Recently active topics

Hello,Our application (Project ID: smtp-campaignbutler) is currently in the "Pending developer action" state in the Verification Center.The console instructed us to "Reply to your email thread with our Trust and Safety team". However, we have not received this email, after thoroughly checking all inboxes and spam folders for our registered developer contact email addresses.We have already resolved the two issues that were required:1. The homepage domain has been verified in Google Search Console.2. A link to our Privacy Policy has been added to the homepage footer.Since we cannot find the email to reply to, and our current support plan does not allow us to open a direct tech support case, we are hoping someone from the community or a Googler can advise on how to notify the Trust & Safety team that our fixes are complete.How can we move forward with the review process?Thank you for your help.

Hello Google Cloud Support Team,I am experiencing a critical issue with my web application (tasleemai.com) where users are consistently failing to generate a reCAPTCHA Enterprise Token, which is blocking the registration process.Details: Affected Key (Site Key ID): 6LeaPgE... (Tasleem AI key) Domain: https://tasleemai.com (The site is now correctly enforcing HTTPS). Frontend Error: The browser console displays the error: Error: فشل في إنشاء رمز reCAPTCHA. which translates to "Error: Failed to create reCAPTCHA token." Key Metric Evidence: No scores or metrics are visible in the reCAPTCHA Enterprise dashboard for this key , confirming that the client-side API call (grecaptcha.enterprise.execute) is not successfully connecting to the Google service. Troubleshooting Performed: reCAPTCHA Enterprise API is Enabled in the project . The Public Site Key (data-sitekey) is correctly placed in the HTML. The domains (tasleemai.com and www.tasleemai.com) are correctly listed in t

Hello everyone,has anyone tried using detection_window in the options?I found it in the documentation, but I don't know how to use it, and it was only mentioned in an example rule; it doesn't appear in the options section.When I put it in one of my rules, it doesn't work. rule failed_logins_from_new_location{ meta: author = "Security Team" description = "Detects multiple failed logins for a user from a new, never-before-seen IP address within 10 minutes." severity = "HIGH" events: $e.metadata.event_type = "USER_LOGIN" $e.security_result.action = "FAIL" $user = $e.target.user.userid $ip = $e.principal.ip outcome: $failed_login_count = count($e) $unique_ips = count_distinct($ip) $first_fail_time = min($e.metadata.event_timestamp) match: $user over 10m condition: #e >= 5 options: detection_window=2d}taken from doc “ The options section specifies when the query first runs: it looks back two days.”Reference link:https://docs.cloud.google.com/chronicle/doc

Hi,What is the best way to field unparsed events ingested in SecOps SIEM without it being a pain. I have so far been searching for raw log with regex and using Procedural Filtering for individual log source until I collect few hundreds and then try to work on parser extension. This has been painful and a lot of manual task and chances of missing unparsed event is high for us (considering the volume of data we ingest and search result capping the returned events to x result (10,000 default) I believe there should be a way for searching for just unparsed logs so that we have better visibility of what we are missing out on. 

Is it possible to set Direct Ingestion of Workspace Activity logs from multiple consoles/organisations to the same SecOps instance? https://docs.cloud.google.com/chronicle/docs/ingestion/default-parsers/workspace-activity

I'm planning to write a detection rule to monitor a log source. I want to be notified when the log feed stops and no logs are being received!--scriptorstartfragment-->  events:    $e.metadata.vendor_name = string    $e.metadata.event_timestamp = int   condition:    not any $e where      $e.metadata.vendor_name == "Crowdstrike" and      $e.metadata.event_timestamp > now() - 1800!--scriptorendfragment-->}Here getting errors on the - not any $e where 

Hi Team,Can anyone provide an insight on how can we create an alert if a log source (Let's assume a principal.hostname) stops sending logs for 30 mins?  

Hi All,We have created a new permission group like “managed-plus” for our SOC users and we want to enable “manage tags” option in it.Any change in permission is not helping with it. Wanted to know if any of you guys have tried it or the permission group that handles the case tags options.

Hi!We are trying to exclude the MS XDR portal from showing up as a entity in our cases. Tried these 3 variants, but it does not filter it out..What is the correct formatting? (The entities in cases are urls to incidents, so I need to catch all variants of the URL with a wildcard.  

I’m trying to retrieve cases that have been recently updated. The `CaseSearchEverything` (external/v1) endpoint can filter by date, but only the case creation date, using `startTime` and `endTime` filter values. It does not have the ability to filter cases by `startModifiedTime` and `endModifiedTime`.The `GetCaseDetails` endpoint returns a value `modificationTimeUnixTimeInMs`, which means that the last modified time value exists somewhere, but is not available to `CaseSearchEverything` via filter parameters. The value also doesn’t appear in the output of `CaseSearchEverything`, preventing me from applying post-processing filters against bulk results.Is there another way to filter cases by last modified time via external API?If not, can we make a feature request for this?

