Unanswered questions

Hi All, I am testing the Microsoft 365 Defender (XDR) Integration v26.0 and have observed the following which when looking at the documentation seems to be by design. Scenario 1Event triggered and “Incident 1” created in XDR Event triggered and “Incident 2” created in XDR Both incidents and their associated alerts are ingested into the SOAR and created: Case 1 with the name “Incident 1” Case 2 with the name “Incident 2” XDR then correlated Incidents 1 & 2 and based on a rule and renamed “Incident 1” to “Suspicious activity on one endpoint”  moved the alert from “Incident 2” to “Incident 1” and closed “Incident 2” The Sync Job in SOAR attached all alerts to Case 1 but left the Case name as “Incident 1” The SOAR Case “Incident 2” was left open along with it’s associated AlertScenario 2Event triggered and “Incident 1” created in XDR Event triggered and “Incident 2” created in XDR “Incident 1” ingested into SOAR and a Case created with the same name “Incident 1”  Before Ingestion of “I

Hello,Has anyone successfully created a simulated case using the API?I'm trying to use the following documentation:https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.legacyCases/simulateAlertHowever, I'm running into some issues. The API call reaches the CreateSimulatedCustomCase method, and the audit logs show that the service account is recognized and has the chronicle.legacyCases.simulate permission. Despite that, the request fails with the following error:Request is missing required authentication credential. Expected OAuth 2 access token, login cookie or other valid authentication credential.I'm authenticating with a Service Account using the cloud-platform scope, and the same token works successfully with other Chronicle APIs.Has anyone encountered this before or managed to create simulated cases through the API?Thanks!

Hello, team I’d like to understand the delay between when a case is created and when it’s detected. All cases based on CrowdStrike have a delay of 1 to 2 hours before the alert is generated. Can this time be adjusted? Why does this only happen with CrowdStrike? We have two SecOps consoles with different environments, and this delay only occurs on one of them; both have the same collection permissions.  

We are configuring remote agents for the SOAR to communicate internally to our tools. We have successfully deployed the remote agents (docker) and they are showing "Lived" status on the web ui.However, during the integration configuration, when we check "run remotely" and select the remote agent, we are unable to save the config. It's showing error "An error occurred while saving instance configuration". We configured everything as the documentation indicated including the service account mapping. The remote agent container does not show any error. 

Hello Google Community Team,My OAuth app verification is currently stuck and I need an internal engineer to manually trigger a status refresh or pass this along to the Trust & Safety team.* Project ID: dev-workrate* The Issue: The Cloud Console Verification Center shows a blocking error under "Homepage requirements" stating: "Your homepage website is not registered to you."* The Resolution: I have successfully verified full domain ownership for our production homepage via Google Search Console using this exact same Google account. The Problem: The console instructs me to "Reply to your email thread with our Trust and Safety team," but I have never received an initial email from the compliance team to reply to. Because the UI is entirely locked in the "Your branding is currently under review" state, I cannot modify fields or trigger a re-scan myself. Could a community manager please escalate this project ID to the Trust & Safety team so they can pull the fresh domain status from

Hi all,I am attempting to create a new Table chart in Native Dashboards utilizing the recently released SOAR Custom Fields feature.We are referring the Documentation: https://security.googlecloudcommunity.com/google-security-operations-2/new-feature-support-for-soar-custom-fields-in-native-dashboards-7604 I am trying to display standard case fields alongside two of our custom text fields: "Case ID" and "CID".  Per the documentation, I am using the required syntax paths: - case.custom_fields["Case ID"].string_seq.string_vals - case.custom_fields["CID"].string_seq.string_vals Whenever I attempt to run the query, the UI returns the following generic backend error: "An error occurred with your query. An unexpected error occurred. Loading Complete." We have already tried multiple troubleshooting variations to isolate the syntax, all of which fail:  Attempt 1(Using array_distinct in outcome): $case_name = case.namematch:$case_nameoutcome:$custom_case_id = array_distinct(case.custom_fields["C

Hi Google Community,We have already enabled these Google Workspace logs:WORKSPACE_ACTIVITY WORKSPACE_USERS WORKSPACE_GROUPS WORKSPACE_ALERTSWe want to understand clearly what WORKSPACE_PRIVILEGES will do differently compared to the above log sources.Main Questions:What extra things does WORKSPACE_PRIVILEGES handle that the other parsers (especially WORKSPACE_ACTIVITY) do not cover well? Can you explain the benefits of enabling WORKSPACE_PRIVILEGES? Please give some examples of logs/events: How they look in WORKSPACE_ACTIVITY (or others) How they look better / different in WORKSPACE_PRIVILEGES We want to confirm the real value before enabling it for the client.

