Recently active topics

Hello Folks! I wanted to share a practical use case I recently implemented to tackle lack of immediate context in security notifications. When an alert fires, every second counts, and I consider that having key threat intelligence delivered right in the initial notification can significantly streamline the initial triage and reduce MTTR. The Problem: Lack of Enriched Context in Initial AlertsAlert fatigue often stems from notifications that simply state that an incident happened, without providing enough intelligence and impeding the ability to take confident decisions.  The Solution: Dynamic Templates via Expression BuilderTo solve this, I used Expression Builder in SecOps a feature I consider often flies under the radar. It allows us to extract output variables from our integrations (like VirusTotal) and map them dynamically into a pre-formatted delivery templates (like HTML).Workflow Operation:Detection: A YARA-L Rule flags a user attempting a DNS resolution to a known malicious dom

Hi,I am new at using the Google recaptcha thing.First, I have to say that Google knows how to make things complicated!!! I cannot find my way around the recaptcha dashboard? It looks like a big mess to me.Anyhow, I have made some recaptcha keys for websites of mine. I am now trying to strengthen my website security after having been hacked over and over.The plugin in I am using asks for both the recaptcha main key and the security key. I seem to be able to find the main keys but I don't seem to have any access to the security keys?Do I need to start over or is there a way to find the security keys once having been made?If so, how?Thanks,John

Hello,We're investigating an issue with a Trellix HX Audit integration in Google SecOps and would appreciate any guidance from others who have worked with this feed.EnvironmentGoogle SecOps SIEM Trellix HX / FireEye HX API Feed Log Type: TRELLIX_HX_AUDITIssueThe feed was ingesting normally for an extended period and then abruptly stopped receiving audit events.Observed ingestion pattern:Normal ingestion for several weeksSharp reduction in volumeSubsequently dropped to 0 events/day Current StatusFeed status shows OK/Healthy Feed is enabled Feed was recreated with the same configuration Other Trellix HX-related feeds continue to ingest successfully No parsing errors No validation errors No indexing errorsSpecific Event Type AffectedThe primary missing events are Bulk Acquisition audit events, such as:Bulk Acquisition InitiatedBulk Acquisition Completed These events were previously being ingested into Google SecOps under TRELLIX_HX_AUDIT.Additional FindingsWhile reviewing historical HX au

September 8, 2026  What SOAR Playbooks Do SOAR playbooks in Google SecOps (formerly Siemplify) automate the response to detection alerts. When a detection rule fires, a playbook can automatically gather context, take containment actions, and notify the right people. The goal is removing repetitive manual steps from analyst workflows while keeping humans in the loop for high-stakes decisions. Playbook Triggers Every playbook starts with a trigger that defines which alerts activate it. You can trigger based on the rule name that fired, the alert severity, the log type involved, or combinations of these. A playbook designed for phishing alerts should only trigger on phishing detection rules. A playbook for critical severity alerts might be broader, handling any detection that crosses the critical threshold. Keep triggers specific. A playbook that fires on everything is just as noisy as an untuned detection rule. The Three Action Patterns Almost every playbook is built from three types of

Hi Team,I need to know how to solve the enrichment issue in google chronicle siem as i am finding some issue lately where chronicle wrongly categorized IP location which was US to Iran and there are other instances as well where there is issue with the geo based enrichments in terms of location and IP.

Hey folks,As you all know, our built-in IDE, despite being a powerful tool, still has a lot of limitations, which can make the development process frustrating. Instead of trying to reinvent the wheel, we want to enable developers to work in the environments they are more used to and to be able to leverage all of the latest technologies to make this process as simple as possible.   In this post, we would like to present a new flow, which enables you to use the local IDE environment to create/update integrations and manage it on Github. In simple terms, this new approach consists of 2 steps:Make all of the changes in the forked version of our existing Github repository Pull/Push updated content to Google SecOps via our developed mp toolMain benefits of this approach is that you fully own your version of Github repository. You can add dedicated CI/CD workflows, pre-commit hooks, AI integrations, Github actions  - anything to operate efficiently. ❗Note: this is still a Preview version  and

Author: Elirez Oved,  Senior Cloud Security Consultant   For any enterprise security team, the prime directive has always been simple: stay one step ahead of the adversary. But recently, threat intelligence from Mandiant's M-Trends 2026 Report has observed a shift: adversaries have moved from experimenting with AI to operationalizing it, deploying adaptive malware that rewrites its own code and queries LLMs mid-execution to evade detection. AI has become an incredibly potent weapon for the offense - accelerating the speed and scale of attacks, which begs the ultimate question: Are defensive teams keeping pace, or are we already falling behind?Look no further than our own defensive stack. Today, many modern security platforms - with Google Security Operations leading the charge - already come equipped with powerful, built-in AI capabilities. Yet, facing this surge of automated threats, security leaders must ask themselves: Are we truly maximizing the full potential of these investments?

