Recently active topics

why is there no procedure clear for users with adversarial google LLM persistent harm

why is there no procedure clear for users with adversarial google LLM persistent harm

Clicking the “Create” button when submitting a new post results in some form of status message.  Maybe it says “Your post has been submitted”.  Maybe it says something about adding tags.  Maybe it says something about duplicate posts. … How about making that status message more visible?  Maybe add it somewhere… I don’t know… even close to the button used to submit the post?  Currently, the window just scrolls up slightly and it’s hidden in a sea of other text using the same font/color.  Super easy to miss if you rarely have time to use the forums.

We successfully established HTTPS log forwarding profiles within Palo Alto Strata Logging Service last year using https://malachiteingestion-pa.googleapis.com/v2/unstructuredlogentries:batchCreate.  Although these profiles continue to forward logs to our SecOps environment, we can no longer manage the profile within Strata due to the following error that follows when testing the connection:  This wasn’t an issue when the forwarding profiles were established and it certainly wasn’t an issue the many times we made adjustments to the profiles throughout last year.  It’s probably been 4-6 months since we last touched these profiles, so it’s unclear when this behavior started. I also noticed SSL Labs is having issues obtaining detail for malachiteingestion-pa.googleapis.com.  Not sure if this is the expected behavior, but figured it was worth mentioning. I have a support case open with Palo first, but figured I’d ask here as well before opening a Google support case.

Hello all,Can GTI be used to determine whether a certain IP or domain is linked to bulletproof hosting or commercial VPN services?Alternatively, is it possible to enrich IPs or domains with any ports or services being run/open on them? Akin to what this Microsoft endpoint would do - https://learn.microsoft.com/en-us/graph/api/resources/security-hostport?view=graph-rest-1.0

Hello Team, We are trying to connect palo alto SLS with secops instance. But when test the connection from SLS side we are getting error “ connection to server failed due to incomplete CA chain unable to find valid certificates path to requested target” We tried all different combinations of certificates provided by google.  Is chain getting corrupted or something else is missed ? Any help would be appreciated

Create and Share Your Security Gemini Gems We're launching a new Community challenge, and this time you not only have a chance to win Google swag, but to also be featured on the Google Cloud Security podcast with Anton Chuvakin and Timothy Peacock. The goal is simple: create and share a Gemini Gem that streamlines security tasks and saves you time. How to Participate:We are looking for creativity and utility.1. Design a Gemini Gem that solves a specific security problem. Crucially, DO NOT put corporate sensitive data in your Gems! 2. Share your submission in the comments below and include the following:    A link to your Gem. Learn about sharing Gems here.     Who it is for (e.g., SOC analyst, CISO, Compliance Manager).     A clear explanation of how to use it and the the value you derive from it (saves time, reduces risk, makes tasks easy, etc) 3. Determining the winner:The post with the most likes in the comment section below will win. Make sure to like your favorite responses to hel

Hello Google reCAPTCHA Support Team,We are urgently reaching out because we have exhausted every possible solution recommended by Google documentation, AI tools, and our hosting provider, and nothing has resolved our issue. We need your direct assistance.━━━━━━━━━━━━━━━━━━━━━━WHAT EXACTLY IS HAPPENING━━━━━━━━━━━━━━━━━━━━━━Every single time ANY visitor loads ANY page on our websites, a reCAPTCHA verification spinner appears on the screen. This happens:• On the very first page load• On every subsequent page load• For every single visitor from any country• On ALL pages — homepage, product pages, course pages, checkout, everywhere• On both of our websites simultaneously• Even after the visitor has already passed verification on a previous pageThe spinner appears, runs for 1-3 seconds, then disappears and the page loads. It happens on EVERY page, EVERY time, for EVERY visitor without exception. This is not a one-time check — it repeats on every single page navigation.WHEN IT STARTED━━━━━━━━

Hi! Previously, as per the FAQs, we were able to hide the reCAPTCHA badge on the site, so long as we referenced the branding in the user flow. Now that any references to Google’s Privacy Policy and Terms and Conditions need to be removed, do we need to display the badge at all times?   

Hi. Related to Switching Google’s role with reCAPTCHA from Data Controller to Data ProcessorI’m using Google recaptcha v2 with checkbox, so after 2 April, 2026, the badge with text Privacy - Terms will be removed from UI like this. is it right? Thank you for your supporting 

Hi Team, We have a Intune feed setup in our google chronicle siem but its not working event after we have configured the api key and token properly it is giving the below error while we try updating the client secret.are there any additional permissions needed from entra side ? or we need to look at some other settings? could you please help to sort this out and what exactly we need to do over here to troubleshoot this furthur. 

