Google SecOps | Marketplace

Details
Content
Dependencies
Version History

Retrieve Google SecOps detections, impacted assets, IOC matches, and 3P alerts to enrich your XSOAR workflows.

Quickly respond to security incidents by integrating Google SecOps with Palo Alto Networks Cortex XSOAR.

Google SecOps is a cloud service, built as a specialized layer on top of core Google infrastructure, designed for enterprises to privately retain, analyze, and search the massive amounts of security and network telemetry they generate. Google SecOps normalizes, indexes, correlates, and analyzes the data to provide instant analysis and context on risky activity.

Google SecOps instances, APIs and search parameters are all accessible directly within Cortex XSOAR for full automation of playbooks.

For more information, please visit https://chronicle.security/products/platform/

Quickly respond to security incidents by integrating Google SecOps with Palo Alto Networks Cortex.

Google SecOps instances, APIs and search parameters are all accessible directly within Cortex for full automation of playbooks.

For more information, please visit https://chronicle.security/products/platform/

Automations

Name	Description
ChronicleAssetIdentifierScript	Collect all asset identifiers - Hostname, IP address and MAC address in the context.
ExtractDomainFromIOCDomainMatchRes	Extracts domain and its details from the Chronicle IOC Domain match response.
ChronicleIsolatedIPWidgetScript	Notifies if the IP address associated with the ChronicleAsset is isolated or not.
ChroniclePotentiallyBlockedIPWidgetScript	Notifies if the IP address associated with the ChronicleAsset is potentially blocked or not.
ChronicleIsolatedHostnameWidgetScript	Notifies if the hostname associated with the ChronicleAsset is isolated or not.
ListDeviceEvents	List all of the events discovered within your enterprise on a particular device within 2 hours earlier than the current time.
ChronicleAssetEventsForProductIDWidgetScript	Displays the list of events fetched for an asset identified as a "ChronicleAsset" type of indicator, when its product ID is passed as an asset identifier.
ChronicleAssetEventsForHostnameWidgetScript	Displays the list of events fetched for an asset identified as a "ChronicleAsset" type of indicator, when its hostname is passed as an asset identifier.
ChronicleListDeviceEventsByEventTypeWidgetScript	Displays a pie chart of the number of events, categorized by its event type, fetched for all the identifiers of the ChronicleAsset.
ConvertDomainToURLs	Converts Domain(s) to URL(s).
ChronicleAssetEventsForMACWidgetScript	Displays the list of events fetched for an asset identified as a "ChronicleAsset" type of indicator, when its MAC address is passed as an asset identifier.
ChronicleDBotScoreWidgetScript	Shows the DBot Score and reputation of the Domain.
ChronicleDomainIntelligenceSourcesWidgetScript	Shows the details of sources in the Chronicle Domain Intelligence Sources section of the incident.
ChronicleAssetEventsForIPWidgetScript	Displays the list of events fetched for an asset identified as a "ChronicleAsset" type of indicator, when its IP address is passed as an asset identifier.

Classifiers

Name	Description
Chronicle - Classifier	Classifies Chronicle incidents
Chronicle - Incoming Mapper	Maps incoming Chronicle incident fields.

Incident Fields

Name	Description
Chronicle Detection Window Start Time	The start time of the window the detection was found in.
Chronicle Detection Window End Time	The end time of the window the detection was found in.
Chronicle Detection ID	Identifier for the detection.
Chronicle Alert Count	The number of times alerts occur.
Chronicle Rule Type	Whether the rule generating this detection is a single event or multi-event rule.
Chronicle Curated Events	List of chronicle UDM events from curated rule detections.
Chronicle Domain Name	Domain name fetched from the Chronicle IOC Domain Matches.
Chronicle Last Seen	The Alert/IOC Domain was most recently seen within your enterprise.
Chronicle Alert Name	The name of the alert.
Chronicle First Seen	The Alert/IOC Domain was first seen within your enterprise.
Chronicle Events	List of chronicle UDM events.
ChronicleAsset Support Contact	The support email address of the chronicle asset.
Chronicle Detection Type	Type of detection.
Chronicle Source Product	The source of the alert.
Chronicle User	The unique identifier of the user.
Chronicle Detection Created Time	Time the detection was created.
Chronicle DBot Score	DBot Score obtained for the IOC Domain Matches fetched from Chronicle
Chronicle Rule ID	Identifier for the rule generating the detection.
Chronicle Detection Time	The time period the detection was found in.
Chronicle Rule Name	Name of the rule generating the detection.
Chronicle Rule Version	Identifier for the rule version generating the detection.
Chronicle Skip Entity Isolation	Skip the isolation of entities. Select 'Yes' to skip isolation process of the entities, 'No' otherwise.
Chronicle IOC Ingest Time	IOC ingest time fetched from the Chronicle IOC Domain Matches.
Chronicle Detection State	Indicates whether the rule generating this detection currently has alerting enabled or disabled.
Chronicle Auto Block Entities	Auto block the detected suspicious Domain(s) and URL(s). Select 'yes' to automatically start the process of blocking the entities, 'no' otherwise.

