Recently active topics

I’m looking for guidance on the appropriate contact point within Google for reporting and following up on unauthorized administrative actions performed by an external party with (current or former) Google Workspace admin access.More specifically, I’m trying to understand: Which Google team or function is responsible for handling this type of incident (e.g. Workspace Support, Trust & Safety, Abuse, Partner oversight, etc.)? Through which channel (ticket type, form, or email) such reports should be submitted to ensure proper review and ownership? Whether there is a defined process for incidents involving actions performed through the Google Workspace Admin Console by a third party? What kind of information or audit logs are typically expected to support an investigation? My goal is to avoid being redirected between multiple teams and to engage the correct channel from the start.Any guidance or direction would be greatly appreciated. Thank you.

We were recommend to post here re. case #10394319, Project number [removed by moderator] and as belowPlease could you highlight for attentionThanksRyan We are writing to appeal the suspension of our Firebase Hosting project dg-style-chooserThis is a false positive. Our application is a legitimate business tool, not phishing.What our application does:We operate LiveStory and DamnGood, two digital magazines that feature content creators.Our web application allows potential creators to browse visual style preferences and submit applications to be featured in our publications.The form collects standard contact information (name, email, Instagram handle) that creators voluntarily provide to apply for partnership opportunities.Why this is NOT phishing:We are a registered business operating at joindamngood.com and joinlivestory.com.We do not impersonate any other brand or service.We do not ask for passwords, financial information, or any sensitive credentials.The data collected is used solely

General Approach: Using System SchedulersFor most general use cases, you can create a simple script (batch, shell, Python, etc.) containing your Git commands (git pull, git push, etc.) and then use your operating system's built-in scheduler to run this script at regular intervals.Linux/macOS (Cron): Create a shell script (e.g., ~/gitsync.sh) with your commands. Make sure it has execute permissions (chmod +x ~/gitsync.sh). Edit your crontab using crontab -e. Add a line to schedule the script, for example, to run every 15 minutes: bash */15 * * * * /bin/bash /home/user/gitsync.sh >> /home/user/cron_log.log 2>&1 This command executes the script and redirects the output to a log file for monitoring.

Guest:Vishwas Manral, CEO at Precize.aiTopics: Artificial Intelligence Subscribe at YouTubeSubscribe at SpotifySubscribe at Apple PodcastsTopics covered:Why is agent security so different from “just” LLM security? Why now? Agents are coming, sure, but they are - to put it mildly - not in wide use. Why create a top 10 list now and not wait for people to make the mistakes? It sounds like “agents + IAM” is a disaster waiting to happen. What should be our approach for solving this? Do we have one? Which one agentic AI risk keeps you up at night?  Is there an interesting AI shared responsibility angle here? Agent developer, operator, downstream system operator? We are having a lot of experimentation, but sometimes little value from Agents. What are the biggest challenges of secure agentic AI and AI agents adoption in enterprises? 

Is there a way to filter the workspace logs and reduce it before sending it to secops ?It is consuming too much storage of the tenant storage limit.

Hello Commmmmunity, I am attempting to implement the detection rule below in SecOps but keep getting an error message when I test or attempt to save the rule.“parsing: error with token: ":" expected '=' between meta assignment key and value line: 11 column: 12-13” rule MAL_Dropper_NetSupportRAT { meta: author = "Sam" description = "Detects a dropper that delivers a decoy ChaGPT Installer and NetSupport RAT" hash = "d86f647f3dfa6a53de7b531cb590636331f83afcea60d4b3d44de5ea3b7d33af" malware = "NetSupport" malware_id = "TWOU5d" category = "MALWARE" strings: //dropped files $d1 = "ChatGPT Installer.exe" $d2 = "setup.exe" //netsupport strings $n1 = "NetSupport" nocase $n2 = "install_netsupport_manager_silently" $n3 = " [removed by moderator] " condition: uint16(0) == 0x5A4D and all of ($d*) and 2 of ($n*)} I’m getting similar error messages for rules that have “strings:” in them. What could be wrong?

Hi,I am new at using the Google recaptcha thing.First, I have to say that Google knows how to make things complicated!!! I cannot find my way around the recaptcha dashboard? It looks like a big mess to me.Anyhow, I have made some recaptcha keys for websites of mine. I am now trying to strengthen my website security after having been hacked over and over.The plugin in I am using asks for both the recaptcha main key and the security key. I seem to be able to find the main keys but I don't seem to have any access to the security keys?Do I need to start over or is there a way to find the security keys once having been made?If so, how?Thanks,John

Hi,  I have a rule created that is to see the users that have used vpn after business hours for the day adn this is for informational purposes only and i want this to be triggered only once per day at a certain time. Eg: 12 AM. how can i set this timei have made the metch section to be 24 hours, but i want to know how i can set a specific time like 12 am for the rule to be triggered. 

Hello all, I need to create some automate TAGs depend con the value of the hostname. Example if a host is from Belgium: BEL-XXX, if its from Brazil: BRA-XXX. Well i thought about the funcion on SOAR casa data→ TAGS. Teh proble here, is i have more than 1 product in incoming alerts, and in one alert the entity is saved in host_name entity, in other deviceDNSname...etc… So, is there any solution or best practice for this?  Thanks!