Hi everyone, I’m running into a persistent issue with my Google SOAR Remote Agent and could use some insight.The Setup: Environment: Remote Agent running inside a Podman container on a Google Cloud (GCP) VM. Status: The agent shows as "Live" in the SOAR Console, confirming that the outbound heartbeat/registration is successful. The Problem: Whenever I attempt to add or save an integration instance in the SOAR UI, the action fails with a "Service Unavailable" error in the console.What I have confirmed so far: Network connectivity from inside the Podman container to the SOAR Publisher endpoint is working (verified via curl). The agent is successfully heartbeating (it appears "Live").  Has anyone experienced this error with Podman- What should be the next steps for troubleshooting?

HI, we have salesforce shield licence and I am configuring event logs ingestion to google chronicle. My question is which events google chronicle will pull after configuration. Do we need to have event data streaming option enabled for each of the event type defined in the event manger?    

I have question does No captcha requests counted with (checkbox and image ) assessments monthly? As per google announcement  if we exceed 10,000 request then we have to pay 8$ to get extra 100,000 requests. As my website have a most of requests as No captcha, so do i have to enable billing to avoid errors or No captcha requests are excluded from assessmnets count ?  One more question does recaptcha detects automation tools or stress tests on form thus it will exceed 10,000 assessments if stress tests applied  ?  

Hello,Is there any options to show pending action to user with dynamic field inside?I know how to create IDE that will prompt user with plaintext, same as Flow > Instruction. But is there any option to prompt user with something dynamic? Even as a text field where he can just go “ok”.Purpose - to not force user to go to wall to look for answer of some regular actions.Example - Playbook get information about IP and instead of post insight it will provide another pending action prompt that when you click respond it will have output from that previous gathering action listed.Looking forward to suggestions.

ObjectiveSecurity operations (SecOps) teams use pattern-matching rules in security event logs for detection. Integrating external threat intelligence, especially Indicators of Compromise (IoC) feeds containing malicious IPs, domains, file hashes, and URLs, significantly enhances these rules. Combining IoC data with behavioral events in SIEM and security analytics platforms allows for proactive threat identification and faster, more accurate responses, shifting from reactive to anticipatory security. Key considerations for leveraging IoC feeds include selecting reputable sources, normalizing and integrating data, and developing correlation logic with behavioral indicators. This approach empowers impactful Google Security Operations’ rules using threat intelligence.The subsequent sections will delve deeper into these aspects, providing practical guidance on creating impactful SecOps rules that harness the power of threat intelligence. IoC Feeds in the SecOps EnvironmentGoogle Security Op

I am using workload identity for Chronicle api integration, I am getting error” unable to acquire impersonated credentials” . I think the issue is in adding the Principal. I am not sure what Principal needs to be added and how I can find it from scratch. I am not getting the principal in the error log also while testing the instance. Please help me with the steps how and which principal I can use and resolve the issue.Thanks in advance :)

This is more of an awareness post from a lesson learned and a request to probably update the documentation for Retrohunt and a feature request on the SecOps UI.Context:We have a noisy Alerting rule that looks at allowed network traffic from one source IP towards x number of distinct destination IPs within a minute. Today, I made several changes to more appropriately reflect the intent of the said rule. As best practice, I always test rules via “Test Rule” in Rules Editor. So far so good, no results in the last ~2 weeks. And for good measure (or so I thought), I ran a Retrohunt for the rule from a start date of Sept 01, 2025 until today. Result shows 400+ detections, with last detection on Feb 24, 2026. I have ran several Retrohunts before, but in retrospect, this was the first time I ran it on a rule that was already set to Alerting. Lo and behold, we got flooded with 60+ cases from that single rule, including Overflow cases. My own investigation pointed showed events from weeks and mo

We are excited to announce that reCAPTCHA is switching from a “data controller” offering to a “data processor” offering on April 2, 2026 and will begin processing reCAPTCHA data in alignment with other Google Cloud services. With this switch, customers deploying reCAPTCHA on their websites will become data controllers, determining the purpose and means of processing their users’ personal data, while  Google will become a data processor, processing the data collected on our customers' websites as instructed by our customers.   What is changing?  To effectuate this switch, we are updating our Google Cloud Platform Service Specific Terms that govern the use of reCAPTCHA. A customer’s users accessing reCAPTCHA-protected websites will no longer be subjected to Google’s Privacy Policy and Terms of Use, and Google will remove those references from the reCAPTCHA badge used in customer deployments. reCAPTCHA will process data gathered at customer websites in accordance with our Cloud Data Proce

