Community & Learning workshop - RSAC 2024
Attending RSAC 2024? Join us at the upcoming Google Security Operations workshop, where we'll do a deep dive i...
SIEM Forum
Find answers to your questions from passionate experts in the community, share industry updates, and engage in discussion.
Forum Posts
New Google Cloud Security Customer Success Services Available!
We are excited to announce the availability of Google Cloud Security Customer Success subscriptions. Optimize ...
How can chronicle SIEM be used for storing data of multiple tenants?
We are looking to provide an MSSP type of service and build an XDR service, currently looking to explore how d...
Problem with outcome aggregation (array) for a multiple-event rule
Hello,I struggle with the outcome section for a rule i'm working on at the moment. I looked in the documentati...
What events Does the `Unix system` parser actually parse?
I have a situation where I need to advise some clients and users that the default `Unix System` parser will pa...
how to develop the parser
Hi All,I am very much looking forward to learning more about parsers, but we do not understand how to develop ...
Executed CLI commands and NGINX logs to Chronicle
Hi,I want to ingest 2 different types of logs from GCP to Chronicle SIEM.1) executed commands on GCP projects ...
Chronicle Forwarder data recovery
In the event a forwarder crashed, let's say 24-48 hours of downtime.How can we recover the events that were me...
Connecting Chrome browser management logs with Chronicle
Hey all,I am trying to connect our Chrome browser with Chronicle using the native workspace connector and Chro...
Chronicle console access error
We are getting below error while accessing Chronicle console. Any idea why this error is coming ?SSO login was...
Metadata Time Start and End Time Interval is not being followed
Hello,I'm setting up asset enrichment through the ENTITY_CONTEXT. I have configured time interval as below:By ...
Web Proxy Zscaler
how to integrate Web Proxy Zscaler into SIEM. Please share the URL.
Ingesting custom log data to Chronicle SIEM - Not existing Log Source and Log type
Hi Community,Did anyone try to ingest a completely custom log data to Chronicle SIEM?I mean log data which doe...
Dynamic risk score assigning in outcome section
Hi guys,I am creating a yara rule to find the lateral movement of the users. But i am stuck at assigning risk ...
Yara-l outcome problems
Hi!I want to create a rule that contemplates different clients($udm.metadata.ingestion_labels["customer"]) and...
Ingest Azure Activity Logs
Good afternoon! I want to ingest Azure Activity Logs into our Chronicle instance. For that, I have found the f...
Restrict feed access to google's IPs
Hi!I am configuring a feed on Chronicle SIEM to obtain Azure Activity Logs following this guide: Ingest Azure ...
500K CIDR Block inclusion List
We have a list of ~500k CIDRs previously used as a lookup table in Splunk that we would like to replicate as a...
Getting "ConnectionResetError: [Errno 104] Connection reset by peer" when installing SIEM forwarder
Are you installing Chronicle forwarder and get the following error when setting up the forwarder when trying t...
YARA-L Rule Using External List
Hi, My reading suggests otherwise but wanted to ask on here whether anyone had successfully managed to create ...
How to find duplicate events ingestion into chronicle
Hi All,Is there any way that we can find the duplicate events ingested into chronicle. If yes, could you pleas...
GMAIL Log Ingestion
How are others ingesting Gmail logs into Chronicle?We've been sending them directly to BQ and querying them th...
Needhelp with yara rule to find the users who are accessing the website which is hosted in AppEngine
Hi everyone,I'm currently working on setting up some security monitoring for my Google App Engine-hosted websi...
How Do I Delete A Reference List?
Hey Folks, I ran into a situation today where I wanted to delete a reference list but couldn't figure it out. ...
How to send a chronicle siem alert to chronicle soar?
How to send a chronicle siem alert to chronicle soar? So basically we would need to send a chronicle siem aler...
assistance in YARA rule
HiI need to migrate the below Splunk alert to Chronicle , can some one assist how this can be converted in YAR...
SPLUNK SIEM TO CHRONICLE MIGRATION
Hi All I have been working to create an approach for customers migration from existing SPLUNK SIEM (on prem) t...
YARA-L, Rule Schreiben
Hi,i have wrotten a new Rule, but it shows always 2 or more Events/Alerts. I want to see only one Event at a s...
Log not receiving - Notification
In Chronicle If I didn't log from a particular source within a timeframe of 30 minutes, will we be able to cre...
Parsing CEF format or other fields containing separator character within
Hello everyone,I am having a quite hard time trying to parse a MalwareByte logs in CEF + KV format, since the ...
trial
hello is there a way to get free trial of chronicle siem and soar for evaluation ?
Parser extension Multiple Raw field to same UDM Field
In a predefined parser, 2 different raw fields are parsed to same UDM field:"var_target.resource.resource_subt...
