Recently active topics

Hi All, I am testing the Microsoft 365 Defender (XDR) Integration v26.0 and have observed the following which when looking at the documentation seems to be by design. Scenario 1Event triggered and “Incident 1” created in XDR Event triggered and “Incident 2” created in XDR Both incidents and their associated alerts are ingested into the SOAR and created: Case 1 with the name “Incident 1” Case 2 with the name “Incident 2” XDR then correlated Incidents 1 & 2 and based on a rule and renamed “Incident 1” to “Suspicious activity on one endpoint”  moved the alert from “Incident 2” to “Incident 1” and closed “Incident 2” The Sync Job in SOAR attached all alerts to Case 1 but left the Case name as “Incident 1” The SOAR Case “Incident 2” was left open along with it’s associated AlertScenario 2Event triggered and “Incident 1” created in XDR Event triggered and “Incident 2” created in XDR “Incident 1” ingested into SOAR and a Case created with the same name “Incident 1”  Before Ingestion of “I

Hello,Has anyone successfully created a simulated case using the API?I'm trying to use the following documentation:https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.legacyCases/simulateAlertHowever, I'm running into some issues. The API call reaches the CreateSimulatedCustomCase method, and the audit logs show that the service account is recognized and has the chronicle.legacyCases.simulate permission. Despite that, the request fails with the following error:Request is missing required authentication credential. Expected OAuth 2 access token, login cookie or other valid authentication credential.I'm authenticating with a Service Account using the cloud-platform scope, and the same token works successfully with other Chronicle APIs.Has anyone encountered this before or managed to create simulated cases through the API?Thanks!

Hello, team I’d like to understand the delay between when a case is created and when it’s detected. All cases based on CrowdStrike have a delay of 1 to 2 hours before the alert is generated. Can this time be adjusted? Why does this only happen with CrowdStrike? We have two SecOps consoles with different environments, and this delay only occurs on one of them; both have the same collection permissions.  

Hello everyone,I'm trying to build a Google SecOps SOAR integration with Freshdesk using HTTPv2.My goal is to automatically create a Freshdesk ticket when a case is moved to either:Investigation ResearchI created an Alert Playbook with a Custom Trigger configured as: [Case.Stage] = InvestigationOR[Case.Stage] = Research The playbook contains a simple HTTPv2 action that should create a ticket in Freshdesk.The playbook is enabled and saved. I also verified that the case stage is successfully changed, for example:"Case stage set to Investigation"However, the playbook never executes when the case stage changes.From the documentation and community posts, I understand that Alert Playbooks can access Case fields (Case.Stage, Case.Name, Case.Tags, etc.), but I'm not sure whether a Case Stage change is actually considered a trigger event for an Alert Playbook.My questions are:Can an Alert Playbook be triggered directly by a Case Stage change? Is a Case Stage change only evaluated when a new ale

Hello team, Is it possible to use UDM filters to filter the events that triggered a rule?In QRadar, you can apply this type of filter to determine which event actually triggered the rule, and I’d like to know if SecOps has the same search mechanism, since we use this data to create a report.Regards,Renato Ferreira​​​​​​​

This release note outlines the latest updates, enhancements, and bug fixes for the Mandiant SecOps Integrations (MSI) service.EnhancementsTrend Micro Vision One v1: Exposed the Alert Field Mapping configuration in the web interface, allowing users to customize which fields are used for alert data. Default mappings are still provided. Enabled support for SSL certificate authentication for the following integrations: Exabeam Cloud v1 Splunk v1 Splunk v2 Added titles to the default queries for the following integrations: Google BigQuery v1 Logzilla v1 Microsoft Defender ATP v1 Security Onion v1 Trellix Enterprise Security Manager v2 Trellix Enterprise Security Manager v1 Trellix Helix v1 Bug fixesCybereason v1: Fixed an issue where Default Malware Queries were not displaying, which prevented the integration from being saved. This was due to incorrect model typing for the malware queries field. Google Cloud Logging v1: Fixed an AttributeError that occurred during health checks whe

Hi,Could anyone help me to fetch alert detections (custom as well as curated) of a specific entity from case using UDM Search Query and REST API?So that I can display it on the case overview.  