Using Log Manager & The Alerting Platform I’ve noticed over the past year or so continuous enumeration and penetration attack attempts from anonymous sources.   These commonly show up as unauthenticated API calls e.g. `storage.objects.list`, `storage.buckets.get` with known bucket names, “Docker-HeadManifest” (to enumerate artifact registry), IAM GetProject, IAM GetResourceBillingInfo to enumerate project names, billing accounts etc.Ideally I would like to immediately block this traffic and have the ability to automatically detect and block anomalies like this.My Attempts to Fix this:Followed best practices e.g. no SA keys, RBAC, continuous audits, alerting on the attack attempts Reported the issue to Google Cloud Platform -- I was told it wasn’t a support issue Reported frequent IPs using the Abuse contact at the Source IP ISP provider (discovered via WHOIS) Questions for the Community Do other customers see anonymous enumeration attacks like these in their logs? What other defens

Hey all,Has anyone faced issues ingesting Salesforce logs into Google SecOps using the OAuth JWT grant method?We’re currently seeing authentication failures when configuring the feed using JWT (all required credentials provided as per Google documentation).When switching to OAuth Password Grant, the configuration fails with:No such column 'Interval' on entity 'EventLogFile'From our research, the Interval field appears to require Salesforce Shield / Event Monitoring, but the customer only has Salesforce Enterprise Edition. The Google documentation mentions Enterprise and above should be sufficient.Just checking: Is Shield/Event Monitoring mandatory for this integration? Has anyone successfully used JWT grant without Shield? Any common causes for JWT authentication failure in this setup? Appreciate any insights 🙏Thanks!

Hi Team,In one of my widget query i was referencing a data table and i can see the required output.This is my  dashboard widget query,metadata.log_type = /Fortinet/ nocase principal.ip != ""target.ip != "" not principal.ip in %Private_IP_Ranges.cidr  match:  security_result.action,principal.ip,principal.port,principal.ip_geo_artifact.location.country_or_region,target.ip,target.port,target.ip_geo_artifact.location.country_or_region,target.application,network.sent_bytes,network.received_bytes outcome:  $event_time = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T", "GMT") limit:    10000after saving the query when i try to apply global filter i am unable to select my widget (it is greyed out) But when i dont reference a data table in the query i am able to add filter.Just wondering if it is  a limitation that dashboards has ? 

Hi everyone,I work for an MSSP, and we are currently trying to build a workflow to extract a section of the inventory of Google SecOps Curated Rules. Our goal is to map our clients' detection coverage (for example, extracting all curated detections monitoring their AWS CloudTrail logs) and show them the active MITRE coverage, regardless of whether a rule has fired an alert yet.I've been using the Python secops-wrapper SDK, basing my code on this section of the documentation.Initially, I called the chronicle.list_curated_rules(as_list=True) method expecting it to return the full catalog of 1500+ curated detections. However, I encountered a very specific and limited behavior. Here is my troubleshooting journey: The Pagination Theory: On my first tenant, the script extracted exactly 161 rules and stopped. I initially thought I was misusing the pagination or hitting a rate limit. However, when I ran the exact same script on a different tenant, it returned a completely different number of r

Are you new to Chronicle or SecOps or SIEM? If you answered yes to any of those, this series is for you! When I started at Google in May, I had spent a good portion of my career working with SIEMs and MSSPs like Symantec, ArcSight and Splunk. However, I know from experience that different platforms have different capabilities and different ways to do build content, conduct investigations and hunt. So, this series is designed to provide some insight into how you can use Chronicle to effectively build rules, conduct searches and much much more. You can find the series at https://chronicle.security/blog/?filters=new-to-chronicle-series, we are at eight posts and growing. In fact, today we released a new blog around the improved search capabilities around UDM data. You can find the blog at https://chronicle.security/blog/posts/new-to-chronicle-a-new-view-for-search/ Stay tuned, there is more to come!

Hi all,I'm experiencing an issue with predefined widgets in a custom action integration. The CSS and JavaScript are not rendering correctly, but the same code works fine in existing widgets. I've confirmed that a noscript tag renders successfully, suggesting a policy is restricting JS execution. The CSS is also not being applied. Any insights on what might be causing this discrepancy would be helpful.Non rendering widget Rendering Widget with same html/cssSource of the non rendering widgetSource of rendering widget