Unanswered questions

Hi everyone,I’m currently working on integrating Microsoft Intune logs into Google Cloud (via the Microsoft Graph API).From what I’ve observed so far, it seems that only audit logs are accessible through this integration.I wanted to ask:Is there a limitation with the Graph API that restricts collection to only audit logs? Are operational logs and compliance logs available through any other endpoint or method? If not, are there any recommended alternatives or workarounds to ingest these logs?Would appreciate any insights or guidance from the community.

Hi everyone,I’m currently working on integrating Microsoft Intune logs into Google Cloud (via the Microsoft Graph API).From what I’ve observed so far, it seems that only audit logs are accessible through this integration.I wanted to ask:Is there a limitation with the Graph API that restricts collection to only audit logs? Are operational logs and compliance logs available through any other endpoint or method? If not, are there any recommended alternatives or workarounds to ingest these logs?Would appreciate any insights or guidance from the community.

Hello everyone,I am seeking urgent guidance regarding a GCP project suspension. My account was recently suspended, and I received an email stating that the project was engaged in abusive activity consistent with "hijacked resources."The Situation:Access Denied: My production application is currently offline. Whenever I attempt to access the IAM & Admin or APIs & Services dashboard to investigate, I am automatically redirected to the suspension warning page. Unknown Leak: I have audited my frontend/backend/app environment variables (.env) but haven't found any obvious exposures. Account Lockout: Because I cannot access the IAM dashboard or Cloud Logging, I am unable to identify which credential is being abused or delete the compromised keys. Appeal Status: I submitted an appeal over a week ago, but I have not received a response, and my production app remains affected.My Questions:Is there a way to access Cloud Logging or Security Command Center via the SDK or a restricted conso

I have few questions about submission process for the SecOps SIEM custom integration:Can I publish my SecOps SIEM custom integration in Content Hub? It is containing these componants: Ingestion Script Dashboard Detection Rules Search Queries Is there any public repository to submit these componants or any of them as part of content hub?

Hello,My Google Cloud project has been suspended due to a security issue (ACCOUNT_HIJACKED).I fully understand the situation and I am ready to take all necessary actions to secure the project. However, I currently do not have access to the project anymore, which prevents me from revoking the compromised API keys or applying the required fixes.As a precaution, I have already stopped billing to prevent any further charges.At the moment, my application is completely down, which is having a severe impact on my business. My clients cannot access the service, and I am receiving increasing complaints and refund requests.I already have an open support case: 70327888This situation is becoming critical, and I would greatly appreciate any help to restore access or guidance on how I can proceed to secure the project.Thank you very much in advance for your support.Vincent

Any one has any idea what is this in chronicle can some one explain in detail  

Title: Securing the Agentic Era: Governance and Trust in the New Gemini Enterprise Agent Platform Author: Tyler DooskinDate: April 26, 2026 IntroductionFollowing the major announcements at Google Cloud Next '26 in Las Vegas this week, the shift from experimental AI to the "agentic enterprise" is officially underway. The headline news is the consolidation and evolution of Vertex AI into the Gemini Enterprise Agent Platform [1]. As organizations deploy autonomous agents capable of managing complex, multi-day workflows, the conversation immediately turns to trust. How do we secure systems that not only retrieve data but act upon it?Here is a breakdown of the new governance, security, and compliance controls introduced for the Gemini Enterprise Agent Platform and what they mean for your security posture.From Vertex AI Governance to Gemini Enterprise ControlThe evolution from Vertex AI to the Gemini Enterprise Agent Platform isn't just a rebrand; it represents a unified approach to building

Hello,I am experiencing an issue related to the use of Data Tables for data enrichment in SOAR. Currently, we have several tables containing IP addresses along with their corresponding hostnames (and in some cases, additional information such as VLAN or other attributes).The goal is to query these tables using the “Is Value In Data Table” action, so that when searching for an IP address, the associated values from the corresponding columns are returned. However, a limitation arises because we need to query three different Data Tables simultaneously, each with different structures and fields.The expected output would be something like:IP (hostname, vlan) if associated information exists IP only, if no match is foundAdditionally, we encounter issues when multiple IPs are present in the same alert. The output does not preserve the relationship between each IP and its corresponding hostname, instead returning an aggregated result such as:ip1, ip2, ip3, hostname1, hostname2, hostname3, whic

in my project show this message “My Project (id: bionic-xxxx) is being suspended for repeatedly violating our Google Cloud Platform Terms of Service or Acceptable Use Policy (including Terms of Service of the Google API you may be using). “ and I can not do anything on my project.How can I fix this problem? I submitted a request a long time ago, but I haven't received a response from Google support yet.-Does anyone have a solution? Please help me.