My Google Cloud project was recently suspended for alleged repeated Terms of Service violations. I already submitted an appeal, but the appeal page does not show the original appeal, its status, history, or any way to add more information.After submitting it, I realized what I think was the likely trigger.Right before the suspension, I ran a one-time automated Gemini/Vertex batch job that analyzed and categorized hundreds of short video clips for a legitimate commercial media library. It involved roughly 693 source assets and 1,076 reusable clips.The workload was intentional, but it may have created an unusually large burst of multimodal requests. There was no spam, scraping of Google services, malware, credential abuse, DDoS activity, quota circumvention, or compromised account.The suspension email also mentioned that a warning may not be sent when project behavior is seriously impacting other users, which makes me think this batch job may have triggered an automated abuse system.I am

I'm seeing a specific Android device consistently receive floor scores from reCAPTCHA Enterprise, and I can't find any signal that explains why. Looking for anyone who has seen this pattern or knows what an assessment with score: 0 and no reason codes indicates for the mobile SDK.What I observe on one device (Pixel 9 Pro, Android 17, stock, bootloader locked, verified boot green)Android SDK com.google.android.recaptcha:recaptcha:18.9.2, app installed from Google Play. Every assessment comes back like this:tokenProperties: valid: true, action matches expectedAction, clientSignalsFailed: falseriskAnalysis: score: 0, reasons: [], extendedVerdictReasons: []- 12 attempts over two days: eleven scored 0.0, one scored 0.1. Never a reason code.- Persists across two networks (Wi-Fi and mobile data), across an app-process restart with a fresh client and fresh token, and across a device reboot.- The SDK reports no error — executeTask succeeds every time, so the app has nothing to react to.- In log

We are using Google reCAPTCHA v3 with Thai language (hl=th). The captcha challenge occasionally displays corrupted Thai characters in the instruction area and action button. The issue occurs inside the Google-hosted reCAPTCHA dialog while the rest of the application renders Thai text correctly.Observations:Application localization is functioning correctly. Issue is occurring only within the reCAPTCHA iframe. Multiple users have reported the issue. Browser refresh does not always resolve the problem. No recent changes were made to the application code or reCAPTCHA integration.Please investigate whether there is an issue with the Thai localization resources or rendering of reCAPTCHA. 

Hi everyone,I am currently setting up a test environment to collect logs from a Linux host using BindPlane, following the official quick start guide: Google SecOps with BindPlane Quick StartMy configurations on BindPlane appear to match the recommended setup, and the agent status looks consistent. However, I am stuck on the verification step: Data Visibility: I cannot see the ingested data in Google SecOps (Chronicle). Verification Process: To be precise, I’m not sure how or where to properly verify if the logs are actually reaching Google SecOps, or if they are getting stuck somewhere in the pipeline (e.g., BindPlane collector, Google SecOps ingestion API, or UDM mapping). Are there recommended troubleshooting steps, CLI tools, or specific queries in Google SecOps to verify that data is flowing correctly? Any guidance on how to inspect and validate this setup would be greatly appreciated!Thanks in advance! 

 Author: Emiliano Martinez, Group Product Manager, Google SecOps Reduce Ingestion Toil with Agentic Parser Extensions Modern enterprise environments ingest massive, ever-evolving telemetry streams from hundreds of distinct log sources—frequently containing bespoke custom attributes and non-standard fields. Data volume and diversity creates a persistent bottleneck for detection engineers and SOC analysts: log parser maintenance.Historically, extracting unmapped fields or extending an existing parser required security engineers to manually write complex regular expressions or GoStash parser code. This manual development process created steep learning curves, prolonged onboarding delays, and created operational friction for detection engineers and threat responders who needed immediate access to newly surfaced data.To help eliminate this ingestion toil, we are announcing the Private Preview of AI Parser Extensions in Google Security Operations. Powered by Gemini, AI Parser Extensions tran

Hi Fam,Where do i exactly need to go and check if this is applicable to my secops :can someone suggest steps where to go and check this out and identify if its applicable to us or we need to take any action.thanks  

