Recently active topics

We're building a production certificate automation tool using Google Trust Services' production ACME API (dv.acme-v02.api.pki.goog).We've observed that when we place a new order and fetch the raw authorization object, the "expires" field is consistently exactly 8 days after the order's creation timestamp — reproduced across 2 different domains and 2 different ACME accounts.Within this 8-day window, a new order for the same domain/account automatically reuses the existing authorization as "valid" — no DNS-01 challenge needed. After 8 days, a new order requires a fresh DNS-01 challenge.GTS's CP/CPS (Section 4.2.1) states validation data may be reused for up to 200 days — but we observe a hard boundary at 8 days.Questions:1. Is this 8-day authorization validity an intentional, fixed, documented policy, separate from the 200-day CP/CPS ceiling?2. Is this duration stable, or could it change without notice?3. Does this differ for wildcard domain authorizations?A clear, authoritative answer w

Hello Community Managers,Our production project MeshTek-Live (Project ID: meshtek-push-notificatio-724ad) was suddenly suspended yesterday for "abusive activity consistent with hijacked resources."We filed a comprehensive appeal immediately, but our production environment is completely down, impacting our active users. Because we are entirely locked out of the Google Cloud Console, we are unable to look at the Logs Explorer or rotate keys.Why we believe this is an automated false positive: Zero Billing Impact: Our Google Cloud billing dashboard shows exactly $0 in fraudulent or unexpected charges. Timing & Certification: The suspension happened immediately after we submitted our first Google Home Action integration for certification review. We believe the heavy testing traffic from Google's automated certification bots or an embedded client-side credential scanner mistakenly triggered a false-positive "hijacking" flag. No Leaks: We have audited our systems; no code or keys are

Hey everyone,Google SecOps is introducing Advanced Filtering to its native dashboard platform. Note that this feature is currently in Private Preview. Since it fundamentally changes how we can build and interact with dashboards, I wanted to share a quick breakdown of how it works, how to set it up, and a few "gotchas" to watch out for.What is it?Unlike basic filters that are strictly tied to specific fields, advanced filters operate as query variables, or tokens. This allows us to inject dynamic values, complex regular expressions, or boolean logic directly into our YARA-L queries at runtime.Here is what makes it stand out: Dynamic Dropdowns: You can populate your filter choices dynamically using the results of a separate YARA-L query, ensuring users always select from up-to-date data. Flexible Formatting: You can define custom Prefixes, Suffixes, and Delimiters (like / for regex or , for IN clauses) to format values before they hit the query. Multi-Select: It allows users to selec

Is there any way to get the number of cases triggered by specific entities through SIEM search? Or would that need SOAR?Trying to make a dashboard widget that shows a SIEM entity and the number of cases it has triggered. I want to use SIEM search instead of SOAR because SOAR entities are username unique, so the same person appears as multiple entities, while SIEM already has it aggregated under a single entity.Is there a way to achieve this?

It’s been a while since we discussed dashboards in Google Security Operations (SecOps), so today we are going to revisit dashboards with an eye towards applying some additional filters to charts. We’ve previously discussed some basic filtering using the global time filter and a string match against a field. If you haven’t worked with filtering before, I’d recommend taking a few minutes to read this blog for context before diving in. Our focus today expands beyond a single filter to constraining the inputs of the dashboard using filters. The constrained listing of inputs could be from a manual list or dynamically derived from data sets like detections, events or data tables, to name a few. Using Multiple FiltersTo highlight the filtering methods available to us, we are going to use a dashboard that utilizes detections and focuses on a specific chart. This chart contains a listing of the detections for the past seven days on our tenant. To highlight the filtering in action, we are going

