Recently active topics

Hi everyone,I’m currently working on integrating Microsoft Intune logs into Google Cloud (via the Microsoft Graph API).From what I’ve observed so far, it seems that only audit logs are accessible through this integration.I wanted to ask:Is there a limitation with the Graph API that restricts collection to only audit logs? Are operational logs and compliance logs available through any other endpoint or method? If not, are there any recommended alternatives or workarounds to ingest these logs?Would appreciate any insights or guidance from the community.

Hi everyone,I’m currently working on integrating Microsoft Intune logs into Google Cloud (via the Microsoft Graph API).From what I’ve observed so far, it seems that only audit logs are accessible through this integration.I wanted to ask:Is there a limitation with the Graph API that restricts collection to only audit logs? Are operational logs and compliance logs available through any other endpoint or method? If not, are there any recommended alternatives or workarounds to ingest these logs?Would appreciate any insights or guidance from the community.

Hello everyone,I am seeking urgent guidance regarding a GCP project suspension. My account was recently suspended, and I received an email stating that the project was engaged in abusive activity consistent with "hijacked resources."The Situation:Access Denied: My production application is currently offline. Whenever I attempt to access the IAM & Admin or APIs & Services dashboard to investigate, I am automatically redirected to the suspension warning page. Unknown Leak: I have audited my frontend/backend/app environment variables (.env) but haven't found any obvious exposures. Account Lockout: Because I cannot access the IAM dashboard or Cloud Logging, I am unable to identify which credential is being abused or delete the compromised keys. Appeal Status: I submitted an appeal over a week ago, but I have not received a response, and my production app remains affected.My Questions:Is there a way to access Cloud Logging or Security Command Center via the SDK or a restricted conso

I have few questions about submission process for the SecOps SIEM custom integration:Can I publish my SecOps SIEM custom integration in Content Hub? It is containing these componants: Ingestion Script Dashboard Detection Rules Search Queries Is there any public repository to submit these componants or any of them as part of content hub?

Hello,My Google Cloud project has been suspended due to a security issue (ACCOUNT_HIJACKED).I fully understand the situation and I am ready to take all necessary actions to secure the project. However, I currently do not have access to the project anymore, which prevents me from revoking the compromised API keys or applying the required fixes.As a precaution, I have already stopped billing to prevent any further charges.At the moment, my application is completely down, which is having a severe impact on my business. My clients cannot access the service, and I am receiving increasing complaints and refund requests.I already have an open support case: 70327888This situation is becoming critical, and I would greatly appreciate any help to restore access or guidance on how I can proceed to secure the project.Thank you very much in advance for your support.Vincent

Any one has any idea what is this in chronicle can some one explain in detail  

Title: Securing the Agentic Era: Governance and Trust in the New Gemini Enterprise Agent Platform Author: Tyler DooskinDate: April 26, 2026 IntroductionFollowing the major announcements at Google Cloud Next '26 in Las Vegas this week, the shift from experimental AI to the "agentic enterprise" is officially underway. The headline news is the consolidation and evolution of Vertex AI into the Gemini Enterprise Agent Platform [1]. As organizations deploy autonomous agents capable of managing complex, multi-day workflows, the conversation immediately turns to trust. How do we secure systems that not only retrieve data but act upon it?Here is a breakdown of the new governance, security, and compliance controls introduced for the Gemini Enterprise Agent Platform and what they mean for your security posture.From Vertex AI Governance to Gemini Enterprise ControlThe evolution from Vertex AI to the Gemini Enterprise Agent Platform isn't just a rebrand; it represents a unified approach to building

Title: Securing the Agentic Era: Governance and Trust in the New Gemini Enterprise Agent Platform Author: Tyler DooskinDate: April 26, 2026 IntroductionFollowing the major announcements at Google Cloud Next '26 in Las Vegas this week, the shift from experimental AI to the "agentic enterprise" is officially underway. The headline news is the consolidation and evolution of Vertex AI into the Gemini Enterprise Agent Platform [1]. As organizations deploy autonomous agents capable of managing complex, multi-day workflows, the conversation immediately turns to trust. How do we secure systems that not only retrieve data but act upon it?Here is a breakdown of the new governance, security, and compliance controls introduced for the Gemini Enterprise Agent Platform and what they mean for your security posture.From Vertex AI Governance to Gemini Enterprise ControlThe evolution from Vertex AI to the Gemini Enterprise Agent Platform isn't just a rebrand; it represents a unified approach to building