Incident Types

Name	Description
Chronicle IOC Domain Matches
Chronicle Asset Alert
Chronicle User Alert
Chronicle Rule Detection
Chronicle Curated Rule Detection

Indicator Fields

Name	Description
ChronicleAssetIP
Chronicle Potentially Blocked IP	Determines if the IP Address is potentially blocked.
Chronicle Isolated Hostname	Determines if the host is isolated.
Chronicle Isolated IP	Determines if the IP Address is isolated.
ChronicleAsset Summary	Summary of the event types of the events fetched for all the possible asset identifiers.
ChronicleAssetMAC
ChronicleAssetProductID
ChronicleAssetHostname

Integrations

Name	Description
Google SecOps v1 Alpha (Partner Contribution)	Use the Google SecOps integration to retrieve IOC Domain matches as Incidents. This integration also provides reputation and threat enrichment of indicators observed in the enterprise.
Chronicle (Partner Contribution)	Use the Chronicle integration to retrieve Asset alerts or IOC Domain matches as Incidents. Use it to fetch a list of infected assets based on the indicator accessed. This integration also provides reputation and threat enrichment of indicators observed in the enterprise.
Google SecOps Streaming API (Partner Contribution)	Use the Google SecOps Streaming API integration to ingest detections created by both user-created rules and Google SecOps Rules as XSOAR incidents.

Layouts

Name	Description
ChronicleAsset Indicator	ChronicleAsset Indicator Layout
Chronicle Rule Detection Incident	Chronicle Rule Detection Incident Layout
Chronicle Curated Rule Detection Incident	Chronicle Curated Rule Detection Incident Layout
Chronicle User Alert Incident	Chronicle User Alert Incident Layout

Playbooks

Name	Description
ChronicleAssets Investigation And Remediation - Chronicle	Performs enrichment and investigation of the ChronicleAsset type of indicators, provides an opportunity to remediate in case any of the ChronicleAsset information i.e., hostname or IP address is found to be malicious or suspicious, and sends out an email containing the list of isolated and potentially blocked entities. To select the indicators you want to add, go to playbook inputs, choose "from indicators" and set your query. For example, type:ChronicleAsset etc. The default playbook query is "type:ChronicleAsset". In case indicators with different query parameters are to be investigated, the query must be edited accordingly. This playbook needs to be used with caution as it might use up the integration’s API license when running large amounts of indicators.
Hostname And IP Address Investigation And Remediation - Chronicle	This playbook receives ChronicleAsset type of indicators from its parent playbook "ChronicleAsset Investigation - Chronicle", performs enrichment and investigation for each one of them, provides an opportunity to isolate and block the hostname or IP address associated with the current indicator, and provides a list of isolated and blocked entities.
List Device Events - Chronicle	This playbook receives ChronicleAsset identifier information and provides a list of events related to each one of them. Supported integration: Chronicle Google SecOps.
Investigate On Bad Domain Matches - Chronicle	Use this playbook to investigate and remediate Bad IOC domain matches with recent activity found in the enterprise, as well as notify the SOC lead and network team about the matches. Supported Integrations: Chronicle Google SecOps Whois Mail Sender (New) Palo Alto Networks PAN-OS Palo Alto Networks AutoFocus v2
Threat Hunting - Chronicle	Use this playbook to investigate and remediate suspicious IOC domain matches with recent activity found in the enterprise. This playbook also creates indicators for the entities fetched, as well as investigating and enriching them. Supported Integrations: Chronicle Google SecOps Whois
ChronicleAsset Investigation - Chronicle	This playbook receives indicators from its parent playbook, performs enrichment and investigation for each one of them, provides an opportunity to isolate and block the hostname or IP address associated with the current indicator, and gives out a list of isolated and blocked entities. This playbook also lists the events fetched for the asset identifier information associated with the indicator.

