Unanswered questions

Hi All,i was trying to ASN enrichment via Entity Context I tried both GLOBAL and ENTITY context but unable to trigger rule Code Snippet $ipcti.graph.entity.artifact.ip = $source_ip  //  e.g. 8.8.8.8(             $ipcti.graph.metadata.source_type = "GLOBAL_CONTEXT"              or              $ipcti.graph.metadata.source_type = "ENTITY_CONTEXT"        )        $ipcti.graph.metadata.entity_type = "IP_ADDRESS"        $ipcti.graph.entity.artifact.network.asn = /google|xyz/ nocaseany suggestion to enrich asn ?

Our classic reCAPTCHA v3 key (domain archetravel.com, used by WordPress Contact Form 7) was auto-migrated to Google Cloud project number 474223265113. The classic admin shows "Action required: accept the invitation to the Google Cloud project".What happens: the invitation page shows "Welcome, <name>. A project owner invited you to join the project (ID: 474223265113)". Clicking Accept redirects to Resource Manager, but no access is granted. IAM for the project still reports missing resourcemanager.projects.get / getIamPolicy. Reopening the invitation shows the same pending dialog. This has been happening for months.Affected: all key owners. Tested today (22 Oct 2026) with two Google Workspace users of archetravel.com (org ID 1095431403131), one of them the super admin. Same result with both the banner link and /invitation?project=474223265113&account=...&memberEmail=...Already ruled out:- Correct account (verified in the dialog greeting and the account menu)- No pending Cl

Hi, is there a way to check the user that has last updated a rule from the SecOps platform without checking cloud looging? 

I have a workflow that requires a case be created in an environment if certain conditions are met. I was able to create a custom action to do this fine a few weeks ago, but since a new scope (also the first scope) was added in our SIEM settings, I notice the action is failing. Error: {"errorCode":2000,"errorMessage":"DataAccessScope is required.","innerException":null,"innerExceptionType":null, This new scope has nothing to do with the environment I am trying to create the case for. The environment itself does not have any scopes applied to it at all, it is ‘Global’. The Swagger docs for the CreateManualCase endpoint specify dataAccessScope should be a string, I’ve tried a selection of strings such as “*”, “Global”, “<ENVIRONMENT_NAME” etc but have had no luck. I’ve also tried not settings it obviously.  Is there a specific string I should be using here? Or should I create a new scope with access to all data? Thanks

Hi everyone,We have noticed that when certain detection rules exceed resource consumption limits, Google SecOps automatically transitions them to a PAUSED state (following the LIMITED throttling period). Because paused rules stop evaluating events and generating alerts, we need to monitor these operational status changes closely.I have two questions regarding identifying and tracking these transitions: Native Notifications: Does Google SecOps support any built-in alerting or notification mechanism (such as in-console alerts, bell notifications, or automated emails) when the platform suspends a rule due to high resource usage? Identification & Auditing: What is the recommended way to capture the exact timestamp when a rule moves to PAUSED? Should we be just polling the SecOps REST API (rules.list / rules.get with executionState)?   How are other teams tracking degraded or paused rules to ensure detection coverage isn't silently lost? Any API query examples, or best practices would

I have a playbook that fetches UDM events using the ‘GoogleChronicle - Execute UDM Query’ action. This action return events in the format below:{    "events": [        {"foo": “bar”},    ]} I need to loop over each event in the events list returned, and send an email containing the dict details. I cannot seem to consume this data in any GSO action without throwing the below error:Message: Unable to cast object of type 'System.String' to type 'Newtonsoft.Json.Linq.JToken'. I can use the base JSONResult from the action, but after parsing it and trying to access the nersted values, i get the above.  Any idea what could be causing this? Thanks

What is the best way to display Source and Destination entities (IP addresses and hostnames) in the Case List view, similar to QRadar and ArcSight, so SOC analysts can quickly understand alert context at a glance without opening each case?

Hey all,What have you found to be the best way to determine which connector a SOAR alert originated from?|We have monitors within GTI, with all of them having their own connector within SecOps. We are looking for either the ability to determine monitor and/or connector.Thanks!

