Unanswered questions

Hi Team, Need help in one automation, i just want to know whether we can able to add values or data from google sec ops soar to Splunk lookup csv file with out using IDE?

I know one way to get a UDM search running on a schedule is to convert it into a YARA-L detection rule, which then runs automatically based on the rule's run frequency. But for use cases where I just want a plain search to run every morning (or every hour , etc) and get the results in an alert for example, is there a native option in the platform to do such a thing?

I know one way to get a UDM search running on a schedule is to convert it into a YARA-L detection rule, which then runs automatically based on the rule's run frequency. But for use cases where I just want a plain search to run every morning (or every hour , etc) and get the results in an alert for example, is there a native option in the platform to do such a thing?

Hi,I'm a developer who set up reCAPTCHA keys for a client's  300 websites, and I'm trying to fully remove myself as an owner. I've hit a dead end created by the migration and need your help.Here's what happened, in order:1. I first tried to transfer/manage ownership of the keys in the classic admin console (google.com/recaptcha/admin), but the owner controls were greyed out, with this message:"Use Cloud IAM policies to manage key owners. You can remove owners until only one remains here. For more information, see Access control with IAM (https://docs.cloud.google.com/recaptcha/docs/access-control)."2. Following that instruction, I migrated the keys to the client's Google Cloud project and used Cloud IAM to transfer ownership to the client, then removed my own IAM role from the project.3. But my Google account  is still listed as the sole legacy owner of these keys in the CLASSIC console (google.com/recaptcha/admin). Per that same message, the console only lets me "remove owners until o

Hi everyone,While designing scalable cloud environments and handling continuous data workflows, maintaining strict security controls around API endpoints and background processing tasks is essential. Implementing least-privilege access and optimizing payload validation helps prevent unauthorized data exposure during high-frequency requests.I wanted to open a discussion to see how other engineers approach this: What security measures do you usually prioritize when securing real-time microservices or background processing pipelines? Are there specific logging or monitoring configurations you rely on to detect unusual traffic spikes early? Would love to hear your insights and recommended security frameworks.

Hi,I have created a data table by the following steps 1.Create data table then i have entered the name 2.Import file → CSV file was uploaded 3.Configure Columns -→ primary key was set While i am referencing the column in Rule it is not working.This was in the data table I have added the below line. It was not taking the column field . not ($e.target.resource.attribute.labels["res_metadata_namespace"] in %test1.namespace )namespace gke-managed-cim gke-managed-networking-dra-driver gke-managed-system gke-managed-volumepopulator

I'm currently testing an application hosted on Google Cloud, and I'm running into a security validation issue that I can't explain. The OAuth consent screen has been configured, the authorized redirect URIs are correct, and all required scopes have been reviewed. However, every time I attempt the validation process, it reports a generic security validation failure without identifying which specific requirement is not being met.I have already verified that the domain ownership is confirmed through Search Console, HTTPS is properly configured with a valid SSL certificate, and the privacy policy and terms pages are publicly accessible. I've also tested the application using different Google accounts and browsers, cleared caches, and even recreated the OAuth credentials, but the validation result remains the same.Has anyone experienced a similar issue where the security validation fails even though the project appears to meet all documented requirements? I'm mainly looking for guidance on

I was referring to this doc for migrating legacy API to chronicle API.https://docs.cloud.google.com/chronicle/docs/administration/migrate-from-legacy-api-to-chronicle-apiIs this belowauthorization scope also needs to be migrated? as above document don’t have it. But ,ost of the ingestion scripts use it for initializing http session for ingesting data in SecOps.AUTHORIZATION_SCOPES = ["https://www.googleapis.com/auth/malachite-ingestion"]https://docs.cloud.google.com/chronicle/docs/reference/ingestion-api

How to extract and schedule reports for any particular widget within a dashboard?I see option only available for entire dashboard can be exported as a report rather a particular widget/stats within the dashboard. Please advise.