Indicator Types

Name	Description
ChronicleAsset

Automations

Name	Description
ChronicleListDeviceEventsByEventTypeWidgetScript	Displays a pie chart of the number of events, categorized by its event type, fetched for all the identifiers of the ChronicleAsset.
ChronicleAssetIdentifierScript	Collect all asset identifiers - Hostname, IP address and MAC address in the context.
ListDeviceEvents	List all of the events discovered within your enterprise on a particular device within 2 hours earlier than the current time.
ChronicleAssetEventsForProductIDWidgetScript	Displays the list of events fetched for an asset identified as a "ChronicleAsset" type of indicator, when its product ID is passed as an asset identifier.
ChronicleAssetEventsForHostnameWidgetScript	Displays the list of events fetched for an asset identified as a "ChronicleAsset" type of indicator, when its hostname is passed as an asset identifier.
ChronicleDBotScoreWidgetScript	Shows the DBot Score and reputation of the Domain.
ChronicleAssetEventsForMACWidgetScript	Displays the list of events fetched for an asset identified as a "ChronicleAsset" type of indicator, when its MAC address is passed as an asset identifier.
ChronicleDomainIntelligenceSourcesWidgetScript	Shows the details of sources in the Chronicle Domain Intelligence Sources section of the incident.
ConvertDomainToURLs	Converts Domain(s) to URL(s).
ChronicleIsolatedHostnameWidgetScript	Notifies if the hostname associated with the ChronicleAsset is isolated or not.
ChroniclePotentiallyBlockedIPWidgetScript	Notifies if the IP address associated with the ChronicleAsset is potentially blocked or not.
ExtractDomainFromIOCDomainMatchRes	Extracts domain and its details from the Chronicle IOC Domain match response.
ChronicleAssetEventsForIPWidgetScript	Displays the list of events fetched for an asset identified as a "ChronicleAsset" type of indicator, when its IP address is passed as an asset identifier.
ChronicleIsolatedIPWidgetScript	Notifies if the IP address associated with the ChronicleAsset is isolated or not.

Classifiers

Name	Description
Chronicle - Classifier	Classifies Chronicle incidents
Chronicle - Incoming Mapper	Maps incoming Chronicle incident fields.

Incident Fields

Name	Description
Chronicle Events	List of chronicle UDM events.
Chronicle Rule Version	Identifier for the rule version generating the detection.
Chronicle Source Product	The source of the alert.
Chronicle Last Seen	The Alert/IOC Domain was most recently seen within your enterprise.
Chronicle Detection Type	Type of detection.
Chronicle Curated Events	List of chronicle UDM events from curated rule detections.
Chronicle Detection State	Indicates whether the rule generating this detection currently has alerting enabled or disabled.
Chronicle Skip Entity Isolation	Skip the isolation of entities. Select 'Yes' to skip isolation process of the entities, 'No' otherwise.
Chronicle Rule Name	Name of the rule generating the detection.
Chronicle DBot Score	DBot Score obtained for the IOC Domain Matches fetched from Chronicle
Chronicle Auto Block Entities	Auto block the detected suspicious Domain(s) and URL(s). Select 'yes' to automatically start the process of blocking the entities, 'no' otherwise.
Chronicle Rule Type	Whether the rule generating this detection is a single event or multi-event rule.
Chronicle IOC Ingest Time	IOC ingest time fetched from the Chronicle IOC Domain Matches.
Chronicle Detection ID	Identifier for the detection.
Chronicle Detection Created Time	Time the detection was created.
ChronicleAsset Support Contact	The support email address of the chronicle asset.
Chronicle Detection Window End Time	The end time of the window the detection was found in.
Chronicle Alert Count	The number of times alerts occur.
Chronicle Alert Name	The name of the alert.

Incident Types

Name	Description
Chronicle Curated Rule Detection
Chronicle IOC Domain Matches
Chronicle Rule Detection
Chronicle User Alert
Chronicle Asset Alert

Indicator Fields

Name	Description
Chronicle Potentially Blocked IP	Determines if the IP Address is potentially blocked.
ChronicleAssetProductID
ChronicleAssetIP
ChronicleAssetMAC
ChronicleAsset Summary	Summary of the event types of the events fetched for all the possible asset identifiers.
ChronicleAssetHostname
Chronicle Isolated Hostname	Determines if the host is isolated.
Chronicle Isolated IP	Determines if the IP Address is isolated.

Integrations

Name	Description
Google SecOps Streaming API (Partner Contribution)	Use the Google SecOps Streaming API integration to ingest detections created by both user-created rules and Google SecOps Rules as XSOAR incidents.
Chronicle (Partner Contribution)	Use the Chronicle integration to retrieve Asset alerts or IOC Domain matches as Incidents. Use it to fetch a list of infected assets based on the indicator accessed. This integration also provides reputation and threat enrichment of indicators observed in the enterprise.
Google SecOps v1 Alpha (Partner Contribution)	Use the Google SecOps integration to retrieve IOC Domain matches as Incidents. This integration also provides reputation and threat enrichment of indicators observed in the enterprise.