Hi,Could anyone help me to fetch alert detections (custom as well as curated) of a specific entity from case using UDM Search Query and REST API?So that I can display it on the case overview.  

I am getting cannot import name 'extract_action_param'  & ‘extract_configuration_param’ from 'TIPCommon' error when I am testing the updated SOAR integration in staging mode for Azure Active Directory & Google Chronicle SOAR integrations. How to resolve this error?

Hi All,Anyone has performed a complete end to end implementation of multi tenancy in google secops SOAR SIEM.I need real example with implementation steps for typical GCP environment.Also if any relevant documents will be helpful

I am currently testing the Microsoft 365 Defender Integration (XDR) v26.0 and have noticed that if I trigger 2 x events that create 2 x Incidents in XDR that become correlated under a new Incident Name, the new Incident Name is not reflected in Google SecOps SOAR, this seems to be by design however, I would like the case in SecOps SOAR to reflect the new Incident Name in XDR, I was thinking of utilising a KQL Query in a playbook to do this, any thoughts? Trigger an event Incident 123456 (Test Incident 1) created in XDR Trigger an event Incident 123457 (Test Incident 2) created in XDR Ingest takes place in SOAR Case 5672 created with the Name Test Incident 1 Correlation takes place in XDR Incident 123457 closed and alert moved to 123456 in XDR Incident 123456 renamed from Test Incident 1 to Suspicious Activity on Endpoint SOAR Case attaches new Alert to Case 5672 and Case name stays as Test Incident 1ThanksDaryll

Hi All,We would like to authenticate with Google SecOps MCP ( Remote MCP) using an MCP Proxy in between.  Our current setup is using Workforce Identity Federation with Microsoft Entra as IDP. Anyone who has achieved this in past or knows how this can be achieved.Our goal is to have controlled communication via central exit point (MCP Proxy Server) and use our existing SecOps user creds for users to query Google SecOps MCP.   

I want to mask my client data like phone number account number etc. Is it possible to mask these data field in Secops. If yes then kindly share the related document how it can be done. If no then kindly share any alternative for this.

Hi,I wanted to know global time filter of the Google SecOps SIEM dashbaord works on which field of IOC model if we have only IOC model data coming from IOC matches?Also, I have one observation that , match which is visible in IOC match table which is not returning while quering through dashboard for same time range?

We have completed Stage 2 of SOAR Migration for our SecOps environment using Cloud Identity integration.However, I'm having trouble understanding the IAM mechanism as described in the documentation. Could you please explain it to me?* My understanding of the requirements for SOAR Migration is as follows, but is this correct? (I'm concerned that the requirement to map the PERMISSION GROUP on the Group Mapping page and the mandatory assignment of predefined roles will limit the permission control of SOAR-side functions.)* I've also heard that Workforce Identity integration doesn't have this restriction and allows operation with only custom roles. Why does the more native Cloud Identity integration have this restriction?■IAM RolesWhen accessing SecOps via Cloud Identity integration, it is absolutely necessary to assign one of the following three roles. I was previously told by support that this is required, like an entry ticket for SecOps.roles/chronicle.soarAdminroles/chronicle.soarThrea

We use the Google Chronicle Alerts connector with dynamic environment routing:Environment Field Name: event_metadata_baseLabels_namespaces_1 Environment Regex Pattern: ^(IFAP|UNIFAP|IFPI)$This correctly routes alerts from mapped namespaces (IFAP, UNIFAP → SOC-AP environment; IFPI → SOC-PI environment). Namespaces not matched by the regex (e.g., IFES, IFTM) correctly fall back to the Default Environment.Problem: Even though unmatched namespaces fall back to Default as intended, we keep receiving email notifications:"Alerts were ingested into Environment IFES which does not exist in the system. Please create this Environment in the Settings in order to see the alerts."These institutions don't have a dedicated SOC yet, so we intentionally want them in Default — not their own environment.Questions:Is there a supported way to suppress these "environment does not exist" notifications without creating an environment for every namespace? Can the connector be configured so unmatched namespaces

We have Data RBAC configured to segregate visibility between regional SOC teams (per namespace). A scoped analyst group (GRP_SECOPS_SOC-AP) is restricted to namespaces IFAP and UNIFAP via a Data Access Scope using only the standard Namespace label (no custom labels).IAM bindings on the group (all with the condition resource.name.endsWith("/soc-siem-ap")):Chronicle API Restricted Data Access Chronicle API Editor Chronicle Restricted Data Access Reader (no condition — base UI) Custom role with chronicle.nativeDashboards.get/list, chronicle.dashboardCharts.get/list, chronicle.dashboardQueries.get/listProblem: On a native dashboard panel using the Ingestion metrics data source, the following query returns no data for the scoped analyst, but returns data correctly for a global (unrestricted) admin:ingestion.component = "Ingestion API"$namespace = ingestion.namespacematch: $namespaceoutcome: $Total_Log_Volume = math.round(sum(ingestion.log_volume) / (1000 * 1000 * 1000), 4)If we change

