Skip to main content

User Groups
Events

Create topic
Login

Community Webinar: Governing the Autonomous SOC - Securing AI Agents End-to-End on Google's Agent Pl...

(Wed, Jul 22, 3:00 PM)

🎉 We're named a Leader in the IDC MarketScape 🎉

Welcome to the Google Cloud Security Community!

Got a question? Need an answer? Let's connect!

Security Forums

Q&A, discussions, share, network

Resource Center

Your learning hub for all things security

User Groups

Join a local meetup!

Events

Discover, RSVP, connect

Featured Blogs

You wont want to miss these articles

New to Google SecOps: Exploring Detections

We’ve spent plenty of time building searches in Google Security Operations (SecOps), but previously we focused on building searches for events and ent...

Forum|Forum|6 days ago

1881

Scaling Collective Defense: Introducing GitHub Support for Google SecOps Parsers

Author:Idan Patelsky, GCP Cloud Security Steward The ChallengeHistorically, managing parsers in Google Security Operations was a highly centralized an...

Forum|Forum|23 hours ago

140

Beyond Chat: Building an Autonomous SOC Analyst with Claude and the Google MCP

This blog post was written by guest author, Eliraz Oved. If you spend your days in the trenches of a Security Operations Center, you already know the...

Forum|Forum|2 months ago

388210

Recent activity
Help others
Categories

dynamicdevNew Member

Google Security Operations

Urgent Request to Take Down Hijacked Project: psyched-crowbar-hf4nj (Ticket: BCVPFWJK2QYD72JIOE423ELZAQ)

Dear Google Cloud Compliance Team, I am writing to follow up on this urgent case (Ticket ID: BCVPFWJK2QYD72JIOE423ELZAQ), which has been pending for over a month.As previously stated, my project has been completely hijacked, and my IAM Owner permissi

MiguelNew Member

Google Security Operations

Google SecOps scheduled report last day of month

Hi everyone,I'm trying to schedule a monthly report in Google SecOps to run on the last day of every month at 11:59 PM (America/Lima timezone).The report is based on a dashboard whose time range is configured as "Last month".The problem is that the A

Tuesday's Tip of the Week

Tuesday's Tip of the Week - First UDM Searches

July 14, 2026 UDM Search Syntax UDM Search is the ad-hoc query interface in Google SecOps. Specify field-value pairs joined with AND, OR, and NOT.Key rules:Fields use dot notation: metadata.event_type, principal.ip, target.user.userid String values g

ar3diuSilver 2

Google Security Operations

YARA-L Question: Password Change Initiated from First Time Seen Country

I am trying to write a rule for Google Workspace password resets initiated from a country that has not been seen in the last 30 days.For some reason, the `first_seen` metric is malfunctioning (returning 0 even though the user has logged in from that

arv261095Bronze 2

Security Command Center

SCC threat finding - Initial access: log4j compromise attempt

Hi Team anyone has any idea on what this low sev SCC findings are actually i am very much confused as most of them are having source IPs as AWS and Google and generating lot of noise also the url contains nessus so not sure why a google / AWS source

GromeroSecBronze 3

Google Security Operations

Google SecOps Field Notes: A Basic Rule-Behavior Audit

**A read-only report for what your rules are actually doing**As detection engineers we all hit the same wall: you can list your rules, but the list doesn't tell you which of them are actually working. Whether a rule is live / alerting, and how much i

hliuBronze 3

Google Security Operations

enrichments in detection rules - outer joins and ECG

The outer join feature recently described by @jstoner is a game-changer for YARA-L, but currently its availability is limited to SEARCH.For detection RULES, while the community has shared a couple workarounds, they each come with tradeoffs:in workar

NASEEFSilver 2

Google Security Operations

silent log source detection rule

Greetings Team,If we do not want to use Google Cloud's native silent log source monitoring, is there any alternative approach using a scheduled YARA-L rule, similar to the one below that runs hourly?I understand that this approach has a few limitatio

jstonerCommunity Manager

New to Google SecOps: Exploring Detections

We’ve spent plenty of time building searches in Google Security Operations (SecOps), but previously we focused on building searches for events and entities. Today I want to highlight how we can use search to find detections and how this can be used i

ericv-avaNew Member

Google Security Operations

Oracle cloud audit log type

Ingesting Oracle Cloud audit logs to Google Secops. Could anyone tell me which one is the proper type? or what the difference between this two type of logs in Google Secops?https://docs.cloud.google.com/chronicle/docs/ingestion/default-parsers/oci-au

ar3diuSilver 2

Google Security Operations

YARA-L Question: Password Change Initiated from First Time Seen Country

I am trying to write a rule for Google Workspace password resets initiated from a country that has not been seen in the last 30 days.For some reason, the `first_seen` metric is malfunctioning (returning 0 even though the user has logged in from that

arv261095Bronze 2

Security Command Center

SCC threat finding - Initial access: log4j compromise attempt

Hi Team anyone has any idea on what this low sev SCC findings are actually i am very much confused as most of them are having source IPs as AWS and Google and generating lot of noise also the url contains nessus so not sure why a google / AWS source

hliuBronze 3

Google Security Operations

enrichments in detection rules - outer joins and ECG

The outer join feature recently described by @jstoner is a game-changer for YARA-L, but currently its availability is limited to SEARCH.For detection RULES, while the community has shared a couple workarounds, they each come with tradeoffs:in workar

NASEEFSilver 2

Google Security Operations

silent log source detection rule

Greetings Team,If we do not want to use Google Cloud's native silent log source monitoring, is there any alternative approach using a scheduled YARA-L rule, similar to the one below that runs hourly?I understand that this approach has a few limitatio

ericv-avaNew Member

Google Security Operations

Oracle cloud audit log type

Ingesting Oracle Cloud audit logs to Google Secops. Could anyone tell me which one is the proper type? or what the difference between this two type of logs in Google Secops?https://docs.cloud.google.com/chronicle/docs/ingestion/default-parsers/oci-au

Ján GornyitzkiNew Member

Cloud Security Foundation

Unable to appeal google cloud platform suspension (ban)

Hello!I have been banned from the Google cloud platform for almost three years (since Dec 22, 2023). I don't know why, I don't know what I've done wrong (if anything). I tried submitting appeals - multiple - but nothing ever works. I only get automat

Austin123Bronze 3

Google Security Operations

Copilot user promt and response monitor

Hi Team,Could you please suggest the best approach to integrate Microsoft Copilot logs with Google SecOps.Our objective is to monitor and analyze user interactions with Copilot, including:User prompts submitted to Copilot Copilot responses generated

invaderzimNew Member

Google Security Operations

BeyondTrust EPM SecOps Feed

Following the integration guide Collect BeyondTrust Endpoint Privilege Management (EPM) logs | Google Security Operations | Google Cloud Documentation The python script is quite outdated and attempts to use an API endpoint (/v2/AuditEvents) that

DOwusuNew Member

Google Security Operations

Palo Alto Network Firewall Logs Not Parsing

Palo Alto Network Firewall Logs Not Parsing. We are using Palo’s Strata Logging to forward Palo Alto Network Firewall Logs to Google Secops Webhook. Some logs are getting parsed and some are not.When we take a look at the logs not getting parsed it s

secfmariNew Member

Google Security Operations

I'm trying to calculate mttr and mtta per environment; this metric is important for each existing environment. Does anyone know how I can do this in the case_history table?I notice that the `cases` table contains the `cases.environment` field. Is it

Security Forums

Welcome to the Google Cloud Security Forums! Your ultimate security conversation spot. Collaborate with peers and experts to solve challenges, together.

Google Security Operations

2963 topics

Google Threat Intelligence

97 topics

Security Command Center

82 topics

Security Validation

124 topics

Fraud Defense (reCAPTCHA)

303 topics

Cloud Security Foundation

54 topics

Stay Informed

Stay Informed

News & Announcements

133 topics

Getting Started

New to the Google Cloud Security Community? Our resources page has everything you need to get started! Find helpful information on account registration, navigating the community, and sharing your valuable feedback.

Community Feedback

14 topics

Open Questions

Can you help?

Unable to appeal google cloud platform suspension (ban)

0

GCP Terraform Kubernetes App validation failure

0

Multi-tenancy on a single Google SecOps — Part 2: Getting Telemetry In Safely

0

How we removed all service account keys using Workload Identity Federation — and the attribute_condition trap nobody warns you about

0

Guide on Migrating SecOps SOAR Remote Agents

0

Leaderboard

The leaderboard is currently empty. Contribute to the community to earn your spot!

Upcoming Community Events

Webinars, User Groups, Podcasts, more

Powered by Gainsight

Terms & ConditionsAccessibility statement

Privacy Policy Terms of Service Gen AI Policy Community Guidelines Cookie Settings

© 2025 Google. All rights reserved.

Sign up

Already have an account? Login

Login with SSO

Login to the community

No account yet? Create an account

Login with SSO

Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.

Enter your e-mail address

Back to overview