alerts have returned, and based on the number makes a conditional jump.  Thanks,