Unanswered questions

Hello,We're investigating an issue with a Trellix HX Audit integration in Google SecOps and would appreciate any guidance from others who have worked with this feed.EnvironmentGoogle SecOps SIEM Trellix HX / FireEye HX API Feed Log Type: TRELLIX_HX_AUDITIssueThe feed was ingesting normally for an extended period and then abruptly stopped receiving audit events.Observed ingestion pattern:Normal ingestion for several weeksSharp reduction in volumeSubsequently dropped to 0 events/day Current StatusFeed status shows OK/Healthy Feed is enabled Feed was recreated with the same configuration Other Trellix HX-related feeds continue to ingest successfully No parsing errors No validation errors No indexing errorsSpecific Event Type AffectedThe primary missing events are Bulk Acquisition audit events, such as:Bulk Acquisition InitiatedBulk Acquisition Completed These events were previously being ingested into Google SecOps under TRELLIX_HX_AUDIT.Additional FindingsWhile reviewing historical HX au

My Google Cloud project was recently suspended for alleged repeated Terms of Service violations. I already submitted an appeal, but the appeal page does not show the original appeal, its status, history, or any way to add more information.After submitting it, I realized what I think was the likely trigger.Right before the suspension, I ran a one-time automated Gemini/Vertex batch job that analyzed and categorized hundreds of short video clips for a legitimate commercial media library. It involved roughly 693 source assets and 1,076 reusable clips.The workload was intentional, but it may have created an unusually large burst of multimodal requests. There was no spam, scraping of Google services, malware, credential abuse, DDoS activity, quota circumvention, or compromised account.The suspension email also mentioned that a warning may not be sent when project behavior is seriously impacting other users, which makes me think this batch job may have triggered an automated abuse system.I am

I'm seeing a specific Android device consistently receive floor scores from reCAPTCHA Enterprise, and I can't find any signal that explains why. Looking for anyone who has seen this pattern or knows what an assessment with score: 0 and no reason codes indicates for the mobile SDK.What I observe on one device (Pixel 9 Pro, Android 17, stock, bootloader locked, verified boot green)Android SDK com.google.android.recaptcha:recaptcha:18.9.2, app installed from Google Play. Every assessment comes back like this:tokenProperties: valid: true, action matches expectedAction, clientSignalsFailed: falseriskAnalysis: score: 0, reasons: [], extendedVerdictReasons: []- 12 attempts over two days: eleven scored 0.0, one scored 0.1. Never a reason code.- Persists across two networks (Wi-Fi and mobile data), across an app-process restart with a fresh client and fresh token, and across a device reboot.- The SDK reports no error — executeTask succeeds every time, so the app has nothing to react to.- In log

We are using Google reCAPTCHA v3 with Thai language (hl=th). The captcha challenge occasionally displays corrupted Thai characters in the instruction area and action button. The issue occurs inside the Google-hosted reCAPTCHA dialog while the rest of the application renders Thai text correctly.Observations:Application localization is functioning correctly. Issue is occurring only within the reCAPTCHA iframe. Multiple users have reported the issue. Browser refresh does not always resolve the problem. No recent changes were made to the application code or reCAPTCHA integration.Please investigate whether there is an issue with the Thai localization resources or rendering of reCAPTCHA. 

Hi everyone,I am currently setting up a test environment to collect logs from a Linux host using BindPlane, following the official quick start guide: Google SecOps with BindPlane Quick StartMy configurations on BindPlane appear to match the recommended setup, and the agent status looks consistent. However, I am stuck on the verification step: Data Visibility: I cannot see the ingested data in Google SecOps (Chronicle). Verification Process: To be precise, I’m not sure how or where to properly verify if the logs are actually reaching Google SecOps, or if they are getting stuck somewhere in the pipeline (e.g., BindPlane collector, Google SecOps ingestion API, or UDM mapping). Are there recommended troubleshooting steps, CLI tools, or specific queries in Google SecOps to verify that data is flowing correctly? Any guidance on how to inspect and validate this setup would be greatly appreciated!Thanks in advance! 

