Recently active topics

Has any one completed the stage 2 of SOAR migration to GCP ?Could you simply explain the pointers that you followed for the same.  

According to the official documentation, the multi-event rules capacity under the “Enterprise” license is 125 rules. However, we have noticed that in a few of our customer environments licensed under the Enterprise license, the multi-event rules quota has been increased to 200. Is this an official update? If so, why has it not been mentioned in any of the release notes or official documentation yet?  

Hi All,We have onboarded logs from multiple GCP projects using direct ingestion into SecOps.  However, the GCP projects belong to different business solutions.The objective is to tag the logs from GCP projects based on the business owner or solutions.I have read some article suggesting to use custom ingestion pipelines: Multi-Tenant Google Cloud log collection with PubSub Push | by Chris Martin (@thatsiemguy) | Medium and like the article confirmed - it’s going to incur additional cost.Please, anyone know how best to tag logs from multiple GCP projects with the existing ingestion method.Regards.

I would like to clarify one point regarding context enrichment in Google SecOps.Currently, our logs are already ingested and enriched with Azure AD context in UDM fields. As I understand, if we update Azure AD context, SecOps will ingest the updated data into the entity context, and future logs will use this updated information for enrichment.However, I would like to confirm what happens to the previously ingested logs that were already enriched using the older context. Will those historical logs get updated automatically, or will they retain the past original enrichment values. Example 1:A user’s location was initially enriched as:City = Chennai Country = USLater, the information was corrected to:Country = IndiaIn this scenario, if historical correlation is used, earlier events may continue to reflect the previously enriched country value (US), even after the correction has been made.

Guest: Matt Gregson, Principal - PwC Cyber Security   Topics: SIEM and SOCSubscribe at YouTubeSubscribe at SpotifySubscribe at Apple Podcasts Topics covered: What is the state of the art of “agentic SOC” in 2026? Can you describe the most agentic SOC you've seen so far? In your experience, what are the main measurable benefits of AI agents in a SOC and for IR? Imagine a 2030 SOC, what do humans do? How you judge if a client SOC is ready for AI and agents? What is the "Ouch" moment where most organizations realize their data isn't ready for that level of autonomy? Should we be more afraid of "AI hallucinations" or "Human fatigue" in the SOC?  If a team has an agentic teammate making its own decisions based on emergent reasoning, how do you audit its "thought process"? Everyone loves to talk about "Time Saved," but in an agentic SOC, we care about "Decision Quality." What is the one metric PwC uses to prove that a SOC agent  deployment is actually reducing risk? We often he

Hello Everyone,Greetings..!!I am trying to build a Google SecOps detection similar to a Splunk behavioral rule for “AWS provisioning activity from a previously unseen geographic region.”Current logic: Detect CloudTrail provisioning actions such as Run* and Create* Baseline source geolocation per activity eg : country,region ,ip ,city  Alert when provisioning comes from a new/unseen location The issue is with the baseline scale.The current baseline stores combinations of: source IP city country region/state Because of this, the baseline has grown to around 600,000 rows.In Splunk, this was implemented using a CSV lookup with historical tracking, but in SecOps we are limited by the Data Table size limit (~1000 rows), so the approach is not scalable as-is.I am looking for recommendations on how to create a rule that alerts on AWS CloudTrail Run* or Create* operations from a new source IP, city, country, or region.The expected behavior is:When a new IP/location combination is seen

Authors: Bhavana Bhinder, Security, Privacy and Compliance Advisor, Office of the CISORK Neelakandan, Software Quality and Solutions Lead • Engineering - HealthOdun Fadahunsi,  Senior Security, Risk and Compliance Advisor, Office of the CISO In the rapidly evolving landscape of healthcare and life sciences (HCLS), AI is no longer a theoretical concept—it’s actively identifying drug targets and assisting in radiological diagnoses. However, bringing AI into regulated GxP (Good Practice such as Good Manufacturing Practices - GMP or Good Clinical Practices - GCP)  environments introduces unique challenges. The core issue isn't just "Does it work?" but rather, "Can we prove it works consistently and safely, and do we understand the risk it introduces?". Most significantly, this requires the rigorous validation of the AI system. To answer this, we need a new conceptual model for evaluating AI risk with respect to GxP validated environments, one that looks beyond simple predictive accuracy an

Guest: Arvin Bansal, CISO, C&S Wholesale Grocers Topics: CISOSubscribe at YouTubeSubscribe at SpotifySubscribe at Apple Podcasts Topics covered: Most people do not associate grocery wholesale and retail with cutting edge technology and threat models. Can you produce the receipts for why this isn’t a story of dry goods but rather a very meaty topic with beefy adversaries?  How are you as the CISO enabling C&S’s journey into AI and LLM driven work? Securing AI is a bit harder than securing classic analytics tools, right? In addition to securely rolling out AI, how is your defense team using AI to secure C&S? Are you into the era of agentic triage and response?  What metrics for AI is your D&R lead surfacing up to you? You have AI in the business process that - if failed - will leave people hungry. How do you approach AI resilience?  How do you approach resilience in general? Is cloud part of your resilience strategy? You worked at Citigroup for a long time. What

