Recently active topics

Hello,We are implementing a secure account deletion workflow using Google Cloud Run, IAM, Firebase Authentication, and Firestore.During our pre-deployment security checks, Google Cloud Policy Troubleshooter v3beta returns HTTP 200, but its evaluation includes: PAB_ACCESS_STATE_UNKNOWN_INFO Overall access state: UNKNOWN_INFO Environment: API: policytroubleshooter.googleapis.com Endpoint: POST /v3beta/iam:troubleshoot Resource type: Google Cloud service account Permission: iam.serviceAccounts.getIamPolicy The requesting principal has the Project Owner role. What we have verified: Policy Troubleshooter API is enabled. The API request succeeds with HTTP 200. Direct IAM policy reads and permission checks succeed. The result was reproduced in separate requests. The response does not establish whether a Principal Access Boundary policy applies. Questions: What causes PAB_ACCESS_STATE_UNKNOWN_INFO in Policy Troubleshooter v3beta? Does this indicate insufficient permissions

Hi everyone, We're ingesting Google Workspace logs into Google SecOps using feed-based ingestion (Method 2, Third Party API). Most Workspace feeds work, but we have two issues:1. WORKSPACE_ALERTS only brings in a small subset of the alerts shown in the Workspace Alert Center.2. WORKSPACE_CHROMEOS shows "Completed" but no data is ingested at all. EnvironmentGoogle SecOps (SIEM + SOAR), region: asia-southeast1 Google Workspace editions: Enterprise Starter, Business Starter, Frontline Starter (no Enterprise Standard/Plus) Other subscriptions: Chrome Enterprise Core, Chrome Enterprise Premium, Google Meet hardware, Cloud Identity Free Auth: GCP service account + domain-wide delegation, impersonating a dedicated Workspace admin user What's configuredAPIs enabled in the GCP project: Admin SDK API, Alert Center API Domain-wide delegation for the service account with all 7 documented scopes, including:  - https://www.googleapis.com/auth/apps.alerts  - https://www.googleapis.com/auth/admin.dire

What’s it going to be the path of certs with Wiz?

I received the following email about my recaptcha quota :Summary: You are receiving this email because your site key exceeded the free assessments limit in reCAPTCHA V2 or V3. Please use our new migration path to upgrade to reCAPTCHA Enterprise so you can have unlimited assessments for your site key.Thank you for being a reCAPTCHA user. Your site key is currently using reCAPTCHA over the quota limit of 1 million calls per month. If you do not migrate to reCAPTCHA Enterprise, within 30 days following this notice, your site key will not protect your webpage after 1 million calls per month.If a site key exceeds 1000 calls per second, then some requests may not be processed. If a V3 site key exceeds 1 million calls per month, then the site might return a static score of 0.9 and an error message that says `"over free quota."` for the remainder of the month. If a V2 site key exceeds its monthly quota, then the following or a similar message may be displayed to your customers in the reCAPTCHA

Title: Google Chronicle SOAR Integration Fails "Test Connection" with GA v1 1Platform Endpoint (/ioc/listiocs 404 JSONDecodeError)Product: Google Security Operations (SOAR & SIEM)Integration: Google Chronicle (Marketplace Integration)1. Description of the IssueGoogle’s official Chronicle API Migration Documentation instructs customers migrating away from legacy APIs (Backstory / Ingestion) to use the 1Platform General Availability (GA) regional template:https://{region}-chronicle.googleapis.com/v1/projects/{project}/locations/{location}/instances/{instance_id} However, when configuring the official Google Chronicle integration instance inside Google SecOps SOAR using this documented GA v1 endpoint, clicking Test fails immediately with the following error:Status: 2: Result Value: falseOutput Message: Authentication with Workload Identity to Google Chronicle server resulted in failure. Error: Unable to connect to Google Chronicle, please validate your credentials: Unable to list IOCs

Hi all,In the Google SecOps feed creation UI, the Microsoft Azure Event Hub source type lets me select log types such as Azure AD Directory Audit, Microsoft Defender for Endpoint and Microsoft Defender for Identity.However, the documentation for these log types only describes ingestion through Azure Blob Storage (Event Hub Capture for Entra ID Audit, Streaming API to Storage for MDE/MDI).Is ingesting these log types directly from an Event Hub, without Capture or Blob Storage, officially supported?Thanks!