My customer data is still on Google Cloud, but my entire account has been banned. I only want to restore access as quickly as possible.After I submitted an appeal, I received an email from an address in this format:google-cloud-compliance-reply+{case-tag}@google.comI was not sure whether replying directly to that message would reach the compliance team and be added to my case. I replied to that email one day ago, but I have not received any response yet.I am in a hurry because the Appeals page only allows 500 characters, and I have also read that I should not submit duplicate appeals. Because of that, I cannot tell whether my case is still moving forward.Could someone confirm the correct way to follow up: wait for a reply to that email, or use another channel? I will not post my project ID, case ID, or the full address here.

I am unable to add or remove domains from the allowed domain list when editing a key. I click save and get a success toast message, but the changes aren’t actually committed.I noticed it yesterday (10/13) at 2pm ET. I can’t open a support ticket b/c we’re running the api.js not enterprise.js

I am unable to add or remove allowed domains when editing a key. When I try to add or remove a domain, and click save, I get a success message. But, when I edit the key again the changes haven’t been committed. This has been happening since 10/13/26. I noticed the issue at approximately 2PM ET 10/13/26.

Hi All, I am testing the Microsoft 365 Defender (XDR) Integration v26.0 and have observed the following which when looking at the documentation seems to be by design. Scenario 1Event triggered and “Incident 1” created in XDR Event triggered and “Incident 2” created in XDR Both incidents and their associated alerts are ingested into the SOAR and created: Case 1 with the name “Incident 1” Case 2 with the name “Incident 2” XDR then correlated Incidents 1 & 2 and based on a rule and renamed “Incident 1” to “Suspicious activity on one endpoint”  moved the alert from “Incident 2” to “Incident 1” and closed “Incident 2” The Sync Job in SOAR attached all alerts to Case 1 but left the Case name as “Incident 1” The SOAR Case “Incident 2” was left open along with it’s associated AlertScenario 2Event triggered and “Incident 1” created in XDR Event triggered and “Incident 2” created in XDR “Incident 1” ingested into SOAR and a Case created with the same name “Incident 1”  Before Ingestion of “I

I am preparing to initialize Google Cloud Identity Platform in a billing-enabled test project.The identitytoolkit.googleapis.com API is already enabled, but the authentication configuration returns CONFIGURATION_NOT_FOUND. I have not run initializeAuth yet.Before calling:POST /v2/projects/PROJECT_ID/identityPlatform:initializeAuthI would like to confirm its automatic side effects:1. Does initialization enable any additional APIs? If so, which ones?2. Does it automatically create API keys, OAuth clients/client secrets, Firebase resources, or service accounts?3. Besides the Identity Platform service agent and roles/identitytoolkit.serviceAgent, are any other IAM bindings automatically added?4. Does the Console's “Enable Identity Platform” action perform additional operations compared with the REST initializeAuth method?5. Is there a supported dry-run or a way to prevent additional API/IAM changes before they occur?The intended use is Google sign-in for an existing Cloud Run application.

Hello Google Cloud reCAPTCHA Team,We are reviewing the Google Play Data Safety declarations for our published Android application SEYCHAS.Application environment: Framework: Flutter Android minSdk: 24 Android targetSdk: 36 reCAPTCHA Android SDK: 18.7.1 Integration: Firebase Authentication (conditional reCAPTCHA verification) Our technical investigation confirmed that the primary reCAPTCHA endpoint uses HTTPS. However, we could not establish complete transport guarantees for auxiliary requests using dynamically supplied URLs and for embedded WebView navigation, redirects, and subresources.We have not identified any confirmed unencrypted transmission of user data or demonstrated security vulnerability.We would appreciate clarification of the following questions:1. Encryption in transitDoes reCAPTCHA Android SDK 18.7.1 ensure that all SDK-controlled network requests carrying user or device data use HTTPS/TLS, including auxiliary GET requests, dynamically supplied URLs, WebView nav