Hi everyone,I'm working on a Google SecOps Parser Extension for Terraform Enterprise logs.The base parser is successfully extracting data into UDM. For example: extracted.fields["_raw.component"] = "nginx" extracted.fields["_raw.log"] =127.0.0.6 - - [07/Aug/2026:18:12:19 +0000] "GET /api/v2/organizations/uwm/workspaces HTTP/1.1" 304 0 "https://terraform.uwm.com/app/uwm/workspaces" "Mozilla/5.0 ..."Show more linesRaw event:{"_raw": {"component": "nginx","log": "127.0.0.6 - - [07/Aug/2026:18:12:19 +0000] \"GET /api/v2/organizations/uwm/workspaces HTTP/1.1\" 304 0 ..."},"cribl_group": "AzureEastUS2-Upper"}My goal is to create a Parser Extension that parses the nginx access log and maps fields such as:client_iphttp_methodurl_pathstatus_codeuser_agent However, when I try to reference:[_raw][log][_raw][component]or%{_raw.log} I get errors such as: "_raw.log" not found in state data Questions:What is the correct way to reference fields that are already extracted by the base parser, such as:ex

Hi everyone,I'm working on a Google SecOps Parser Extension for Terraform Enterprise logs.The base parser is successfully extracting data into UDM. For example: extracted.fields["_raw.component"] = "nginx" extracted.fields["_raw.log"] = [removed by moderator] - - [07/Aug/2026:18:12:19 +0000] "GET /api/v2/organizations/uwm/workspaces HTTP/1.1" 304 0 "https://terraform.uwm.com/app/uwm/workspaces" "Mozilla/5.0 ..."Show more linesRaw event:{"_raw": {"component": "nginx","log": " [removed by moderator] - - [07/Aug/2026:18:12:19 +0000] \"GET /api/v2/organizations/uwm/workspaces HTTP/1.1\" 304 0 ..."},"cribl_group": "AzureEastUS2-Upper"}My goal is to create a Parser Extension that parses the nginx access log and maps fields such as:client_iphttp_methodurl_pathstatus_codeuser_agent However, when I try to reference:[_raw][log][_raw][component]or%{_raw.log} I get errors such as: "_raw.log" not found in state data Questions:What is the correct way to reference fields that are already extracted by

This is the final part of a four-part series on running many tenants on one Google SecOps instance. Part 1 built the mental model: this kind of multi-tenancy is really three independent isolation challenges, and one slug per tenant can carry all three. Part 2 got each tenant's telemetry in, correctly tagged, without trusting the partner's machines or leaking the ingestion key. Part 3 made each analyst see only their own tenant and each alert land in the right queue. This part closes the series with the content that runs on top of that platform work, and a few corrections the platform work itself earned along the way. Everything so far has been platform configuration and architecture: a namespace stamped, a scope stood up, an environment wired. None of it detects anything or responds to anything on its own. This part covers the detection rules that fire across many or specific tenants and the SOAR playbooks and integrations that act on them. Additionally, this part begins with three cor

Project ID: traknly-3cb91App Name: TraknlyIssue:My app verification is currently stuck on the branding guidelines requirement error ("Your app has not met branding guidelines requirements...").I have already updated and saved our app name and branding across our OAuth consent screen and homepage so that they match. However, no initial email thread was received from the Trust & Safety team to reply to, and updating the consent screen settings has not refreshed the verification queue.Could a Community Manager or Google representative please help escalate or route this Project ID to the Trust & Safety team for review?Thank you!

I’m trying to set a dashboard widget and I need to set timeframe as current month (from the month beginning till date)In relative and absolute there’s no such option. Is there a way that we can achieve this?

For the dashboard filter, is there way we can filter results for the current month? in absolute and relative setting, not able to achieve that. 

I’m building a playbook that runs on new alerts and enriches it’s entities. To avoid unnecessary API calls, I want to only enrich entities that have not already been enriched. Some cases may contain alerts with the same entities, it would be inefficient to run each duplicate entity through enrichment each time. The idea is to have a condition at the start of the playbook that filters on the ‘Entity.IsEnriched’ field. If this field is False, perform enrichment. Once enrichment is complete, the playbook would then set the field to True.I can set the field value for an entity fine using the ‘Enrichment - Enrich Entity With Field’ action. My issue is that I cannot access this field from anywhere in the playbook. Other fields such as ‘Entity.IsInternal’ are exposed, but this is not. Why is this? 

