User Groups
Events

Create topic
Login

Community Capture The Flag with Hack The Box - Operation Cymbal: Cold Room

(Thu, Oct 29, 4:00 PM)

Welcome to the Google Cloud Security Community!

Got a question? Need an answer? Let's connect!

Security Forums

Q&A, discussions, share, network

Resource Center

Your learning hub for all things security

User Groups

Join a local meetup!

Events

Discover, RSVP, connect

Featured Blogs

You wont want to miss these articles

Announcing Public Preview of the Google Security Operations Detection Engineering Agent

Author: Nolan Karpinski, Group Product Manager, Google Cloud Security We are excited to share the latest leap forward in autonomous defense by announc...

1 month ago

6035

Lifecycle of a SOAR Automation

Author: Dmitry Kosarev, Senior Security Automation Engineer - Admiral Group Have you ever had to perform a laborious, repetitive task in an IT role?I...

1 month ago

4821

Beyond Chat: Building Multi Agent SOC Ecosystems with Claude and Google MCP

Author: Elirez Oved, Senior Cloud Security Consultant For any enterprise security team, the prime directive has always been simple: stay one step a...

2 months ago

17244

Read More!

Recent activity
Help others
Categories

nickharbourStaff

published in Community Blog

Announcing the 13th FLARE-On Challenge

Author: Nick Harbour, Reverse Engineer We are proud to officially announce the thirteenth edition of the FLARE-On challenge! This is a Reverse Engineering contest that runs online for four weeks starting this Friday (September 25th, 2026) at 8pm East

10532

53 minutes ago

czjStaff

published in Community Blog

Practical Threat Hunting Playbooks for Google Threat Intelligence: Querying Campaigns and Operations with Agentic Threat Intelligence

Authors: Jules Czarniak, Senior Security EngineerDaniel Kapellmann Zafra, Staff Security Engineer Connecting Intelligence to Execution Google Threat Intelligence recently introduced new capabilities that deliver frontline Mandiant technical observati

8671

8 hours ago

Mufa_shahBronze 2

asked in Google Security Operations

Limitation in IP Enrichment via Entity Context

Hi All,i was trying to ASN enrichment via Entity Context I tried both GLOBAL and ENTITY context but unable to trigger rule Code Snippet $ipcti.graph.entity.artifact.ip = $source_ip // e.g. 8.8.8.8( $ipcti.graph.metadata.source_type = "G

261

16 hours ago

spartan_07New Member

posted in Google Security Operations

Google SecOps Dashboards Drilldown Not Working on Individual Array Elements

I'm trying to configure drilldown functionality on a Table widget in Google SecOps Dashboards, where one of the displayed fields is an array (repeated field). I'm running into a rendering/drilldown limitation and would appreciate guidance or confirma

121

17 hours ago

Technology ArchètravelNew Member

asked in Fraud Defense (reCAPTCHA)

Automigrated reCAPTCHA project 474223265113: "Accept invitation" redirects but the invitation stays pending for every owner

Our classic reCAPTCHA v3 key (domain archetravel.com, used by WordPress Contact Form 7) was auto-migrated to Google Cloud project number 474223265113. The classic admin shows "Action required: accept the invitation to the Google Cloud project".What h

10

1 day ago

S

ShaliniPereraBronze 1

asked in Google Security Operations

Check user that last updated the rule

Hi, is there a way to check the user that has last updated a rule from the SecOps platform without checking cloud looging?

354

1 day ago

scuba-steveNew Member

asked in Google Security Operations

Unable to create manual case via SOAR API without setting data access scope for relevant environment

I have a workflow that requires a case be created in an environment if certain conditions are met. I was able to create a custom action to do this fine a few weeks ago, but since a new scope (also the first scope) was added in our SIEM settings, I no

1136

1 day ago

iLotuusBronze 1

asked in Google Security Operations

Can the Salesforce SOAR integration automatically create and synchronize tickets from Google SecOps cases?

Hi everyone,I’m evaluating the Salesforce integration for Google SecOps SOAR and would like to confirm whether it supports this workflow:A case is created in Google SecOps from any connected alert source. A corresponding Salesforce Case (ticket) is c

272

1 day ago

SaitejaKattaBronze 4

asked in Google Security Operations

How to detect and get alerted when detection rules are automatically moved to PAUSED state?

