Unanswered questions

Hey Community, I'm working on configuring a detection rule in SecOps to monitor and generate an alert when a file owned/signed by my company is uploaded to VirusTotal. Has anyone worked on a similar task in the past? 

I am having difficulty writing a detection rule to identify VPN IPs, specifically for services like Mullvad VPN and other similar VPN providers, using only built-in threat feeds (no external data sources). I do not want to hardcode ASN numbers.

Hello,I have a bindplane configuration that collects logs from Active Directory and Windows Events. However, I noticed that some events are not being sent to the blindplane, but are generated on the server.For example, event 4740. I can see this event in the event viewer, but at no point is it consumed by the bindplane.What could be causing these events not to be brought in?

hello, has anyone encountered or have used security_result.variables.key before? i would like to ask for your help with the parser syntax for it. tyia!

Im using set context on alert level and i have multiple duplicate values.Now i need to remove all duplicates

Hi All,I’ve integrated Microsoft Graph Mail with Google SecOps SOAR. For the Delete Mail  action, if we don’t provide specific values for the Sender or Subject filters, will the action delete all emails from the user’s mailbox?

I’ve been using this page to reference collector ID values in ingestion metrics.https://docs.cloud.google.com/chronicle/docs/ingestion/ingestion-notifications-for-health-metricsRecently, I’m seeing bbbb1111-bbbb-1111-bbbb-1111bbbb1111and ffffffff-ffff-ffff-ffff-ffffffffffffvalues returned for ingestion.collector_id -- are these documented anywhere? Seeing UDM as the ingestion.metadata.log_type for these -- I assume one or the other of these corresponds with entity risk change UDM events which have recently been enabled, but not sure about the other.https://docs.cloud.google.com/chronicle/docs/release-notes#October_28_2025

I have seen “Integration - Updated integration action definitions to meet the new requirements of IDE” come up in lots of SOAR integration updates. What new requirements are being referenced? Is there some kind of deadline by which these updates have to be implemented?

Can anyone identify the difference in the maximum result when using different over values in the match?Example: I search the last hour of logs by log_type: events: $event.metadata.event_timestamp.seconds > timestamp.current_seconds() - 3600 $silent_hostname = $event.metadata.log_type And in the match I insert: match: $silent_hostname over 30 min This shows me 2 groups of logs:Group A (the first 30 minutes) and Group B (the last 30 minutes).With the following outcome, to show me the max timestamp of each group: outcome: $max_event_time = max($event.metadata.event_timestamp.seconds) I get 2 results, each with the max timestamp for its group.However, if I change the over value to 1 hour, it is supposed to return only one result, with the max timestamp equal to the max timestamp from Group B. But this does not happen. Instead, I get only one result, but the max timestamp is much lower than the max from Group B and slightly higher than the max from Group A.

I’m trying to integrate reCaptcha v 3 into our checkout page. It seems that no matter what I do the call to grecaptcha.enterprise.execute is always returning a token of 0.Here is the button event: function OnCCCard(e) {            e.preventDefault();            grecaptcha.enterprise.ready(async () => {                console.log('Getting Token');                const token = await grecaptcha.enterprise.execute('MyKey', { action: 'checkout' });                console.log('Got Token:' & token);            });        }No matter what I try the second console.Log always says : “Got Token: 0”I’m not sure what I’m doing wrong. 

Hi, We are in the process of setting up Google reCAPTCHA and are facing an issue related to URL filtering on our Palo Alto firewall. We created URL filtering rules to allow only recaptchaenterprise.googleapis.com, but reCAPTCHA is still not functioning as expected. During troubleshooting, access began working immediately after we removed the URL filtering restrictions, which confirms that the firewall had been blocking one or more additional Google domains required for reCAPTCHA validation. However, when we re-enabled the URL filtering policy and permitted only recaptchaenterprise.googleapis.com, the issue returned. This indicates that reCAPTCHA Enterprise relies on multiple backend Google domains, and allowing just this single URL is not sufficient for the complete validation workflow. To fully restore functionality, we may need to allow the complete Google reCAPTCHA domain set as recommended by Google, instead of permitting only a single hostname. Please advise on the exact list of d