Hello,My Google Cloud project has been suspended due to a security issue (ACCOUNT_HIJACKED).I fully understand the situation and I am ready to take all necessary actions to secure the project. However, I currently do not have access to the project anymore, which prevents me from revoking the compromised API keys or applying the required fixes.As a precaution, I have already stopped billing to prevent any further charges.At the moment, my application is completely down, which is having a severe impact on my business. My clients cannot access the service, and I am receiving increasing complaints and refund requests.I already have an open support case: 70327888This situation is becoming critical, and I would greatly appreciate any help to restore access or guidance on how I can proceed to secure the project.Thank you very much in advance for your support.Vincent

My GCP account (project ID: project-0b2ff1f9-abbb-46e6-bc1) was restricted on Feb 13, 2026 for a policy violation caused by a software bug — a flawed retry pattern that sent excessive Vertex AI API requests.I submitted an appeal and provided detailed corrective steps. On March 9, I received a project reinstatement email confirming the project is reinstated. However, the account-level restriction still blocks all access to GCP Console, CLI, and all services.Could someone help look into this? The project has been reinstated but the account-level restriction remains, so I cannot access the project to verify compliance.

Hello everyone,I am trying to build a dashboard in Google SecOps that displays statistics about malicious IP addresses observed in firewall traffic and correlated against Mandiant Fusion IOC data.The correlation works correctly in Log Search using a query similar to the following:$e.metadata.log_type = "CHECKPOINT_FIREWALL"$e.security_result.action = "ALLOW"$origen = $e.principal.ip$origen != ""$gti.graph.metadata.product_name = "MANDIANT_FUSION_IOC"$gti.graph.metadata.vendor_name = "MANDIANT_FUSION_IOC"$gti.graph.metadata.source_type = "GLOBAL_CONTEXT"$gti.graph.metadata.threat.verdict_info.confidence_score >= 90$ip_ioc = $gti.graph.entity.ip$origen = $ip_iocThe query returns results successfully in Log Search.However, when I try to use the same logic in a Dashboard/Report widget, no data is returned. I also tested simplified queries that only reference MANDIANT_FUSION_IOC graph entities (without any UDM event correlation), and they still return no results in Dashboards.My question

Hi, my Google Cloud/Firebase project was suspended for suspected key misuse (account_hijacked).I submitted an appeal, but after 9 days I still have no response.This is now a production outage: about 1200 paying users cannot log in and trust for my application is starting to go down rapidly. The business impact this has is nothing short of a disaster, and the students that’s using the application to study for exams are panicking and asking for refunds.What I already did:Removed exposed credentials from files/repos Rewrote Git history and force-pushed cleaned history Removed old test/dev files with hardcoded keys Tightened secret handling to prevent re-commitWhat I am ready to do immediately when access is restored:Rotate/revoke all affected keys Apply strict key restrictions (referrer/IP/API allowlist) Move secrets to Secret Manager Review IAM, billing, and audit logsI’m currently blocked because suspended status prevents console access.Can anyone advise:how to confirm the appeal is act

Dear All, I need your help to understand  log ingestion for vulnerability management tool.   Currently in our environment , we are managing tenable.io vulnerability management console. We need to on-board the  vulnerability logs into GoogleSecops. On search , we found the below article  which is purely related to SOAR concept but we wish to understand how to on-board the logs from SIEM concept. Request  your kind support to address  this issue. As we are running out of time.                                                                    Tenable.io  |  Google Security Operations  |  Google Cloud Documentation

Hi all,Looking for advice from anyone who has navigated a "Hijacked Resource" suspension or has insight into typical Trust & Safety appeal timelines.TL;DR: Production Firebase project (live consumer app) was suspended on May 21 for suspected credential compromise. I had unintentionally committed service account keys to a private repo (months ago) and it has only been pulled by 2 developers.  Despite this exposure, my audit logs show no abusive activity, no foreign IP usage, and total billing for the month was about $1.99. I responded to the Trust & Safety follow-up on May 25 with a full remediation report. 13 days in, still no response. Console is locked behind the appeal screen.What I've done:Revoked all user-managed keys on affected service accounts via gcloud CLI (only SYSTEM_MANAGED keys remain) Deleted exposed Gemini API keys in AI Studio Purged credentials from version control history Rotated third-party keys (payment processor and others in progress) Reviewed 120 days of

I ran across an error in the detection pane for a rule, that does not show up in the rule editor. How is that even possible? 

Hi! Is it possible to create cases in SecOps based on emails received in O365?Any experiences?