Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Meninjau potensi masalah keamanan dengan Google Security Operations
Dokumen ini menjelaskan cara melakukan penelusuran saat menyelidiki pemberitahuan dan
kemungkinan masalah keamanan menggunakan Google Security Operations.
Sebelum memulai
Google Security Operations dirancang untuk berfungsi secara eksklusif dengan browser Google Chrome atau Mozilla Firefox.
Google merekomendasikan agar Anda mengupgrade browser ke versi terbaru. Anda dapat mendownload Chrome versi terbaru dari https://www.google.com/chrome/.
Google SecOps terintegrasi ke dalam solusi single sign-on (SSO) Anda.
Anda dapat login ke Google SecOps menggunakan kredensial yang disediakan oleh perusahaan Anda.
Luncurkan Chrome atau Firefox.
Pastikan Anda memiliki akses ke akun perusahaan Anda.
Untuk mengakses aplikasi Google SecOps, dengan customer_subdomain
adalah ID khusus pelanggan Anda, buka:
https://customer_subdomain.backstory.chronicle.security.
Melihat Pemberitahuan dan Kecocokan IOC
Di panel navigasi, pilih Detections > Alerts and IOCs.
Klik tab IOC Matches.
Menelusuri kecocokan IOC dalam tampilan Domain
Kolom Domain di tab IOC Domain Matches berisi daftar domain yang dicurigai. Mengklik domain di kolom ini akan membuka tampilan Domain, seperti yang ditunjukkan pada gambar berikut, yang memberikan informasi mendetail tentang domain ini.
Tampilan Domain
Menggunakan kolom Penelusuran Google Security Operations
Mulai penelusuran langsung dari halaman beranda Google Security Operations, seperti yang ditunjukkan pada gambar berikut.
Kolom Penelusuran Google Security Operations
Di halaman ini, Anda dapat memasukkan istilah penelusuran berikut:
Nama host menampilkan tampilan Domain
(misalnya, plato.example.com)
Tampilan domain Domain
(misalnya, altostrat.com)
Alamat IP menampilkan tampilan Alamat IP
(misalnya, 192.168.254.15)
Tampilan URL Domain
(misalnya, https://new.altostrat.com)
Nama pengguna menampilkan tampilan Aset
(misalnya, betty-decaro-pc)
Hash file menampilkan tampilan Hash
(misalnya, e0d123e5f316bef78bfdf5a888837577)
Anda tidak perlu menentukan jenis istilah penelusuran yang Anda masukkan,
Google Security Operations akan menentukannya untuk Anda. Hasilnya ditampilkan dalam tampilan investigasi yang sesuai. Misalnya, mengetik nama pengguna di kolom penelusuran akan menampilkan tampilan Aset.
Menelusuri log mentah
Anda memiliki opsi untuk menelusuri database yang diindeks atau menelusuri log mentah. Menelusuri log mentah adalah penelusuran yang lebih komprehensif, tetapi membutuhkan waktu lebih lama daripada penelusuran yang diindeks.
Untuk lebih mempersempit penelusuran, Anda dapat menggunakan ekspresi reguler, membuat entri penelusuran peka huruf besar/kecil, atau memilih sumber log. Anda juga dapat memilih
linimasa yang diinginkan menggunakan kolom waktu Mulai dan Akhir.
Untuk melakukan penelusuran log mentah, selesaikan langkah-langkah berikut:
Ketik istilah penelusuran Anda, lalu pilih Raw Log Scan di menu dropdown,
seperti yang ditunjukkan pada gambar berikut.
Menu dropdown yang menampilkan opsi Raw Log Scan
Setelah menetapkan kriteria penelusuran mentah, klik tombol Telusuri.