Hi Team,I am looking to get an alert if I miss a log from an endpoint from a server. Since the ingestion API monitoring is not granular enough to get this info, I planned to create a dedicated Yara-L rule for the said server. The rule I had planned for looked something like this:    rule silentLogFromCriticalEndpoint { meta: author = "Srijan Kafle" description = "Detects missing logs from server" severity = "MEDIUM" created = "2024-06-03" events: $session.principal.namespace = "prodSydney" and $session.principal.hostname = "redacted" $source = $session.principal.hostname $tenant = $session.principal.namespace match: $source,$tenant over 12h outcome: $risk_score = 3 // logic to check delay here which is not working $delay = $session.metadata.event_timestamp - timestamp.current_seconds() condition: $session and $delay >= xyz }  line 23 and 26 not a working line currently but wanted to includ

I have been thinking about how google is assures log data post ingestion is stored in an immutable state for assurance from data security viewpoint.  I tried searching for SecOps documentation but unable to find a straightforward statement. Also, once data is stored, is there a way one could delete/alter the data, if one has an appropriate permission to do so.  And how to keep a tap to such actions.?  

I can't add a timezone setting to the timestamp.The part of the parser that extracts the timestamp is below.----------date {match => ["eventtime1", "UNIX", "UNIX_MS"]on_error => "not_eventtime1_valid"}----------I tried the following settings:①----------date {match => ["eventtime1", "UNIX", "UNIX_MS"]timezone => "Asia/Tokyo"on_error => "not_eventtime1_valid"}----------Result:No change.②----------date {match => ["eventtime1", "yyyy-MM-dd HH:mm:ss"]timezone => "Asia/Tokyo"on_error => "not_eventtime1_valid"}----------Result:Syntax error.The current time is stored in UNIX time in timestamp.Is it possible to reflect the time zone setting in the above settings?

Hi,I am developing a custom parser for a email-security product with JSON logs.Everything is working as intended, except for information I want to include under “security_result.action_details” UDM field, which does not get populated whatever I try.My code is as follows:if [event][scan][indicators] != "" { for indicator in [event][scan][indicators] { mutate { replace => { "action_details" => "indicator" } } mutate { merge => { "security_result.action_details" => "action_details" } } mutate { merge => { "udm_event.idm.read_only_udm.security_result" => "security_result" } } }}With the json log having information in this format (redacted all other information about the email and left only the structure and relevant field): { "event": { "scan": { "indicators": [ "MachineLearningGood", "SuspiciousUri" ], "aiClassifier": "neutral"

Hello Google Cloud Community,I would like to clarify a point regarding Google SecOps licensing.I have been reviewing the official documentation, including the "Applied Threat Intelligence overview" and "Emerging Threats overview." The documentation states that the Applied Threat Intelligence (ATI) and Emerging Threats features are available with the Google SecOps Enterprise Plus license.However, it is not entirely clear whether these features are excluded from the Enterprise license.Could someone please confirm my understanding?Is it correct that the Applied Threat Intelligence and Emerging Threats features are unavailable with the Enterprise license? Is the Enterprise Plus license strictly required to use them?Thank you in advance for your help.

Hi All,Struggling to find "graph.metadata.threat.threat_feed_name"  for info stealers. Also , how to get those list of threat feeds , we can leverage. for both VT and Mandiant.Thanks in advance  

Hi AllHow to export the list of rule name both curated and custom. (not the rule set name) RegardsAjay P

We are encountering an error when attempting to create multiple data feeds in Google SecOps SIEM from a single Azure Event Hub.The error message "Combination is not unique" suggests that the system is not allowing multiple feeds with the same configuration details.We have configured an Event Hub with multiple log sources (Azure Activity, Defender logs)Questions:[1] whether we need to create separate Event Hubs for each data feed or if there's a way to differentiate the data streams within the same Event Hub for ingestion into SecOps SIEM, referencing the documentation on https://cloud.google.com.mcas.ms/chronicle/docs/administration/create-azure-feedhttps://cloud.google.com/chronicle/docs/administration/create-azure-feed#create-azure-event-hubBased on our understanding, we should be able to use the same Azure Event Hub to ingest different data feeds into Google SecOps. This is achieved by utilizing **consumer groups** to manage separate data streams; each consumer group functions as an