Billing account: 013EAA-30E019-83A787Account: familleguillou92@gmail.comOrganization: 414196513488Every new project I create becomes immediately inaccessible with CONSUMER_INVALID errors. This affects both my personal account and all service accounts. Projects are created (exit 0) but cannot be accessed afterward — even by the creator.I'm building a multi-tenant SaaS (mykrew.pro) where each client gets an isolated Firebase project. During development testing, I created and deleted ~50 projects which likely triggered an anti-abuse flag. My project quota was already increased and approved.I need this flag lifted on my billing account to continue operating my business.

Hi everyone,I'm building a Native Dashboard that tracks total ingested data volume (GB) grouped by Namespace, using the standard pattern:ingestion.component = "Ingestion API"$Namespace = ingestion.namespacematch:    $Namespaceoutcome:    $Total_GB = math.round(sum(ingestion.log_volume) / math.pow(1000, 3), 2)order:    $Total_GB descThis works great for a Namespace-level breakdown. However, I'd like to roll this up further — specifically, I want to group/aggregate this ingestion volume by SOAR "Environment" (case.environment), so I can see total GB ingested per Environment rather than per individual Namespace.The challenge: ingestion.namespace (SIEM) and case.environment (SOAR) appear to be two separate data sources/concepts, and I haven't found a native field that joins them directly in dashboard queries (similar to the "joining case and case_history is only supported for one case and one case_history event" limitation I ran into when trying to join case and case_history data).Question

I created a custom parser extension for Qumulo and mapped the following values to additional.fields:additional.fields["before_ctime"]additional.fields["after_ctime"]additional.fields["before_mtime"]additional.fields["after_mtime"]additional.fields["before_size"]additional.fields["after_size"]I can successfully see these fields populated in Search/Event Viewer for:metadata.log_type = "QU_FS"metadata.product_event_type = "fs_write_metadata"for eg: additional.fields["before_ctime"] = 2026-08-04T15:34:56.456288103Zadditional.fields["after_ctime"] = 2026-08-04T15:34:56.46247726Zadditional.fields["before_mtime"] = 2026-08-04T15:34:56.456288103Zadditional.fields["after_mtime"] = 2026-08-04T15:34:56.46247726Zadditional.fields["before_size"] = 0additional.fields["after_size"] = 23Eg: events:$e.metadata.log_type = "QUMULO_FS"$e.metadata.product_event_type = "fs_write_metadata" $log_id = $e.metadata.product_log_id match:$log_id over 1h outcome:$count = count($e.metadata.id) condition:$e What is t

In today's rapidly evolving threat landscape, security teams are challenged by a persistent talent shortage and an overwhelming volume of alerts. Every investigation involves the same repetitive steps: pull evidence from multiple tools, read through it, form a hypothesis, write up recommendations, and update the ticket. None of that work is hard, but it is slow, and it pulls analysts away from the alerts that need human judgment. Google SecOps already brings native AI assistance to investigation, including case summarization and Gemini-backed support inside the platform itself. That covers a lot of ground, but it is scoped to SecOps and to Google's model. Many SOC teams run a heterogeneous stack (multiple SIEMs, EDR, ticketing system, and a mix of AI vendor agreements depending on the business unit) and need their AI-enabled playbooks to reach across all of it. We’ve built the custom integration AIModelQuery for Google SecOps SOAR to close that gap. It lets any playbook call out to any

Having some issues running Crowdstrike actions, specifically - Run Script, Execute Command, and Contain Endpoint.  Contain Endpoint - I selected the hostname as the entity. but get the output message “None of the provided endpoints were found in Crowdstrike Falcon.”Run Script/Execute Command - I’ve tried to reference the script name and raw script. But I just get the output message “Script wasn't executed on the provided endpoints in CrowdStrikeFalcon.” I know the integration works for the most part as I run the “Get Host Information” and that gave me no issues.  Any one have any insight into this?