Hello,I'm getting intermittent 500 INTERNAL errors from accounts/mfaEnrollment:start and accounts/mfaSignIn:start after enabling Fraud Defense "Enforce" mode (phoneEnforcementState) for SMS-based MFA in my Identity Platform project.The exact same requests work fine when I switch phoneEnforcementState to "AUDIT". I tested tollFraudManagedRules.startScore as low as 0.1, but even at this threshold some legitimate requests still fail with the error:{  "error": {    "code": 500,    "message": "Internal error encountered.",    "status": "INTERNAL"  }} Has anyone successfully debugged this kind of toll fraud protection issue? 

I’m working for vendor risk assessment or Bank compliance review for the following documents and reports. I’ve tried to access the “Compliance Reports Manager” but it seems that I have no access. Please someone advice.Google SOC2 Type II Google ISO27001 Google DPA Google Data Retention Statement Google Responsible AI Documentation Google AI Security Documentation

Hello All ,Issue - reCAPTCHA Enterprise Policy-Based Challenge consistently returns BROWSER_ERROR for some usersWe are using reCAPTCHA Enterprise Policy-Based Challenge on an ASP.NET Web Forms application.Site key integration type: Policy-Based ChallengeAction: confirmThreshold: 0.3For some production users, grecaptcha.enterprise.execute() returns a token successfully, but when we create the server-side assessment at backend code , Google returns:TokenProperties.Valid = falseInvalidReason = BROWSER_ERROROther fields are:Score = 0Challenge = UNSPECIFIEDOne affected user received the same result repeatedly over several hours rather than just once.Questions:What exactly causes BROWSER_ERROR for Policy-Based Challenge? We did see that its not only for Policy-Based but also for a Score based also we do get some times. If execute() returns a token but the subsequent assessment returns BROWSER_ERROR, what browser/network communication is failing? Is there a recommended list of Google endpoint

October 6, 2026  Audience: SOC leads, detection engineers, SecOps platform adminsSummary: Google SecOps native dashboards turn detections, rules, and ingestion telemetry into trends, so you can tell whether your detection program is working, degrading, or broken. This briefing defines three core dashboards, the metrics behind each, and the YARA-L 2.0 queries to build them. All queries are based on Google's published dashboard examples.1. PurposeTriaging alerts one at a time doesn't show problems that build up across the whole program: telemetry that has stopped flowing, parser regressions, rules that have drifted, and growing alert fatigue.Question Signal Is the program working? Alert volume and severity mix stay inside baselines, and high-value rules keep firing Is it degrading? Noise is growing, precision is falling, parsing errors are rising Is it broken? A log source has gone silent, rules never fire, or a parser is failing  Data sources usedData source Query prefix

Project ID: wixtoproject Project number: [removed by moderator] App: StoreToSheet — a published Google Workspace Marketplace add-on Submitted: 4 October 2026WHAT'S HAPPENINGI submitted OAuth data-access verification on 4 October. The Verification Center stated a first email from Trust & Safety within 3–5 days and a decision within 4–6 weeks. No email has arrived at the registered developer contact address — I've checked spam for [removed by moderator] — and the Verification Center provides no reply or contact control of any kind.CURRENT PANEL STATEHomepage requirements: Approved Branding guidelines: Verified and shown to users Privacy policy requirements: Under review App functionality: Pending Appropriate data access: Pending Request minimum scopes: PendingSCOPES — TWO ONLY, NO RESTRICTED SCOPEShttps://www.googleapis.com/auth/spreadsheets.currentonly — non-sensitive https://www.googleapis.com/auth/script.external_request — sensitiveThe restricted tier is empty, so no CASA assess

Author: Peter Solagna, Cloud Security Consultant  Google Cloud Security Operations lets you monitor logs for matches against indicators of compromise (IOCs).While you can enable 1st party threat intelligence feeds, many organizations also ingest proprietary IOC data to enhance detections.To ingest custom IOCs, parse the data as an entity context graph and populate the ioc.*  fields. SecOps includes default parsers for sources like MISP.Matching event logs appear automatically in the IOC MATCHES dashboard under Alerts & IOC. These dashboard matches rely on specific internal data model fields: ioc.active_timerange.end ioc.active_timerange.start ioc.categorization ioc.confidence_score ioc.description ioc.domain_and_ports.* ioc.feed_name ioc.ip_and_ports.*  Note: The ioc.*  fields are populated during ingestion normalization and are internal-only (not searchable via UDM search, nor usable in your own detections).Automatic IOC MATCHES dashboard matches do not generate aler

