Google Security Operations

Hello, All! After perusing the group and finding some excellent info, I was able to get GitSync up and running between our SecOps instance and GitHub, thanks to the official document as well. I’ve successfully sent out various folders, playbooks, etc. but am looking to automate this process via scheduled times. I’ve found this document which highlights this capability on what looks to be an older version of GitSync but I can’t find it on the current version (unless I’m missing it, of course):

If you want to export your logs to a storage bucket a few days before your license expires, but:- You don't need to export every log type (to save on costs),- You want to write specific logs to different buckets,- And you want to automate this process daily or weekly...You can use the SOAR integration I developed.It utilizes the Data Export API and Chronicle API (solving the deprecated fetchAvailablelogTypes endpoint issue) to automatically discover active logs and filter them based on your needs.Here is the integration link: https://www.linkedin.com/posts/samet-ibis_github-samet-ibisgoogle-secops-automated-data-export-activity-

Good afternoon, I'm trying to integrate AWS CloudTrail, CloudWatch, and GuardDuty alerts with Google SIEM Secops. My question is, what are the differences between sending these logs to Amazon S3 or Firehose and then to Google SIEM? Is it possible to send the logs from these cloud resources directly via API without any intermediary? Why? What do you recommend?

I have a panel in a dashboard. When I click on three dots on the top right corner, I get these options: On clicking on ‘View Query’, the following box opens: When clicking on ‘Run in Search’, a new window opens showing the output in UDM Search for the same query written for the panel: When I hover over three dots adjacent to any row, I get following options:

I’ve got Sentinel one feeds installed for sometime as follows:Cloudfunnel for all the agents procexec  (via s3 buckets Alert feeds via api  Recently, I started to use  SentinelOne new  SOC UI and I realized they have new rules/detections (“platform Detections and Alerts”). I enabled many of these detections based on my environment for they are not enabled by default.  Performed a few tests and they fired as expected, I can see them on the S1 Console, yet, on Google Secops, none of my feeds seems to receive any of these new “platform detections /alerts”.  the old custom and malware detections seems to be fine though.I opened a case with S1 and they are thinking that perhaps the current S1 alert api feed  setup still not updated to get these new “platform detections” .   Do any have any idea if this is case? if so, how do I proceed to get Google SecOps update their Alert feed connection to support these new alerts? 

I’m running mysql 8.0.26-google cloudsql instancecloudsql_iam_authentication flag = ONBUT the authentication_iam plugin is not getting loaded.when I run SELECT PLUGIN_NAME, PLUGIN_STATUSFROM INFORMATION_SCHEMA.PLUGINSWHERE PLUGIN_NAME LIKE '%iam%';I getgcp_iam_authgcp_iam_group_auth According to ChatGPT, these are Postgresql plugins, not mysql.   

Good afternoon, I'm trying to integrate AWS CloudTrail, CloudWatch, and GuardDuty alerts with Google SIEM Secops. My question is, what are the differences between sending these logs to Amazon S3 or Firehose and then to Google SIEM? Is it possible to send the logs from these cloud resources directly via API without any intermediary? Why? What do you recommend?

I have this nested JSON: "jsonPayload": {"message": "\"id2\":{\"timestamp\":\"2026-01-19 03:15:20\", \"app_name\": \"test1234\", \"client_port\": \"2233\", \"client_host\": \"hostName\"},}I wrote this code snippet but it doesn't work, can you tell me why?filter { mutate { replace => { "client_port" => "" } } grok { match => { "jsonPayload.message" => ["client_port=(?P<client_port>[0-9]+)"] } overwrite => ["client_port"] on_error => "client_port_not_present" } statedump{} mutate { rename => { "client_port" => "event.idm.read_only_udm.principal.port" } } mutate { convert => { "event.idm.read_only_ud

Hi All,In the Microsoft Graph Mail integration, there is an action called “Delete Mail.” If this action is executed via Google SecOps SOAR, will the email be permanently deleted, or is there any option to restore or release it back afterward? 

Analysts are executing an action that I put on a Playbook which requires manual selection from a dropdown list.Main problem is they are sometimes doing it without choosing an option.So I have to prevent this happening, I cant simply blame random analysts.We have only 2 options when i create a manual action from dropdown list. You make that required parameter as MANDATORY. Then you have to give a DEFAULT VALUE when you are implementing it. If you give default value then when it is live, its showing that, action in playbook already filled with your default parameter, just like below image, and you can just press EXECUTE button as an analysts without choosing it. Which we dont want. You make that required parameter as NON-MANDATORY Then when its live playbook will gonna show you a dropdown list, that has “

I have noticed a delay regarding how quickly data about changes on cases in the SOAR UI propagates to the SecOps Dashboards datasets, “case” and ”case_history”.Currently, it takes almost an hour for the database used by the dashboards to update with the latest changes made to cases in the SOAR UI. (e.g. a case going from OPEN > CLOSED).Is this the intended/expected behavior?

