Google Security Operations

We're looking to ingest IRU and Kandji logs into our Google SecOps environment but can't find any related documentation. What's the recommended approach for this integration?

Is there any way we can integrate Emerging Threats with SOAR so that if an IOC match is found it creates a SOAR case?

At present, playbooks can only be triggered based on information available at the time a case is created, such as initial case fields or other creation‑time metadata. This is a significant limitation, as it prevents triggering playbooks based on later context, including alert data from additional systems, case stage changes, enrichment results, or information added manually by an analyst.As a result, it’s difficult to design playbooks that respond dynamically as a case evolves, which is a common requirement in real‑world SOC workflows.Based on the discussion in Unable to trigger playbook when case is set to notify (linked above), it sounds like expanded triggering capabilities are planned for Q2 this year. Is there any additional clarity on what functionality this feature will include, and whether there is a more specific timeframe for its release?In the meantime, is there a recommended workaround from Google to address this limitation, or is manually a

Hi All,First may I apologise for the incorrect place for this topic - but right now I feel completely out of options.Our production SOAR instance became unresponsive yesterday around 13:45BST (503 errors from a number of API’s meaning we can’t authenticate into the system at all)- I raised a support ticket (Ref 70050003) which I was told due to technical reasons could be no higher than a Priority 2, and right now the only outcome I have received between yesterday and today (22 hours) is “We’re still looking for an engineer”.I am completely dismayed, that a production service outage has not only been left to placeholder SLA matching updates, but there is a complete lack of information, timelines and indeed any form of troubleshooting or breakfix been applied.I have asked a number of questions which have been met with silence, and this reflects on us as this then translates to the only updates we can give customers.I’ve been a proponent of SIEMplify/

I have an Azure log that contains multiple policy validations. Each validation generates an object inside an array with rule_name and result.All this information is parsed in SecOps as security_result, so now I have a security_result field with two or more objects.For example: security_result: (2)0:rule_name: "rule_1"result: "success"1:rule_name: "rule_2"result: "notApplied"How can I, in Search and YARA-L, perform a validation where rule_name = "rule_1" and the result of that policy is "notApplied", without using a predefined index? The position of rule_name = "rule_1" can change depending on the log.

I need to create Google Chronicle API instance using workload identity but I am getting permission denied error  “unable to acquire impersonated credentials”.iam.serviceAccountTokemCreator has already been provided.Still getting the error.Request more insights 

Hi, I have created the datatables, one field is ip ranges which is values and its data type is string and another filed is its respective sitename Query :case.alerts.entities.type = "ADDRESS"$ip = case.alerts.entities.identifier$ip in %Test.ValueMatch:    case.priorityoutcome:    $Count = count(case.name)how to fetch the sitename along with its matching IP in the datatables in secops dashboard queryNote: When I check the logs, sitename is found in the udm filed deviceGroupName and also in deviceGroupDescriptionthank you!

What is the difference between collecting the CrowdStrike Falcon logs vs the CrowdStrike FalconStream logs? I notice there are parsers for both, but was wondering whether one provided any particular advantage over the other? We are after the logs which provide the most detail about the environment, and are also looking at using Bindplane. Any insight would be appreciated! 

Hey Community! We have a great webinar, in two languages: Portuguese and Spanish, coming your way April 15th. Check out the details below. You wont want to miss this session!  A Day in the Life of a SOC Analyst with Google SecOps 🕵️ AI Triage: Gemini summarizes thousands of alerts into clear narratives, cutting down manual tab-hopping. 💬 Easy Search: Run complex queries across petabytes of data using simple natural language commands. ⚡ Smart Automation: Convert manual investigations into one-click automated response and remediation workflows.  Register for Portuguese (April 15th 11AM PDT) 

 Hi everyone,I’m currently in the process of setting up my Google Cloud environment and awaiting my monthly innovator credits. In the meantime, I’m not letting the grass grow under my feet! I’m kicking off my first security-focused project: The Automated IAM "Least Privilege" Auditor.The Goal: I want to build a tool (using Python and Cloud Functions) that audits IAM policies across a project and flags any identities holding the primitive "Owner" or "Editor" roles where a more granular predefined role would suffice.While I wait for my credits to clear, I’m focusing on: Mapping out the service account hierarchy. Writing the logic to parse IAM policy JSON objects. Designing a dashboard layout for security alerts. My Questions for the Experts: For a project like this, do you recommend pulling data via the 

Hi All,Is there a way to monitor a windows directory and ingest the logs into Sec Ops ?I have explored some part of bindplane but that is giving me an option to ingest Application, Security or Sysmon logs

Hello Community, Looks like DUO will be discontinuing the support for older version of duo_client/Client.py and i have not seen an update that upgrades that file to 5.5.0. Is there any guidance and has anyone tested this using a custom IDE. If so have you ran into any issues with the integration. 