Title: Securing the Agentic Era: Governance and Trust in the New Gemini Enterprise Agent Platform Author: Tyler DooskinDate: April 26, 2026 IntroductionFollowing the major announcements at Google Cloud Next '26 in Las Vegas this week, the shift from experimental AI to the "agentic enterprise" is officially underway. The headline news is the consolidation and evolution of Vertex AI into the Gemini Enterprise Agent Platform [1]. As organizations deploy autonomous agents capable of managing complex, multi-day workflows, the conversation immediately turns to trust. How do we secure systems that not only retrieve data but act upon it?Here is a breakdown of the new governance, security, and compliance controls introduced for the Gemini Enterprise Agent Platform and what they mean for your security posture.From Vertex AI Governance to Gemini Enterprise ControlThe evolution from Vertex AI to the Gemini Enterprise Agent Platform isn't just a rebrand; it represents a unified approach to building

Hello,I am experiencing an issue related to the use of Data Tables for data enrichment in SOAR. Currently, we have several tables containing IP addresses along with their corresponding hostnames (and in some cases, additional information such as VLAN or other attributes).The goal is to query these tables using the “Is Value In Data Table” action, so that when searching for an IP address, the associated values from the corresponding columns are returned. However, a limitation arises because we need to query three different Data Tables simultaneously, each with different structures and fields.The expected output would be something like:IP (hostname, vlan) if associated information exists IP only, if no match is foundAdditionally, we encounter issues when multiple IPs are present in the same alert. The output does not preserve the relationship between each IP and its corresponding hostname, instead returning an aggregated result such as:ip1, ip2, ip3, hostname1, hostname2, hostname3, whic

Hey Everyone!Welcome to the Google Cloud Security Community! We want to kick things off by getting to know each other better. This space is all about connecting, sharing, solving, and building the future of cloud security – and that journey starts with you!So, don't be shy! Drop a quick intro below and tell us:Who are you? (Your name, role, etc.) What's your cloud security superpower? (What area excites you most, or a cool project you're working on?) What are you hoping to learn or share here? (Let's help each other grow!)We're incredibly excited to learn from your unique experiences and build a vibrant hub where we can all protect, create, and innovate together.Can't wait to meet you all!Matt 

Hello Google Cloud Community,I am the founder of Meyra Digital Plant Health Clinic (DPHC), an initiative focused on supporting smallholder farmers with accessible, AI-powered plant health services.Our mission is to reduce dependency on chemical pesticides by providing farmers with natural, locally available solutions combined with intelligent diagnosis tools.We are currently exploring how to leverage Google Cloud to build a scalable and impactful system with the following components:Image-based plant disease detection using AI/MLAutomated advisory system for eco-friendly treatment recommendationsMobile-first delivery (Telegram bot / lightweight apps) for rural accessibilityScalable backend infrastructure for future expansionI would greatly appreciate guidance from the community on:The most suitable Google Cloud services for building and scaling this solution (e.g., Vertex AI, Firebase, Cloud Run)Best approaches for training or integrating plant disease detection modelsDesigning cost-ef

My production project is down and suspended for 48h now with no prior notice and no reply for my appeal request. Not sure what to do.  We are facing a huge loss. I have audited all my code for any security leak and it is clean. Not sure what happened.

in my project show this message “My Project (id: bionic-xxxx) is being suspended for repeatedly violating our Google Cloud Platform Terms of Service or Acceptable Use Policy (including Terms of Service of the Google API you may be using). “ and I can not do anything on my project.How can I fix this problem? I submitted a request a long time ago, but I haven't received a response from Google support yet.-Does anyone have a solution? Please help me.

We are in the Ag tech industry and are “Breaking  the IOT” with localized LORAN solutions. what is one creative way you would stop a user from accidentally performing something malicious 

Project id: project-5580276092549813950My project got suspended 5. april, due to misuse of some keys.I have filed an appeal, taking actions on how to prevent this from happening again. But I do not get any response at all.Now observing users are dropping off, users not able to sign on, complaining. It is very devastating to observe, years of developing an app for dog owners. It is very critical.  Actions Taken:• Removed exposed API keys from all repositories and application code• Ensured that no API keys or credentials are publicly accessible• Reviewed all Git repositories and verified that sensitive credentials are no longer present• Updated development practices to prevent API keys from being embedded in client-side applications• Planned migration of all Gemini API requests from client-side usage to a secure backend service• Implemented safeguards to ensure that future API usage is authenticated and controlled• Preparing to rotate all API keys and service account credentials immediat