I’m trying to write a rule that checks the value of the “network.dns.questions.name” field, but will only trigger if the value is NOT in a data table using regex matching instead of a static value.Assuming I have a data table named dns_tunnel_list with below values:domain_names  <« column headerexample.invaliddoes-not-exist.example.comgoogleapis.commetadata.google.internal I cannot seem to get right a UDM search query that will ignore values from the above table with a query like below, for example: metadata.log_type = "GCP_DNS"metadata.event_type = "NETWORK_DNS"not network.dns.questions.name in regex %dns_tunnel_list.domain_names Similarly, for a rule such as below:rule LOG_SECOPS_005_dns_newly_seen_domain_v2 { meta: (snip) version = "1.0" events: $dns.metadata.log_type = "GCP_DNS" $dns.metadata.event_type = "NETWORK_DNS" $querying_ip = $dns.principal.ip $query_name = $dns.network.dns.questions.name not $query_name in regex %dns_tunnel_list.domai

I am getting below error while validating my terraform kubernetes app. Can any on ehelm what is the issue?{  "taskReports": [    {      "taskType": "EXECUTE_TERRAFORM_PLAN",      "taskExecutionStatus": "ISSUES_FOUND",      "digest": "Unable to start verification.",      "errorMessage": "Failed to process container images from schema file: Unexpected response.\nHeaders:\nHTTP/1.1 400 Bad Request\r\nContent-Type: application/json; charset=utf-8\r\ndocker-distribution-api-version: registry/2.0\r\nServer: Docker Registry\r\nVary: Accept-Encoding\r\nX-Content-Type-Options: nosniff\r\nX-Frame-Options: SAMEORIGIN\r\nx-gcr-using-artifact-registry: true\r\nx-google-artifactregistry-docker-imageref: us-docker.pkg.dev/cloud-launcher-images-prd/gcr.io/crestdata-public/test-app/test-app:1.0\r\nx-google-gfe-cloud-project-number: 720804119614\r\nX-Google-GFE-Backend-Request-Cost: 48.89476869076971\r\nX-Google-Security-Signals: FRAMEWORK=GOA\r\nX-Google-Security-Signals: ACTION=GOA_ACTION,ENV=borg,ENV

I have few questions about submission process for the SecOps SIEM custom integration:Can I publish my SecOps SIEM custom integration in Content Hub? It is containing these componants: Ingestion Script Dashboard Detection Rules Search Queries Is there any public repository to submit these componants or any of them as part of content hub?

Hi,How can I update datatable values from an external source, one of the uses that we want to implement is keep a updated JA3 list, we can update this list from an external resource, via http, It is possible to autoupdate a datatable from an external .csv downloadable resource?The main idea is check with the https source if there’s any row addition/deletion/update and automatically perform the changes in the datatable. Best regards.

Hi everyone,We are working on integrating Google SecOps SOAR with an external application security platform, and wanted to validate our approach as well as explore better alternatives.Use Case1. Incident Sync (Bi-directional)Sync status and comments: From SecOps SOAR → external platform From external platform → SecOps SOAR Current ApproachUsing a scheduled job (polling) to: Fetch updates from both systems Compare changes Push updates accordingly QuestionsArchitecture Validation Is a polling-based approach considered acceptable for this use case? Or is any other approach recommended? Webhook Capabilities in SecOps SOAR Are there limitations on which fields can be mapped via webhook? Is it possible to map custom fields (status, comments, metadata)? Is there any reference for the list of fields. Comments / Notes Mapping In SecOps SOAR alerts, which field is best suited to store external comments/notes? Is there a recommended standard field (e.g., notes, activity log)?

