Google Chronicle Backstory
Use the Chronicle integration to retrieve Asset alerts or IOC Domain matches as Incidents. Use it to fetch a list of infected assets based on the indicator accessed. This integration also provides reputation and threat enrichment of indicators observed in the enterprise.
- Category
- Analytics & SIEM
- Pack
- GoogleChronicleBackstory
Configuration parameters
- service_account_credential — User's Service Account JSON (required)
- region — Region
- other_region — Other Region
- malicious_categories — Provide comma(',') separated categories (e.g. APT-Activity, Phishing). Indicators belonging to these "categories" would be considered as "malicious" when executing reputation commands.
- suspicious_categories — Provide comma(',') separated categories (e.g. Unwanted, VirusTotal YARA Rule Match). Indicators belonging to these "categories" would be considered as "suspicious" when executing reputation commands.
- override_severity_malicious — Specify the "severity" of indicator that should be considered as "malicious" irrespective of the category. If you wish to consider all indicators with High severity as Malicious, set this parameter to 'High'. Allowed values are 'High', 'Medium' and 'Low'. This configuration is applicable to reputation commands only.
- override_severity_suspicious — Specify the "severity" of indicator that should be considered as "suspicious" irrespective of the category. If you wish to consider all indicators with Medium severity as Suspicious, set this parameter to 'Medium'. Allowed values are 'High', 'Medium' and 'Low'. This configuration is applicable to reputation commands only.
- override_confidence_score_malicious_threshold — Specify the numeric value of "confidence score". If the indicator's confidence score is equal or above the configured threshold, it would be considered as "malicious". The value provided should be greater than the suspicious threshold. This configuration is applicable to reputation commands only.
- override_confidence_score_suspicious_threshold — Specify the numeric value of "confidence score". If the indicator's confidence score is equal or above the configured threshold, it would be considered as "suspicious". The value provided should be smaller than the malicious threshold. This configuration is applicable to reputation commands only.
- override_confidence_level_malicious — Select the confidence score level. If the indicator's confidence score level is equal or above the configured level, it would be considered as "malicious". The confidence level configured should have higher precedence than the suspicious level. This configuration is applicable to reputation commands only. Refer the "confidence score" level precedence UNKNOWN SEVERITY < INFORMATIONAL < LOW < MEDIUM < HIGH.
- override_confidence_level_suspicious — Select the confidence score level. If the indicator's confidence score level is equal or above the configured level, it would be considered as "suspicious". The confidence level configured should have lesser precedence than the malicious level. This configuration is applicable to reputation commands only. Refer the "confidence score" level precedence UNKNOWN SEVERITY < INFORMATIONAL < LOW < MEDIUM < HIGH.
- isFetch — Fetch incidents
- incidentType — Incident type
- incidentFetchInterval — Incidents Fetch Interval
- first_fetch — First fetch time
- max_fetch — How many incidents to fetch each time
- backstory_alert_type — Chronicle Alert Type (Select the type of data to consider for fetch incidents).
- incident_severity — Select the severity of alerts to be filtered for Fetch Incidents. Available options are 'High', 'Medium', 'Low' and 'Unspecified' (If not selected, fetches all alerts).
- fetch_detection_by_ids — Detections to fetch by Rule ID or Version ID
- fetch_all_detections — Fetch all rules detections
- fetch_detection_by_alert_state — Filter detections by alert state
- time_window — Time window (in minutes)
- fetch_detection_by_list_basis — List Basis
- insecure — Trust any certificate (not secure)
- proxy — Use system proxy settings
- integrationReliability — Source Reliability
- feedExpirationPolicy —
- feedExpirationInterval —
Commands (35)
- domain — Checks the reputation of a domain.
- gcb-assets — Returns a list of the assets that accessed the input artifact (IP, domain, MD5, SHA1 and SHA256) during the specified time.
- gcb-cancel-retrohunt — Cancel a retrohunt for a specified rule.
- gcb-change-live-rule-status — Updates the live rule status for a rule specified by Rule ID.
- gcb-change-rule-alerting-status — Updates the alerting status for a rule specified by Rule ID.
- gcb-create-reference-list — Create a new reference list.
- gcb-create-rule — Creates a new rule. By default the live rule status will be set to disabled.
- gcb-create-rule-version — Creates a new version of an existing rule.
- gcb-delete-rule — Deletes the rule specified by Rule ID.
- gcb-get-event — Get the specific event with the given ID from Chronicle. Note: This command returns more than 60 different types of events. Any event would have only specific output context set. Refer the UDM documentation to figure out the output properties specific to the event types.
- gcb-get-reference-list — Returns the specified list.
- gcb-get-retrohunt — Get retrohunt for a specific version of rule.
- gcb-get-rule — Retrieves the rule details of specified Rule ID or Version ID.
- gcb-ioc-details — Accepts an artifact indicator and returns any threat intelligence associated with the artifact. The threat intelligence information is drawn from your enterprise security systems and from Chronicle's IoC partners (for example, the DHS threat feed).
- gcb-list-alerts — List all the alerts tracked within your enterprise for the specified time range. Both the parsed alerts and their corresponding raw alert logs are returned.
- gcb-list-assetaliases — Lists all the aliases of an asset in an enterprise for the specified asset identifier and time period.
- gcb-list-curatedrule-detections — Return the detections for the specified curated rule identifier.
- gcb-list-curatedrules — List curated rules.
- gcb-list-detections — Return the detections for the specified version of a rule, the latest version of a rule, all versions of a rule, or all versions of all rules.
- gcb-list-events — List all of the events discovered within your enterprise on a particular device within the specified time range. If you receive the maximum number of events you specified using the page_size parameter (or 100, the default), there might still be more events within your Chronicle account. You can narrow the time range and issue the call again to ensure you have visibility into all possible events. This command returns more than 60 different types of events. Any event would have only specific output context set. Refer the UDM documentation to figure out the output properties specific to the event types.
- gcb-list-iocs — Lists the IOC Domain matches within your enterprise for the specified time interval. The indicator of compromise (IOC) domain matches lists for which the domains that your security infrastructure has flagged as both suspicious and that have been seen recently within your enterprise.
- gcb-list-reference-list — Retrieve all the reference lists.
- gcb-list-retrohunts — List retrohunts for a rule.
- gcb-list-rules — List the latest versions of all Rules.
- gcb-list-useraliases — Lists all the aliases of a user in an enterprise for a specified user identifier and time period.
- gcb-reference-list-append-content — Appends lines into an existing reference list.
- gcb-reference-list-remove-content — Removes lines from an existing reference list.
- gcb-start-retrohunt — Initiate a retrohunt for the specified rule.
- gcb-test-rule-stream — Test a rule over a specified time range. Return any errors and any detections up to the specified maximum.
- gcb-udm-search — Lists the events for the specified UDM Search query. Note: The underlying API has the rate limit of 120 queries per hour.
- gcb-update-reference-list — Updates an existing reference list.
- gcb-verify-reference-list — Validates list content and returns any errors found for each line.
- gcb-verify-rule — Verifies that a rule is a valid YARA-L 2.0 rule without creating a new rule or evaluating it over data.
- gcb-verify-value-in-reference-list — Check if provided values are found in the reference lists in Google Chronicle.
- ip — Checks the reputation of an IP address.