In our last blog, we reviewed how users could set row based expirations using a time to live (TTL) value in data tables and applied this to a rule based example. These concepts can also be applied to dashboards and searches. Everything we did last time was using the UI and as I was writing that blog, I realized that some readers might like to explore TTLs beyond the UI, and see how we could work with these values via the API. So, I decided to write this follow-on that takes a look at TTLs and data tables but uses the API. My intent is to provide you some insight and some curl commands that you can take and apply to your own environments to work with TTLs via the APIs if you wish. In the blog titled Creating Large Reference Datasets and Using Them In Rules, I shared how you can load a data table via the API. We also have previously discussed writing data into data tables using search and rules with the write_row function, so if you need a refresher on getting data into the data table be

We are configuring remote agents for the SOAR to communicate internally to our tools. We have successfully deployed the remote agents (docker) and they are showing "Lived" status on the web ui.However, during the integration configuration, when we check "run remotely" and select the remote agent, we are unable to save the config. It's showing error "An error occurred while saving instance configuration". We configured everything as the documentation indicated including the service account mapping. The remote agent container does not show any error. 

This blog post was written by guest author, Eliraz Oved.  If you spend your days in the trenches of a Security Operations Center, you already know the struggle: pivoting between screens, writing complex queries, and manually clicking through menus to create rules or check feed health.Recently, Google dropped something that has the potential to completely change this workflow: the Google SecOps MCP (Model Context Protocol) Server, which officially supports Claude.For those new to the term, think of MCP as a universal, open -source API standard that gives AI models secure, structured access to external tools and data sources. Instead of just chatting with a static knowledge base, MCP servers equip the LLM with real-world tools, allowing it to fetch live data, analyze logs, and actively execute commands against backend services.A quick note before we dive in: because MCP is an open standard, you aren't locked into a single AI ecosystem. While we are using Claude (via the Claude Code CLI)

Hello Google Community Team,My OAuth app verification is currently stuck and I need an internal engineer to manually trigger a status refresh or pass this along to the Trust & Safety team.* Project ID: dev-workrate* The Issue: The Cloud Console Verification Center shows a blocking error under "Homepage requirements" stating: "Your homepage website is not registered to you."* The Resolution: I have successfully verified full domain ownership for our production homepage via Google Search Console using this exact same Google account. The Problem: The console instructs me to "Reply to your email thread with our Trust and Safety team," but I have never received an initial email from the compliance team to reply to. Because the UI is entirely locked in the "Your branding is currently under review" state, I cannot modify fields or trigger a re-scan myself. Could a community manager please escalate this project ID to the Trust & Safety team so they can pull the fresh domain status from

Hi everyone, I have a feature proposal that I believe would greatly benefit our workflows.Every SOC team relies heavily on documentation. On any given day, we need quick access to: Playbooks and Standard Operating Procedures (SOPs) Guides and how-tos Internal systems documentation Detailed reporting for major incidents Reference lists The list goes on We all want Google SecOps to truly function as a "single pane of glass" for our analysts. Currently, forcing them to context-switch and jump between SecOps and external tools like Loop, OneNote, Confluence, or an external wiki breaks focus and disrupts the workflow.Implementing a simple, native Markdown-based wiki directly into Google SecOps seems like a straightforward solution with massive benefits. Having all security-critical documentation residing in the primary operational tool would be incredible.Imagine the potential: you could even search and automatically pull relevant internal documentation directly into specific case

Hi all,I am attempting to create a new Table chart in Native Dashboards utilizing the recently released SOAR Custom Fields feature.We are referring the Documentation: https://security.googlecloudcommunity.com/google-security-operations-2/new-feature-support-for-soar-custom-fields-in-native-dashboards-7604 I am trying to display standard case fields alongside two of our custom text fields: "Case ID" and "CID".  Per the documentation, I am using the required syntax paths: - case.custom_fields["Case ID"].string_seq.string_vals - case.custom_fields["CID"].string_seq.string_vals Whenever I attempt to run the query, the UI returns the following generic backend error: "An error occurred with your query. An unexpected error occurred. Loading Complete." We have already tried multiple troubleshooting variations to isolate the syntax, all of which fail:  Attempt 1(Using array_distinct in outcome): $case_name = case.namematch:$case_nameoutcome:$custom_case_id = array_distinct(case.custom_fields["C

Hi Google Community,We have already enabled these Google Workspace logs:WORKSPACE_ACTIVITY WORKSPACE_USERS WORKSPACE_GROUPS WORKSPACE_ALERTSWe want to understand clearly what WORKSPACE_PRIVILEGES will do differently compared to the above log sources.Main Questions:What extra things does WORKSPACE_PRIVILEGES handle that the other parsers (especially WORKSPACE_ACTIVITY) do not cover well? Can you explain the benefits of enabling WORKSPACE_PRIVILEGES? Please give some examples of logs/events: How they look in WORKSPACE_ACTIVITY (or others) How they look better / different in WORKSPACE_PRIVILEGES We want to confirm the real value before enabling it for the client.

