Recently active topics

Hi Team, Need help in one automation, i just want to know whether we can able to add values or data from google sec ops soar to Splunk lookup csv file with out using IDE?

Hi Team, Need help in one automation, i just want to know whether we can able to add values or data from google sec ops soar to Splunk lookup csv file with out using IDE?

I know one way to get a UDM search running on a schedule is to convert it into a YARA-L detection rule, which then runs automatically based on the rule's run frequency. But for use cases where I just want a plain search to run every morning (or every hour , etc) and get the results in an alert for example, is there a native option in the platform to do such a thing?

I know one way to get a UDM search running on a schedule is to convert it into a YARA-L detection rule, which then runs automatically based on the rule's run frequency. But for use cases where I just want a plain search to run every morning (or every hour , etc) and get the results in an alert for example, is there a native option in the platform to do such a thing?

Getting error while publishing Terraform Kubernetes App. on GCP marketplace.{ "taskReports": [ { "taskType": "EXECUTE_TERRAFORM_PLAN", "taskExecutionStatus": "ISSUES_FOUND", "digest": "Failed to execute terraform plan for some versions.", "errorMessage": "Error validating Terraform zip: Marketplace UI deployments must declare a variable 'goog_cm_deployment_name'. This variable specifies the name of the deployment, and should be used to avoid resource name collisions across deployments\n" } ]}Possible solutions I have tried:I have changed variable.tf file to include variable:variable "goog_cm_deployment_name" { description = "Name of the Google Cloud Marketplace deployment. Auto-populated by the Marketplace UI." type = string}Added below in metadata.yaml file:interfaces: variables: # ---- GCP / cluster --------------------------------------------------- - name: goog_cm_deployment_name description: The name of the deployment.

Hi,I'm a developer who set up reCAPTCHA keys for a client's  300 websites, and I'm trying to fully remove myself as an owner. I've hit a dead end created by the migration and need your help.Here's what happened, in order:1. I first tried to transfer/manage ownership of the keys in the classic admin console (google.com/recaptcha/admin), but the owner controls were greyed out, with this message:"Use Cloud IAM policies to manage key owners. You can remove owners until only one remains here. For more information, see Access control with IAM (https://docs.cloud.google.com/recaptcha/docs/access-control)."2. Following that instruction, I migrated the keys to the client's Google Cloud project and used Cloud IAM to transfer ownership to the client, then removed my own IAM role from the project.3. But my Google account  is still listed as the sole legacy owner of these keys in the CLASSIC console (google.com/recaptcha/admin). Per that same message, the console only lets me "remove owners until o

Hello Google Cloud Team and Community,I am writing to request a review of my suspended project (ID: repairbill-erp- [removed by moderator] ), which was flagged for a policy violation (CONSUMER_SUSPENDED).The Issue: I have identified the root cause of the suspension: an API key was accidentally included in a public GitHub repository during the early development phase of my small business ERP.Corrective Actions Taken:Credential Rotation: I have already deleted the compromised keys and generated new, restricted keys with strict domain-level security (repairbill.shop/*). Repository Scrubbing: The GitHub repository has been thoroughly scrubbed of all historical traces of the leaked keys using git filter-repo and the history has been rewritten. Infrastructure Security: I have migrated the application to a dedicated VPS and implemented environment variable security to ensure no sensitive data is ever stored in the code again.Appeal Details:Appeal ID: [removed by moderator] Project Name: repa

Hi everyone,While designing scalable cloud environments and handling continuous data workflows, maintaining strict security controls around API endpoints and background processing tasks is essential. Implementing least-privilege access and optimizing payload validation helps prevent unauthorized data exposure during high-frequency requests.I wanted to open a discussion to see how other engineers approach this: What security measures do you usually prioritize when securing real-time microservices or background processing pipelines? Are there specific logging or monitoring configurations you rely on to detect unusual traffic spikes early? Would love to hear your insights and recommended security frameworks.

Hi,I have created a data table by the following steps 1.Create data table then i have entered the name 2.Import file → CSV file was uploaded 3.Configure Columns -→ primary key was set While i am referencing the column in Rule it is not working.This was in the data table I have added the below line. It was not taking the column field . not ($e.target.resource.attribute.labels["res_metadata_namespace"] in %test1.namespace )namespace gke-managed-cim gke-managed-networking-dra-driver gke-managed-system gke-managed-volumepopulator

I'm currently testing an application hosted on Google Cloud, and I'm running into a security validation issue that I can't explain. The OAuth consent screen has been configured, the authorized redirect URIs are correct, and all required scopes have been reviewed. However, every time I attempt the validation process, it reports a generic security validation failure without identifying which specific requirement is not being met.I have already verified that the domain ownership is confirmed through Search Console, HTTPS is properly configured with a valid SSL certificate, and the privacy policy and terms pages are publicly accessible. I've also tested the application using different Google accounts and browsers, cleared caches, and even recreated the OAuth credentials, but the validation result remains the same.Has anyone experienced a similar issue where the security validation fails even though the project appears to meet all documented requirements? I'm mainly looking for guidance on