Hello All,I'm working on setting up alerting rules in SecOps, and I’m encountering an issue where some alerts are critical but tend to trigger frequently, creating unnecessary noise in the alert stream.I’m thinking of implementing a rule where, once an alert is triggered, subsequent alerts of the same type (or related) would be suppressed until a specified time window has passed. The goal is to avoid alert fatigue and ensure that we’re not overwhelmed with redundant notifications while still tracking important events.Has anyone implemented a similar mechanism? If so, could you share some insights on how you went about this or any best practices you’d recommend? I’m particularly interested in solutions where the suppression is time-based (e.g., 30 minutes after an alert is triggered, suppress any similar alerts during that period).Thanks,Suraj Kadav

Hi @jstoner I am new to YARA L, I am trying to convert few KQL query into YARA L, but I can’t able to achive same as KQL logic. please help on this rules.Response rows stateful anomaly on database | Microsoft Sentinel Analytic Rules Drop attempts stateful anomaly on database | Microsoft Sentinel Analytic Rules

We have 7+ v2 classic [checkbox] keys, we got email that our keys will be automatically migrated or we can manually.We have below queries, appreciate if you can provide inline answers for all of them. There seems some confsion w.r.t needing code changes, billing etc post migration.If we manually migrate v2 (checkbox) to cloud v2 (checkbox) , it is said that no code change andwe can continue to use siteverify api. Questionsa) But after migration if our usage goes above 10000 like 150000, then what, will we be charged or not ?b) Will our siteverify api stop working and give error if more hits more than 10000 ?c) If it will give error, then how can we enable billing ? will it be enabled by default when we manually migrate orautomatically migrate ?d) What if we do not enable billing and if our v2 checkbox/invisible migrated to cloud and usage more than 10000 ?e) What if we do not enable Enterprise in our case v2 checkbox/invisible migrated to cloud and usage more than 10000 ?f) Will enterp

Hi I am new to YARA L, I am trying to convert KQL query into YARA L, but I feel difficult to convert specific Rule which is mentioned below as URL Please go through URL for KQL Query. please help me to convert this rule into YARA LResponse rows stateful anomaly on database | Microsoft Sentinel Analytic Rules

Log Parsing Issue in Restricted Pipeline (Chronicle/CBN/Logstash) We are encountering persistent syntax and parsing errors in a highly restricted log processing pipeline (likely based on Logstash/Grok, possibly within Google Chronicle or CBN). We need help structuring the code to handle the strict syntax and mixed log types without using advanced conditional logic. 1. Environment and Constraint  Environment: Highly restricted log parsing pipeline (cannot use standard Logstash features). Confirmed Constraints (Key Failures): NO if/else conditionals (if [field] fails, if "tag" in [tags] fails). NO semicolons (;) allowed anywhere in the config. Field names must use snake_case (e.g., host_name).  2. The Core Problem: Mixed Log Types Our pipeline receives two distinct log formats that crash the system when we try to parse the second one, or when we encounter simple syntax errors.Log Type Sample Log (Raw) Envoy Access Log (Primary Goal) <166>2025-10-22T14:00:00.095

Hi Team,I am looking to get an alert if I miss a log from an endpoint from a server. Since the ingestion API monitoring is not granular enough to get this info, I planned to create a dedicated Yara-L rule for the said server. The rule I had planned for looked something like this:    rule silentLogFromCriticalEndpoint { meta: author = "Srijan Kafle" description = "Detects missing logs from server" severity = "MEDIUM" created = "2024-06-03" events: $session.principal.namespace = "prodSydney" and $session.principal.hostname = "redacted" $source = $session.principal.hostname $tenant = $session.principal.namespace match: $source,$tenant over 12h outcome: $risk_score = 3 // logic to check delay here which is not working $delay = $session.metadata.event_timestamp - timestamp.current_seconds() condition: $session and $delay >= xyz }  line 23 and 26 not a working line currently but wanted to includ

I'm working with data tables in a SecOps SIEM, where the goal is to evaluate incoming log data against records in the data table. The relevant fields are:Data Table:Logic:%DL_Anomali_High_Critical_Severity_IP_v1.target_ip = $ip$e.principal.ip = %DL_Anomali_High_Critical_Severity_IP_v1.principal_ip$e.metadata.log_type = %DL_Anomali_High_Critical_Severity_IP_v1.log_typeSample Log Data:principal.ip= [removed by moderator]target.ip = [removed by moderator]log_type = PAN_PANORAMA--------------------------------------------------------------------------------------------------------------------------------------------------------------------Existing Behavior:Currently, if the log data exactly matches a row (for example, row 5 in the table above), the rule is triggered.Desired Requirement:I need the opposite behavior:If all log values for target.ip, principal.ip, and log_type match a single row in the data table, the rule should NOT trigger. If even one value does not match (i.e., only partia