Layouts

Name	Description
ChronicleAsset Indicator	ChronicleAsset Indicator Layout

Playbooks

Name	Description
Investigate On Bad Domain Matches - Chronicle	Use this playbook to investigate and remediate Bad IOC domain matches with recent activity found in the enterprise, as well as notify the SOC lead and network team about the matches. Supported Integrations: Chronicle Google SecOps Whois Mail Sender (New) Palo Alto Networks PAN-OS Palo Alto Networks AutoFocus v2
Hostname And IP Address Investigation And Remediation - Chronicle	This playbook receives ChronicleAsset type of indicators from its parent playbook "ChronicleAsset Investigation - Chronicle", performs enrichment and investigation for each one of them, provides an opportunity to isolate and block the hostname or IP address associated with the current indicator, and provides a list of isolated and blocked entities.
ChronicleAssets Investigation And Remediation - Chronicle	Performs enrichment and investigation of the ChronicleAsset type of indicators, provides an opportunity to remediate in case any of the ChronicleAsset information i.e., hostname or IP address is found to be malicious or suspicious, and sends out an email containing the list of isolated and potentially blocked entities. To select the indicators you want to add, go to playbook inputs, choose "from indicators" and set your query. For example, type:ChronicleAsset etc. The default playbook query is "type:ChronicleAsset". In case indicators with different query parameters are to be investigated, the query must be edited accordingly. This playbook needs to be used with caution as it might use up the integration’s API license when running large amounts of indicators.
ChronicleAsset Investigation - Chronicle	This playbook receives indicators from its parent playbook, performs enrichment and investigation for each one of them, provides an opportunity to isolate and block the hostname or IP address associated with the current indicator, and gives out a list of isolated and blocked entities. This playbook also lists the events fetched for the asset identifier information associated with the indicator.
Threat Hunting - Chronicle	Use this playbook to investigate and remediate suspicious IOC domain matches with recent activity found in the enterprise. This playbook also creates indicators for the entities fetched, as well as investigating and enriching them. Supported Integrations: Chronicle Google SecOps Whois
List Device Events - Chronicle	This playbook receives ChronicleAsset identifier information and provides a list of events related to each one of them. Supported integration: Chronicle Google SecOps.

Indicator Types

Name	Description
ChronicleAsset

Required Content Packs (10)

Pack Name	Pack By
Base	By: Cortex XSOAR
Common Playbooks	By: Cortex XSOAR
Common Scripts	By: Cortex XSOAR
Common Types	By: Cortex XSOAR
Filters And Transformers	By: Cortex XSOAR
NIST	By: Cortex XSOAR
PAN-OS by Palo Alto Networks	By: Cortex XSOAR
Phishing	By: Cortex XSOAR
SANS	By: Cortex XSOAR
Sixgill Darkfeed - Annual Subscription	By: Cybersixgill

Optional Content Packs (48)

Pack Name	Pack By
APIVoid	By: Cortex XSOAR
AbuseIPDB	By: Cortex XSOAR
AlienVault OTX	By: Cortex XSOAR
Anomali ThreatStream	By: Cortex XSOAR
AutoFocus by Palo Alto Networks	By: Cortex XSOAR
Awake Security	By: Cortex XSOAR
Barracuda	By: Harri Ruuttila
Cisco Umbrella Investigate	By: Cortex XSOAR
CrowdStrike Falcon Intel	By: Cortex XSOAR
CyberTotal	By: CyCraft Technology Corporation.
DomainTools Enterprise (Deprecated)	By: DomainTools
DomainTools Iris Investigate	By: DomainTools
EclecticIQ Platform	By: EclecticIQ
Flashpoint	By: Flashpoint
Gmail	By: Cortex XSOAR
Gmail Single User	By: Cortex XSOAR
HelloWorld	By: Cortex XSOAR
Ipstack	By: Cortex XSOAR
JsonWhoIs	By: Cortex XSOAR
MISP	By: Cortex XSOAR
Mail Sender (New)	By: Cortex XSOAR
Maltiverse	By: Cortex XSOAR
MaxMind GeoIP2	By: Cortex XSOAR
Microsoft Graph Mail	By: Cortex XSOAR
Threat Vault by Palo Alto Networks	By: Cortex XSOAR
PassiveTotal	By: RiskIQ
PolySwarm	By: PolySwarm
Pulsedive	By: Konrad Zacharias
Pwned	By: Cortex XSOAR
Recorded Future Intelligence	By: Recorded Future
RiskIQ Digital Footprint	By: RiskIQ
Shodan	By: Cortex XSOAR
SlashNext Phishing Incident Response - Annual Subscription (Direct Subscription)	By: SlashNext
Spamcop	By: Harri Ruuttila
Synapse	By: Jordan Berry
ThreatConnect	By: Cortex XSOAR
ThreatExchange	By: Cortex XSOAR
ThreatMiner	By: Cortex XSOAR
ThreatQ	By: Cortex XSOAR
TruSTAR (Deprecated)	By: TruSTAR
URLhaus	By: Cortex XSOAR
VirusTotal	By: VirusTotal
Whois	By: Cortex XSOAR
IBM X-Force Exchange	By: Cortex XSOAR
Zscaler Internet Access	By: Cortex XSOAR
Analyst1	By: Analyst1
Ipinfo	By: Cortex XSOAR
FireEye iSIGHT	By: Cortex XSOAR

All level dependencies (13)

Pack Name	Pack By
Common Scripts	By: Cortex XSOAR
Common Types	By: Cortex XSOAR
SANS	By: Cortex XSOAR
Common Playbooks	By: Cortex XSOAR
Filters And Transformers	By: Cortex XSOAR
Cortex REST API	By: Cortex XSOAR
Rasterize	By: Cortex XSOAR
Sixgill Darkfeed - Annual Subscription	By: Cybersixgill
Brute Force	By: Cortex XSOAR
Phishing	By: Cortex XSOAR
Base	By: Cortex XSOAR
PAN-OS by Palo Alto Networks	By: Cortex XSOAR
NIST	By: Cortex XSOAR

