Welcome to the Google Cloud Security Community!

Multi-tenancy on a single Google SecOps — Part 1: The Isolation Challenge

This is Part 1 of a four-part series on running many tenants on one Google SecOps instance. Part 1 sets up the mental model and the naming convention the rest of the series builds on. Part 2 covers getting telemetry in safely; Part 3 covers who sees

3338

8 hours ago

dnehodaStaff

Tuesday's Tip of the Week

Tuesday's Tip of the Week - Signal, Not Noise: Tuning Detection Rules with Exclusions and Data Tables

September 1, 2026 The Cost of Noisy Rules A rule that fires 10,000 alerts daily is worse than no rule at all. Analysts learn to ignore it, and real threats buried in the noise go uninvestigated. Detection tuning is the discipline of reducing false po

130

14 hours ago

melissagrBronze 5

Unexpected GTI IOC matches on legitimate domains

Hello,Since Friday evening, we have been receiving more than 400 daily alerts from a custom GTI IOC ( on domain) matching rule.Many detections involve well-known legitimate domains such as Microsoft, Google, GitHub, DigiCert and Windows Update. Befor

453

14 hours ago

nkarpinskiStaff

Community Blog

Announcing Public Preview of the Google Security Operations Detection Engineering Agent

Author: Nolan Karpinski, Group Product Manager, Google Cloud Security We are excited to share the latest leap forward in autonomous defense by announcing the Public Preview of the Detection Engineering agent in Google Security Operations.Wondering if

350

17 hours ago

G

GoogleUser2New Member

Why is Google adding an origin trial token meta tag with recaptcha?

Have noticed this appearing in the document head when inspecting the page. Just wondering what this is and why it's been added. Does anyone know? Thanks

954

20 hours ago

SagarFromAurusTechBronze 2

reCAPTCHA v3 Risk Score Assessment Becoming Inconsistent

Hi Google Cloud Community,We recently enabled reCAPTCHA v3 as a fraud-prevention mechanism and monitored the risk scores for approximately two weeks to understand its assessment behavior.During the first two days, we did not consider the scores for e

711

BrijeshKNew Member

Thai Localization Characters Corrupted in Google reCAPTCHA

We are using Google reCAPTCHA v3 with Thai language (hl=th). The captcha challenge occasionally displays corrupted Thai characters in the instruction area and action button. The issue occurs inside the Google-hosted reCAPTCHA dialog while the rest of

412

hzmndtStaff

[Part#3] 📊 Google SecOps Data in BigQuery: Demystifying Advanced BigQuery Export (SIEM) vs. Legacy BigQuery (SOAR)

🗄️ Part 3: SOAR BigQuery Schema Reference (siemplify_search_everything_db)The siemplify_search_everything_db dataset contains tables capturing the lifecycle of incident management, playbook automation, and analyst workflows. Synchronization & Gua

410

hzmndtStaff

[Part#2] 📊 Google SecOps Data in BigQuery: Demystifying Advanced BigQuery Export (SIEM) vs. Legacy BigQuery (SOAR)

⚠️ Part 2: SOAR Data Limitation & Accessing Legacy BigQuery Important Platform Note:SOAR data is not currently supported in Advanced BigQuery Export.(Documentation Reference: "Data from Google Security Operations SOAR (search_everything_db) isn't

190

melissagrBronze 5

Unexpected GTI IOC matches on legitimate domains

Hello,Since Friday evening, we have been receiving more than 400 daily alerts from a custom GTI IOC ( on domain) matching rule.Many detections involve well-known legitimate domains such as Microsoft, Google, GitHub, DigiCert and Windows Update. Befor

453

14 hours ago

SagarFromAurusTechBronze 2

reCAPTCHA v3 Risk Score Assessment Becoming Inconsistent

Hi Google Cloud Community,We recently enabled reCAPTCHA v3 as a fraud-prevention mechanism and monitored the risk scores for approximately two weeks to understand its assessment behavior.During the first two days, we did not consider the scores for e

711

BrijeshKNew Member

Thai Localization Characters Corrupted in Google reCAPTCHA

We are using Google reCAPTCHA v3 with Thai language (hl=th). The captcha challenge occasionally displays corrupted Thai characters in the instruction area and action button. The issue occurs inside the Google-hosted reCAPTCHA dialog while the rest of

412

SantoshKhandeNew Member

When we are expecting SecOps to include ability to schedule report in pdf format.

Google SecOps SIEM CMEK instance, there’s only option to schedule reports in csv format. We are expecting the pdf format as its simpler way to present data to Monitoring team.

803

2 days ago

AmeyaNew Member

Need help on UDM Enrichment

Hi Everyone,I have a problem around UDM enrichment and I would appreciate if someone can guide me to resolve this. Problem :The current user data is enriched with Azure AD Context and it is pulling all the data that is associated with the user presen

484

4 days ago

DrVigilantNew Member

Trellix HX Audit Feed (TRELLIX_HX_AUDIT) No Longer Receiving Bulk Acquisition Audit Events

Hello,We're investigating an issue with a Trellix HX Audit integration in Google SecOps and would appreciate any guidance from others who have worked with this feed.EnvironmentGoogle SecOps SIEM Trellix HX / FireEye HX API Feed Log Type: TRELLIX_HX_A

1657

4 days ago

collin_peelNew Member

Is the SOAR/SIEM UI Slow for Anybody Else? Lagging and Freezing on IDE and Data Tables Views

Is the SOAR/SIEM UI slow for anybody else? Mine is lagging and freezing on IDE and data table views. I’m on Windows and Chrome

312

4 days ago

R

rdhd0701New Member

reCAPTCHA Enterprise checkbox image-challenge renders button/error text as corrupted strings for non-latin languages

Summary:In the checkbox image challenge popup, the instruction line renders correctly in Japanese (e.g. 「横断歩道のタイルをすべて選択してください」), but the red hint/error text and the verify/skip button labels render as random-looking strings (e.g.F&JfWOUD, 9-CW`).

1661

5 days ago

Khushboo14New Member

how to add 2 different conditions in rule

Hi I want this rule to work in such a way that if the e1 or e2 condition is true then we should get an alert but if e2 and e3 is true then we should not get and alert. i have tried multiple ways but somehow it is not working. rule RULE_PROD_USER_INFO