This webinar introduces Google Cloud Fraud Defense, the next-generation evolution of reCAPTCHA Enterprise. As artificial intelligence matures, traditional security metrics (like tracking mouse movements or typing speed) are no longer enough to stop malicious actors. AI agents can now mimic human behavior with terrifying accuracy.This session covers how Google is shifting from a "gatekeeper" mindset to an "enabler" mindset—introducing intelligent, unified trust that precisely blocks automated threats and rogue AI bots while keeping the user experience completely frictionless for real human customers and authorized AI partners.What you will learn:The Rebrand from reCAPTCHA: Learn why reCAPTCHA has expanded into the comprehensive Google Cloud Fraud Defense platform to secure the entire customer journey (from signup to checkout). The Rise of the "Agentic Web": Bad actors are using cheap, industrialized AI to launch sophisticated multi-stage fraud campaigns. This webinar shows you how to fi

I speak with customers daily. A challenge many security teams face isn't just finding vulnerabilities—it is mapping those vulnerabilities to compliance frameworks in a way that satisfies both internal security teams and external auditors.The monitoring and auditing capabilities of Compliance Manager in Security Command Center can fundamentally change how you define, monitor, and enforce your cloud compliance postures. What is Compliance Manager? Compliance Manager is a native SCC capability that uses software-defined cloud controls to assess, monitor, and actively enforce compliance across your Google Cloud infrastructure. https://docs.cloud.google.com/security-command-center/docs/compliance-manager-overviewInstead of relying on disconnected compliance dashboards, Compliance Manager maps Security Health Analytics (SHA) detectors directly to specific regulatory requirements, allowing you to see exactly where your workloads stand in real time. Three Operational Modes of Cloud ControlsCom

Hi,Could anyone help me to fetch alert detections (custom as well as curated) of a specific entity from case using UDM Search Query and REST API?So that I can display it on the case overview.  

I am getting cannot import name 'extract_action_param'  & ‘extract_configuration_param’ from 'TIPCommon' error when I am testing the updated SOAR integration in staging mode for Azure Active Directory & Google Chronicle SOAR integrations. How to resolve this error?

Hi All,Anyone has performed a complete end to end implementation of multi tenancy in google secops SOAR SIEM.I need real example with implementation steps for typical GCP environment.Also if any relevant documents will be helpful

How do I automate the process to send an email alert to team if log source is not reporting.1.SOAR Dashboard: I have created a query to fetch last reported time of each log_type, but how do I trigger an email if last reporting time is greater than x hours or something?SOAR Job Script: Anyone has used this to automate this? 

I am currently testing the Microsoft 365 Defender Integration (XDR) v26.0 and have noticed that if I trigger 2 x events that create 2 x Incidents in XDR that become correlated under a new Incident Name, the new Incident Name is not reflected in Google SecOps SOAR, this seems to be by design however, I would like the case in SecOps SOAR to reflect the new Incident Name in XDR, I was thinking of utilising a KQL Query in a playbook to do this, any thoughts? Trigger an event Incident 123456 (Test Incident 1) created in XDR Trigger an event Incident 123457 (Test Incident 2) created in XDR Ingest takes place in SOAR Case 5672 created with the Name Test Incident 1 Correlation takes place in XDR Incident 123457 closed and alert moved to 123456 in XDR Incident 123456 renamed from Test Incident 1 to Suspicious Activity on Endpoint SOAR Case attaches new Alert to Case 5672 and Case name stays as Test Incident 1ThanksDaryll

Hi All,We would like to authenticate with Google SecOps MCP ( Remote MCP) using an MCP Proxy in between.  Our current setup is using Workforce Identity Federation with Microsoft Entra as IDP. Anyone who has achieved this in past or knows how this can be achieved.Our goal is to have controlled communication via central exit point (MCP Proxy Server) and use our existing SecOps user creds for users to query Google SecOps MCP.   

I want to mask my client data like phone number account number etc. Is it possible to mask these data field in Secops. If yes then kindly share the related document how it can be done. If no then kindly share any alternative for this.