Hi,The reCAPTCHA that we were planning to migrate automatically has apparently been migrated automatically the other day.As a result, we have received an email from Google Cloud titled “Action Required: Accept Your Invitation to Manage reCAPTCHA on Google Cloud”.If we approve this, we currently have only one project that has an active reCAPTCHA contract—after clicking Accept/Approve, will the keys that were automatically migrated this time appear in that project?

Last time, I demonstrated how you could build a search in Google Security Operations (SecOps) to create a Z-score to identify outlier IP address pairs and their associated time bucket.  I also mentioned that Z-scores are most meaningful when you have data that falls into a standard distribution, that is the data follows a bell curve. In reality, this is rarely the case. Today, we are going to examine another method to identify outlier behavior, but this time we aren’t going to assume a normal distribution and instead of calculating a standard deviation and a Z-Score, we are going to take a look at using Median Absolute Deviation (MAD). Median Absolute DeviationLet’s take a moment to discuss MAD, how it differs from standard deviation as well as why it may be a better choice than its cousin, Mean Absolute Deviation. Standard deviations, which we’ve already used to calculate Z-scores, measure the distance from the mean and then squares the distance before adding the distances up, dividin

Do you know when the APIVoid integration in Google SecOps (SOAR) will support the new APIVoid v2 APIs? The current integration (linked below) references the older v1 endpoints:https://docs.cloud.google.com/chronicle/docs/soar/marketplace-integrations/apivoid APIVoid has announced that v1 APIs will be deprecated on Feb 28, and v2 introduces breaking changes. From the APIVoid v2 API documentation, requests now use POST with a JSON payload, for example: curl -X POST "https://api.apivoid.com/v2/ip-reputation" \ -H "Content-Type: application/json" \ -H "X-API-Key: YOUR_API_KEY_HERE" \ -d '{"ip": "80.82.77.139"}' Additionally, the response structure has changed. Previously (v1), responses were wrapped under data or data.report, e.g.: { "data": { "report": { "ip": "80.82.77.139", "blacklists": { "engines": { ... In v2, the response is now flat, for example: { "ip": "80.82.77.139", "version": "IPv4", "blackl

I am creating a new integration, and for that I copied the pyproject.toml file from an existing integration. To generate the uv.lock file, I am using the uv sync command as mentioned in the Content Hub install and build steps.Once the uv.lock file is created, I use the mp build --integration <integration_name> command to generate the build, and I can see the output in the Out folder. After that, I change IsCustom to true, generate the ZIP file, and try to install it. However, I encounter an error. Upon investigation, I found that the issue is related to dependencies.I had some working integrations on my instance. I exported those integrations and copied it’s dependences and replaced them in the Out folder, and after doing that, the installation worked.To reproduce this issue, I tried generating a build for an already available integration in Content Hub (InfobloxNIOS). First, I ran the build command to generate the build and installed it on my instance, and it worked correctly. T

Hello Community,I am trying to clearly understand the design and deployment model of Google SecOps SOAR Remote Agents, specifically when the target systems (for example, FortiGate firewalls or other on-prem security tools) are hosted inside a private customer network. I would like clarification on the following points: Hosting Model Do we need to create a VM in the customer private network to host remote agent? Is the Remote Agent always expected to run on a dedicated VM or server inside the customer’s private network? Is this the recommended and supported architecture for interacting with internal devices such as firewalls, AD, or other non-internet-exposed systems? Allowing Access for Remote Agent to Google Publisher and Firewall

HI everyone, I’m trying to find a documentation of the SOAR api, but I’m unable to find an API that lets me retrieve playbook results per alert.I want to be able to retrieve the data from query enrichments that I’ve created. Has anyone been successful at doing this? 

I am looking to build a dynamic asset inventory in Chronicle SIEM to map AWS Account IDs to their respective OUs.My environment has a lot of accounts and CloudTrail logs lack OU context. My plan is to create a Chronicle Data Table with a bulk export of current accounts and then use a YARA-L detection rule to catch CreateAccount events (which contain the OU name). This rule would trigger a SOAR playbook to automatically append the new Account ID and OU mapping to the Data Table. What is the best practice for my problem?Which YARA-L rule and playbook should I create for this solution?Thanks

Hello guys,I’m working on SecOps Audit events for MOC purposes.I wrote a query to identify modifications on Parsers & Extensions.Here’s my query :events: metadata.log_type = "GCP_CLOUDAUDIT" target.application = "chronicle.googleapis.com" // Filter on Parser Mgmt events metadata.product_event_type = /\.ParserService\./ $action = re.capture(metadata.product_event_type, `ParserService\.(.*)$`) // Exclude 'Read' events not $action = "GetParser" not $action = "ListParsers" not $action = "ListParserExtensions" not $action = "GetParserExtension" $evtid = metadata.id match: $evtidoutcome: $timestamp = array(timestamp.get_timestamp(metadata.event_timestamp.seconds, "SECOND", "Europe/Paris")) $audit_action = array_distinct($action) $log_type = array_distinct(re.capture(target.resource.name, `logTypes/([^/]+)`)) $actor = array_distinct(principal.user.email_addresses)order: $timestamp descunselect: $evtidUnfortunately, my filters to remove ‘Read’ events seem to be not wor