What’s New in Google SecOps for the interval Sep 28th through 4th Oct, 2026.  Product Updates & New Features Google SecOps 🚀 Release Notes from Google Cloud DocsGoogle SecOps has updated the Chronicle API Restricted Data Access Viewer IAM role, expanding its read-only permissions to include those of the Chronicle API Viewer role, excluding global data access. Read More📑 New Docs: Investigation > Search Syntax Reference from Google Cloud DocsThis document outlines the comprehensive search syntax for Google SecOps SIEM, guiding security analysts on configuring search expressions in the query editor. Read More📝 Updated Docs: Use Google Secops MCP from Google Cloud DocsThis update introduces a comprehensive guide for integrating Google SecOps with Gemini Enterprise. The new section details the process, including: Setting up an OAuth 2.0 Web Application in Google Cloud Console, specifying redirect URIs, and outlining required IAM roles. Configuring a Custom MCP datastore within

In our previous blog, we introduced the WHERE pipe operator and discussed how it can be used to filter rows from a data set. Today, we are going to take a look at the SELECT pipe operator to reduce the number of columns returned in a query.  Using the SELECT and WHERE pipe operators together immediately shrinks a data set as vast as UDM events into a much smaller data set that can then be further refined. Notice I am using the word columns rather than fields. This is intentional because as we evolve our queries, we are going to transform the data to create new columns of data that are derived from fields. While the SELECT pipe’s functionality may seem fairly obvious, it’s important to make sure the fundamentals are covered before we get into more advanced queries, so stick with me. A Basic SearchIn a YARA-L search, we don’t need to take into account the columns being returned when we are exploring the data within the UI:principal.hostname = "win-server.lunarstiiiness.com" In traditiona

Author: Jose Luis Sanchez Martinez,  Senior Security Engineer Introduction In today's fast-moving cybersecurity landscape, security operations are transitioning from manual, repetitive triage to intelligent, proactive defense. At the core of this transformation are Agentic workflows, which shift AI from a simple conversational assistant into an active, autonomous collaborator.To power this new paradigm, Agentic threat intelligence in Google Threat Intelligence officially launched in General Availability (GA) in January this year. Agentic threat intelligence provides a multi-language conversational interface that unlocks Google's vast threat intelligence, allowing security analysts to chat with specialized AI agents to accelerate security investigations and obtain immediate threat analysis.At the same time, traditional URL analysis has been redefined by the VirusTotal launch of URL Scanning 2.0, an update that significantly expands URL analysis capabilities by introducing automated visi

Guests:Sivanesh Ashok, bug bounty hunter Sreeram KL, bug bounty hunterTopics: Cloud Posture and Hygiene Cloud Security Practices29:29Subscribe at SpotifySubscribe at Apple PodcastsSubscribe at YouTubeTopics covered:We hear from the Cloud VRP team that you write excellent bug bounty reports - is there any advice you'd give to other researchers when they write reports? You are one of Cloud VRP's top researchers and won the MVH (Most Valuable Hacker) award at their event. What do you think makes you so successful at finding issues?  What is a Bugswat? What do you find most enjoyable and least enjoyable about the VRP? What is the single best piece of advice you'd give an aspiring cloud bug hunter today?

IntroductionA SIEM is only as good as the data reaching it. When a feed stalls, a parser breaks or a forwarder falls silent, detections go quiet with it, and nobody is told. This guide closes that gap without loosening a single control on your SecOps project. It walks through the Google Cloud console, click by click. You link the SecOps project to a central monitoring project through a metrics scope, then build three alerts on the native metrics SecOps already publishes. Alerting roles, policies and notification channels all live in the central project, so the SecOps project stays exactly as locked down as it is today. How it fits togetherThe central monitoring project reads SecOps metrics through its metrics scope, so every alerting policy and notification channel is created outside the SecOps project. SecOps metrics stay in the SecOps project. The metrics scope lets the central project read them and alert on them. This guide uses CENTRAL_PROJECT and SECOPS_PROJECT as placeholders for