What’s New in Google SecOps for the interval Sep 30th through Sep 7th, 2026. What’s new in Google SecOps, 6th Sept 2026 Highlights🚀 New SecOps features: Case level playbooks, Reaction Triggers, and Scheduled YARA-L Rules🤖 A great blog from Greg Kushmerek on Building AI-driven UEBA for Google SecOps Product Updates & New Features Google SecOps 🚀 Release Notes from Google Cloud Docs 🔥 SOAR: New Feature > Case playbooks. This feature is in preview. Google SecOps now supports case playbooks. You can run playbooks or execute manual actions across an entire case container rather than individual alerts, consolidating response tasks and reducing redundant operations during investigations. [Read More] Case playbooks overview | Google Security Operations | Google Cloud DocumentationThis feature is covered by Note: Pre-GA Offerings Terms of the Google Security Operations Service Specific Terms…docs.cloud.google.com 🔥 SOAR: New Feature > Reaction triggers. This feature is in preview

Looking for guidance on a suspension case.Our project was shut down on Sep 7 under the hijacked-resources policy.The trigger appears to be a billing anomaly on Gemini API — daily costjumped to roughly 400 times our normal baseline within a single day.None of that traffic came from us, so we assume a key of ours ended upsomewhere it shouldn't have.What we've done so far: every user-managed service account key in theproject is gone, and every API key including the Gemini one is gone.Nothing left to rotate on that front. IAM stayed reachable long enoughfor us to finish that part.What we can't do: anything requiring project APIs. Audit log review,Secret Manager rotation, checking for resources we didn't create — allof it returns CONSUMER_SUSPENDED.The appeal went in the same evening, plus the separate suspensioninquiry form. No decision yet.Two questions for anyone who's been through this:Is there any way to learn which credential Google actually flagged?Knowing the exposure path would hel

Hello Google Community Team,My OAuth app verification is currently stuck and I need an internal engineer to manually trigger a status refresh or pass this along to the Trust & Safety team.* Project ID: dev-workrate* The Issue: The Cloud Console Verification Center shows a blocking error under "Homepage requirements" stating: "Your homepage website is not registered to you."* The Resolution: I have successfully verified full domain ownership for our production homepage via Google Search Console using this exact same Google account. The Problem: The console instructs me to "Reply to your email thread with our Trust and Safety team," but I have never received an initial email from the compliance team to reply to. Because the UI is entirely locked in the "Your branding is currently under review" state, I cannot modify fields or trigger a re-scan myself. Could a community manager please escalate this project ID to the Trust & Safety team so they can pull the fresh domain status from

# Bindplane Integration for Google SecOps This repository contains the architecture, automation, and setup scripts for deploying an OpenTelemetry-based telemetry pipeline using Bindplane OP. The primary objective is to route logs to Google SecOps (filtered for cost-optimization) and Google Cloud Storage (GCS) for full raw retention, while providing an automated incident rehydration capability through Google SecOps. # Codehttps://github.com/Darrenswift/secops-incident-response ## Project Structure- `setup_scripts/create_bindplane_pipeline.py`: Python script to programmatically create Bindplane pipelines via the REST API.- `soar_integration/bindplane_soar_integration.py`: Custom Siemplify (Google SecOps SOAR) Python integration to automate incident log rehydration.- `docs/architecture-design.md`: Overview of the primary routing and incident rehydration architectures.- `docs/automation-guide.md`: Guide on automating the rehydration workflow via API and SOAR.- `docs/incident-rehydration-ru

Author: Nolan Karpinski, Group Product Manager, Google Cloud Security We are excited to share the latest leap forward in autonomous defense by announcing the Public Preview of the Detection Engineering agent in Google Security Operations.Wondering if your organization is ready for the latest AI hack? Rather than entering into a marathon of drafting rules and hoping they trigger, the Detection Engineering agent brings a powerful new capability to security teams with the ability to safely simulate threat coverage at a moment's notice. Agentic AI makes a continuous detection-and-validation loop truly possible. The agent can generate realistic attack sequences and run them against your detection capabilities. This allows you to simulate a wide breadth of coverage and verify rule execution in production-safe environments, confirming your defenses stand strong before an actual attack occurs. A Continuous and Autonomous Detection Lifecycle Detection engineering is often constrained by a painf