5.0.0 - R5158591 (September 28, 2025)

Integrations

New: Google SecOps v1 Alpha

New: Added a new integration- Use "Google SecOps v1 Alpha" to retrieve IOC Domain matches as Incidents. Use it to fetch a list of infected assets based on the indicator accessed. This integration also provides reputation and threat enrichment of indicators observed in the enterprise.
Added the following commands:
- gcb-list-rules
- gcb-create-rule
- gcb-get-rule
- gcb-delete-rule
- gcb-create-rule-version
- gcb-change-rule-alerting-status
- gcb-change-live-rule-status
- gcb-verify-rule
- gcb-list-retrohunts
- gcb-get-retrohunt
- gcb-start-retrohunt
- gcb-cancel-retrohunt
- gcb-list-events
- gcb-get-event
- gcb-list-detections
- gcb-list-curatedrule-detections
- gcb-list-curatedrules
- gcb-test-rule-stream
- gcb-udm-search
- gcb-get-reference-list
- gcb-create-reference-list
- gcb-update-reference-list
- gcb-list-reference-list
- gcb-verify-reference-list
- gcb-verify-value-in-reference-list
- gcb-reference-list-append-content
- gcb-reference-list-remove-content
- gcb-list-iocs
- gcb-ioc-details
- ip
- domain
- gcb-list-data-tables
- gcb-create-data-table
- gcb-get-data-table
- gcb-verify-value-in-data-table
- gcb-data-table-add-row
- gcb-data-table-remove-row
- gcb-get-detection

Google SecOps Streaming API

Updated the integration to support Google SecOps v1 Alpha API.
Updated the Docker image to: demisto/googleapi-python3:1.0.0.4892936.

Playbooks

Investigate On Bad Domain Matches - Chronicle

Updated the Investigate On Bad Domain Matches - Chronicle playbook to support Google SecOps v1 Alpha integration.

List Device Events - Chronicle

Updated the List Device Events - Chronicle playbook to support Google SecOps v1 Alpha integration.

Threat Hunting - Chronicle

Updated the Threat Hunting - Chronicle playbook to support Google SecOps v1 Alpha integration.

Related pull requests:
- 41176
- 41380

Download

4.1.8 - 4847835 (September 11, 2025)

Scripts

ListDeviceEvents

Updated the Docker image to: demisto/python3:3.12.8.3296088.

Related pull requests:
- 41193

Download

4.1.7 - 4770511 (September 4, 2025)

Scripts

ConvertDomainToURLs

Updated the Docker image to: demisto/python3:3.12.8.3296088.

ChroniclePotentiallyBlockedIPWidgetScript

Updated the Docker image to: demisto/python3:3.12.8.3296088.

ChronicleAssetEventsForHostnameWidgetScript

Updated the Docker image to: demisto/python3:3.12.8.3296088.

ChronicleDomainIntelligenceSourcesWidgetScript

Updated the Docker image to: demisto/python3:3.12.8.3296088.

ChronicleAssetEventsForIPWidgetScript

Updated the Docker image to: demisto/python3:3.12.8.3296088.

ChronicleListDeviceEventsByEventTypeWidgetScript

Updated the Docker image to: demisto/python3:3.12.8.3296088.

ChronicleAssetIdentifierScript

Updated the Docker image to: demisto/python3:3.12.8.3296088.

ChronicleIsolatedIPWidgetScript

Updated the Docker image to: demisto/python3:3.12.8.3296088.

ChronicleAssetEventsForMACWidgetScript

Updated the Docker image to: demisto/python3:3.12.8.3296088.

ChronicleIsolatedHostnameWidgetScript

Updated the Docker image to: demisto/python3:3.12.8.3296088.

ChronicleDBotScoreWidgetScript

Updated the Docker image to: demisto/python3:3.12.8.3296088.

ChronicleAssetEventsForProductIDWidgetScript

Updated the Docker image to: demisto/python3:3.12.8.3296088.

ExtractDomainFromIOCDomainMatchRes

Updated the Docker image to: demisto/python3:3.12.8.3296088.

Related pull requests:
- 41158

Download

4.1.6 - 4341046 (July 28, 2025)

Integrations

Chronicle

Added the gcb-reference-list-append-content command that appends lines into an existing reference list.
Added the gcb-reference-list-remove-content command that removes lines from an existing reference list.
Added the entry_id argument to the gcb-create-reference-list and gcb-update-reference-list commands to allow users to create or update reference lists from a file.
Added the use_delimiter_for_file argument to the gcb-create-reference-list and gcb-update-reference-list commands to determine whether the file content is split by a delimiter or by new lines.
Updated the Docker image to: demisto/googleapi-python3:1.0.0.4114363.

Related pull requests:
- 40580
- 40743

Download

4.1.5 - R3474673 (May 20, 2025)

Integrations

Chronicle Streaming API

Metadata and documentation improvements.