We’ve spent plenty of time building searches in Google Security Operations (SecOps), but previously we focused on building searches for events and entities. Today I want to highlight how we can use search to find detections and how this can be used in your workflow. Detections or Alerts?When we talk about searching for detections, we are covering both detections and alerts. For those not familiar with the broader data flow and the nuance here, stick with me for a moment.  Traditionally, events are processed by the rules engine and if events matched conditions laid out in a rule, a finding would be created. This finding could be made available in a queue to an analyst to triage and investigate and flow into a case. These types of findings are considered alerts. On the other hand, you might have a finding that does not merit this additional workflow. These are then classified as detections. Within the rules engine, it is possible to detect but not alert. Both detections and alerts are st

Hello,I am a physician and the founder of Néa, a French digital health project currently preparing its first application for production.Néa is intended to become a broader digital health ecosystem, with several applications and services planned over time. Our roadmap involves substantial use of cloud services, including AI capabilities, document/OCR processing and secure health-data infrastructure. We are currently evaluating Google Cloud as a long-term technology platform for this ecosystem.Before scaling our use of Google Cloud, however, we need to complete the HDS v2.0 contractual and compliance requirements applicable to the processing of French health data.According to Google Cloud’s HDS documentation, Google Cloud is HDS v2.0 certified and an HDS Addendum is available through a Google Cloud sales representative.Our difficulty is simply reaching the appropriate Google Cloud team.We have submitted several requests through Google Cloud Sales and Security contact channels and tried t

Hello guys,I have a theoretical question for my understanding of SecOps behavior when namespaces are involved. Let’s say I have a SecOps instance with multiple namespaces configured, and matching environments configured on the SOAR part (1 to 1 with namespaces). I also have a multi-event rule that monitors  events regardless of namespace. The rule also has a `match` field that is not an asset. My question:If this multi-event rule triggers based on data from multiple namespaces, in what environment will the alert land ? 

Our embedded form is receiving hundreds of bot signups. When I tried to enable reCAPTCHA, it displays ‘This site is exceeding reCAPTCHA Enterprise free quota.’ Can you confirm whether this is an issue with MailerLite’s reCAPTCHA configuration? Or….?

Hi, I'm working on modifying an ontology to create entities from UDM properties. My problem is that I am not able to extract fields like files_accessed_1_filename, files_accessed_2_filename and so on without hardcoding each mapping to another 10 rules or extracting some unwanted properties (because I used the contains/startswith/endswith functions). I was hoping that I could do some regex to get the whole list of filenames (or just have all the filenames in 1 single UDM property). Is there any solution to this? Please look at these images to see the problem:Thank you!

 IntroductionYour custom YARA-L rules are some of the most valuable content in Google SecOps. Each one captures months of tuning, threat research and hard-won knowledge about your environment. A rule that is deleted by mistake, broken by a rushed edit, or needed again after a migration is painful to rebuild from memory.The quick fix is a script that exports every rule using a service account key. Many organizations can no longer do that: their cloud policies ban long-lived service account key files, because a leaked key gives an attacker the same access until someone notices and revokes it.This guide shows a better way. A small Cloud Run function, triggered daily by Cloud Scheduler, exports every rule to a Cloud Storage bucket. It authenticates with its own service account through short-lived tokens, so there is no key to download, store or rotate. Setup takes about 30 minutes in the Google Cloud console, with no software to install. This guide deploys a Cloud Run function that backs u

could some one please help check what i need to do for this aws guard duty feed as other are already on V2 but i think this is not auto upgraded i am also not getting logs in my SIEM from last 2 days so a bit worried on this what action should i take to solve the issue please guide.  

September 29, 2026 Summary: Curated Detections are YARA-L 2.0 rule sets that Google and Mandiant write and maintain. They run against your UDM-normalized telemetry. Enabling them gives you vendor-maintained coverage of known threat techniques without adding to your custom rule backlog.1. How they workAspect Detail Rule language YARA-L 2.0, the same engine as custom rules Data model Runs on UDM events and entity context. Parsers must normalize your logs correctly or the rules won't fire. Authorship Google Cloud Threat Intelligence and Mandiant, based on incident response findings and tracked threat actor TTPs Update model Google pushes changes to the rule logic. You get new coverage (including for actively exploited zero-days) without redeploying anything. Visibility You can't edit the rule logic. You can see each rule's metadata: what it detects, the log types it needs, its severity, and its MITRE ATT&CK mapping. Output Standard detections and alerts, labeled wi