Project ID: meeings-acc6e (Aura Notes)Ticket Reference ID: ZH4ATUO7HEX2U3633LN6LOUSLUSuspension reason: account hijacked (compromised credentials)Suspended since: September 4, 2026Appeal history (all under the same ticket):- Appeals submitted: Sept 12, Sept 25, Oct 7, Oct 12 (plus Sept 5 original)- Follow-up emails to the compliance address: Sept 9, Sept 10- Each submission produced only an automated "Appeal Received" email.  No human response or request for more information in 41 days.Root causes found and fixed:1. API keys were committed to Git history of a private repository.   History was cleaned and the keys were deleted.2. A config file containing an API key was bundled as a plain asset in   the published Android app. The asset has been removed from the app   source and the key was deleted. A new release will not include it.3. Local tooling access was reduced: Firebase CLI access was revoked   from the Google account, and no service account key files exist on   the development ma

I am working on a use case in Google SecOps SOAR where I want to automatically retrieve files attached to a case and submit them to an external platform for further analysis.We are using the get_attachments function from the Siemplify SDK to retrieve attachments associated with a case. However, we have noticed that this function retrieves attachments added through case comments but does not seem to return attachments added by other actions.For example, suppose an action adds a file attachment when it is executed within a case. The attachment is visible in the result of that action. Later, when another action runs on the same case and uses the get_attachments function from the Siemplify SDK, the attachment added by the previous action is not returned. However, attachments added through case comments are returned successfully.Our goal is to retrieve files associated with a case, regardless of whether they were added through case comments or by other actions, so that we can use them in su

Hi Google SecOps Community,i would like to confirm whether YARA-L supports Levenshtein distance (edit distance) or any equivalent fuzzy string-matching functionality.Use Case:We have a detection that identifies potential data exfiltration through Microsoft 365 Exchange emails by comparing the username portion of the sender's corporate email address with the username portion of the recipient's personal email address.The objective is to identify sender and recipient usernames that are identical or differ by fewer than three character edits.For example: [removed by moderator] → [removed by moderator] (distance = 1) [removed by moderator] → [removed by moderator] (distance = 2) Questions: Does Google SecOps YARA-L 2.0 provide a built-in function for calculating Levenshtein distance between two strings? If Levenshtein distance is not supported natively, is there another supported YARA-L function or approach for fuzzy string matching? Can this comparison be implemented directl

Hi All, Can someone please clarify how custom IOC data is stored in the SecOps? I am coming from Splunk ES, where IOC indicators are stored in KVStore as simple lookup lists.However, when setting up third-party API feeds for IOC ingestion (Anomali) the data is ingested into SIEM with time dimension. (e.g. graph.metadata.vendor_name = "ANOMALI_IOC" over last 30 days gives 30 matchies for the same IOC).Wouldn’t it make more sense to store IOC as timeless data? Thanks!

When creating a saved/dynamic search in Search Manager using the ${variable} placeholder syntax, the input box generated at runtime only supports exact string equality matching. There appears to be no way to pass a regex pattern (e.g., wildcard .*) through this input box to perform pattern-based matching on UDM fields.Steps to ReproduceNavigate to Search Manager and create a new saved search with the following query: metadata.log_type = ${log_type}   Save and run the search — an input box is correctly generated, prompting for a value for log_type. Enter a regex pattern as the value, e.g.: .* Observed result: The query executes as metadata.log_type = ".*", treating the input as a literal string rather than a regex pattern. No results are returned (since no log_type literally equals .*).Attempted WorkaroundsAttempt 1: Replaced = with =~ operator for regex matching:metadata.log_type =~ ${log_type}  Result: Compilation error:lexer error: token recognition error at: '~' line: 1 column:

My Google Cloud project project-cb22cbd9-5cdb-4e06-88a8 has an OAuth publishing failure. Google Auth Platform reports that I need additional access, listing clientauthconfig.brands.get, clientauthconfig.clients.list, oauthconfig.verification.get, resourcemanager.projects.get, and serviceusage.quotas.get.My account has Owner and Organization Administrator roles. Policy Troubleshooter shows that the allow policy permits access and no IAM Deny policy blocks it. The organization’s Principal Access Boundary policy page shows “No policies.”I cannot access the OAuth Branding configuration or publish the app from Testing to Production. Google Cloud Support Cases is unavailable under my current support plan.Can Google Cloud investigate why permissions included in the Owner role are reported as missing?

