User Groups
Events

Create topic
Login

Community Learning! 4 Webinars and 3 Workshops. Register Now!

20 days ago

Welcome to the Google Cloud Security Community!

Got a question? Need an answer? Let's connect!

Security Forums

Q&A, discussions, share, network

Resource Center

Your learning hub for all things security

User Groups

Join a local meetup!

Events

Discover, RSVP, connect

Featured Blogs

You wont want to miss these articles

Beyond Chat: Building Multi Agent SOC Ecosystems with Claude and Google MCP

Author: Elirez Oved, Senior Cloud Security Consultant For any enterprise security team, the prime directive has always been simple: stay one step a...

Forum|Forum|21 hours ago

2760

Better Together: Integrating Wiz Defend and Google SecOps

Ready for the ultimate cloud security synergy? The integration of Google SecOps and Wiz Defend is here to elevate your security game. This powerful co...

Forum|Forum|26 days ago

12715

Scaling Collective Defense: Introducing GitHub Support for Google SecOps Parsers

Author:Idan Patelsky, GCP Cloud Security Steward The ChallengeHistorically, managing parsers in Google Security Operations was a highly centralized an...

Forum|Forum|1 month ago

4661

Recent activity
Help others
Categories

yadavmanjeet65Bronze 2

Google Security Operations

Data security for Security log data ingested in Google Chronicle SIEM.

I have been thinking about how google is assures log data post ingestion is stored in an immutable state for assurance from data security viewpoint. I tried searching for SecOps documentation but unable to find a straightforward statement. Also, onc

3108

1 hour ago

dazzlerellisNew Member

Google Security Operations

Defender Sync Alerts Job

Can this be updated https://docs.cloud.google.com/chronicle/docs/soar/marketplace-integrations/microsoft-365-defender#sync-alertsThis job is failing as it is not taking into account alerts from insider risk policies for example or dlpThey are prefixe

302

2 hours ago

pandamooseStaff

Cloud Security Foundation

Webinar 9/30: CodeMender: AI Code Security Agent

Hi all,You’ve been sleeping under a rock if you haven’t heard about the frontier AI models “hacking” their way out of sandboxes and finding vulnerabilities to break into production systems. But how many of you are trying to reverse that playbook and

70

10 hours ago

dnehodaStaff

Tuesday's Tip of the Week

Tuesday's Tip of the Week - Data Tables: Allow-Lists, Block-Lists, and Enrichment in Your Rules

August 18, 2026 What Are Data Tables? Data tables are structured lookup tables managed in Google SecOps with named columns and rows. They support multiple columns, making them ideal for enrichment and allow/block patterns. Syntax in YARA-L Data tabl

80

16 hours ago

KumarSashankGhantaNew Member

Google Security Operations

How We Built an Agentic Purple-Team System for Detection Validation in Google SecOps

An architecture walkthrough of a purple-team agent that turns detection logic into synthetic telemetry, validates it locally, sends it An architecture walkthrough of a purple-team agent that turns detection logic into synthetic telemetry, validates

Google Security Operations

Google SecOps Parser Extension - How to reference extracted.fields["_raw.log"] from base parser?

Hi everyone,I'm working on a Google SecOps Parser Extension for Terraform Enterprise logs.The base parser is successfully extracting data into UDM. For example: extracted.fields["_raw.component"] = "nginx" extracted.fields["_raw.log"] =127.0.0.6 - -

9613

19 hours ago

matthewnicholsCommunity Manager

Webinars

Meet SecOps: Your Agentic SOC

In this webinar session, Regional Security Architects Sumit Patel and Ethan Gardiner dive deep into how generative AI and autonomous agentic workflows are transforming modern SOC.As cyber adversaries leverage machine-scale automation and large langu

130

20 hours ago

vesselinStaff

Community Blog

Building Custom Anomaly Detection Models with Google SecOps and BigQuery ML: Prediction Model (Part 1)

Author: Vesselin Tzvetkov, Principal Security Engineer and Security Advisor Co- Author: Andre Mohr, Cloud Security Consultant The Google Security Operations (SecOps) platform provides a wide set of powerful AI features to improve the effectiveness

610

21 hours ago

EovedBronze 4

Community Blog

Beyond Chat: Building Multi Agent SOC Ecosystems with Claude and Google MCP

Author: Elirez Oved, Senior Cloud Security Consultant For any enterprise security team, the prime directive has always been simple: stay one step ahead of the adversary. But recently, threat intelligence from Mandiant's M-Trends 2026 Report has ob

2760

21 hours ago

scuba-steveNew Member

Google Security Operations

How to create an alert from a SOAR workflow

I have a playbook that needs to generate an alert in a specific environment if certain criteria are met after an investigation has been performed. It seems this may be possible in two ways:Create a UDM event in SecOps and have a detection trigger on

331

1 day ago

yadavmanjeet65Bronze 2

Google Security Operations

Data security for Security log data ingested in Google Chronicle SIEM.