Looking for guidance on a suspension case.Our project was shut down on Sep 7 under the hijacked-resources policy.The trigger appears to be a billing anomaly on Gemini API — daily costjumped to roughly 400 times our normal baseline within a single day.None of that traffic came from us, so we assume a key of ours ended upsomewhere it shouldn't have.What we've done so far: every user-managed service account key in theproject is gone, and every API key including the Gemini one is gone.Nothing left to rotate on that front. IAM stayed reachable long enoughfor us to finish that part.What we can't do: anything requiring project APIs. Audit log review,Secret Manager rotation, checking for resources we didn't create — allof it returns CONSUMER_SUSPENDED.The appeal went in the same evening, plus the separate suspensioninquiry form. No decision yet.Two questions for anyone who's been through this:Is there any way to learn which credential Google actually flagged?Knowing the exposure path would hel

Hello Google Community Team,My OAuth app verification is currently stuck and I need an internal engineer to manually trigger a status refresh or pass this along to the Trust & Safety team.* Project ID: dev-workrate* The Issue: The Cloud Console Verification Center shows a blocking error under "Homepage requirements" stating: "Your homepage website is not registered to you."* The Resolution: I have successfully verified full domain ownership for our production homepage via Google Search Console using this exact same Google account. The Problem: The console instructs me to "Reply to your email thread with our Trust and Safety team," but I have never received an initial email from the compliance team to reply to. Because the UI is entirely locked in the "Your branding is currently under review" state, I cannot modify fields or trigger a re-scan myself. Could a community manager please escalate this project ID to the Trust & Safety team so they can pull the fresh domain status from

Hi, I want to write a parser extension to capture additional fields from a json log that looks like: { "key": "value",  ...  "ExperimentalFeatures": { "mcp": false },  ... "key": "value"} I’m imagining the UDM field based on the above to look like:additional.fields["mcp"] = "false" So far I’ve come up with:filter {  # Additional Fields Mapping (ExperimentalFeatures.mcp)  mutate {    replace => {      "ExperimentalFeatures.mcp" => ""    }  }  if [ExperimentalFeatures][mcp] != "" and [ExperimentalFeatures][mcp] != "NULLPLACEHOLDERVALUE" {    mutate {      add_field => {        "[@metadata][mcp_val]" => "%{[ExperimentalFeatures][mcp]}"      }    }    mutate {      add_field => {        "event.idm.read_only_udm.additional.fields[key]" => "mcp"        "event.idm.read_only_udm.additional.fields[value]" => "%{[@metadata][mcp_val]}"      }    }  }} However something about the above isn’t right because json logs that contain the above key:value pairs are not getting such UD

Hi all, We're trying to set up the built-in **SilentPush integration (v3.0)** in Google SecOps SOAR, but Test Connection consistently fails with no useful error detail. Hoping someone from the community or Google team can help point us in the right direction. **Environment:**​Google SecOps SOAR (Google-managed / SaaS instance) ​No self-hosted Remote Agent — running entirely on Google-managed infrastructure ​SilentPush integration version 3.0 **What we've already verified/tried:**1. Confirmed the correct API base URL per SilentPush's official docs (https://help.silentpush.com/docs/get-started-with-api): https://api.silentpush.com (root domain only, scheme included, no trailing path)2. Confirmed API Key is populated and valid3. Tested with "Verify SSL" enabled4. Tested on two separate integration instances (a Shared Instance and the System Default Instance) — identical failure on both5. Ruled out URL formatting issues — we initially hit a MissingSchema error (missing https://) and a wron

Hello,Since Friday evening, we have been receiving more than 400 daily alerts from a custom GTI IOC ( on domain) matching rule.Many detections involve well-known legitimate domains such as Microsoft, Google, GitHub, DigiCert and Windows Update. Before Friday, the alert volume was normal.We also noticed that the graph.metadata.threat field is now marked as deprecated in the YARA-L editor, but we could not find clear documentation about its replacement.Has there been a recent change to GTI GLOBAL_CONTEXT data or entity enrichment?What is the recommended replacement for graph.metadata.threat when matching GTI indicators in YARA-L?Is anyone else experiencing the same issue?Thank you.

Hi Google Cloud Community,We recently enabled reCAPTCHA v3 as a fraud-prevention mechanism and monitored the risk scores for approximately two weeks to understand its assessment behavior.During the first two days, we did not consider the scores for evaluation, as we followed the recommendation in the documentation to allow sufficient time for the risk analysis/assessment to establish.For the following five days, the results were as expected:Fraudulent transactions: The reCAPTCHA score was consistently 0.4 or below. Genuine transactions: The score was consistently 0.5 or above. This separation between fraudulent and genuine transactions was useful for defining our fraud-detection threshold.However, after approximately five days, we started seeing inconsistent results. Our genuine transactions are now also receiving very low scores, sometimes as low as 0.0, even though these transactions are legitimate.This behavior is making it difficult for us to reliably distinguish between genuine an

Google SecOps SIEM CMEK instance, there’s only option to schedule reports in csv format. We are expecting the pdf format as its simpler way to present data to Monitoring team.