We recently launched data processing pipelines (in Public Preview) for Google Security Operations, which provides security teams with pre-parsing control for their log ingestion. This new capability gives you granular control over your logs before they are shipped to Google SecOps for ingestion, allowing you to:Manage Cost & Reduce Noise – Automatically drop high-volume, low-value events so you only pay for the ingestion of events that are relevant to your security operations capabilities. Redact Sensitive Data – Mask or hash PII and confidential data like sensitive document names in Google Workspace logs. Accelerate Detection – Send cleaner, higher-fidelity data to Google SecOps, making it easier to find the signal in the noise.In this blog post, I’ll demonstrate how to filter and redact data from your logs leveraging data pipeline processing with Bindplane and Google SecOps. This feature is available to Enterprise and Enterprise+ customers.In my Bindplane management console, I’ve

Hi everyone,I’m currently exploring how to detect potential data exfiltration using firewall logs (FortiGate) in Google Security Operations, and I’d really appreciate some feedback from others who have worked on similar use cases.I’m noticing that a lot of legitimate traffic (e.g. Microsoft services, video streaming, web analytics, normal browsing) can generate significant outbound activity, which makes it challenging to distinguish between normal behavior and potential exfiltration.I’d be interested to understand how others are handling this in practice: What signals or patterns do you rely on when working primarily with firewall logs? Do you focus more on behavioral anomalies, destination-based detection, or a combination of both? How do you effectively reduce noise without missing real threats? Are there specific indicators that you’ve found particularly reliable for detecting exfiltration? Any best practices, feedback, or examples would be greatly appreciated Thanks!

Is there a way to add a Tag to an Alert via a playbook? I can add one to the case but I don’t see an option to add to the Alert.

Hello Everyone,Greetings..!!I am trying to build a Google SecOps detection similar to a Splunk behavioral rule for “AWS provisioning activity from a previously unseen geographic region.”Current logic: Detect CloudTrail provisioning actions such as Run* and Create* Baseline source geolocation per activity eg : country,region ,ip ,city  Alert when provisioning comes from a new/unseen location The issue is with the baseline scale.The current baseline stores combinations of: source IP city country region/state Because of this, the baseline has grown to around 600,000 rows.In Splunk, this was implemented using a CSV lookup with historical tracking, but in SecOps we are limited by the Data Table size limit (~1000 rows), so the approach is not scalable as-is.I am looking for recommendations on how to create a rule that alerts on AWS CloudTrail Run* or Create* operations from a new source IP, city, country, or region.The expected behavior is:When a new IP/location combination is seen

Hello SecOps Community!If you are building custom Native Dashboards to track SOC performance metrics like Mean Time to Resolve (MTTR), analyst workloads, or SLA compliance, you know that the data you need often lives in two different places: the current case state (case) and the audit log of actions taken on that case (case_history).I want to provide some quick guide on how to seamlessly join these two data sources within your dashboard queries to unlock deeper insights into your case lifecycles.The Secret Sauce: Aliasing and Shared VariablesIn Native Dashboard queries, you do not need to use YARA-L rule or events blocks to join data. Instead, you establish the relationship by assigning an alias to each data source and mapping their unique identifiers to a single, shared placeholder variable.To successfully join case and case_history, focus on this core syntax:Code snippet// Assign aliases ($h for history, $c for case) and map to a shared variable$h.case_history.case_response_platform_

 At Google Cloud Next we introduced a new security and governance paradigm for managing agent identity and access. This comprehensive framework focuses on foundational Agent Identity and an Agent Gateway with Identity-Aware Proxy, while integrating robust agent access management, agent guardrails, and runtime defense to enable a secure cloud environment for your organization. Check out this blog to learn on all new capabilities announced at Next 2026.https://cloud.google.com/blog/products/identity-security/whats-new-in-iam-security-governance-and-runtime-defense?e=48754805

Hi All ,  Im not able to submit file in CS what this error means? 

According to the official documentation, the multi-event rules capacity under the “Enterprise” license is 125 rules. However, we have noticed that in a few of our customer environments licensed under the Enterprise license, the multi-event rules quota has been increased to 200. Is this an official update? If so, why has it not been mentioned in any of the release notes or official documentation yet?  

By default Google Secops compress the x-axis on its visualizations.For instance in any timechart if there is no value on any given timeslot, it’d just compress the x-axis making it non-linear. Sometimes this might be helpful but other times it could be misleading.We need a way to switch between compressed and linear x-axis.

