The best place to start would be the base search like this:
metadata.event_type = "USER_LOGIN" and security_result.action = "BLOCK"
Like metadata.event_type, security_result.action is an enumerated field so there are a fixed set of values allowed. These include
| Enum Value |
Enum Number |
Description |
| ALLOW |
1 |
Allowed. |
| ALLOW_WITH_MODIFICATION |
3 |
Strip, modify something (e.g. File or email was disinfected or rewritten and still forwarded). |
| BLOCK |
2 |
Blocked. |
| CHALLENGE |
6 |
Challenged (e.g. the user was challenged by a Captcha, 2FA). |
| FAIL |
5 |
Failed (e.g. the event was allowed but failed). |
| QUARANTINE |
4 |
Put somewhere for later analysis (does NOT imply block). |
| UNKNOWN_ACTION |
0 |
The default action. |
https://cloud.google.com/chronicle/docs/reference/udm-field-list#securityresultaction
Hopefully this gets you going in the right direction!
LinkedIn
Twitter