Hi Everyone,I have a problem around UDM enrichment and I would appreciate if someone can guide me to resolve this. Problem :The current user data is enriched with Azure AD Context and it is pulling all the data that is associated with the user present in the Azure AD. But, every user’s attributes have at least 500+ key-value pairs which are getting enriched as a part of the AD Context which is making the event data heavy with essentially too much garbage data that we don’t need at all. Below is one example: This screenshot is from the event details under the event tab:Because of this, the actual event/incident details are fully buried under this garbage. This is the SIEM Event details :  I have checked the documentation and did not find any way to remove the user attribute fields or configuration of event enrichment. Thanks in advance!

Is the SOAR/SIEM UI slow for anybody else? Mine is lagging and freezing on IDE and data table views. I’m on Windows and Chrome

Summary:In the checkbox image challenge popup, the instruction line renders correctly in Japanese (e.g. 「横断歩道のタイルをすべて選択してください」), but the red hint/error text and the verify/skip button labels render as random-looking strings (e.g.F&JfWOUD, 9-CW`).Impact:- Users cannot read the challenge buttons or error messages, effectively blocking them from completing verification on the affected flow (a public request form).- Root-cause evidence (deterministic 7-bit corruption)  We analyzed the corrupted strings. Each displayed character equals the original code point masked to its low 7 bits — i.e. displayed = String.fromCharCode(originalCodePoint & 0x7F). This is deterministic, not random.  - Taking the low 7 bits of each code point reproduces the corrupted string exactly.  - Characters whose result falls into a control code disappear or become line breaks (e.g. 認 U+8A8D → 0x0D, 再 U+518D → 0x0D, り U+308A →0x0A, み U+307F → DEL), which accounts for the stray line breaks inside the popup.  -

Hi I want this rule to work in such a way that if the e1 or e2 condition is true then we should get an alert but if e2 and e3 is true then we should not get and alert. i have tried multiple ways but somehow it is not working. rule RULE_PROD_USER_INFORMATION_REGISTRY_ACCESS { meta:author = "Fortrea Security Engineering (abcd)"description = "Detect access to registry keys containing user/system information while suppressing expected Dell activity"severity = "LOW"priority = "LOW"mitre_tactic = "TA0005"mitre_technique = "T1112"case_type = "Anomaly detection" events:// Original detection event$e1.principal.hostname = $host($e1.target.registry.registry_key = /Control Panel\\International\\Geo/ or$e1.principal.process.command_line = /Control Panel\\International\\Geo/ or$e1.target.registry.registry_key = /SYSTEM\\CurrentControlSet\\Services\\Disk\\Enum/)// MDE BIOS registry query$e2.principal.hostname = $host$e2.principal.log_type = "MICROSOFT_DEFENDER_FOR_ENDPOINT"$e2.principal.process.comma

Hi everyone,I'm working on a Google SecOps Parser Extension for Terraform Enterprise logs.The base parser is successfully extracting data into UDM. For example: extracted.fields["_raw.component"] = "nginx" extracted.fields["_raw.log"] =127.0.0.6 - - [07/Aug/2026:18:12:19 +0000] "GET /api/v2/organizations/uwm/workspaces HTTP/1.1" 304 0 "https://terraform.uwm.com/app/uwm/workspaces" "Mozilla/5.0 ..."Show more linesRaw event:{"_raw": {"component": "nginx","log": "127.0.0.6 - - [07/Aug/2026:18:12:19 +0000] \"GET /api/v2/organizations/uwm/workspaces HTTP/1.1\" 304 0 ..."},"cribl_group": "AzureEastUS2-Upper"}My goal is to create a Parser Extension that parses the nginx access log and maps fields such as:client_iphttp_methodurl_pathstatus_codeuser_agent However, when I try to reference:[_raw][log][_raw][component]or%{_raw.log} I get errors such as: "_raw.log" not found in state data Questions:What is the correct way to reference fields that are already extracted by the base parser, such as:ex