Project id: project-5580276092549813950My project got suspended 5. april, due to misuse of some keys.I have filed an appeal, taking actions on how to prevent this from happening again. But I do not get any response at all.Now observing users are dropping off, users not able to sign on, complaining. It is very devastating to observe, years of developing an app for dog owners. It is very critical.  Actions Taken:• Removed exposed API keys from all repositories and application code• Ensured that no API keys or credentials are publicly accessible• Reviewed all Git repositories and verified that sensitive credentials are no longer present• Updated development practices to prevent API keys from being embedded in client-side applications• Planned migration of all Gemini API requests from client-side usage to a secure backend service• Implemented safeguards to ensure that future API usage is authenticated and controlled• Preparing to rotate all API keys and service account credentials immediat

Hi, my Google Cloud/Firebase project was suspended for suspected key misuse (account_hijacked).I submitted an appeal, but after 9 days I still have no response.This is now a production outage: about 1200 paying users cannot log in and trust for my application is starting to go down rapidly. The business impact this has is nothing short of a disaster, and the students that’s using the application to study for exams are panicking and asking for refunds.What I already did:Removed exposed credentials from files/repos Rewrote Git history and force-pushed cleaned history Removed old test/dev files with hardcoded keys Tightened secret handling to prevent re-commitWhat I am ready to do immediately when access is restored:Rotate/revoke all affected keys Apply strict key restrictions (referrer/IP/API allowlist) Move secrets to Secret Manager Review IAM, billing, and audit logsI’m currently blocked because suspended status prevents console access.Can anyone advise:how to confirm the appeal is act

Hi Google Team,We have successfully integrated Microsoft Intune logs into Google SecOps using a third-party Graph API feed. The feed configuration appears to be working — logs are being ingested and the feed shows a healthy status.However, we've noticed a significant discrepancy in log size:- **In Google SecOps (via the feed):** Ingested log size is approximately **40 KB**- **Manual API retrieval (direct Graph API call):** The same file/export is approximately **6 MB**This is roughly a 150x difference, which strongly suggests that the feed is either truncating or only partially ingesting the log data.**What we've already ruled out:**- Feed configuration is confirmed successful with no visible errors- Authentication against the Microsoft Graph API is working correctly- we have verified via direct API calls that pagination exist in the returned logs file and the full dataset is returned when querying manually **Questions:**1. Is there a known ingestion size cap or event limit per feed cy

I am slowly but surely working on migrating my many clients to the new reCAPTCHA area in the Cloud Console.  Sometimes I have been able to upgrade from a classic key and sometimes I had to start fresh. When working in websites, and adding the recaptcha key(s) to a specific tool (like a popup builder or opt-in form) that tool has a spot for adding those keys depending on what type i am using. V2 checkbox, V2 invisible, or V3. Meaning they have different fields depending on which type of recaptcha. So I go back into the Cloud Console to try to find what type it is. I cannot find any reference to that. The classic keys are all listed in a table with a column for type. But even when I look at the specific key (already upgraded) in a table there is no “type” column. Are ALL migrated recaptchas V3? If not, where exactly can i see what the recaptcha actually is.

What is the specific PowerShell command used to prevent external entities from sending emails to your tenant using your own domain names?Why is it necessary to enable "Enhanced Filtering for Connectors" when you have already locked down your tenant to only accept mail from a third-party gateway?If an organization enables RejectDirectSend $true but forgets to update their SPF record to include their legitimate third-party sending services, what is the likely impact on outbound mail delivery?

Any one has any idea what is this in chronicle can some one explain in detail  

Hi,I’m working on enriching AWS CloudTrail logs with Organization Unit (OU) information. Since CloudTrail logs (except for the “CreateAccount” event) do not natively include the OU, I’ve implemented the following workflow:I created a Data Table that maps Account ID to OU and I wrote a detection rule that triggers on the “CreateAccount” log and uses the write_row function to update the mapping in the Data Table.I need the OU information to be available in every case opened for a specific account, even though the logs triggering those cases don't contain the OU field. What is the best practice to enrich a case with a field from a data table in this situation?Can I leverage the outcome section to fetch the OU from my data table and then promote it to the case level?I’m looking for the standard procedure to handle the Alert-to-Case mapping for these enriched values.Or, is graph_override a better approach for this type of entity-based enrichment?I want to make sure that when an analyst open

logs and  deployment  instances should be  filtered with  time  

I recently created detection rules that look for possible suspicious activities for a terminated user. The idea was to only escalate when we see these rules fire after the termination timestamp. The logic are not complex, essentially single event rules looking at certain event_types along with principal and target userids of the user, and no match section therefore running NRT. I did my tests to exclude possible offboard related events. However, after I enabled Alerting, cases were generated with events that occurred days before the rules were set to Alerting. I noticed that the Alerts tied to the cases had the tooltip information below: Now based from what I’ve gathered, this is something to do with how the detection rules pipeline making sure that even “older” events are properly surfaced and is essentially a continuous stream processor. Some of it covered here Latency Analysis in Google SecOps | by Chris Martin (@thatsiemguy) | Medium The tooltip information is a good indicator, but

Hello,I am trying to get sensitive scopes enabled on our OAuth application, but the video we previously submitted was deemed insufficient. We now have an updated video ready to submit; however, I have not received any follow-up email to respond to.Why is there no user interface available for this process? How am I supposed to resubmit the updated video? Is there a specific email address or support channel I should use to follow up?Additionally, it is frustrating that a required process for any OAuth application is so opaque. At the moment, I have no clear action to take and no accessible support channel unless I pay for premium support.Thank you for your guidance.