I was referring to this doc for migrating legacy API to chronicle API.https://docs.cloud.google.com/chronicle/docs/administration/migrate-from-legacy-api-to-chronicle-apiIs this belowauthorization scope also needs to be migrated? as above document don’t have it. But ,ost of the ingestion scripts use it for initializing http session for ingesting data in SecOps.AUTHORIZATION_SCOPES = ["https://www.googleapis.com/auth/malachite-ingestion"]https://docs.cloud.google.com/chronicle/docs/reference/ingestion-api

How to extract and schedule reports for any particular widget within a dashboard?I see option only available for entire dashboard can be exported as a report rather a particular widget/stats within the dashboard. Please advise.

Hey Community! You may have seen a new event added to our incredible list of upcoming enablement opportunities.One I would like to highlight is something built specifically for you. SecOps SIEMposium 2026 is coming to San Diego this October. There have been a lot of requests for more hands-on training, more focus on SecOps best practices, more help adopting new features as they ship. This inspired SIEMposium! It's a first-of-its-kind technical conference and training week focused entirely on Google SecOps.The formatThis is a three days hands-on Master Classes taught by experienced SecOps instructors, followed by a full conference day of keynotes and lessons learned from the trenches. No expo hall, no booth crawl, no vendor bingo.Parse & Recreation (Oct 5) — Hands-on learning and practice across all aspects of parsing: extensions, custom parsers, UDM, Entity Data Model & Enrichment, JavaScript parsing, and more.YARApalooza (Oct 6) — Build up from basic to advanced YARA-L and SQL

I’m trying to write a rule that checks the value of the “network.dns.questions.name” field, but will only trigger if the value is NOT in a data table using regex matching instead of a static value.Assuming I have a data table named dns_tunnel_list with below values:domain_names  <« column headerexample.invaliddoes-not-exist.example.comgoogleapis.commetadata.google.internal I cannot seem to get right a UDM search query that will ignore values from the above table with a query like below, for example: metadata.log_type = "GCP_DNS"metadata.event_type = "NETWORK_DNS"not network.dns.questions.name in regex %dns_tunnel_list.domain_names Similarly, for a rule such as below:rule LOG_SECOPS_005_dns_newly_seen_domain_v2 { meta: (snip) version = "1.0" events: $dns.metadata.log_type = "GCP_DNS" $dns.metadata.event_type = "NETWORK_DNS" $querying_ip = $dns.principal.ip $query_name = $dns.network.dns.questions.name not $query_name in regex %dns_tunnel_list.domai

I am getting below error while validating my terraform kubernetes app. Can any on ehelm what is the issue?{  "taskReports": [    {      "taskType": "EXECUTE_TERRAFORM_PLAN",      "taskExecutionStatus": "ISSUES_FOUND",      "digest": "Unable to start verification.",      "errorMessage": "Failed to process container images from schema file: Unexpected response.\nHeaders:\nHTTP/1.1 400 Bad Request\r\nContent-Type: application/json; charset=utf-8\r\ndocker-distribution-api-version: registry/2.0\r\nServer: Docker Registry\r\nVary: Accept-Encoding\r\nX-Content-Type-Options: nosniff\r\nX-Frame-Options: SAMEORIGIN\r\nx-gcr-using-artifact-registry: true\r\nx-google-artifactregistry-docker-imageref: us-docker.pkg.dev/cloud-launcher-images-prd/gcr.io/crestdata-public/test-app/test-app:1.0\r\nx-google-gfe-cloud-project-number: 720804119614\r\nX-Google-GFE-Backend-Request-Cost: 48.89476869076971\r\nX-Google-Security-Signals: FRAMEWORK=GOA\r\nX-Google-Security-Signals: ACTION=GOA_ACTION,ENV=borg,ENV

I have few questions about submission process for the SecOps SIEM custom integration:Can I publish my SecOps SIEM custom integration in Content Hub? It is containing these componants: Ingestion Script Dashboard Detection Rules Search Queries Is there any public repository to submit these componants or any of them as part of content hub?

Hi,How can I update datatable values from an external source, one of the uses that we want to implement is keep a updated JA3 list, we can update this list from an external resource, via http, It is possible to autoupdate a datatable from an external .csv downloadable resource?The main idea is check with the https source if there’s any row addition/deletion/update and automatically perform the changes in the datatable. Best regards.