Dari tampilan Pemindaian Log Mentah, Anda dapat menganalisis data log lebih lanjut.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-08-21 UTC."],[[["\u003cp\u003eGoogle Security Operations helps investigate security issues using various views like Domain, User, and Asset, each providing specific insights into potential threats.\u003c/p\u003e\n"],["\u003cp\u003eUsers can access Google Security Operations through Chrome or Firefox using their enterprise single sign-on credentials, by navigating to a customer-specific URL.\u003c/p\u003e\n"],["\u003cp\u003eThe platform allows searching for IOC matches and viewing alerts, and you can use the built-in search bar with various terms like hostnames, domains, IP addresses, URLs, usernames, and file hashes, which automatically direct you to the appropriate view.\u003c/p\u003e\n"],["\u003cp\u003eIt offers both indexed database and raw log searches, with raw log searches being more comprehensive and allowing for further refinement using regular expressions, case sensitivity, log sources, and custom timelines.\u003c/p\u003e\n"],["\u003cp\u003eNavigating to a user or asset view can be done from the Enterprise insights page by clicking on the user or asset name from the recent alerts section, allowing for further investigation.\u003c/p\u003e\n"]]],[],null,["# Quickstart: Review potential security issues with Google Security Operations\n\nReview potential security issues with Google Security Operations\n================================================================\n\nThis document describes how to conduct searches when investigating alerts and\npotential security issues using Google Security Operations.\n\nBefore you begin\n----------------\n\nGoogle Security Operations is designed to work exclusively with the Google Chrome or Mozilla Firefox browsers.\n| **Note:** Google SecOps doesn't support multiple concurrent logins for the same profile.\n\nGoogle recommends upgrading your browser to the most current version. You can download the latest version of Chrome from \u003chttps://www.google.com/chrome/\u003e.\n\nGoogle SecOps is integrated into your single sign-on solution (SSO).\nYou can log in to Google SecOps using the credentials provided by your enterprise.\n\n1. Launch Chrome or Firefox.\n\n2. Ensure you have access to your corporate account.\n\n3. To access the Google SecOps application, where \u003cvar translate=\"no\"\u003ecustomer_subdomain\u003c/var\u003e\n is your customer-specific identifier, navigate to:\n https://\u003cvar translate=\"no\"\u003ecustomer_subdomain\u003c/var\u003e.backstory.chronicle.security.\n\nViewing Alerts and IOC Matches\n------------------------------\n\n1. In the navigation bar, select **Detections \\\u003e Alerts and IOCs**.\n\n2. Click the **IOC Matches** tab.\n\nSearching for IOC matches in **Domain** view\n--------------------------------------------\n\nThe **Domain** column in the **IOC Domain Matches** tab contains a list of\nsuspect domains. Clicking on a domain in this column opens **Domain** view, as shown\nin the following figure, providing detailed information about this domain.\n\n\n**Domain** view\n\nUsing the Google Security Operations Search field\n-------------------------------------------------\n\nInitiate a search directly from the Google Security Operations home page, as shown in the following figure.\n\n\nGoogle Security Operations **Search** field\n\nOn this page, you can enter the following search terms:\n\n\u003cbr /\u003e\n\nYou do not have to specify which type of search term you are entering,\nGoogle Security Operations determines it for you. The results are shown in the\nappropriate investigative view. For example, typing a username in the search field\ndisplays **Asset** view.\n\nSearching raw logs\n------------------\n\nYou have the option of searching the indexed database or searching raw\nlogs. Searching raw logs is a more comprehensive search, but takes\nlonger than an indexed search.\n\nTo further pinpoint your search, you can use regular expressions, make the\nsearch entry case sensitive, or select log sources. You can also select\nthe timeline you want using the **Start** and **End** time fields.\n\nTo conduct a raw log search, complete the following steps:\n\n1. Type in your search term, and then select **Raw Log Scan** in the dropdown menu,\n as shown in the following figure.\n\n\n Dropdown menu showing **Raw Log Scan** option\n2. After setting your raw search criteria, click the **Search** button.\n\n3. From **Raw Log Scan** view, you can further analyze your log data."]]
Tampilan Domain
Kolom Penelusuran Google Security Operations
Menu dropdown yang menampilkan opsi Raw Log Scan