Hi everyone,I'm facing a critical remediation blocker following a "Hijacked Resource" suspension on theproject. While I am eager to secure my environment and rotate all potentially compromised credentials, I am trapped in a redirect loop that prevents administrative action.The Technical Problem:Whenever I navigate to IAM & Admin or APIs & Services, the GCP Console performs a forced redirect to the suspension warning page. This means I cannot revoke existing API keys or Audit Service Account activity through the standard UI.Investigation Status:Audit: Local .env files and Git history have been reviewed, but I suspect a credential may have been intercepted or leaked elsewhere. Timeline: Appeal submitted 7+ days ago; no response received. Production environment remains offline.Seeking Expert Advice on:Programmatic Revocation: What is the specific gcloud syntax to force-delete all active API keys when the project status is "Suspended"? Log Retrieval: Can I export Activity Logs or V

Use caseWe want to implement a mechanism in Google SecOps (Chronicle SOAR) where, if the same entity (user, IP, or host) accumulates 3 or more alerts within a given time window (e.g. last 24h), the severity is automatically escalated to High — regardless of whether the individual alerts came from Chronicle SIEM, Cortex XDR, Microsoft Defender, or Entra ID.The individual alerts may be Low or Medium on their own, but the accumulation pattern signals a higher risk that warrants immediate attention.QuestionWhat is the recommended approach to achieve this in Google SecOps?We are evaluating:A SOAR Playbook that counts open alerts per entity and escalates if threshold is met Risk Score Analytics — does this support alerts from third-party connectors (Cortex, Defender) or only Chronicle detections? Any native alert grouping or correlation feature in the SOAR that already handles this out of the boxWhat has worked for others in production? Any pitfalls to be aware of?Thanks!

Hello,I have integrated the Azure Organizational Context and noticed that some log sources are now being enriched based on this data. For example, my Netskope logs are successfully using principal.user.userid for enrichment.However, in other log sources that contain the same principal.user.userid value—such as my FortiGate logs—the enrichment does not occur.Is there any additional configuration required to enable enrichment for these sources?

Hello Team,I am working with logs in Google SecOps where the IP address fields (such as SourceIPV4, TargetIPV4, and AnalyzerIPV4) are received in decimal (integer) format instead of the standard dotted IPv4 format.For example:750176699 → expected to be converted to a standard IPv4 format (e.g., x.x.x.x)Could anyone please advise on how to convert these decimal IP values into normal dotted IPv4 format within the Google SecOps parser (UDM mapping)?sample log: EPO_Events.EPOEvents 20XX-03-XXT05:XX:33 HOST123 EPOEvents{"AgentGUID": "XXXX12345678","Analyzer": "_1000","AnalyzerHostName": "HOST001","AnalyzerIPV4": "3232235777","AnalyzerIPV6": "AAAAAAAAAAAAAP//wKgBAQ==","AnalyzerMAC": "001122AABBCC","AnalyzerName": "Drive Encryption","AnalyzerVersion": "7.4.0.11","AutoGUID": "ABCDEF12-34567890AB","AutoID": "123456789","DetectedUTC": "2026-03-17T05:48:33","ReceivedUTC": "2026-03-17T07:59:05.920","ServerID": "SRV01","SourceIPV4": "3232235778","SourceIPV6": "AAAAAAAAAAAAAP//wKgBAg==","TargetIPV4"

Hi all,Can anyone help me with this query?I need to fetch cases that have the tag “xyz”. Some cases contain multiple tags stored together, like “ABC, xyz, qwerty”.At the moment, I’m unable to retrieve cases where “xyz” appears as part of a multi-tag value.Any suggestions would be appreciated.

Hi everyone,We are working on integrating Google SecOps SOAR with an external application security platform, and wanted to validate our approach as well as explore better alternatives.Use Case1. Incident Sync (Bi-directional)Sync status and comments: From SecOps SOAR → external platform From external platform → SecOps SOAR Current ApproachUsing a scheduled job (polling) to: Fetch updates from both systems Compare changes Push updates accordingly QuestionsArchitecture Validation Is a polling-based approach considered acceptable for this use case? Or is any other approach recommended? Webhook Capabilities in SecOps SOAR Are there limitations on which fields can be mapped via webhook? Is it possible to map custom fields (status, comments, metadata)? Is there any reference for the list of fields. Comments / Notes Mapping In SecOps SOAR alerts, which field is best suited to store external comments/notes? Is there a recommended standard field (e.g., notes, activity log)?