Hi, my Google Cloud/Firebase project was suspended for suspected key misuse (account_hijacked).I submitted an appeal, but after 9 days I still have no response.This is now a production outage: about 1200 paying users cannot log in and trust for my application is starting to go down rapidly. The business impact this has is nothing short of a disaster, and the students that’s using the application to study for exams are panicking and asking for refunds.What I already did:Removed exposed credentials from files/repos Rewrote Git history and force-pushed cleaned history Removed old test/dev files with hardcoded keys Tightened secret handling to prevent re-commitWhat I am ready to do immediately when access is restored:Rotate/revoke all affected keys Apply strict key restrictions (referrer/IP/API allowlist) Move secrets to Secret Manager Review IAM, billing, and audit logsI’m currently blocked because suspended status prevents console access.Can anyone advise:how to confirm the appeal is act

Hi Google Team,We have successfully integrated Microsoft Intune logs into Google SecOps using a third-party Graph API feed. The feed configuration appears to be working — logs are being ingested and the feed shows a healthy status.However, we've noticed a significant discrepancy in log size:- **In Google SecOps (via the feed):** Ingested log size is approximately **40 KB**- **Manual API retrieval (direct Graph API call):** The same file/export is approximately **6 MB**This is roughly a 150x difference, which strongly suggests that the feed is either truncating or only partially ingesting the log data.**What we've already ruled out:**- Feed configuration is confirmed successful with no visible errors- Authentication against the Microsoft Graph API is working correctly- we have verified via direct API calls that pagination exist in the returned logs file and the full dataset is returned when querying manually **Questions:**1. Is there a known ingestion size cap or event limit per feed cy

I am slowly but surely working on migrating my many clients to the new reCAPTCHA area in the Cloud Console.  Sometimes I have been able to upgrade from a classic key and sometimes I had to start fresh. When working in websites, and adding the recaptcha key(s) to a specific tool (like a popup builder or opt-in form) that tool has a spot for adding those keys depending on what type i am using. V2 checkbox, V2 invisible, or V3. Meaning they have different fields depending on which type of recaptcha. So I go back into the Cloud Console to try to find what type it is. I cannot find any reference to that. The classic keys are all listed in a table with a column for type. But even when I look at the specific key (already upgraded) in a table there is no “type” column. Are ALL migrated recaptchas V3? If not, where exactly can i see what the recaptcha actually is.

What is the specific PowerShell command used to prevent external entities from sending emails to your tenant using your own domain names?Why is it necessary to enable "Enhanced Filtering for Connectors" when you have already locked down your tenant to only accept mail from a third-party gateway?If an organization enables RejectDirectSend $true but forgets to update their SPF record to include their legitimate third-party sending services, what is the likely impact on outbound mail delivery?

Any one has any idea what is this in chronicle can some one explain in detail  

Hi,I’m working on enriching AWS CloudTrail logs with Organization Unit (OU) information. Since CloudTrail logs (except for the “CreateAccount” event) do not natively include the OU, I’ve implemented the following workflow:I created a Data Table that maps Account ID to OU and I wrote a detection rule that triggers on the “CreateAccount” log and uses the write_row function to update the mapping in the Data Table.I need the OU information to be available in every case opened for a specific account, even though the logs triggering those cases don't contain the OU field. What is the best practice to enrich a case with a field from a data table in this situation?Can I leverage the outcome section to fetch the OU from my data table and then promote it to the case level?I’m looking for the standard procedure to handle the Alert-to-Case mapping for these enriched values.Or, is graph_override a better approach for this type of entity-based enrichment?I want to make sure that when an analyst open

logs and  deployment  instances should be  filtered with  time  

How to detect cyber security criminals and stop black hat hacker 

I recently created detection rules that look for possible suspicious activities for a terminated user. The idea was to only escalate when we see these rules fire after the termination timestamp. The logic are not complex, essentially single event rules looking at certain event_types along with principal and target userids of the user, and no match section therefore running NRT. I did my tests to exclude possible offboard related events. However, after I enabled Alerting, cases were generated with events that occurred days before the rules were set to Alerting. I noticed that the Alerts tied to the cases had the tooltip information below: Now based from what I’ve gathered, this is something to do with how the detection rules pipeline making sure that even “older” events are properly surfaced and is essentially a continuous stream processor. Some of it covered here Latency Analysis in Google SecOps | by Chris Martin (@thatsiemguy) | Medium The tooltip information is a good indicator, but