Welcome to the Google Cloud Security Community!

SecOps - GCP Ingestion Metrics - is_unhealthy

Hello,I’ve noticed a new ingestion metric popup from SecOps in GCP Cloud Monitoring. An “is_unhealthy” metric, which I’m seeking to understand a bit further to figure out what it can do. If it lets us do real time alerting based upon findings from He

572

3 minutes ago

_K_OSilver 2

How do you Update Gemini / AI Model Versions in Your SecOpsEnvironment?

Hi All, We received notifications that some Gemini versions that we were relying on for Playbooks were going to be deprecated: https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/model-versions. Based on this, we needed to identify

10

6 minutes ago

Rob_PStaff

Elevating Cyber Threat Hunting for Files with Google Threat Intelligence and YARA

In the rapidly evolving landscape of cybersecurity, defenders require advanced tools to stay ahead of sophisticated adversaries. A recent instructional overview from Google Threat Intelligence outlines how security operations teams can significantly

40

soaruserBronze 2

How to fetch UDM Additional Fields in Dashboard Query

I have a field :udm.additional.fields[“eventAnnotationManagerTime”] = [removed by moderator] How do i fetch this in the dashboard query?

525

Rob_PStaff

Amplifying Threat Hunting with Google Threat Intelligence and YARA

In the rapidly evolving world of cybersecurity, staying ahead of sophisticated threat actors requires tools that offer speed, deep context, and seamless automation. Google Threat Intelligence brings the full power of YARA to the forefront of modern d

30

matthewnicholsCommunity Manager

🚀 Exciting News: Introducing "The Weekly Brief" — Your Ultimate Guide to Mastering Google Security!

Hey Google Cloud Security Community!Whether you are a security engineer building custom parsers, a SOC analyst hunting threats, or a security leader keeping up with rapid product releases, staying ahead of the threat landscape requires continuous le

211

FounderbyledBronze 1

Where should deterministic authorization live before an AI agent executes a transaction?

Google Cloud’s agentic architecture provides strong controls for identity, isolation, prompt protection, observability, and tool access.However, once an AI agent is allowed to trigger a consequential operation — such as approving a financial conditio

121

Tuesday's Tip of the Week

dnehodaStaff

Tuesday's Tip of the Week - First UDM Searches

July 14, 2026 UDM Search Syntax UDM Search is the ad-hoc query interface in Google SecOps. Specify field-value pairs joined with AND, OR, and NOT.Key rules:Fields use dot notation: metadata.event_type, principal.ip, target.user.userid String values g

405

Rob_PStaff

Unlocking Search Superpowers with Advanced IOC Searches

Google Threat Intelligence offers powerful search capabilities designed to elevate how security analysts hunt for and investigate cyber threats. Moving far beyond basic indicators of compromise searches, the platform introduces advanced querying feat

80

Rob_PStaff

Elevating Modern Defense with Tailored Threat Profiles

In an era where cyber threats evolve at an unprecedented pace, a generalized approach to cybersecurity is no longer sufficient. Security teams frequently find themselves overwhelmed by an influx of generic threat data, much of which lacks relevance t

50

2 hours ago

FounderbyledBronze 1

Where should deterministic authorization live before an AI agent executes a transaction?

Google Cloud’s agentic architecture provides strong controls for identity, isolation, prompt protection, observability, and tool access.However, once an AI agent is allowed to trigger a consequential operation — such as approving a financial conditio

121

SCC - Malware: Malicious file on disk (YARA)

arv261095Bronze 2

Security Command Center

Hi Team,I am not getting what exactly withing the file is matching the signatures of these SCC yara rules can anyone help here please this is first time i am getting this not sure if this is some SCC premium service this triggered this but not able t

80

3 hours ago

bluechipNew Member

How to map a range to discreet values using Google SecOps Expression Builder

I’m looking for a way to map case attributes using Expression Builder for a GSO playbook/block.Scenario: I’m working with the ServiceNow integration that accepts discreet values for urgency and impact when creating/updating incidents. 1 = High, 2 = M

363

6 hours ago

NASEEFSilver 2

silent log source detection rule

Greetings Team,If we do not want to use Google Cloud's native silent log source monitoring, is there any alternative approach using a scheduled YARA-L rule, similar to the one below that runs hourly?I understand that this approach has a few limitatio

828

6 hours ago

ar3diuSilver 2

YARA-L Question: Password Change Initiated from First Time Seen Country

I am trying to write a rule for Google Workspace password resets initiated from a country that has not been seen in the last 30 days.For some reason, the `first_seen` metric is malfunctioning (returning 0 even though the user has logged in from that

384

GCP Terraform Kubernetes App validation failure

harshal.thakorBronze 5

Security Validation

I am getting below error while validating my terraform kubernetes app. Can any on ehelm what is the issue?{ "taskReports": [ { "taskType": "EXECUTE_TERRAFORM_PLAN", "taskExecutionStatus": "ISSUES_FOUND", "digest": "Unable to start

101

A

af27Bronze 1

issue with siemplify.get_attachment(attachment_id)

Hi,I have wrote a custom actions that gets attachments from the case wall and creates a html table, allowing the user to click a button to download the attachment. This had been working okay but we have now been experiencing this following error: F

1022

DOwusuBronze 1

Palo Alto Network Firewall Logs Not Parsing

Palo Alto Network Firewall Logs Not Parsing. We are using Palo’s Strata Logging to forward Palo Alto Network Firewall Logs to Google Secops Webhook. Some logs are getting parsed and some are not.When we take a look at the logs not getting parsed it s

1129

DOwusuBronze 1

Set up data processing using API methods to redact okta user context logs

Hi all, I am trying to test googles “Data processing using API methods” (No bindplane)I was wondering has anyone tried to use this feature yet and have any tips.I am testing with OKTA_USER_CONTEXT and trying to redact PII but just for testing I am tr

171