Community

Auditing / monitoring of changes made in reference list

Hi All,Would like to know if there is a possibility to monitor the changes made to a reference list such as adding / deleting a value from the reference list? As we have for changes made to rules from GCP console. Thanks!

10

SamNew Member

Monitor for Uploads of My Company Owned/Signed Files to VirusTotal

Hey Community, I'm working on configuring a detection rule in SecOps to monitor and generate an alert when a file owned/signed by my company is uploaded to VirusTotal. Has anyone worked on a similar task in the past?

383

havoxNew Member

Chronicle re.capture() Limitation: Only Returns First Match (Cannot Extract Multiple Expressions)

The Chronicle re.capture() function only returns the first match in the text, and it supports only 0 or 1 capture group. If the regex contains 0 capture groups, Chronicle returns the first full substring that matches the expression. If the regex cont

30

Rob_PStaff

New Google Threat Intelligence Functionality! Saved Searches for IOC Investigations

New Feature for Saved IOC Searches: We have enhanced the Intelligence Search workflow to eliminate repetitive manual entry. Threat hunters can now build complex queries once and save them for future use. This allows teams to efficiently monitor spec

10

2 hours ago

Rob_PStaff

Month of Google TI Search - Day 19 Recap: Hunting Regional Ransomware

This Google Threat Intelligence search query is designed to identify files submitted from specific countries, along with community feedback indicating the presence of a Ransom note, which strongly suggests a potential victim from that country and is

00

2 hours ago

Rob_PStaff

Month of Google TI Search - Day 18 Recap: Hunting LockBit 3.0 ELF Ransomware

This Google Threat Intelligence search query uses a high-fidelity byte signature to instantly identify LockBit 3.0 ELF ransomware samples. content:{34043B5C0B8CFB1AEEDB995A9AA9EE19F9AA9AEE9A09DACA299AAAEE6E09F9EE9A69A99A09B95AF909EEBA6ADA097A9AB95E5

20

2 hours ago

Rob_PStaff

Month of Google TI Search - Day 17 Recap: Hunting AI Evasion and Prompt Injection

This Google Threat Intelligence search query is designed to hunt for malicious files that attempt to confuse, manipulate, or evade security Large Language Models (LLMs) by embedding specific adversarial commands or "jailbreak" phrases. entity:file (

00

3 hours ago

shubham8agarNew Member

Case Created using create_case(case_info) but Alerts/Events Not Showing in Google SecOps

Hi everyone,I'm using the Siemplify SOAR SDK to create a case in Google SecOps. The case is being created successfully, but the alerts and events are not showing up inside the case. Here is the code I'm using:import json from SiemplifyAction import S

1836

4 hours ago

lukeeeenNew Member

security_result issue

I am attempting to parse the following log by using UDM mapping but I am facing the following error:generic::unknown: pipeline.ParseLogEntry failed: LOG_PARSING_CBN_ERROR: "generic::invalid_argument: failed to convert raw output to events: failed to

121

melissagrBronze 1

403 Forbidden when sending logs from Bindplane to Google SecOps (gRPC)

Hi everyoneI’m currently testing log ingestion from a Linux VM to Google SecOps (Chronicle) using Bindplane (no Chronicle Forwarder, only the Bindplane agent and gRPC).In the Bindplane destination, I’m using: Protocol: gRPC Endpoint: malachiteinges

404

preeeyaNew Member

Auditing / monitoring of changes made in reference list

Hi All,Would like to know if there is a possibility to monitor the changes made to a reference list such as adding / deleting a value from the reference list? As we have for changes made to rules from GCP console. Thanks!

10

SamNew Member

Monitor for Uploads of My Company Owned/Signed Files to VirusTotal

Hey Community, I'm working on configuring a detection rule in SecOps to monitor and generate an alert when a file owned/signed by my company is uploaded to VirusTotal. Has anyone worked on a similar task in the past?

383

havoxNew Member

Chronicle re.capture() Limitation: Only Returns First Match (Cannot Extract Multiple Expressions)

The Chronicle re.capture() function only returns the first match in the text, and it supports only 0 or 1 capture group. If the regex contains 0 capture groups, Chronicle returns the first full substring that matches the expression. If the regex cont

30

lukeeeenNew Member

security_result issue

I am attempting to parse the following log by using UDM mapping but I am facing the following error:generic::unknown: pipeline.ParseLogEntry failed: LOG_PARSING_CBN_ERROR: "generic::invalid_argument: failed to convert raw output to events: failed to

121

melissagrBronze 1

403 Forbidden when sending logs from Bindplane to Google SecOps (gRPC)

Hi everyoneI’m currently testing log ingestion from a Linux VM to Google SecOps (Chronicle) using Bindplane (no Chronicle Forwarder, only the Bindplane agent and gRPC).In the Bindplane destination, I’m using: Protocol: gRPC Endpoint: malachiteinges

404

S

sofnNew Member

Best pattern for ingesting Akamai WAF logs (DataStream vs. SIEM API) - looking for full request details

Hi everyone,I am looking for advice on the best architecture for ingesting Akamai WAF logs into Google SecOps. We are currently trying to find another way rather from using Bindplane.We are checking with Akamai DataStream 2, but we are running into a

543

16 hours ago

JSpoorSonicBronze 3

Enriching Event Data using Data Tables

I am trying to enhance / enrich event data / UDM by means of a Data Table. I have the following data table called CrownJewelsColumn 1: Hostname - mapped to entity.asset.hostnameColumn 2: Asset_ID - mapped to entity.asset.asset_idColumn 3: IP - mapped

Notified When The Log feed stops

I'm planning to write a detection rule to monitor a log source. I want to be notified when the log feed stops and no logs are being received!--scriptorstartfragment--> events: $e.metadata.vendor_name = string $e.metadata.event_timestamp = i

1419

S

19 hours ago

manoj610New Member

Clarification on Ingesting Google Vault Logs into Google SecOps SIEM

Hello Team,We are currently ingesting the following Google Workspace logs into Google SecOps: WORKSPACE_ACTIVITY WORKSPACE_ALERTS WORKSPACE_CHROMEOS WORKSPACE_GROUPS WORKSPACE_MOBILE WORKSPACE_USERS I would like to check whether Google Vaul

557

1 day ago

Khaled_mNew Member