Authors:Olu Akinrolabu, Security Cloud ConsultantUtkarsh Bhardwaj,  Technical Solutions Consultant INTRODUCTIONAs enterprises race to deploy autonomous agents utilizing Large Language Models (LLMs) like Gemini, they transition from static retrieval systems to active, tool-wielding digital employees. This shift unlocks incredible productivity, but it exposes a critical surface vulnerability: Indirect Prompt Injection.Unlike direct injections (where a malicious user actively inputs a "jailbreak"), indirect prompt injection occurs when an LLM or autonomous agent processes untrusted data fetched dynamically from an external source—such as a file in Google Drive, a Slack message, or a third-party SaaS tool—and that data contains hidden instructions designed to hijack the model's logic.This article explores how to architect a defense-in-depth security model using GCP-native primitives—specifically Model Armor. We will contrast two technical implementation scenarios to illustrate the necessit

Hi everyone,We are working on integrating Google SecOps SOAR with an external application security platform, and wanted to validate our approach as well as explore better alternatives.Use Case1. Incident Sync (Bi-directional)Sync status and comments: From SecOps SOAR → external platform From external platform → SecOps SOAR Current ApproachUsing a scheduled job (polling) to: Fetch updates from both systems Compare changes Push updates accordingly QuestionsArchitecture Validation Is a polling-based approach considered acceptable for this use case? Or is any other approach recommended? Webhook Capabilities in SecOps SOAR Are there limitations on which fields can be mapped via webhook? Is it possible to map custom fields (status, comments, metadata)? Is there any reference for the list of fields. Comments / Notes Mapping In SecOps SOAR alerts, which field is best suited to store external comments/notes? Is there a recommended standard field (e.g., notes, activity log)?

Since we can now change the deployment state of individual curated rules, I expected to read (GET) the same information using one of the following endpoints:https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.rules.deployments/list - this returns deployment state for custom rules only; https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.rules/getDeployment - this returns 404s when tried on curated rule IDs.Any guidance on how to GET there? 😁

Hi Fraud Defense team, Starting 2026-07-17 (zero occurrences before that date), legitimate desktopChrome 150 users on our site began receiving very low reCAPTCHA Enterprisescores (0.1-0.3) with reason code UNEXPECTED_ENVIRONMENT on our sign-inaction, blocking them from logging in. Tokens are fully valid and the actionmatches the expected action -- only the risk score collapsed. Setup: web score-based site key (v3-style), server-side assessments via thereCAPTCHA Enterprise API. Users are mostly in Taiwan on residential ISPs. Evidence that this is browser-version-specific(rejected vs. allowed-with-low-score counts, same site key and threshold,last 2 days):- Chrome 150 desktop: 306 rejected / 22 allowed- Chrome 149 desktop: 2 rejected / 23 allowed- Edge (Chromium 150): 1 rejected / 4 allowed Daily rejected count for Chrome 150: 0 (before Jul 17) -> 98 (Jul 17) ->113 (Jul 18) -> 180 (Jul 19), still rising. Chrome 150 had already beenrolled out for about two weeks before Jul 17, so

Author: Christopher Frost, Adoption Engineer, Security, Google Cloud There is an old survival adage that when a grizzly bear charges, you don’t have to outrun the bear—you just have to outrun the person running next to you. In the world of automated bot and fraud defense, that isn't just a quaint saying; it is the fundamental economic reality of how attackers operate.Cybercriminals don't attack your infrastructure out of ideological malice. They run automated businesses driven by strict Return on Investment (ROI) and conversion metrics. Every residential proxy rotation, CAPTCHA solver API call, and headless browser instance has a concrete line-item cost on their balance sheet. When your implementation raises their cost-per-attempt even slightly above industry baselines, their ROI flips into the red. They stop wasting resources on your endpoints and move on to an easier target.The problem is that too many organizations approach bot defense as a superficial procurement checkbox. They buy

Hello,My Google Cloud project has been suspended due to a security issue (ACCOUNT_HIJACKED).I fully understand the situation and I am ready to take all necessary actions to secure the project. However, I currently do not have access to the project anymore, which prevents me from revoking the compromised API keys or applying the required fixes.As a precaution, I have already stopped billing to prevent any further charges.At the moment, my application is completely down, which is having a severe impact on my business. My clients cannot access the service, and I am receiving increasing complaints and refund requests.I already have an open support case: 70327888This situation is becoming critical, and I would greatly appreciate any help to restore access or guidance on how I can proceed to secure the project.Thank you very much in advance for your support.Vincent

Project id: project-5580276092549813950My project got suspended 5. april, due to misuse of some keys.I have filed an appeal, taking actions on how to prevent this from happening again. But I do not get any response at all.Now observing users are dropping off, users not able to sign on, complaining. It is very devastating to observe, years of developing an app for dog owners. It is very critical.  Actions Taken:• Removed exposed API keys from all repositories and application code• Ensured that no API keys or credentials are publicly accessible• Reviewed all Git repositories and verified that sensitive credentials are no longer present• Updated development practices to prevent API keys from being embedded in client-side applications• Planned migration of all Gemini API requests from client-side usage to a secure backend service• Implemented safeguards to ensure that future API usage is authenticated and controlled• Preparing to rotate all API keys and service account credentials immediat