Hi Fraud Defense team, Starting 2026-07-17 (zero occurrences before that date), legitimate desktopChrome 150 users on our site began receiving very low reCAPTCHA Enterprisescores (0.1-0.3) with reason code UNEXPECTED_ENVIRONMENT on our sign-inaction, blocking them from logging in. Tokens are fully valid and the actionmatches the expected action -- only the risk score collapsed. Setup: web score-based site key (v3-style), server-side assessments via thereCAPTCHA Enterprise API. Users are mostly in Taiwan on residential ISPs. Evidence that this is browser-version-specific(rejected vs. allowed-with-low-score counts, same site key and threshold,last 2 days):- Chrome 150 desktop: 306 rejected / 22 allowed- Chrome 149 desktop: 2 rejected / 23 allowed- Edge (Chromium 150): 1 rejected / 4 allowed Daily rejected count for Chrome 150: 0 (before Jul 17) -> 98 (Jul 17) ->113 (Jul 18) -> 180 (Jul 19), still rising. Chrome 150 had already beenrolled out for about two weeks before Jul 17, so

Hello,My Google Cloud project has been suspended due to a security issue (ACCOUNT_HIJACKED).I fully understand the situation and I am ready to take all necessary actions to secure the project. However, I currently do not have access to the project anymore, which prevents me from revoking the compromised API keys or applying the required fixes.As a precaution, I have already stopped billing to prevent any further charges.At the moment, my application is completely down, which is having a severe impact on my business. My clients cannot access the service, and I am receiving increasing complaints and refund requests.I already have an open support case: 70327888This situation is becoming critical, and I would greatly appreciate any help to restore access or guidance on how I can proceed to secure the project.Thank you very much in advance for your support.Vincent

Project id: project-5580276092549813950My project got suspended 5. april, due to misuse of some keys.I have filed an appeal, taking actions on how to prevent this from happening again. But I do not get any response at all.Now observing users are dropping off, users not able to sign on, complaining. It is very devastating to observe, years of developing an app for dog owners. It is very critical.  Actions Taken:• Removed exposed API keys from all repositories and application code• Ensured that no API keys or credentials are publicly accessible• Reviewed all Git repositories and verified that sensitive credentials are no longer present• Updated development practices to prevent API keys from being embedded in client-side applications• Planned migration of all Gemini API requests from client-side usage to a secure backend service• Implemented safeguards to ensure that future API usage is authenticated and controlled• Preparing to rotate all API keys and service account credentials immediat

According to the Google SecOps documentation, an outcome variable from a child detection rule can be accessed in a composite rule using a path such as:e.g. detection.detection.outcomes["dest_domain"]Link :- https://docs.cloud.google.com/chronicle/docs/yara-l/composite-detection-rules#reference_detection_content_with_variables_or_meta_labelsHowever, when I use this field in a YARA-L composite rule, I receive the following warning:outcomes field is deprecated and might not populate as expected.I have not been able to find an alternative field or updated syntax in the documentation.My requirement is to pass a variable that is calculated only in the child rule’s outcome section and use it in the parent composite rule.   

Hello,I'm parsing Qumulo JSON audit logs in Google SecOps and I'm able to successfully extract top-level and nested fields such as:{"operation": "fs_write_metadata","details": {"file_id": "9283XXXXXXXXXX329","path": "/smb/underwritingscan/Windows (C) - Shortcut.lnk","before": {"ctime": "2026-07-16T16:06:05.106082716Z"},"after": {"ctime": "2026-07-16T17:56:43.431152651Z"}}}-- Using statedump, I can confirm the parser is exposing: details.before.ctimedetails.after.ctime--- and temporary test fields are populated:before_ctime_test = 2026-07-16T16:06:05.106082716Zafter_ctime_test = 2026-07-16T17:56:43.431152651Z------Current UDM mappings work successfully for:principal.user.useridprincipal.iptarget.file.full_pathmetadata.product_log_idmetadata.product_event_type------- My goal is to expose the following fields in UDM for dashboarding:details.before.ctimedetails.after.ctimedetails.before.mtimedetails.after.mtime------I attempted to use:event.idm.read_only_udm.additional.fields---but receive