Hello.I submitted this question to Google Cloud's contact form, but the quote was avoided, so I'm posting it here.I apologize for the inconvenience, but could you please confirm the following?I'm currently using reCAPTCHA with a free quotation of 10,000 instances on a site I manage.I would like to use the same free quota on other sites, so I plan to create a project and billing account on Google Cloud Platform for each site on which I will implement reCAPTCHA.I just want to confirm: if I create billing accounts with the same credit card, will the free quota for reCAPTCHA be separate for each billing account?Also, will the billing information be separate?Thank you for your support.

This week we released Custom Fields - a new Case Management feature that allows you to extend the cases and alerts. Full guide is available under adoption guides - here.

In another thread my organization got a great solution for MTTX calculations in dashboards using new mutli-stage yara-l capabilities.Now we are trying to apply this for a more advanced MTTX metric.  We are calculating an MTTR (Mean Time to Resolve) metric, but *if* the case was set to a “paused case stage” for a duration, we want to subtract that duration in the metric.  It seems like this should be 2 additional yara-l stages: one for the pause event and one for the unpause event.  But not all cases pause, so joining these stages in the root seems to ruin the logic.  Furthermore, logic to ensure that the stages happen in the right order needs to be added in, e.g., The “pause” event must happen before the “unpause” event.Is it possible with the current release to construct this metric with the optional stages?

Hello!I have a rule that round a value, but when I put the rule in the rule editor I have the following error: “parsing: function math.round not found line: 29 column: 22-32” The rule that I’m trying to create is:   events:    $e.metadata.log_type =$log_type    $e.metadata.event_timestamp.seconds =$log_time   match:    $log_type over 60m   outcome:  $last_event_timestamp = max($log_time)  $min_event_timestamp = min($log_time)  $now_ts = timestamp.now()  $diferenca= $now_ts-$last_event_timestamp  $time_in_minutes = math.round($diferenca/60)  $date_event_first = timestamp.get_timestamp( $min_event_timestamp,"SECOND", "GMT")  $date_event_last = timestamp.get_timestamp( $last_event_timestamp,"SECOND", "GMT")  $date_event_now = timestamp.get_timestamp( $now_ts,"SECOND", "GMT")   condition:  $e and $time_in_minutes > 55

Hi All,I wanted to check if it’s possible to use role-based authentication for the AWS SOAR integration. Currently, it seems to only support authentication using an access key and secret key.In my case, the access key and secret key keep changing frequently, which creates challenges. Has anyone discovered a way to implement role-based authentication for this integration?

Hey. I'm trying to use the Google Chronicle Security Operations standard Cases API (`v1alpha/cases`), but I consistently get a `500 Internal Server Error` with the message **"there is an empty key in the header"**. However, the legacy API (`legacy:legacyBatchGetCases`) works perfectly with the exact same authentication and headers.Has anyone successfully used the standard Cases API? What am I missing? What Works (Legacy API)https://cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.legacy/legacyBatchGetCases?rep_location=uscurl -H "Authorization: Bearer ${TOKEN}" \"https://chronicle.us.rep.googleapis.com/v1alpha/projects/{project}/locations/us/instances/{instance}/legacy:legacyBatchGetCases?names=" Response:{"cases": []}✅ Success! Status 200 What Doesn't Work (Standard API) This fails with 500 error:curl -H "Authorization: Bearer ${TOKEN}" \"https://chronicle.us.rep.googleapis.com/v1alpha/projects/{project}/locations/us/instances/{instance}/cases" Respo

Hello Team,We’re currently performing a MITRE ATT&CK analysis for the curated detections using the MITRE ATT&CK Matrix dashboard.While the dashboard makes it easy to see how many rules exist per technique, identifying each rule’s corresponding rule name, rule set, and category is quite challenging — I have to review them individually. For techniques with a large number of rules, this becomes very time-consuming.I’m focusing only on curated rules, and it seems that the Ruleset dashboard doesn’t support MITRE queries — the mapping appears to be available only in the rules field, which doesn’t seem to work for curated content.Is there any way to generate a sheet like the example snippet below directly from the dashboard or through any other approach/tool?Thanks in advance for your help!​@jstoner 

Now that multi-stage queries are available as pre-GA, is it possible to create a dashboard KPI for MTTX using case_history data? An easy example would be a measure of the avg time cases were in Triage before going to Investigation.My organization has been trying various yara-l approaches but to no avail.  The examples in the multi-stage documentation do not seem to be related to this type of use case. Thanks