Chronicle

Metadata and documentation improvements.

Scripts

ConvertDomainToURLs

Metadata and documentation improvements.

ChronicleDBotScoreWidgetScript

Metadata and documentation improvements.

ChronicleDomainIntelligenceSourcesWidgetScript

Metadata and documentation improvements.

ExtractDomainFromIOCDomainMatchRes

Metadata and documentation improvements.

ListDeviceEvents

Metadata and documentation improvements.

ChronicleAssetEventsForProductIDWidgetScript

Metadata and documentation improvements.

ChronicleAssetEventsForIPWidgetScript

Metadata and documentation improvements.

ChronicleAssetEventsForHostnameWidgetScript

Metadata and documentation improvements.

ChronicleAssetIdentifierScript

Metadata and documentation improvements.

ChronicleListDeviceEventsByEventTypeWidgetScript

Metadata and documentation improvements.

ChronicleIsolatedHostnameWidgetScript

Metadata and documentation improvements.

ChronicleAssetEventsForMACWidgetScript

Metadata and documentation improvements.

ChronicleIsolatedIPWidgetScript

Metadata and documentation improvements.

ChroniclePotentiallyBlockedIPWidgetScript

Metadata and documentation improvements.

Related pull requests:
- 39077

Download

4.1.4 - R2988527 (March 26, 2025)

Chronicle

Documentation and metadata improvements.

Related pull requests:
- 38999

Download

4.1.3 - 2148169 (February 5, 2025)

Integrations

Chronicle

Updated the documentation and added metadata improvements.

Related pull requests:
- 38480
- 38488

Download

4.1.2 - 1935630 (January 6, 2025)

Integrations

Chronicle

Code functionality improvements.
Updated the Docker image to: demisto/googleapi-python3:1.0.0.1839740.

Related pull requests:
- 37472

Download

4.1.1 - R1931958 (January 6, 2025)

Integrations

Chronicle Streaming API

Added the functionality to ignore integration parameters having null values.

Related pull requests:
- 37594
- 37600

Download

4.1.0 - 1752502 (December 4, 2024)

Integrations

Chronicle Streaming API

Added the filter parameters to the Chronicle Streaming API integration.
Updated the Docker image to: demisto/googleapi-python3:1.0.0.117483.

Chronicle

Added the following commands:
- gcb-verify-value-in-reference-list
- gcb-verify-rule
- gcb-get-event
Updated the Docker image to: demisto/googleapi-python3:1.0.0.117483.

Related pull requests:
- 37462
- 37558

Download

4.0.4 - 1748140 (December 4, 2024)

Scripts

ChronicleDBotScoreWidgetScript

Updated the Docker image to: demisto/python3:3.11.10.115186.

ChronicleAssetEventsForProductIDWidgetScript

Updated the Docker image to: demisto/python3:3.11.10.115186.

ChronicleIsolatedHostnameWidgetScript

Updated the Docker image to: demisto/python3:3.11.10.115186.

ChronicleIsolatedIPWidgetScript

Updated the Docker image to: demisto/python3:3.11.10.115186.

ChronicleAssetEventsForHostnameWidgetScript

Updated the Docker image to: demisto/python3:3.11.10.115186.

ChronicleAssetEventsForIPWidgetScript

Updated the Docker image to: demisto/python3:3.11.10.115186.

ChronicleDomainIntelligenceSourcesWidgetScript

Updated the Docker image to: demisto/python3:3.11.10.115186.

ConvertDomainToURLs

Updated the Docker image to: demisto/python3:3.11.10.115186.

ChronicleListDeviceEventsByEventTypeWidgetScript

Updated the Docker image to: demisto/python3:3.11.10.115186.

ChronicleAssetIdentifierScript

Updated the Docker image to: demisto/python3:3.11.10.115186.

ChroniclePotentiallyBlockedIPWidgetScript

Updated the Docker image to: demisto/python3:3.11.10.115186.

ListDeviceEvents

Updated the Docker image to: demisto/python3:3.11.10.115186.

ExtractDomainFromIOCDomainMatchRes

Updated the Docker image to: demisto/python3:3.11.10.115186.

ChronicleAssetEventsForMACWidgetScript

Updated the Docker image to: demisto/python3:3.11.10.115186.

Related pull requests:
- 37528
- 37524
- 37525
- 37526
- 37527

Download

4.0.3 - R1741355 (December 3, 2024)

Integrations

Chronicle

Updated the Docker image to: demisto/googleapi-python3:1.0.0.115338.

Chronicle Streaming API

Updated the Docker image to: demisto/googleapi-python3:1.0.0.115338.