 Author: Dmitry Kosarev, Senior Security Automation Engineer - Admiral Group Have you ever had to perform a laborious, repetitive task in an IT role?I certainly have. Whether it’s manually triaging suspicious emails in a reporting mailbox or pulling metrics from half a dozen systems to build a monthly slide deck, many of us have spent countless hours on work that should be automated.Some teams take steps to solve this. There are plenty of courses on Python, Bash, and scripting in general. And if you’re lucky, you might build small automations for your own workflow. How do you scale those automations? How do you monitor them? How do you maintain them over time? While software engineering has mature practices and guidance, there is still a noticeable gap when it comes to operationalising automation in cybersecurity. In practice, this often leads to immature, makeshift and fragile solutions.Earlier in my career before joining Admiral, I managed automation for a Security Operations tea

I would like to create some detection rules around Google Workspace App Passwords. I generated a few in an environment, but I can’t find the specific event indicating that an app password was created. Does anyone have any idea, or is it a logging gap?

I noticed that some of the new curated rules land with detecting (status) disabled and alerting enabled.I was wondering if this is a misconfiguration or if alerting will continue to work even though detecting (whose field name in the API calls is actually status) is disabled. 

Hi, I want to write a parser extension to capture additional fields from a json log that looks like: { "key": "value",  ...  "ExperimentalFeatures": { "mcp": false },  ... "key": "value"} I’m imagining the UDM field based on the above to look like:additional.fields["mcp"] = "false" So far I’ve come up with:filter {  # Additional Fields Mapping (ExperimentalFeatures.mcp)  mutate {    replace => {      "ExperimentalFeatures.mcp" => ""    }  }  if [ExperimentalFeatures][mcp] != "" and [ExperimentalFeatures][mcp] != "NULLPLACEHOLDERVALUE" {    mutate {      add_field => {        "[@metadata][mcp_val]" => "%{[ExperimentalFeatures][mcp]}"      }    }    mutate {      add_field => {        "event.idm.read_only_udm.additional.fields[key]" => "mcp"        "event.idm.read_only_udm.additional.fields[value]" => "%{[@metadata][mcp_val]}"      }    }  }} However something about the above isn’t right because json logs that contain the above key:value pairs are not getting such UD

Author: John Murray, Senior Product Manager  Proactive threat hunting is an essential pillar of a mature security posture. Yet for most Security Operations Centers (SOCs), it remains an elusive goal. Translating high-level threat intelligence (such as a campaign report on a new threat actor) into tangible, cross-telemetry analysis is historically a manual, high-expertise task reserved for senior analysts. Due to the sheer complexity of manual log analysis across weeks of historical data, most SOCs remain purely reactive.Today, we are excited to announce the SecOps Threat Hunt agent is now available in public preview.The Threat Hunt agent is an autonomous AI-driven capability powered by Gemini, Google Threat Intelligence, Mandiant Frontline analyst insights and the MITRE ATT&CK® framework embedded directly within Google Security Operations. It transforms threat hunting from a time-consuming, manual process into a scalable, proactive, automated force multiplier. What used to take sen

In the rapidly shifting landscape of modern cybersecurity, static detection mechanisms are no longer sufficient to counter sophisticated, evasive web threats. Malicious actors continuously alter their infrastructure and obfuscate code to slip past traditional scanners. To address this critical challenge, Google Threat Intelligence has launched URL Scanning 2.0, a transformative capability designed to give security analysts unprecedented visibility and drastically reduce the Mean Time to Resolution (MTTR) for phishing and link-based investigations. At the core of URL Scanning 2.0 is a dynamic approach to web threat analysis. Instead of relying on passive reputation scores, the system employs sandboxed, headless browser technology to interact with live websites. This allows security teams to visually verify threats through automated live screenshots and full page previews. By seeing exactly what a targeted victim would see, analysts can bypass text-obfuscation tactics. Additionally, the

Hi all, We're trying to set up the built-in **SilentPush integration (v3.0)** in Google SecOps SOAR, but Test Connection consistently fails with no useful error detail. Hoping someone from the community or Google team can help point us in the right direction. **Environment:**​Google SecOps SOAR (Google-managed / SaaS instance) ​No self-hosted Remote Agent — running entirely on Google-managed infrastructure ​SilentPush integration version 3.0 **What we've already verified/tried:**1. Confirmed the correct API base URL per SilentPush's official docs (https://help.silentpush.com/docs/get-started-with-api): https://api.silentpush.com (root domain only, scheme included, no trailing path)2. Confirmed API Key is populated and valid3. Tested with "Verify SSL" enabled4. Tested on two separate integration instances (a Shared Instance and the System Default Instance) — identical failure on both5. Ruled out URL formatting issues — we initially hit a MissingSchema error (missing https://) and a wron