I have been thinking about how google is assures log data post ingestion is stored in an immutable state for assurance from data security viewpoint. I tried searching for SecOps documentation but unable to find a straightforward statement. Also, onc

3108

1 hour ago

dazzlerellisNew Member

Google Security Operations

Defender Sync Alerts Job

Can this be updated https://docs.cloud.google.com/chronicle/docs/soar/marketplace-integrations/microsoft-365-defender#sync-alertsThis job is failing as it is not taking into account alerts from insider risk policies for example or dlpThey are prefixe

Google Security Operations

Google SecOps Parser Extension - How to reference extracted.fields["_raw.log"] from base parser?

Hi everyone,I'm working on a Google SecOps Parser Extension for Terraform Enterprise logs.The base parser is successfully extracting data into UDM. For example: extracted.fields["_raw.component"] = "nginx" extracted.fields["_raw.log"] =127.0.0.6 - -

9613

19 hours ago

scuba-steveNew Member

Google Security Operations

How to create an alert from a SOAR workflow

I have a playbook that needs to generate an alert in a specific environment if certain criteria are met after an investigation has been performed. It seems this may be possible in two ways:Create a UDM event in SecOps and have a detection trigger on

331

1 day ago

TRIX-y_MA.9livesglitchtwitchNew Member

Fraud Defense (reCAPTCHA)

forbidden

My phone always says contact your IT administrator or forbidden from accessing your Google takeout or using ADB it says only administrators are allowed access. I previously had access right after I downloaded the app and lost it. How the hell do I ge

121

1 day ago

shanmukha1499New Member

Fraud Defense (reCAPTCHA)

Increase in low reCAPTCHA Enterprise scores

Hello We are seeing unexpectedly low reCAPTCHA Enterprise scores for our iOS application starting around May 20, 2026.The tokens are valid, but many legitimate users are receiving low scores ( 0.1–0.2 >= ), affecting application flows.We don’t hav

52211

2 days ago

ORBRSilver 2

Google Security Operations

MS Teams - Adaptive cards

Hello Experts,We are attempting to send styled Microsoft Adaptive Cards to Teamschats directly through Google SecOps SOAR playbooks. We designed the card JSON using the official Microsoft Adaptive Cards Designer.However, when passing the JSON payload

220

2 days ago

dazzlerellisNew Member

Google Security Operations

Alert Overview Widget

Hi all,The Alert Overview widget is blank in all views.The case wall is showing output from the Alert Overview block.Anything I am missing to get this working?

674

3 days ago

DrVigilantNew Member

Google Security Operations

Trellix HX Audit Feed (TRELLIX_HX_AUDIT) No Longer Receiving Bulk Acquisition Audit Events

Hello,We're investigating an issue with a Trellix HX Audit integration in Google SecOps and would appreciate any guidance from others who have worked with this feed.EnvironmentGoogle SecOps SIEM Trellix HX / FireEye HX API Feed Log Type: TRELLIX_HX_A

1213

3 days ago

malzahnOptivBronze 5

Google Security Operations

SIEM Entity Enrichment

Is there a documented procedure for ingesting enrichment data (Assets, Identities) in the SIEM when the source is not listed in Supported log types and default parsers? Let’s say I have sources such as a CMDB, a less common identity provider, or eve

961

4 days ago

Security Forums

Welcome to the Google Cloud Security Forums! Your ultimate security conversation spot. Collaborate with peers and experts to solve challenges, together.

Google Security Operations

3034 topics

Google Threat Intelligence

101 topics

Security Command Center

83 topics

Security Validation

130 topics

Fraud Defense (reCAPTCHA)

306 topics

Cloud Security Foundation

66 topics

Stay Informed

News & Announcements

134 topics

Getting Started

New to the Google Cloud Security Community? Our resources page has everything you need to get started! Find helpful information on account registration, navigating the community, and sharing your valuable feedback.

Community Feedback

14 topics

Resource Center

Looking to uplevel your cloud defenses? Here you’ll find dynamic guides, community insights, technical webinars, security best practices, thought leadership, courses, docs, & updates.