Related pull requests:
- 37146
- 37142

Download

5.0.0 - R5158591 (September 28, 2025)

Integrations

New: Google SecOps v1 Alpha

New: Added a new integration- Use "Google SecOps v1 Alpha" to retrieve IOC Domain matches as Incidents. Use it to fetch a list of infected assets based on the indicator accessed. This integration also provides reputation and threat enrichment of indicators observed in the enterprise.
Added the following commands:
- gcb-list-rules
- gcb-create-rule
- gcb-get-rule
- gcb-delete-rule
- gcb-create-rule-version
- gcb-change-rule-alerting-status
- gcb-change-live-rule-status
- gcb-verify-rule
- gcb-list-retrohunts
- gcb-get-retrohunt
- gcb-start-retrohunt
- gcb-cancel-retrohunt
- gcb-list-events
- gcb-get-event
- gcb-list-detections
- gcb-list-curatedrule-detections
- gcb-list-curatedrules
- gcb-test-rule-stream
- gcb-udm-search
- gcb-get-reference-list
- gcb-create-reference-list
- gcb-update-reference-list
- gcb-list-reference-list
- gcb-verify-reference-list
- gcb-verify-value-in-reference-list
- gcb-reference-list-append-content
- gcb-reference-list-remove-content
- gcb-list-iocs
- gcb-ioc-details
- ip
- domain
- gcb-list-data-tables
- gcb-create-data-table
- gcb-get-data-table
- gcb-verify-value-in-data-table
- gcb-data-table-add-row
- gcb-data-table-remove-row
- gcb-get-detection

Google SecOps Streaming API

Updated the integration to support Google SecOps v1 Alpha API.
Updated the Docker image to: demisto/googleapi-python3:1.0.0.4892936.

Playbooks

Investigate On Bad Domain Matches - Chronicle

Updated the Investigate On Bad Domain Matches - Chronicle playbook to support Google SecOps v1 Alpha integration.

List Device Events - Chronicle

Updated the List Device Events - Chronicle playbook to support Google SecOps v1 Alpha integration.

Threat Hunting - Chronicle

Updated the Threat Hunting - Chronicle playbook to support Google SecOps v1 Alpha integration.

Related pull requests:
- 41176
- 41380

Download

4.1.8 - 4847835 (September 11, 2025)

Scripts

ListDeviceEvents

Updated the Docker image to: demisto/python3:3.12.8.3296088.

Related pull requests:
- 41193

Download

4.1.7 - 4761438 (September 4, 2025)

Scripts

ConvertDomainToURLs

Updated the Docker image to: demisto/python3:3.12.8.3296088.

ChroniclePotentiallyBlockedIPWidgetScript

Updated the Docker image to: demisto/python3:3.12.8.3296088.

ChronicleAssetEventsForHostnameWidgetScript

Updated the Docker image to: demisto/python3:3.12.8.3296088.

ChronicleDomainIntelligenceSourcesWidgetScript

Updated the Docker image to: demisto/python3:3.12.8.3296088.

ChronicleAssetEventsForIPWidgetScript

Updated the Docker image to: demisto/python3:3.12.8.3296088.

ChronicleListDeviceEventsByEventTypeWidgetScript

Updated the Docker image to: demisto/python3:3.12.8.3296088.

ChronicleAssetIdentifierScript

Updated the Docker image to: demisto/python3:3.12.8.3296088.

ChronicleIsolatedIPWidgetScript

Updated the Docker image to: demisto/python3:3.12.8.3296088.

ChronicleAssetEventsForMACWidgetScript

Updated the Docker image to: demisto/python3:3.12.8.3296088.

ChronicleIsolatedHostnameWidgetScript

Updated the Docker image to: demisto/python3:3.12.8.3296088.

ChronicleDBotScoreWidgetScript

Updated the Docker image to: demisto/python3:3.12.8.3296088.

ChronicleAssetEventsForProductIDWidgetScript

Updated the Docker image to: demisto/python3:3.12.8.3296088.

ExtractDomainFromIOCDomainMatchRes

Updated the Docker image to: demisto/python3:3.12.8.3296088.

Related pull requests:
- 41158

Download

4.1.6 - 4350237 (July 29, 2025)

Integrations

Chronicle

Added the gcb-reference-list-append-content command that appends lines into an existing reference list.
Added the gcb-reference-list-remove-content command that removes lines from an existing reference list.
Added the entry_id argument to the gcb-create-reference-list and gcb-update-reference-list commands to allow users to create or update reference lists from a file.
Added the use_delimiter_for_file argument to the gcb-create-reference-list and gcb-update-reference-list commands to determine whether the file content is split by a delimiter or by new lines.
Updated the Docker image to: demisto/googleapi-python3:1.0.0.4114363.

Related pull requests:
- 40580
- 40743

Download

4.1.5 - R3474673 (May 20, 2025)

Integrations

Chronicle Streaming API

Metadata and documentation improvements.

Chronicle

Metadata and documentation improvements.

Scripts

ConvertDomainToURLs

Metadata and documentation improvements.

ChronicleDBotScoreWidgetScript

Metadata and documentation improvements.

ChronicleDomainIntelligenceSourcesWidgetScript

Metadata and documentation improvements.

ExtractDomainFromIOCDomainMatchRes

Metadata and documentation improvements.