I am working on a use case in Google SecOps SOAR where I want to automate file processing using file paths available in alert details.In some scenarios, an integration adds a file path to an alert's details. This path points to a file stored on a specific remote machine, such as an endpoint or server. However, the action that needs to process the file may be running on a different machine, so the file is not directly accessible using the provided path.For example, an alert might contain a file path such as C:\Users\user\Downloads\suspicious.exe. This file exists on the endpoint that generated the alert, but the action running in Google SecOps SOAR may not have direct access to that endpoint or its local file system.My goal is to automate the process of retrieving the file from the machine where it resides and then submitting it to an external analysis platform or processing it through another action.I understand that accessing a file using its path requires access to the machine or a m

I'm trying to configure drilldown functionality on a Table widget in Google SecOps Dashboards, where one of the displayed fields is an array (repeated field). I'm running into a rendering/drilldown limitation and would appreciate guidance or confirmation if this is a known gap.metadata.log_type = "ZSCALER_DNS"additional.fields["dns_record_type"] = "A"network.dns.questions.name = $requestnetwork.dns.answers.data = $responsematch: $requestoutcome: $ips = array_distinct($response)limit: 10000This groups results by $request (the queried domain) and aggregates all resolved IPs into a deduplicated array $ips.Problem:When $ips is displayed as a column in a Table widget, the array is rendered as a single comma-separated string in one cell, e.g.:142.250.122.94, 142.251.106.94, 142.250.118.94  I configured a drilldown mapping on $ips pointing to the UDM field network.dns.answers.data (operator =). However, since the entire array is flattened into one string value per cell, clicking on i

We are performing read-only security checks before setting up private Cloud Run staging.We evaluated artifactregistry.repositories.downloadArtifacts on an existing Artifact Registry repository for the project's Cloud Run service agent: [removed by moderator] Using POST https://policytroubleshooter.googleapis.com/v3beta/iam:troubleshoot with an explicit x-goog-user-project header, the response returned:overallAccessState: UNKNOWN_INFOallowAccessState: ALLOW_ACCESS_STATE_GRANTEDdenyAccessState: DENY_ACCESS_STATE_NOT_DENIEDprincipalAccessBoundaryAccessState: PAB_ACCESS_STATE_UNKNOWN_INFONo top-level errors were returned. The PAB explanation contained only its UNKNOWN_INFO state; explainedBindingsAndPolicies was omitted.The requesting user has project Owner access. The project has no organization or folder parent. The Cloud Run service agent has roles/run.serviceAgent, and the existing production service is operational.We understand that Google-managed service agents cannot be inspected as

I’m evaluating integration approaches for ingesting alerts from Microsoft Defender for Endpoint (MDE) into Google SecOps and facing challenges with both SIEM and SOAR options.  With Google SecOps SIEM:  MDE alerts and their evidences are ingested as individual events rather than a single alert/incident This requires building additional detection rules to stitch events back together Due to high alert volume from MDE, suppression via SIEM detection rules becomes difficult to manage   With Google SecOps SOAR:  Using the MDE connector results in 1 alert = 1 case (e.g., 1000 alerts/day → 1000 cases) There is no pre-ingestion suppression/filtering mechanism Any update to an alert (e.g., assignment change) generates a new alert in SOAR, leading to duplication   Key Questions:  What is the recommended architecture for integrating MDE with Google SecOps? Is SIEM-based ingestion preferred over SOAR, or a hybrid approach? How do you handle alert suppression and deduplication at scale? Are there b

My 4 under development sites stopped functioning because of “Immediate Action required: Critical Issue with your Google Cloud Agent Platform project” issue. Kindly help as i don't know the actual issue and all of sites are on production.