Community & Learning workshop - RSAC 2024
Attending RSAC 2024? Join us at the upcoming Google Security Operations workshop, where we'll do a deep dive i...
Forum Posts
New Google Cloud Security Customer Success Services Available!
We are excited to announce the availability of Google Cloud Security Customer Success subscriptions. Optimize ...
Segregation of similar alerts into one in Google chronicle SIEM
Hi All,I just want to know is there any feasibility to merge similar alerts into one single alert that matches...
Dynamic risk score assigning in outcome section
Hi guys,I am creating a yara rule to find the lateral movement of the users. But i am stuck at assigning risk ...
trial
hello is there a way to get free trial of chronicle siem and soar for evaluation ?
Community & Learning workshop - RSAC 2024
Attending RSAC 2024? Join us at the upcoming Google Security Operations workshop, where we'll do a deep dive i...
API to manage alerts
Hi,is there any API endpoint to manage alerts? We'd like to be able to close alerts from scripting and externa...
Alarming Disabled Rules Appearing in Alerts Console – Anyone Else?
Hey everyone!I've come across a peculiar issue and wanted to see if anyone else is experiencing the same thing...
remote login analysis using IP addresses - unreliable?
@Marie_Chudolij YouTube video 2-27-24 - Chronicle SOAR to the Rescue: Orchestrate SIEM Reference List Updates ...
Empowering Detection Engineering with Chronicle SIEM and Mandiant Security Validation
Empowering Detection Engineering with Chronicle SIEM and Mandiant Security Validation Introduction Detection e...
Chronicle Parser - JSON
Hi All,Can we parse a log with the below mentioned format with out making any changes while ingesting?[ { "hea...
escaping backslash
The Parser syntax reference documentation https://cloud.google.com/chronicle/docs/reference/parser-syntax#gsub...
Nxlog BufferSize Keyword Error
I changed the buffersize from default (65000) to 512000 both in im_file & om_tcp modules but it give the follo...
Error while running the forwarder
Hello All,I was trying to install forwarder on my test machine which has been newly configured and it is showi...
Chronicle logs ingested but not appear in search for a custom parser
I have created a custom parser for json raw data for proofpoint. I tested my parser and was able to get all re...
SIEM Alerts icon
Hi community. Yesterday I noticed something weird working on Chronicle SIEM. We received an alert coming from ...
What is a predicate in YARA-L?
The following doc makes reference to the term "predicate".https://cloud.google.com/chronicle/docs/detection/ya...
Windows applications logs
Hi All,How to collect the specific application logs for Windows servers. could you please us.
Converting data from json log into Chronicle UDM events
Hello everyone!I am creating a custom parser for json logs and I need to convert domains_list into principal.u...
Json parsing
Hello everyone, we are currently developing a parser for logs that are in JSON format (not raw JSON). Is it po...
Migrating log data to a new data label
Has anyone here ingested data to SIEM via a temporary label and then migrated to a new data label? We recently...
UDM event for Storage.Object events
Hey folks!!For GCP audit logs does anyone know if there are any udm event for storage.object.get or storage.ob...
Event Color Coding
What does this different color (Green, Grey, Red, violet etc..) coding says for an Event? Are there any more ?...
Chronicle SIEM alerts detection delay.
Hi everyone, Yesterday I noticed that there could be a problem with our SIEM. I'll give you an example:In cura...
Failed to connect to Chronicle Alerts APIs
We are try to extract alert generated in Chronicle instance with the below approaches: Approach 1: https://clo...
Workspace_Activity Download: Who done it?
I'm looking at events in Chronicle withmetadata.log_type = "WORKSPACE_ACTIVITY"metadata.product_name = "drive"...