Welcome to the Google Cloud Security Community!

Recaptcha Enterprise scores dropped significantly since about a week

When checking the score-distribution on https://console.cloud.google.com/security/recaptcha/the scores dropped from this (first week of June) to this (first week of July)Obviously, this has a major impact on our users (schools & pupils, often sta

1284

9 hours ago

EovedBronze 4

Community Blog

Beyond Chat: Building Multi Agent SOC Ecosystems with Claude and Google MCP

Author: Elirez Oved, Senior Cloud Security Consultant For any enterprise security team, the prime directive has always been simple: stay one step ahead of the adversary. But recently, threat intelligence from Mandiant's M-Trends 2026 Report has ob

7253

9 hours ago

R

rdhd0701New Member

reCAPTCHA Enterprise checkbox image-challenge renders button/error text as corrupted strings for non-latin languages

Summary:In the checkbox image challenge popup, the instruction line renders correctly in Japanese (e.g. 「横断歩道のタイルをすべて選択してください」), but the red hint/error text and the verify/skip button labels render as random-looking strings (e.g.F&JfWOUD, 9-CW`).

831

10 hours ago

AZacchinoBronze 1

Google Threat Intelligence

False positive in iplist-known-malicious-ips: Shopify production IP [removed by moderator] and no documented way to dispute it

SUMMARY The address 23.227.38.74 is present in the Google Threat Intelligence curated list`iplist-known-malicious-ips`. IP: 23.227.38.74PTR: shops.myshopify.comWhois: Shopify, Inc. — NetName SHOPIFY-NET, CIDR 23.227.32.0/19 This is core Shopify store

756

11 hours ago

AmeyaNew Member

Need help on UDM Enrichment

Hi Everyone,I have a problem around UDM enrichment and I would appreciate if someone can guide me to resolve this. Problem :The current user data is enriched with Azure AD Context and it is pulling all the data that is associated with the user presen

221

janguiseNew Member

How to get subkey if the parent key is dynamic in the expression builder

Hi everyoneI'm getting a JSON in a playbook action. I want to reuse that json in another action of my playbook.I'm trying to get the value of a subkey “category” in a nested json like this{ “a”:{“category”:1}, “b”: {“category”:3}}I haven’t found

301

ylandovskyyStaff

[Public Preview] Building Custom Integrations using local IDEs and managing them on Github

Hey folks,As you all know, our built-in IDE, despite being a powerful tool, still has a lot of limitations, which can make the development process frustrating. Instead of trying to reinvent the wheel, we want to enable developers to work in the envir

4534

15 hours ago

Khushboo14New Member

how to add 2 different conditions in rule

Hi I want this rule to work in such a way that if the e1 or e2 condition is true then we should get an alert but if e2 and e3 is true then we should not get and alert. i have tried multiple ways but somehow it is not working. rule RULE_PROD_USER_INFO

832

1 day ago

matthewnicholsCommunity Manager

SecOps SIEMposium 2026 — A Google SecOps-Focused Conference, Oct 5–8 in San Diego

Hey Community! You may have seen a new event added to our incredible list of upcoming enablement opportunities.One I would like to highlight is something built specifically for you. SecOps SIEMposium 2026 is coming to San Diego this October. There ha

2312

1 day ago

donkosBronze 1

Community Blog

Lifecycle of a SOAR Automation

Author: Dmitry Kosarev, Senior Security Automation Engineer - Admiral Group Have you ever had to perform a laborious, repetitive task in an IT role?I certainly have. Whether it’s manually triaging suspicious emails in a reporting mailbox or pulling

290

1 day ago

MarcVanDaele90New Member

Recaptcha Enterprise scores dropped significantly since about a week

When checking the score-distribution on https://console.cloud.google.com/security/recaptcha/the scores dropped from this (first week of June) to this (first week of July)Obviously, this has a major impact on our users (schools & pupils, often sta

1284

9 hours ago

R

rdhd0701New Member

reCAPTCHA Enterprise checkbox image-challenge renders button/error text as corrupted strings for non-latin languages

Summary:In the checkbox image challenge popup, the instruction line renders correctly in Japanese (e.g. 「横断歩道のタイルをすべて選択してください」), but the red hint/error text and the verify/skip button labels render as random-looking strings (e.g.F&JfWOUD, 9-CW`).

831

10 hours ago

AmeyaNew Member

Need help on UDM Enrichment

Hi Everyone,I have a problem around UDM enrichment and I would appreciate if someone can guide me to resolve this. Problem :The current user data is enriched with Azure AD Context and it is pulling all the data that is associated with the user presen

221

janguiseNew Member

How to get subkey if the parent key is dynamic in the expression builder

Hi everyoneI'm getting a JSON in a playbook action. I want to reuse that json in another action of my playbook.I'm trying to get the value of a subkey “category” in a nested json like this{ “a”:{“category”:1}, “b”: {“category”:3}}I haven’t found

301

Khushboo14New Member

how to add 2 different conditions in rule

Hi I want this rule to work in such a way that if the e1 or e2 condition is true then we should get an alert but if e2 and e3 is true then we should not get and alert. i have tried multiple ways but somehow it is not working. rule RULE_PROD_USER_INFO

Google SecOps Parser Extension - How to reference extracted.fields["_raw.log"] from base parser?

Hi everyone,I'm working on a Google SecOps Parser Extension for Terraform Enterprise logs.The base parser is successfully extracting data into UDM. For example: extracted.fields["_raw.component"] = "nginx" extracted.fields["_raw.log"] =127.0.0.6 - -

19722

2 days ago

Khushboo14New Member

Need help with YARA-L rule

I am attaching a rule below. I need to have an alert when e1 is true or e2 is true but I don't want and alert when we have a combination of e2 and e3 is true. How can i mention then in the rule. rule RULE_PROD_USER_INFORMATION_REGISTRY_ACCESS { meta:

391

2 days ago

DrVigilantNew Member

Trellix HX Audit Feed (TRELLIX_HX_AUDIT) No Longer Receiving Bulk Acquisition Audit Events

Hello,We're investigating an issue with a Trellix HX Audit integration in Google SecOps and would appreciate any guidance from others who have worked with this feed.EnvironmentGoogle SecOps SIEM Trellix HX / FireEye HX API Feed Log Type: TRELLIX_HX_A

1495

3 days ago

SagarFromAurusTechBronze 2

reCAPTCHA v3 Risk Score Assessment Becoming Inconsistent

Hi Google Cloud Community,We recently enabled reCAPTCHA v3 as a fraud-prevention mechanism and monitored the risk scores for approximately two weeks to understand its assessment behavior.During the first two days, we did not consider the scores for e

460

3 days ago

ORBRSilver 2