This blog post was written by guest author, Eliraz Oved.  If you spend your days in the trenches of a Security Operations Center, you already know the struggle: pivoting between screens, writing complex queries, and manually clicking through menus to create rules or check feed health.Recently, Google dropped something that has the potential to completely change this workflow: the Google SecOps MCP (Model Context Protocol) Server, which officially supports Claude.For those new to the term, think of MCP as a universal, open -source API standard that gives AI models secure, structured access to external tools and data sources. Instead of just chatting with a static knowledge base, MCP servers equip the LLM with real-world tools, allowing it to fetch live data, analyze logs, and actively execute commands against backend services.A quick note before we dive in: because MCP is an open standard, you aren't locked into a single AI ecosystem. While we are using Claude (via the Claude Code CLI)

A few months ago we discussed calculating Z-scores and median absolute deviations within a multi-stage search. These are some hearty examples that I would encourage you to review as they are good strategies to employ for conducting outlier analysis. Recently, I received a question asking how we can identify user logins that are deemed excessive based on the average of their logins over the past seven days. Today, we are going to circle back to multi-stage searches and build a search to help address this question. Let’s start by determining the data we need. As previously discussed, a good way to build multi-stage searches is to make sure that data from each of the stages in the search is able to return results before you assemble the stages.  The first data set I need contains the event count of the target.user.userid for user login events grouped by the user and each day within the search range. In this example, the search range is seven days and I’m going to focus on Windows login ev

Hello Google SecOps Community!We know that building the perfect dashboard is crucial for your SOC's visibility, but we've also heard your feedback: mastering the underlying data schemas and getting the hang of YARA-L 2.0 queries for charting can come with a steep learning curve.To help you get the most out of your data and accelerate your custom dashboard creation, we are thrilled to announce a major revamp to our Google SecOps Dashboard documentation, along with a brand-new reference query library!Here is what’s newly available to you:📊 Revamped Native Dashboards Documentation We have overhauled our dashboards documentation to give you more clarity and control. You will now find in-depth details about the schemas for the different supported data sources. To make getting started even easier, we have included ready-to-use templates and practical examples for each data source. 👉 Check out the updated Data Sources documentation💡 1,000+ Curated YARA-L 2.0 Reference Queries Struggling to

Hello Google, I want to know that why my results test with reCAPCHA enterprise (I use script App Automation - Browser Stack) to trigger reCAPTCHA Button in IOS App. But it always return 0.9.  Note - Code at IOS - I'm not using testing key -  It's demo project but I can't guarantee it works right now. I can't intergrate when it can't not prevent bot spam, bot abuse) - I'm using script for (App Automation - Browser Stack) to test results of reCAPTCHA and it passed all the cases. How can? It's bot, many assessments was created but always return nice scores (0.9)   If you can explain, pls. If you want email me for the iba file

Hi,I'm struggling to get cases into the right Environments in Google SecOps.I have my environments defined in the SOAR settings, and I’ve set the Ingestion Label and Namespace correctly in the feeds. I also configured the Chronicle Alerts connector to use a UDM field that carries the environment name, but for some reason, all cases still land in the "Default Environment."I've already tried swapping fields in the connector but no luck. Is there something specific about how the connector parses UDM fields for environment mapping that I might be missing?Any advice would be appreciated!Thanks 

Hello,My Google Cloud project has been suspended due to a security issue (ACCOUNT_HIJACKED).I fully understand the situation and I am ready to take all necessary actions to secure the project. However, I currently do not have access to the project anymore, which prevents me from revoking the compromised API keys or applying the required fixes.As a precaution, I have already stopped billing to prevent any further charges.At the moment, my application is completely down, which is having a severe impact on my business. My clients cannot access the service, and I am receiving increasing complaints and refund requests.I already have an open support case: 70327888This situation is becoming critical, and I would greatly appreciate any help to restore access or guidance on how I can proceed to secure the project.Thank you very much in advance for your support.Vincent

Hello Google Cloud Security Community,As autonomous AI agents transform the internet into the Agentic Web, securing online interactions requires a fundamental shift in risk management.Join our launch webinar to see how we are evolving our 20-year heritage from reCAPTCHA into Google Cloud Fraud Defense—a comprehensive trust platform natively built on Google Cloud. As we announced at Cloud Next, this represents a transformation of our industry-leading bot protection into a comprehensive trust platform that secures the entire user journey.What we will cover: The Evolution of reCAPTCHA: Advancing to Fraud Defense to secure the complete customer journey across registration, login, and checkout. Agentic Activity Measurement: Identifying and classifying AI agent traffic using industry standards like Web Bot Auth and SPIFFE. Agentic Policy Engine: Applying granular, real-time control to allow, block, or challenge requests based on risk scores and automation types. AI-Resistant Controls: