Recently active topics

Hello Google Cloud reCAPTCHA Team,We are reviewing the Google Play Data Safety declarations for our published Android application SEYCHAS.Application environment: Framework: Flutter Android minSdk: 24 Android targetSdk: 36 reCAPTCHA Android SDK: 18.7.1 Integration: Firebase Authentication (conditional reCAPTCHA verification) Our technical investigation confirmed that the primary reCAPTCHA endpoint uses HTTPS. However, we could not establish complete transport guarantees for auxiliary requests using dynamically supplied URLs and for embedded WebView navigation, redirects, and subresources.We have not identified any confirmed unencrypted transmission of user data or demonstrated security vulnerability.We would appreciate clarification of the following questions:1. Encryption in transitDoes reCAPTCHA Android SDK 18.7.1 ensure that all SDK-controlled network requests carrying user or device data use HTTPS/TLS, including auxiliary GET requests, dynamically supplied URLs, WebView nav

Just wanted to share some quick things I’ve learned about migrating to use the newq Chronicle API endpoints: 1. The APIs are maturing (but not uniformly)Over roughly the last four months, a number of endpoints that were previously available only through the unstable v1alpha API have become available through production-ready v1 endpoints.There are still exceptions, though.A number of endpoints with “legacy” in their names remain available only through v1alpha, largely because their payloads still mirror the structure of the older SOAR APIs.2. Your GCOM migration state mattersSome functionality will not work completely until the tenant has completed GCOM Stage 2 migration.This has been particularly noticeable with integrations.For example, exporting an integration from a migrated tenant and importing the resulting ZIP into a tenant that has not yet migrated currently isn't viable for us.That can leave manual transfer of custom actions as the only practical option.3. Migrating custom acti

When a high-severity alert fires, the clock starts. Pulling the trigger on a high-priority incident response is also expensive. It pulls people off other work, can disrupt the business, and costs real money. A bare number isn't enough to justify that. This deck covers Google Threat Intelligence (GTI) Score Explainability. It details a new feature that shows the evidence behind every 0-100 score, so we can remove doubt about whether to pull the trigger.Evidence Instead of a Black BoxThe Explainability Drawer pins the highest-impact factor at the top, such as malware family attribution, an active actor, or capabilities. That saves us from pivoting across multiple tabs. Below it, clickable evidence cards group human-verified Mandiant intelligence, sandbox results, YARA rules, and mitigating signals. Each card links to the underlying reports.Matching the Response to the ScoreGTI weighs confidence and impact across more than 100 telemetry signals and sorts threats into three tiers:Active Th

Project ID: meeings-acc6e (Aura Notes)Ticket Reference ID: ZH4ATUO7HEX2U3633LN6LOUSLUSuspension reason: account hijacked (compromised credentials)Suspended since: September 4, 2026Appeal history (all under the same ticket):- Appeals submitted: Sept 12, Sept 25, Oct 7, Oct 12 (plus Sept 5 original)- Follow-up emails to the compliance address: Sept 9, Sept 10- Each submission produced only an automated "Appeal Received" email.  No human response or request for more information in 41 days.Root causes found and fixed:1. API keys were committed to Git history of a private repository.   History was cleaned and the keys were deleted.2. A config file containing an API key was bundled as a plain asset in   the published Android app. The asset has been removed from the app   source and the key was deleted. A new release will not include it.3. Local tooling access was reduced: Firebase CLI access was revoked   from the Google account, and no service account key files exist on   the development ma

IntroductionWhen building custom HTML views in Google SecOps, one common challenge is making embedded content adapt to the application's current visual theme.A custom HTML view may look perfectly fine in light mode but become difficult to read when the surrounding application switches to dark mode. Hardcoded backgrounds, text colors, and link styles can create visual inconsistencies and reduce readability.Fortunately, a small JavaScript and CSS addition can make an HTML view respond dynamically to theme changes and, where supported, synchronize its appearance with the background color provided by the parent application.How does it work?The solution combines three mechanisms: System theme detection — Uses prefers-color-scheme to detect the user's operating-system preference as an initial fallback. Parent-window communication — Listens for messages from the parent window containing a background color, allowing the embedded view to infer whether the surrounding interface is light or dar

Hey folks,As you all know, our built-in IDE, despite being a powerful tool, still has a lot of limitations, which can make the development process frustrating. Instead of trying to reinvent the wheel, we want to enable developers to work in the environments they are more used to and to be able to leverage all of the latest technologies to make this process as simple as possible.   In this post, we would like to present a new flow, which enables you to use the local IDE environment to create/update integrations and manage it on Github. In simple terms, this new approach consists of 2 steps:Make all of the changes in the forked version of our existing Github repository Pull/Push updated content to Google SecOps via our developed mp toolMain benefits of this approach is that you fully own your version of Github repository. You can add dedicated CI/CD workflows, pre-commit hooks, AI integrations, Github actions  - anything to operate efficiently. ❗Note: this is still a Preview version  and

I am working on a use case in Google SecOps SOAR where I want to automatically retrieve files attached to a case and submit them to an external platform for further analysis.We are using the get_attachments function from the Siemplify SDK to retrieve attachments associated with a case. However, we have noticed that this function retrieves attachments added through case comments but does not seem to return attachments added by other actions.For example, suppose an action adds a file attachment when it is executed within a case. The attachment is visible in the result of that action. Later, when another action runs on the same case and uses the get_attachments function from the Siemplify SDK, the attachment added by the previous action is not returned. However, attachments added through case comments are returned successfully.Our goal is to retrieve files associated with a case, regardless of whether they were added through case comments or by other actions, so that we can use them in su

Hi all,I created a flow in GTI that sends the results of a prompt to several team members via email each day. The issue is that recipients are unable to view the prompt when they click the GTI link included in the email.I've already verified everyone's permissions and haven't found any issues there. Has anyone else encountered this problem or found a solution?

October 13, 2026 Audience: SOC managers, detection engineers, SOAR engineersSummary: A metric is only useful if everyone measures it the same way. This briefing defines MTTD, MTTR, and MTTC with exact start and end points, maps each to the Google SecOps data source that records those timestamps, and gives the dashboard queries to calculate them.1. Metric definitionsMetric Starts Ends Data source MTTD (Mean Time to Detect) First malicious event (event timestamp) Alert created Detections Alert-to-case Alert detection time Case created Cases MTTR (Mean Time to Respond) Case created First assignment to an analyst Case history (Google calls this MTTA) MTTC (Mean Time to Contain) Case created Containment verified Cases, via a custom field you add Time to close (supporting) Case created Case closed Case history (Google’s samples call this MTTR)  Worked example, one consistent timeline:Time What happens Metric 09:00 Malicious login occurs Star

Authors: Rashi Joshi, Product Manager, Google Cloud Identity and InfrastructureManish Gaur, Cloud Security Architect, Google Cloud Google Cloud Privileged Access Manager Enterprises are racing to deploy autonomous AI agents- from SRE incident responders and automated cloud operators to dynamic data orchestrators.In our interactions with our customers we frequently hear the same core challenge from security architects: "How do we unlock the agility and velocity of AI agents without handing non-deterministic models the keys to the kingdom?"Giving an AI agent standing administrative access (owner, editor, or permanent database admin rights) introduces an unacceptable operational risk. In this opening post of our Privileged Access Manager (PAM) blog series, we explore how Google Cloud Privileged Access Manager enables Zero Standing Privileges (ZSP) for agent identities by letting the AI agent act as the requester while keeping humans in command for privileged access.  The Risk of ambient a

Hi Google SecOps Community,i would like to confirm whether YARA-L supports Levenshtein distance (edit distance) or any equivalent fuzzy string-matching functionality.Use Case:We have a detection that identifies potential data exfiltration through Microsoft 365 Exchange emails by comparing the username portion of the sender's corporate email address with the username portion of the recipient's personal email address.The objective is to identify sender and recipient usernames that are identical or differ by fewer than three character edits.For example: [removed by moderator] → [removed by moderator] (distance = 1) [removed by moderator] → [removed by moderator] (distance = 2) Questions: Does Google SecOps YARA-L 2.0 provide a built-in function for calculating Levenshtein distance between two strings? If Levenshtein distance is not supported natively, is there another supported YARA-L function or approach for fuzzy string matching? Can this comparison be implemented directl

Hi All, Can someone please clarify how custom IOC data is stored in the SecOps? I am coming from Splunk ES, where IOC indicators are stored in KVStore as simple lookup lists.However, when setting up third-party API feeds for IOC ingestion (Anomali) the data is ingested into SIEM with time dimension. (e.g. graph.metadata.vendor_name = "ANOMALI_IOC" over last 30 days gives 30 matchies for the same IOC).Wouldn’t it make more sense to store IOC as timeless data? Thanks!

When creating a saved/dynamic search in Search Manager using the ${variable} placeholder syntax, the input box generated at runtime only supports exact string equality matching. There appears to be no way to pass a regex pattern (e.g., wildcard .*) through this input box to perform pattern-based matching on UDM fields.Steps to ReproduceNavigate to Search Manager and create a new saved search with the following query: metadata.log_type = ${log_type}   Save and run the search — an input box is correctly generated, prompting for a value for log_type. Enter a regex pattern as the value, e.g.: .* Observed result: The query executes as metadata.log_type = ".*", treating the input as a literal string rather than a regex pattern. No results are returned (since no log_type literally equals .*).Attempted WorkaroundsAttempt 1: Replaced = with =~ operator for regex matching:metadata.log_type =~ ${log_type}  Result: Compilation error:lexer error: token recognition error at: '~' line: 1 column:

My Google Cloud project project-cb22cbd9-5cdb-4e06-88a8 has an OAuth publishing failure. Google Auth Platform reports that I need additional access, listing clientauthconfig.brands.get, clientauthconfig.clients.list, oauthconfig.verification.get, resourcemanager.projects.get, and serviceusage.quotas.get.My account has Owner and Organization Administrator roles. Policy Troubleshooter shows that the allow policy permits access and no IAM Deny policy blocks it. The organization’s Principal Access Boundary policy page shows “No policies.”I cannot access the OAuth Branding configuration or publish the app from Testing to Production. Google Cloud Support Cases is unavailable under my current support plan.Can Google Cloud investigate why permissions included in the Owner role are reported as missing?

I am working on a use case in Google SecOps SOAR where I want to automate file processing using file paths available in alert details.In some scenarios, an integration adds a file path to an alert's details. This path points to a file stored on a specific remote machine, such as an endpoint or server. However, the action that needs to process the file may be running on a different machine, so the file is not directly accessible using the provided path.For example, an alert might contain a file path such as C:\Users\user\Downloads\suspicious.exe. This file exists on the endpoint that generated the alert, but the action running in Google SecOps SOAR may not have direct access to that endpoint or its local file system.My goal is to automate the process of retrieving the file from the machine where it resides and then submitting it to an external analysis platform or processing it through another action.I understand that accessing a file using its path requires access to the machine or a m

Author: Simone Bruzzechesse,  Strategic Cloud Engineer   Detection engineering teams put a lot of effort into writing, tuning and deploying YARA-L rules in Google SecOps. Once a rule is live, it is easy to assume it keeps running. That isn't always true. To keep the platform stable for every tenant, Google SecOps watches how much each live rule costs to run. When a rule uses unusually high resources, the platform can move it to a LIMITED execution state, where its executions are no longer guaranteed. If its performance doesn't improve within three days, the rule is moved again, this time to PAUSED, and it stops running.This protects the platform. For the SOC, though, it creates a quiet failure: a rule that stopped running raises no errors in the case queue, sends no page and produces no alert. It just stops producing detections. The first sign may be a missed incident or a coverage review days later. The state change is visible in the console, but only if someone opens the Rules Dashbo

What’s New in Google SecOps for the interval Oct 5th through Oct 11th, 2026. Highlights Improved Terraform support for Google SecOps A new Response Hub dashboard to monitor your SOAR Playbooks An important upgrade note if you use the SOAR GitSync integration Using the Select statement in Google SQL from John Stoner How to manage Bindplane Agents via the CLI from Simone Bruzzechesse  Product Updates & New Features Google SecOps 🔥 🚀 Chronicle Release Notes from Google Cloud Docs Google Cloud has released Terraform providers and client libraries for numerous Google SecOps features accessible via the Chronicle API, including Feeds, Parsers, Rules, and Data Export. Read More Provision Google SecOps resources with Terraform | Google Security Operations | Google Cloud…Learn how to provision Terraform for Google SecOps resourcesdocs.cloud.google.com 📄 New Docs: Standard SQL > Query Performance Best Practices from Google Cloud DocsThis document introduces GoogleSQL query perfo

Author: Ayman Abdelaziz, Intervention Outcome Customer Engineer ⚠️ Important Notice: Legacy GTI ASM DeprecationThe legacy Google Threat Intelligence (GTI) Attack Surface Management (ASM) scanning engine and backend API endpoints are currently in their deprecation window as of September 28, 2026. End of June 2027: GTI will launch a native baseline ASM feature to replace non-authenticated external asset discovery workflows. September 28, 2027: Legacy GTI ASM will reach End-of-Life (EOL). The console will be decommissioned, and the API endpoints covered in this guide will return 410 Gone errors. Why use this guide now? This guide remains fully applicable until September 2027. We highly recommend using the API scripts provided below to operationalize your current data and prepare your environment for a seamless export and migration to the new native ASM features coming in June 2027.  The Need for API-Driven Attack Surface Management  As organizations expand their global infrastructure an

Hi,Can anyone explain about the SOAR based approach to ingest alerts from MDE to SecOps SOAR instead SecOps SIEM?  Does anyone faced any challenges? Which connector I should use? Microsoft Graph Security

I'm trying to configure drilldown functionality on a Table widget in Google SecOps Dashboards, where one of the displayed fields is an array (repeated field). I'm running into a rendering/drilldown limitation and would appreciate guidance or confirmation if this is a known gap.metadata.log_type = "ZSCALER_DNS"additional.fields["dns_record_type"] = "A"network.dns.questions.name = $requestnetwork.dns.answers.data = $responsematch: $requestoutcome: $ips = array_distinct($response)limit: 10000This groups results by $request (the queried domain) and aggregates all resolved IPs into a deduplicated array $ips.Problem:When $ips is displayed as a column in a Table widget, the array is rendered as a single comma-separated string in one cell, e.g.:142.250.122.94, 142.251.106.94, 142.250.118.94  I configured a drilldown mapping on $ips pointing to the UDM field network.dns.answers.data (operator =). However, since the entire array is flattened into one string value per cell, clicking on i

We are performing read-only security checks before setting up private Cloud Run staging.We evaluated artifactregistry.repositories.downloadArtifacts on an existing Artifact Registry repository for the project's Cloud Run service agent: [removed by moderator] Using POST https://policytroubleshooter.googleapis.com/v3beta/iam:troubleshoot with an explicit x-goog-user-project header, the response returned:overallAccessState: UNKNOWN_INFOallowAccessState: ALLOW_ACCESS_STATE_GRANTEDdenyAccessState: DENY_ACCESS_STATE_NOT_DENIEDprincipalAccessBoundaryAccessState: PAB_ACCESS_STATE_UNKNOWN_INFONo top-level errors were returned. The PAB explanation contained only its UNKNOWN_INFO state; explainedBindingsAndPolicies was omitted.The requesting user has project Owner access. The project has no organization or folder parent. The Cloud Run service agent has roles/run.serviceAgent, and the existing production service is operational.We understand that Google-managed service agents cannot be inspected as

We are migrating some workloads from Azure to GCP and in Azure we have Azure policy which requires resources to have contact tag and value of the tag shall be ending with @company.com, so no resources can be created without that tag being present.I tried to perform the same in GCP and it does not seem to work, tag with dynamic values does not seem to be attached to new resources at all. Environment isTag key [removed by moderator] /Product (tagKeys/ [removed by moderator] ): predefined values, e.g. DevOpsTag key [removed by moderator] /contact (tagKeys/ [removed by moderator] ): dynamic values, allowedValuesRegex: ^[A-Za-z0-9._%+-]+@company[.]com$My condition is condition: resource.hasDirectTagKey(" [removed by moderator] /Product") && resource.hasDirectTagKey(" [removed by moderator] /contact")methodTypes: [GOVERN_TAGS]resourceTypes: [compute.googleapis.com/Instance]actionType: ALLOWStep to reproducegcloud compute instances create tag-test --project comp-dev1 --zone us-east1-b

Authors:Sumit Patel, Regional Security ArchitectYazan Mughrabi, Security Practice Lead In today’s rapidly evolving threat landscape, security teams are challenged by a persistent talent shortage and an overwhelming volume of data. Integrating Google Security Operations with Gemini Enterprise creates an "Agentic SOC" that allows defenders to move at machine speed by combining human rigor with AI-driven productivity.Gemini Enterprise brings significant benefits to companies looking to leverage GenAI and low code agents to streamline operations. A big part of these operations involves the intersection of Observability and Security. Being able to bring in the context of Security to the other parts of the business allows customers to have a good overall view of the data and tools needed.By leveraging the Model Context Protocol (MCP), organizations can connect Google SecOps directly to Gemini Enterprise without the need for custom coding or complex agent creation. This integration makes Gemi

I’m evaluating integration approaches for ingesting alerts from Microsoft Defender for Endpoint (MDE) into Google SecOps and facing challenges with both SIEM and SOAR options.  With Google SecOps SIEM:  MDE alerts and their evidences are ingested as individual events rather than a single alert/incident This requires building additional detection rules to stitch events back together Due to high alert volume from MDE, suppression via SIEM detection rules becomes difficult to manage   With Google SecOps SOAR:  Using the MDE connector results in 1 alert = 1 case (e.g., 1000 alerts/day → 1000 cases) There is no pre-ingestion suppression/filtering mechanism Any update to an alert (e.g., assignment change) generates a new alert in SOAR, leading to duplication   Key Questions:  What is the recommended architecture for integrating MDE with Google SecOps? Is SIEM-based ingestion preferred over SOAR, or a hybrid approach? How do you handle alert suppression and deduplication at scale? Are there b

My 4 under development sites stopped functioning because of “Immediate Action required: Critical Issue with your Google Cloud Agent Platform project” issue. Kindly help as i don't know the actual issue and all of sites are on production.