Hi Folks,I’m new to SecOps and still getting familiar with the platform’s functionality. Apologies if this is a basic question, but I believe it will be helpful not only for me but also for others who are beginning their SecOps journey. I’m looking for guidance on how to search logs in SecOps for the following requirement:We have onboarded Windows servers via Bindplane, and I want to run a query to list all logs coming from a specific Windows server.Currently, we are using a query similar to the one below (Partial query) :metadata.log_type = "WINEVTLOG"$host = strings.coalesce(principal.asset.hostname, principal.hostname)However, we are observing an issue where we have onboarded only 50 Windows servers, but the query returns more than 50 host values. Upon initial review, these additional hosts appear to be introduced during parsing (exact cause not yet confirmed).In Splunk, we typically rely on the host field to retrieve all logs from a specific server/device. Could someone please advi

Hi Team,While running a Dashboard query using “Run in Search”, the query returns No results, even though the same query shows results within the dashboard visualization. The issue specifically occurs when applying an equality filter (=) on a derived field created using an if() expression. metadata.product_event_type = "test" $inference = if( security_result.summary = "Client Authentication Bypass", "ABP", if(security_result.summary = "SSH Agent Forwarding Requested", "AFR"))$inference = "ABP"match: principal.ip, target.ip, $inference  When filtering with: $inference = "ABP"  → No results are returned. However, removing the equality filter entirely returns results Using a negation filter: $inference != "ABP"  → Also returns results The issue is reproducible across multiple dashboard queries using similar derived-field logic. The problem appears to be specific to equality (=) filtering on fields derived via if() expressions. Dashboard widgets show results, but “Run in S

I have this nested JSON: "jsonPayload": {"message": "\"id2\":{\"timestamp\":\"2026-01-19 03:15:20\", \"app_name\": \"test1234\", \"client_port\": \"2233\", \"client_host\": \"hostName\"},}I wrote this code snippet but it doesn't work, can you tell me why?filter { mutate { replace => { "client_port" => "" } } grok { match => { "jsonPayload.message" => ["client_port=(?P<client_port>[0-9]+)"] } overwrite => ["client_port"] on_error => "client_port_not_present" } statedump{} mutate { rename => { "client_port" => "event.idm.read_only_udm.principal.port" } } mutate { convert => { "event.idm.read_only_udm.principal.port" => "integer" } } mutate { merge => { "@output" => "event" } }} I want to extract the value of the client_port field and map it to the UDM principal.port fieldThanks in adva

Hi Community,I came across a use case where a Chronicle detection rule uses a reference list to check if a certain value (like a source and destination IP pair) already exists. If it does, the rule suppresses the alert; if not, it triggers an alert and then adds that value to the reference list to avoid duplicate alerts for a certain duration.I’d also like to understand the best way to implement it - Do I need to create any playbook for this?Below is the use case I’m referring to:  events:    $e.metadata.vendor_name = "AMAZON"    $e.metadata.product_name = "AWS VPC Flow"    $e.metadata.event_type = "NETWORK_CONNECTION"     $e.security_result.action != "BLOCK"    $e.principal.ip = $sourceip    not $e.principal.ip in cidr %internal_ips    $e.target.ip = $targetip    not $e.target.ip in %nat_ips    not strings.concat("vpc_blacklisted_inbound_traffic", ",", $sourceip, ",", $targetip) in regex %suppress_list    $gcti.graph.entity.artifact.ip = $sourceip    $gcti.graph.metadata.threat.confid

Hi All,In our environment, we are using the Bindplane OP Console. As part of our logging and monitoring requirements, we need to forward the Bindplane OP Console Audit logs to the SecOps console for centralized visibility and analysis. Could someone please guide us on the recommended approach to send or integrate Bindplane OP Console logs into SecOps? Currently I am referring the link https://docs.bindplane.com/integrations/sources/bindplane-audit-logs  and performed the below changes. I created an API key at the Bindplane project level and configured a source using Bindplane Audit Logs, with the destination set to our SecOps console. However, I’m not seeing any logs in SecOps. In other configurations, we usually need to attach agents to a configuration for logs to flow. In this case, since it’s SaaS-based, how are these changes supposed to be applied or pushed from the Bindplane OP console? Any documentation, configuration steps, or best practices would be greatly appreciatedThanks in

I have noticed a delay regarding how quickly data about changes on cases in the SOAR UI propagates to the SecOps Dashboards datasets, “case” and ”case_history”.Currently, it takes almost an hour for the database used by the dashboards to update with the latest changes made to cases in the SOAR UI. (e.g. a case going from OPEN > CLOSED).Is this the intended/expected behavior?

Now that multi-stage queries are available as pre-GA, is it possible to create a dashboard KPI for MTTX using case_history data? An easy example would be a measure of the avg time cases were in Triage before going to Investigation.My organization has been trying various yara-l approaches but to no avail.  The examples in the multi-stage documentation do not seem to be related to this type of use case. Thanks