Hi everyone,We have noticed that when certain detection rules exceed resource consumption limits, Google SecOps automatically transitions them to a PAUSED state (following the LIMITED throttling period). Because paused rules stop evaluating events an

452

1 day ago

scuba-steveNew Member

asked in Google Security Operations

Unable to use results of fetched events in SAR playbook downstream

I have a playbook that fetches UDM events using the ‘GoogleChronicle - Execute UDM Query’ action. This action return events in the format below:{ "events": [ {"foo": “bar”}, ]} I need to loop over each event in the events list returned,

161

1 day ago

Show more activity

Mufa_shahBronze 2

asked in Google Security Operations

Limitation in IP Enrichment via Entity Context

Hi All,i was trying to ASN enrichment via Entity Context I tried both GLOBAL and ENTITY context but unable to trigger rule Code Snippet $ipcti.graph.entity.artifact.ip = $source_ip // e.g. 8.8.8.8( $ipcti.graph.metadata.source_type = "G

261

16 hours ago

Technology ArchètravelNew Member

asked in Fraud Defense (reCAPTCHA)

Automigrated reCAPTCHA project 474223265113: "Accept invitation" redirects but the invitation stays pending for every owner

Our classic reCAPTCHA v3 key (domain archetravel.com, used by WordPress Contact Form 7) was auto-migrated to Google Cloud project number 474223265113. The classic admin shows "Action required: accept the invitation to the Google Cloud project".What h

10

1 day ago

S

ShaliniPereraBronze 1

asked in Google Security Operations

Check user that last updated the rule

Hi, is there a way to check the user that has last updated a rule from the SecOps platform without checking cloud looging?

354

1 day ago

scuba-steveNew Member

asked in Google Security Operations

Unable to create manual case via SOAR API without setting data access scope for relevant environment

I have a workflow that requires a case be created in an environment if certain conditions are met. I was able to create a custom action to do this fine a few weeks ago, but since a new scope (also the first scope) was added in our SIEM settings, I no

1136

1 day ago

SaitejaKattaBronze 4

asked in Google Security Operations

How to detect and get alerted when detection rules are automatically moved to PAUSED state?

Hi everyone,We have noticed that when certain detection rules exceed resource consumption limits, Google SecOps automatically transitions them to a PAUSED state (following the LIMITED throttling period). Because paused rules stop evaluating events an

452

1 day ago

scuba-steveNew Member

asked in Google Security Operations

Unable to use results of fetched events in SAR playbook downstream

I have a playbook that fetches UDM events using the ‘GoogleChronicle - Execute UDM Query’ action. This action return events in the format below:{ "events": [ {"foo": “bar”}, ]} I need to loop over each event in the events list returned,

161

1 day ago

soaruserBronze 2

asked in Google Security Operations

Display Source and Destination Entities in Case List View

What is the best way to display Source and Destination entities (IP addresses and hostnames) in the Case List view, similar to QRadar and ArcSight, so SOC analysts can quickly understand alert context at a glance without opening each case?

342

1 day ago

okjokerNew Member

asked in Google Security Operations

GTI Monitor/Connector Identification within SOAR playbook

Hey all,What have you found to be the best way to determine which connector a SOAR alert originated from?|We have monitors within GTI, with all of them having their own connector within SecOps. We are looking for either the ability to determine monit

281

2 days ago

amesamehotNew Member

asked in Google Security Operations

Does a reply to [removed by moderator] reach the compliance case?

My customer data is still on Google Cloud, but my entire account has been banned. I only want to restore access as quickly as possible.After I submitted an appeal, I received an email from an address in this format:google-cloud-compliance-reply+{case

824

3 days ago

CrescentCommunitiesBronze 1

asked in Fraud Defense (reCAPTCHA)

Unable to add or remove allowed domains from recaptcha key

I am unable to add or remove domains from the allowed domain list when editing a key. I click save and get a success toast message, but the changes aren’t actually committed.I noticed it yesterday (10/13) at 2pm ET. I can’t open a support ticket b/c

837

3 days ago

Show more activity

Security Forums

Welcome to the Google Cloud Security Forums! Your ultimate security conversation spot. Collaborate with peers and experts to solve challenges, together.

Google Security Operations

3117 topics

Google Threat Intelligence

103 topics

Security Command Center

83 topics

Security Validation

131 topics

Fraud Defense (reCAPTCHA)

317 topics

Cloud Security Foundation

78 topics

Stay Informed

News & Announcements

135 topics

Getting Started

New to the Google Cloud Security Community? Our resources page has everything you need to get started! Find helpful information on account registration, navigating the community, and sharing your valuable feedback.

Community Feedback

16 topics

Resource Center

Looking to uplevel your cloud defenses? Here you’ll find dynamic guides, community insights, technical webinars, security best practices, thought leadership, courses, docs, & updates.