Hi all,We operate multiple Google SecOps instances and use the managed remote MCP server (chronicle.<region>.rep.googleapis.com/mcp, negotiated protocol version 2025-11-25) from an AI agent. On one specific instance, every SOAR-backed tool fails, while the same tools work fine on our other instance. This is not agent-specific — it reproduces with direct, bare MCP tool calls (minimal arguments, no LLM involved).Symptom — on the affected instance, with only customerId / projectId / region / pageSize: 1:tool: list_cases→  isError: true, "Internal error encountered."Same result with/without filter ("Status='OPENED'") and orderBy — all argument variants fail identically.Side-by-side (identical bare calls on both instances):  What we've ruled out:1. Caller permissions — the same service account runs all SIEM tools successfully on the affected instance, so MCP authorization passes. And when we deliberately call with an SA that lacks access, we get an explicit PERMISSION_DENIED with a tr

Hi all,We operate multiple Google SecOps instances and use the managed remote MCP server (chronicle.<region>.rep.googleapis.com/mcp, negotiated protocol version 2025-11-25) from an AI agent. On one specific instance, every SOAR-backed tool fails, while the same tools work fine on our other instance. This is not agent-specific — it reproduces with direct, bare MCP tool calls (minimal arguments, no LLM involved).Symptom — on the affected instance, with only customerId / projectId / region / pageSize: 1:tool: list_cases→  isError: true, "Internal error encountered."Same result with/without filter ("Status='OPENED'") and orderBy — all argument variants fail identically.Side-by-side (identical bare calls on both instances):  What we've ruled out:1. Caller permissions — the same service account runs all SIEM tools successfully on the affected instance, so MCP authorization passes. And when we deliberately call with an SA that lacks access, we get an explicit PERMISSION_DENIED with a tr

Hi everyone,While developing custom browser extensions and lightweight client-side tools, managing background script lifecycles and asynchronous data serialization can sometimes introduce performance bottlenecks if event listeners aren't properly optimized.I was looking into architectural patterns for handling continuous data streams smoothly without impacting the main browser thread, and wanted to get the community's perspective: What strategies do you implement to minimize memory leaks during long-running background tasks in extensions? How do you handle efficient local state caching for high-frequency utility tools? Would appreciate any technical insights or optimization patterns you recommend!

Hi All,Anyone has performed a complete end to end implementation of multi tenancy in google secops SOAR SIEM.I need real example with implementation steps for typical GCP environment.Also if any relevant documents will be helpful

Hi All, I am testing the Microsoft 365 Defender (XDR) Integration v26.0 and have observed the following which when looking at the documentation seems to be by design. Scenario 1Event triggered and “Incident 1” created in XDR Event triggered and “Incident 2” created in XDR Both incidents and their associated alerts are ingested into the SOAR and created: Case 1 with the name “Incident 1” Case 2 with the name “Incident 2” XDR then correlated Incidents 1 & 2 and based on a rule and renamed “Incident 1” to “Suspicious activity on one endpoint”  moved the alert from “Incident 2” to “Incident 1” and closed “Incident 2” The Sync Job in SOAR attached all alerts to Case 1 but left the Case name as “Incident 1” The SOAR Case “Incident 2” was left open along with it’s associated AlertScenario 2Event triggered and “Incident 1” created in XDR Event triggered and “Incident 2” created in XDR “Incident 1” ingested into SOAR and a Case created with the same name “Incident 1”  Before Ingestion of “I

First of all this issue appear around 1month ago? Before I am sure that we were able to see highlights.I am having an issue with Highlighted Fields properties not rendering below entity inside the Entities Highlights widget at the bottom of the Alert View/Case View.Specifically, Google SecOps automatically maps our network ranges and populates the Network Name property for IP addresses (ADDRESS entity type). But same is for custom ones created by us that worked previously.Although the data is successfully populated and visible in other parts of the UI, it refuses to appear directly on the entity rows/cards in the main alert view.What I have already checked and verified: Properties Metadata: The Network Name field has both Is displayed and Is highlighted checkboxes checked. Side Panel & Entity Details: The configuration works perfectly for the right-hand side panel (Highlighted Fields section) and inside the SOAR Search -> Entity Details view. The field is there, and the value