Hello everyone,Due to the parsing of proxy logs, I need to “re-build” the URL from network.application_protocol and target.url: $url = strings.concat($e.network.application_protocol, "://", $e.target.url)I’m getting the following error:compilation error compiling query: validating query: expect type [string int float], got type backstory.Network.ApplicationProtocol for "e.udm.network.application_protocol"I guess I need to convert the enum to string.Any solutions for that ?Thanks,

Hi all, I am trying to test googles “Data processing using API methods” (No bindplane)I was wondering has anyone tried to use this feature yet and have any tips.I am testing with OKTA_USER_CONTEXT and trying to redact PII but just for testing I am trying to redact the “Title” field. I tried it but not sure if I can redact a whole field using blockedKeyPatterns or does it only work on with blockedValues. Documentation used: Hi all,I am testing Google SecOps Data Processing Pipelines using the API methods directly, without deploying Bindplane agents/collectors. My use case is OKTA_USER_CONTEXT, where I am trying to redact PII from the Okta user profile payload before the data is stored/parsed in Google SecOps.For initial testing, I associated a data processing pipeline to a specific OKTA_USER_CONTEXT and confirmed the pipeline is associated using fetchAssociatedPipeline. The pipeline currently has a redactProcessor. I first tried testing field-based redaction using blockedKeyPatterns aga

Author:Tim Gallo, Google Cloud, Head of Customer Engineering  Detection HighlightsOur Google Threat Intelligence Group and FLARE teams are always working to update YARA rules to help customers stay ahead of emerging threats. This week, we've rolled out rules in the Google Threat Intelligence platform for three newly tracked malware families. We focus our updates on the threats we see most often in Mandiant engagements, Google Security Operations’ environments, and trending searches.Whenever our research uncovers a new malware family, we quickly build and deploy the necessary detection signatures.Here are a few recent examples: SALATSTEALER: a Go-based crypto stealer that targets Windows browsers, cryptocurrency wallets, and Telegram clients (specifically Telegram Desktop and Kotatogram). It is capable of hijacking webcams and microphones to stream data directly to a C2 server. SCARLETSMASHER: a Downloader used to download, compile and execute C# .NET code. See its curated YARA detect

How can I manage the spacing for column entries in the SecOps dashboard? When I create a report, columns containing lengthy values are truncated, and some of the content is hidden. Is there an option similar to Wrap Text or any other way to display the full column values?

August 4, 2026  The Match Section in Depth In a YARA-L rule, the match section controls what to group by and how wide the time window is. The match variable you choose fundamentally changes what the rule detects. Grouping by $source_ip answers "which IPs are generating events?" Grouping by $user answers "which users are experiencing events?" Same events, different questions.You can group by multiple variables: $user, $source_ip over 1h creates one detection per unique user-IP combination. Time Window Selectionover 5m - Tight windows for high-speed attacks (brute force, scanning) over 1h - General-purpose window for most behavioral rules over 24h - Wide windows for slow-and-low attacks, but more expensive to evaluateChoose the shortest window that captures the behavior you care about.Outcome Functions Function Purpose Example count($event) Total matching events How many API calls occurred count_distinct($var) Unique values of a placeholder How many distinct methods were ca

The Mandiant Security Validation (MSV) team is pleased to announce version 4.14.7.0 of the MSV platform.EnhancementsAdded the option to set a default landing page (such as the Topology Map) upon sign in, improving load times for users who prefer to bypass the initial Simulations page. For Windows 10/11, added support for TPM 2.0 on Protected Theater.  Added the ability to hide unselectable actors from the user interface, streamlining the actor selection process when running actions. Improved system memory efficiency and performance when downloading or exporting large datasets—including attachments, assessments, Bulk Job results, and suspect events. Enhanced the scaling and responsiveness of the Jobs interface through optimizations, including batched loading and database aggregation for event lists.Bug fixesThis release includes a number of bug fixes and stability improvements. Key fixes are categorized as follows:Actor and integration stabilityFixed an intermittent issue where Actors w

Hello We are seeing unexpectedly low reCAPTCHA Enterprise scores for our iOS application starting around May 20, 2026.The tokens are valid, but many legitimate users are receiving low scores ( 0.1–0.2 >= ), affecting application flows.We don’t have active support plan, and there is no option to enable support plan for our project, can anyone point to right place for resolving this issueThank you.