I am attaching a rule below. I need to have an alert when e1 is true or e2 is true but I don't want and alert when we have a combination of e2 and e3 is true. How can i mention then in the rule. rule RULE_PROD_USER_INFORMATION_REGISTRY_ACCESS { meta:author = "abcd"description = "Detect access to registry keys containing user/system information while suppressing expected Dell activity"severity = "LOW"priority = "LOW"mitre_tactic = "TA0005"mitre_technique = "T1112"case_type = "Anomaly detection" events:// Original detection event$e1.principal.hostname = $host($e1.target.registry.registry_key = /Control Panel\\International\\Geo/ or$e1.principal.process.command_line = /Control Panel\\International\\Geo/ or$e1.target.registry.registry_key = /SYSTEM\\CurrentControlSet\\Services\\Disk\\Enum/)not ($e1.principal.process.parent_process.file.names = "Dell.TechHub.Diagnostics.SubAgent.exe" nocase or$e1.principal.process.parent_process.file.names = "Dell.TechHub.Instrumentation.SubAgent.exe" nocas

Hello Experts,We are attempting to send styled Microsoft Adaptive Cards to Teamschats directly through Google SecOps SOAR playbooks. We designed the card JSON using the official Microsoft Adaptive Cards Designer.However, when passing the JSON payload into the Text parameter of the MicrosoftTeams - Send Chat Message action, the message renders strictly as unformatted raw JSON text in Microsoft Teams rather than as a visual Adaptive Card.Is there an existing parameter, syntax wrapper, or integration configuration in the Microsoft Teams integration that allows Send Chat Message to accept native Adaptive Card JSON payloads?If not, could you provide a supported Python snippet or guide on how to extend MicrosoftTeamsManager so it can properly post application/vnd.microsoft.card.adaptive attachments to Microsoft Graph API?

Hi team, I am wanting to configure the following SLAs in SecOps to do the following:A separate SLA for a case being unassigned A new SLA countdown once the case has been assigned depending on severity A third for when either an action is awaiting approval from second line support e.g the case in an escalation state (between first and second line)Also, has anyone had success in integrating SecOps SLA notifications into 3rd party tools (Slack, ServiceNow, Jira,etc)?  Thanks

Given the coming EoL for Python 3.11 in Oct 2027, is planning currently underway at all to start preparing the migration in Google SecOps SOAR to a later version than 3.11 (similarly to what was done for 3.7)?

I have a playbook that needs to generate an alert in a specific environment if certain criteria are met after an investigation has been performed. It seems this may be possible in two ways:Create a UDM event in SecOps and have a detection trigger on it. Create an alert using the SOAR API.It seems both would require a custom integration as these actions/endpoints are not available in the  default integrations available.Which would be preferable? I feel as though going via a detection would be proper, as it would leave a full trail from event to alert. Using the SOAR API would probably be faster and easier however. I’ve been unable to find strong documentation on how to do either, hence the post, thanks!

Hello community, as we know Bindplane now handles NetFlow data thankfully, I am reviewing the SecOps documentation and attempting to create a dashboard to help better visualize this data and while I am building out something I wanted to check in here to see if anyone else has faced similar and how they might have tackled the question..

Hello! This is, I guess, aimed more at Google people (especially ​@dnehoda as the original writer, and I’m really sorry if directly mentioning users is rude) since it’s a question on a Google post, but please feel free to answer if you have relevant information.On the most recent Tip of the Week (on which I can’t reply, hence why I’m creating this new topic) I read that, apparently, “Data tables use $table_name[column_name] syntax”Is that a new thing? From what I’ve read and used, it’s always been %a.b rather than $a[b]. If that’s a new thing, is it different in any way from the old %a.b syntax? I’ve attempted to test the syntax used in the post, and it throws syntax errors---Also, in the same post, there’s an example rule for unauthorized secret access, which has the following in the events block:$secret.principal.user.email_addresses = $sa_email$secret.target.resource.name = $resourcenot $sa_email in $approved_service_accounts[email]not $resource in $approved_secrets[secret_name]That

Hi All, I am testing the Microsoft 365 Defender (XDR) Integration v26.0 and have observed the following which when looking at the documentation seems to be by design. Scenario 1Event triggered and “Incident 1” created in XDR Event triggered and “Incident 2” created in XDR Both incidents and their associated alerts are ingested into the SOAR and created: Case 1 with the name “Incident 1” Case 2 with the name “Incident 2” XDR then correlated Incidents 1 & 2 and based on a rule and renamed “Incident 1” to “Suspicious activity on one endpoint”  moved the alert from “Incident 2” to “Incident 1” and closed “Incident 2” The Sync Job in SOAR attached all alerts to Case 1 but left the Case name as “Incident 1” The SOAR Case “Incident 2” was left open along with it’s associated AlertScenario 2Event triggered and “Incident 1” created in XDR Event triggered and “Incident 2” created in XDR “Incident 1” ingested into SOAR and a Case created with the same name “Incident 1”  Before Ingestion of “I