Hi.I have three questions.①The email from Google Cloud said:“If you do not take action within 90 days of receiving this notice, your keys will automatically be associated with your Google Cloud project.”Even after 90 days have passed, they have not been automatically associated with a Google Cloud project.When will this happen? Did that notification have any meaning?②The email stated, “You will receive a notification when the association process is complete.”When the association is finished, will a notification be sent to the same address specifying which domain the process has been completed for? ③I understand that billing will begin with the month in which we exceed the free tier.Will the billing statement be sent by email or by postal mail?

 Hi everyone,I’m reaching out to check whether others are experiencing issues with the curated detection ruleset Workspace: Data Exfiltration from Gmail in Google SecOps.We’re using the recommended direct ingestion path for WORKSPACE_ACTIVITY logs (including Gmail). While the ingestion and parsing work, we’ve noticed that the UDM fields produced by the Workspace Activity parser do not align with what the curated detection rules expect — specifically in the Workspace: Data Exfiltration from Gmail ruleset.Examples of mismatches include:principal.application is populated with only the message_info.source.service value (e.g., gmail-ui), while the curated rule expects a concatenated value such as gmail-ui send. The selector value is placed under additional.fields instead of a field the curated rule monitors. metadata.product_name is mapped as gmail (lowercase) even though some curated rules appear to expect GMAIL (uppercase), with no case-insensitive matching applied.The curated rules do no

Hi everyone, I've been exploring Google Cloud's Confidential Computing products like Confidential VMs, GKE Nodes, and Confidential Space. The potential for protecting data-in-use is very promising, especially for sensitive AI workloads. My question is:How can we securely integrate third-party AI models (e.g., from open source or external vendors) into Confidential Space or Confidential VMs without compromising data privacy or the TEE trust boundary? Are there recommended architectural patterns, isolation practices, or attestation tools we should use when the model provider is not part of our organization? Appreciate any insights, resources, or examples you can share! Thanks,

Estou criando um webhook no SIEM para configurar com o Tenable. É  necessário criar um fluxo? Qual seria esse fluxo? Google Translate: "I am creating a webhook in the SIEM to configure with Tenable. Is it necessary to create a workflow? What would that workflow look like?"

I set up a few months ago a long ingestion for slack audit via S3 bucket. It was working fine up until a few days ago that i went to search for logs and couldnt find the log type or log source or literally anything related to this feed. I checked the S3 side to make sure everything is working as intended, didnt find any discrepancy there, checked the feed to see when was the last time it received logs from the S3 bucket and its actively receiving it. However, where are the logs going? I’m not seeing anything when i try to search it and i dont know how to troubleshoot this issue? is there a last chance source that i can look in? (splunk has something like this) or is there a way to search what may be the issue? i am going to look into the log explorer in gcp console to see if there’s anything i can find on it there. Please help? suggestions? tips appreciated!

Hi everyone,I am looking for advice on the best architecture for ingesting Akamai WAF logs into Google SecOps. We are currently trying to find another way rather from using Bindplane.We are checking with Akamai DataStream 2, but we are running into a visibility issue. The streams seem to be metrics-heavy and when we look at the WAF data, we are primarily seeing the "Rule Trigger" ( just the Rule ID and Action, e.g "securityRules": "ULnR_28976|3900000:3900001:3900005:3900006:BOT-ANOMALY-HEADER|" ).In that case, we are missing the deeper forensic context we need for analysis, such as: Payloads / Post Body details The specific logic that caused the match So I have some questions:  Is DataStream the wrong tool for this? Is it possible to configure DataStream 2 to include full request details, or is it strictly for high-level metrics and simple triggers? SIEM Integration API: Is the "Akamai SIEM Integration" (the Pull API) considered the standard for getting the full verbose security ev