GoogleSecOps

Use the Google SecOps integration to retrieve IOC Domain matches as Incidents. This integration also provides reputation and threat enrichment of indicators observed in the enterprise.

Category: Analytics & SIEM
Pack: GoogleChronicleBackstory

Configuration parameters

credentials — (required)
url_format — API URL Format
secops_project_instance_id — Google SecOps Project Instance ID (required)
secops_project_number — Google SecOps Project Number
region — Region (required)
other_region — Other Region
malicious_categories — Provide comma(',') separated categories (e.g. APT-Activity, Phishing). Indicators belonging to these "categories" would be considered as "malicious" when executing reputation commands.
suspicious_categories — Provide comma(',') separated categories (e.g. Unwanted, VirusTotal YARA Rule Match). Indicators belonging to these "categories" would be considered as "suspicious" when executing reputation commands.
override_severity_malicious — Specify the "severity" of indicator that should be considered as "malicious" irrespective of the category. If you wish to consider all indicators with High severity as Malicious, set this parameter to 'High'. Allowed values are 'High', 'Medium' and 'Low'. This configuration is applicable to reputation commands only.
override_severity_suspicious — Specify the "severity" of indicator that should be considered as "suspicious" irrespective of the category. If you wish to consider all indicators with Medium severity as Suspicious, set this parameter to 'Medium'. Allowed values are 'High', 'Medium' and 'Low'. This configuration is applicable to reputation commands only.
override_confidence_score_malicious_threshold — Specify the numeric value of "confidence score". If the indicator's confidence score is equal or above the configured threshold, it would be considered as "malicious". The value provided should be greater than the suspicious threshold. This configuration is applicable to reputation commands only.
override_confidence_score_suspicious_threshold — Specify the numeric value of "confidence score". If the indicator's confidence score is equal or above the configured threshold, it would be considered as "suspicious". The value provided should be smaller than the malicious threshold. This configuration is applicable to reputation commands only.
override_confidence_level_malicious — Select the confidence score level. If the indicator's confidence score level is equal or above the configured level, it would be considered as "malicious". The confidence level configured should have higher precedence than the suspicious level. This configuration is applicable to reputation commands only. Refer the "confidence score" level precedence UNKNOWN SEVERITY < INFORMATIONAL < LOW < MEDIUM < HIGH.
override_confidence_level_suspicious — Select the confidence score level. If the indicator's confidence score level is equal or above the configured level, it would be considered as "suspicious". The confidence level configured should have lesser precedence than the malicious level. This configuration is applicable to reputation commands only. Refer the "confidence score" level precedence UNKNOWN SEVERITY < INFORMATIONAL < LOW < MEDIUM < HIGH.
isFetch — Fetch incidents
incidentType — Incident type
incidentFetchInterval — Incidents Fetch Interval
first_fetch — First fetch time
max_fetch — How many incidents to fetch each time
time_window — Time window (in minutes)
integrationReliability — Source Reliability
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings

Commands (38)

domain — Checks the reputation of a domain.
gcb-cancel-retrohunt — Cancel a retrohunt for a specified rule.
gcb-change-live-rule-status — Updates the live rule status for a rule specified by Rule ID.
gcb-change-rule-alerting-status — Updates the alerting status for a rule specified by Rule ID.
gcb-create-data-table — Creates a new data table schema.
gcb-create-reference-list — Create a new reference list.
gcb-create-rule — Creates a new rule. By default the live rule status will be set to disabled.
gcb-create-rule-version — Creates a new version of an existing rule.
gcb-data-table-add-row — Adds rows to a data table.
gcb-data-table-remove-row — Removes rows from a data table based on specified row data. Note: This command only removes the first 1000 data table rows. To remove the next set of rows, use the page_token argument.
gcb-delete-rule — Deletes the rule specified by Rule ID.
gcb-get-data-table — Retrieves the data table details of specified data table name.
gcb-get-detection — Retrieves the detection details of specified detection ID.
gcb-get-event — Get the specific event with the given ID from Google SecOps. Note: This command returns more than 60 different types of events. Any event would have only specific output context set. Refer the UDM documentation to figure out the output properties specific to the event types.
gcb-get-reference-list — Returns the specified list.
gcb-get-retrohunt — Get retrohunt for a specific version of rule.
gcb-get-rule — Retrieves the rule details of specified Rule ID or Version ID.
gcb-ioc-details — Accepts an artifact indicator and returns any threat intelligence associated with the artifact. The threat intelligence information is drawn from your enterprise security systems and from Chronicle's IoC partners (for example, the DHS threat feed).
gcb-list-curatedrule-detections — Return the detections for the specified curated rule identifier.
gcb-list-curatedrules — List curated rules.
gcb-list-data-tables — Returns a list of data tables.
gcb-list-detections — Return the detections for the specified version of a rule, the latest version of a rule, all versions of a rule, or all versions of all rules.
gcb-list-events — List all of the events discovered within your enterprise on a particular device within the specified time range. If you receive the maximum number of events you specified using the page_size parameter (or 100, the default), there might still be more events within your Google SecOps account. You can narrow the time range and issue the call again to ensure you have visibility into all possible events. This command returns more than 60 different types of events. Any event would have only specific output context set. Refer the UDM documentation to figure out the output properties specific to the event types.
gcb-list-iocs — Lists the IOC Domain matches within your enterprise for the specified time interval. The indicator of compromise (IOC) domain matches lists for which the domains that your security infrastructure has flagged as both suspicious and that have been seen recently within your enterprise.
gcb-list-reference-list — Retrieve all the reference lists.
gcb-list-retrohunts — List retrohunts for a rule.
gcb-list-rules — List the latest versions of all Rules.
gcb-reference-list-append-content — Appends lines into an existing reference list.
gcb-reference-list-remove-content — Removes lines from an existing reference list.
gcb-start-retrohunt — Initiate a retrohunt for the specified rule.
gcb-test-rule-stream — Test a rule over a specified time range. Return any errors and any detections up to the specified maximum.
gcb-udm-search — Lists the events for the specified UDM Search query. Note: For more information about rate limits, see [Google service limits](https://cloud.google.com/chronicle/docs/reference/service-limits#:~:text=udmSearch-,360%20QPH,-Search%20API#:~:text=udmSearch-,360%20QPH,-Search%20API).
gcb-update-reference-list — Updates an existing reference list.
gcb-verify-reference-list — Validates list content and returns any errors found for each line.
gcb-verify-rule — Verifies that a rule is a valid YARA-L 2.0 rule without creating a new rule or evaluating it over data.
gcb-verify-value-in-data-table — Check if provided values are found in the data table. Note: This command only searches in the first 1000 data table rows. To search next set of rows, use the page_token argument.
gcb-verify-value-in-reference-list — Check if provided values are found in the reference lists in Google SecOps.
ip — Checks the reputation of an IP address.