ListDeviceEvents

Metadata and documentation improvements.

ChronicleAssetEventsForProductIDWidgetScript

Metadata and documentation improvements.

ChronicleAssetEventsForIPWidgetScript

Metadata and documentation improvements.

ChronicleAssetEventsForHostnameWidgetScript

Metadata and documentation improvements.

ChronicleAssetIdentifierScript

Metadata and documentation improvements.

ChronicleListDeviceEventsByEventTypeWidgetScript

Metadata and documentation improvements.

ChronicleIsolatedHostnameWidgetScript

Metadata and documentation improvements.

ChronicleAssetEventsForMACWidgetScript

Metadata and documentation improvements.

ChronicleIsolatedIPWidgetScript

Metadata and documentation improvements.

ChroniclePotentiallyBlockedIPWidgetScript

Metadata and documentation improvements.

Related pull requests:
- 39077

Download

4.1.4 - R2988527 (March 26, 2025)

Chronicle

Documentation and metadata improvements.

Related pull requests:
- 38999

Download

4.1.3 - 2148169 (February 5, 2025)

Integrations

Chronicle

Updated the documentation and added metadata improvements.

Related pull requests:
- 38480
- 38488

Download

4.1.2 - 1935630 (January 6, 2025)

Integrations

Chronicle

Code functionality improvements.
Updated the Docker image to: demisto/googleapi-python3:1.0.0.1839740.

Related pull requests:
- 37472

Download

4.1.1 - R1931958 (January 6, 2025)

Integrations

Chronicle Streaming API

Added the functionality to ignore integration parameters having null values.

Related pull requests:
- 37594
- 37600

Download

4.1.0 - 1752502 (December 4, 2024)

Integrations

Chronicle Streaming API

Added the filter parameters to the Chronicle Streaming API integration.
Updated the Docker image to: demisto/googleapi-python3:1.0.0.117483.

Chronicle

Added the following commands:
- gcb-verify-value-in-reference-list
- gcb-verify-rule
- gcb-get-event
Updated the Docker image to: demisto/googleapi-python3:1.0.0.117483.

Related pull requests:
- 37462
- 37558

Download

4.0.4 - 1748140 (December 4, 2024)

Scripts

ChronicleDBotScoreWidgetScript

Updated the Docker image to: demisto/python3:3.11.10.115186.

ChronicleAssetEventsForProductIDWidgetScript

Updated the Docker image to: demisto/python3:3.11.10.115186.

ChronicleIsolatedHostnameWidgetScript

Updated the Docker image to: demisto/python3:3.11.10.115186.

ChronicleIsolatedIPWidgetScript

Updated the Docker image to: demisto/python3:3.11.10.115186.

ChronicleAssetEventsForHostnameWidgetScript

Updated the Docker image to: demisto/python3:3.11.10.115186.

ChronicleAssetEventsForIPWidgetScript

Updated the Docker image to: demisto/python3:3.11.10.115186.

ChronicleDomainIntelligenceSourcesWidgetScript

Updated the Docker image to: demisto/python3:3.11.10.115186.

ConvertDomainToURLs

Updated the Docker image to: demisto/python3:3.11.10.115186.

ChronicleListDeviceEventsByEventTypeWidgetScript

Updated the Docker image to: demisto/python3:3.11.10.115186.

ChronicleAssetIdentifierScript

Updated the Docker image to: demisto/python3:3.11.10.115186.

ChroniclePotentiallyBlockedIPWidgetScript

Updated the Docker image to: demisto/python3:3.11.10.115186.

ListDeviceEvents

Updated the Docker image to: demisto/python3:3.11.10.115186.

ExtractDomainFromIOCDomainMatchRes

Updated the Docker image to: demisto/python3:3.11.10.115186.

ChronicleAssetEventsForMACWidgetScript

Updated the Docker image to: demisto/python3:3.11.10.115186.

Related pull requests:
- 37528
- 37524
- 37525
- 37526
- 37527

Download

4.0.3 - R1741355 (December 3, 2024)

Integrations

Chronicle

Updated the Docker image to: demisto/googleapi-python3:1.0.0.115338.

Chronicle Streaming API

Updated the Docker image to: demisto/googleapi-python3:1.0.0.115338.

Related pull requests:
- 37146
- 37142

Download

PUBLISHER

PLATFORMS

Cortex XSOARCortex XSIAM

INFO

Certification	Certified	Read more
Supported By	Partner
Created	April 14, 2020
Last Release	September 28, 2025

WORKS WITH THE FOLLOWING INTEGRATIONS:

Cybersixgill DVE Feed Threat Intelligence (Deprecated)

Palo Alto Networks Threat Vault (Deprecated)

DISCLAIMER

Content packs are licensed by the Publisher identified above and subject to the Publisher’s own licensing terms. Palo Alto Networks is not liable for and does not warrant or support any content pack produced by a third-party Publisher, whether or not such packs are designated as “Palo Alto Networks-certified” or otherwise.