About citreno

citreno · 02-05-2025

Hi team,It has come to our attention that the Workspace Integration only works with Workspace Enterprise and Enterprise+ edition per the docs. We have a client with Workspace Education + which is the highest tier of Education tiers and yet the integr...

citreno · 08-22-2024

Hi Team,I'm trying to build some example YARA-L Metrics functions and one of the ones is resource_read_success/resource_read_fail. There's something strange about this one because in the documented supported filters it says principal.user (which is a...

citreno · 03-26-2025

Ah here is the updated learning path too: https://www.cloudskillsboost.google/paths/581 it contains those courses as well as another course.

citreno · 03-26-2025

These are some of the newest recorded and cover the unified SecOps platform: https://www.cloudskillsboost.google/course_templates/971 - Fundamentalshttps://www.cloudskillsboost.google/course_templates/972 - Deep DiveThe name Chronicle was used at the...

citreno · 03-19-2025

Most commonly the reason is you're not parsing time zone so your event time zone assumes GMT. very common for certain log types like firewalls that don't consider it necessary to send the actual time zone they're reporting time in. So the firewalls a...

citreno · 02-07-2025

I learned the answer, it's in the roadmap for this year for the native integration. For the moment the path is going through BigQuery.

citreno · 02-06-2025

We don't have cloudwatch yet, but we successfully tested SecurityHub via Amazon Data Firehose and you can read our docs here. I believe you can use a similar method, just send CloudWatch to Firehose via CloudWatch subscription filtersThat would be an...

My Stats

citreno's Bio

Badges citreno Earned

Recent Activity

Workspace connector limitation for EDU Editions

Error in YARA-L Metrics function for resource_read_success

Re: Does Google have sec ops trainings, focusing only on sec ops and not the many other products?

Re: Does Google have sec ops trainings, focusing only on sec ops and not the many other products?

Re: Event Timestamp > Ingest Timestamp

Re: Workspace connector limitation for EDU Editions

Re: Ingesting AWS CloudWatch logs into SecOps SIEM