I’m trying to authenticate to the new Chronicle API using PowerAutomate. It’s been working using the old API, but I’m not sure how to set it up for the new API. Has anyone done it or have any advice? The issue is the authentication methods I see all involve client libraries or the CLI, but in PowerAutomate there is not a pre-built integration that I see, so I’m just using HTTP requests.  Previous MethodURL: https://REMOVED.siemplify-soar.com/api/external/v1/cases/CreateManualCaseAuthentication Method: AppKey New MethodURL: https://us-chronicle.googleapis.com/v1alpha/proje

Is it possible to trigger a playbook based on a new case being created? I’m working on building a case notification system that alerts a security analyst when a new case is created.The intended workflow is:Send an initial notification when a new case is created After a delay, allow a triage phase so all related alerts can be grouped into the case Send a follow-up “case summary” notification that includes all relevant case details to help the analyst determine whether the case is a true or false positiveThe issue I’m running into is that when multiple alerts hit the SOAR system at the same time, multiple playbook executions occur, which results in duplicate notifications.

Hello everyone, I am trying to ingest mimecast v2 api logs into googlesecops, however integration available in content hub expects app id, V2 API does not have app id, Can anyone help me on this please. 

n our SecOps platform, we are currently in the process of moving all our reference lists to data tables since lists are on a deprecation path. We currently have a couple of reference lists “known Malicious hashes” which contains 2 lakhs hashes divided into two lists(1 lakh hashes each).  Reference list allow 1 lakhs entries per list. Whereas, Data tables allow only 10,000 entries per table so I have created 20 data tables and somehow moved all of them. I would like to know if there’s anyway we can fix this portion first. This was a time-consuming task to move just 2 lists to 20 tables due to the limitation.Next up, when I try to use those data tables in a rule, I hit a limitation again “The number of in statements is more than max allowed limit(10). Can you help?Attached error message 

Hello,I am experiencing an issue related to the use of Data Tables for data enrichment in SOAR. Currently, we have several tables containing IP addresses along with their corresponding hostnames (and in some cases, additional information such as VLAN or other attributes).The goal is to query these tables using the “Is Value In Data Table” action, so that when searching for an IP address, the associated values from the corresponding columns are returned. However, a limitation arises because we need to query three different Data Tables simultaneously, each with different structures and fields.The expected output would be something like:IP (hostname, vlan) if associated information exists IP only, if no match is foundAdditionally, we encounter issues when multiple IPs are present in the same alert. The output does not preserve the relationship between each IP and

When building playbooks for Chronicle SOAR, I often run into a limitation around looping logic. Specifically, there doesn’t appear to be a supported way to create nested loops (a loop within another loop).This becomes an issue in fairly common use cases. For example:Iterating over all entities of a specific type in a case, and then looping through the values of a particular field for each entity. Looping through all alerts associated with a case, and within that loop, iterating through each alert’s entities or a specific type of entity.These types of nested iterations are typical in automation workflows, so I’m curious about the rationale behind the current limitation. Is there a design or technical reason nested loops aren’t supported today, and is this functionality something Google plans to add in the future?

n our SecOps platform, we are currently in the process of moving all our reference lists to data tables since lists are on a deprecation path. We currently have a couple of reference lists “known Malicious hashes” which contains 2 lakhs hashes divided into two lists(1 lakh hashes each).  Reference list allow 1 lakhs entries per list. Whereas, Data tables allow only 10,000 entries per table so I have created 20 data tables and somehow moved all of them. I would like to know if there’s anyway we can fix this portion first. This was a time-consuming task to move just 2 lists to 20 tables due to the limitation.Next up, when I try to use those data tables in a rule, I hit a limitation again “The number of in statements is more than max allowed limit(10). Can you help?Attached error message 

Simple Question:Is there any way to identify which raw logs ingested into Google SecOps do not yet have a parser?There are many teams ingesting logs into my Google SecOps, and I would like to identify which logs do not yet have an active parser. Is there a way to view or report on logs that are not yet parsed?

 Hello everyone, I need some help regarding Google SecOps Case Management. In the Case Wall, we can see all activities related to a case such as actions taken, comments, status changes, tasks , and other events that happened during the life-cycle of the case. I would like to know if there is a way to export or extract the Case Wall activity into a table format or CSV file.Our team focus to review response time of each assigned case and what happen to that case.  Any suggestions or guidance would be greatly appreciated.Thank you.

Hello,My GCP project (id: vaulted-zodiac-491122-f0) has been suspended for a week and I appealed immediately but still no response. I have no clue why I violated Google’s policy. It has greatly affected my work. I hope you can escalate my case for review.ThanksC