Hi community, I am working on YARA-L detection rules in Google Chronicle to identify suspicious self-equality assignments (tautologies) in SQL logs. These patterns, like "1=1" or "test=test", are often used in SQL injection attempts to bypass filters or force true evaluations. Goal: Detect patterns where the left side of "=" exactly matches the right side, such as: test=test 1=1 time=time status = status flag=flag admin=admin bypass=bypass enabled=enabled id=id version=version But not detect mismatches like: 1=2 a=B (and similar non-tautologies) Challenges in Chronicle: I Tried regex -> ([A-Za-z0-9'-]+)\s*=\s*\1 were i used /1 #BackReference, but unfortunately backreference is not supported in YARAL, so using re.regex to directly check for equal values on both sides of "=". Then i used were grouping issue => The Chronicle re.capture() function only returns the first match in the text, and it supports only 0 or 1 capture group. If the regex contains 0 capture groups, Chronicle

Dashboard reports (Non-legacy) have no email delivery . Unable to schedule reports like the legacy ones. Is this feature out yet ? How do we schedule daily report to be sent to an email address

I’m looking for guidance on the appropriate contact point within Google for reporting and following up on unauthorized administrative actions performed by an external party with (current or former) Google Workspace admin access.More specifically, I’m trying to understand: Which Google team or function is responsible for handling this type of incident (e.g. Workspace Support, Trust & Safety, Abuse, Partner oversight, etc.)? Through which channel (ticket type, form, or email) such reports should be submitted to ensure proper review and ownership? Whether there is a defined process for incidents involving actions performed through the Google Workspace Admin Console by a third party? What kind of information or audit logs are typically expected to support an investigation? My goal is to avoid being redirected between multiple teams and to engage the correct

Hello,I’m trying to implement an SLA workflow for Cases in Google SecOps, specifically around analyst assignment and investigation timing, and I’d appreciate guidance on best practices.From what I can see today, at the system level, Google SecOps provides: Alert Stage Severity However, there is no native SLA mechanism for: Time to analyst assignment (Owner) Time spent in specific case phases (Triage / Investigation) SLA logic I’m trying to enforceMy desired SLA flow is: Case created (Unassigned) → Triage: 30 minutes to assign an analyst → Assigned → 15 minutes to move to Investigation → Investigation → 1 hour to progress / respond   What is the recommended way to implement SLA tracking for:

Hello,I have a question about the "Quick Action" Feature. I understand that you can use quick action buttons linked to integration actions. But is there a way to link it to a playbook block? I tried using the "Attach playbook to alert" But this workaround does not allow for custom input for the playbook.Is this something that is on the road map for the "Quick Actions"?https://cloud.google.com/chronicle/docs/soar/investigate/working-with-cases/quick-actions?hl=en

Hi Community,I'm building a bidirectional integration between Google SecOps and Jira for our SOC operations and would appreciate any guidance, tutorials, or examples from those who've implemented similar workflows. I didn’t find any good tutorial to create a playbook.

Hi Security & SecOps Community,​As organizations rush to deploy Agentic AI, CISO’s and Security Architects face a new dilemma. Standard security tools (Firewalls, IAM) protect the perimeter, and standard MLOps tools protect the performance.​But who protects the Integrity?​With the enforcement of the EU AI Act and ISO 42001, we need a new layer of defense. An AI Agent that performs technically well but violates regulatory boundaries is not an asset; it is a liability.​Today, on behalf of CreativeMindSolutions (Research), I am sharing the high-level methodology of our Compliance Auditor. This is a novel, zero-storage framework built on Google Cloud (Vertex AI) designed to enforce "Artificial Wisdom"—a verifiable state of operational integrity.​1. The Core Innovation: Artificial Wisdom (AW) as a Security Layer​In our research, we moved beyond the philosophical definition of wisdom. We define Artificial Wisdom (AW) as a technical Integrity S

Hi Folks,I’m new to SecOps and still getting familiar with the platform’s functionality. Apologies if this is a basic question, but I believe it will be helpful not only for me but also for others who are beginning their SecOps journey. I’m looking for guidance on how to search logs in SecOps for the following requirement:We have onboarded Windows servers via Bindplane, and I want to run a query to list all logs coming from a specific Windows server.Currently, we are using a query similar to the one below (Partial query) :metadata.log_type = "WINEVTLOG"$host = strings.coalesce(principal.asset.hostname, principal.hostname)However, we are observing an issue where we have onboarded only 50 Windows servers, but the query returns more than 50 host values. Upon initial review, these additional hosts appear to be introduced during parsing (exact cause not yet confirmed).

Hi Team, I’m reaching out regarding an issue with our Nozomi Guardian integration in Google SecOps. Even though the connection shows as successful in the Nozomi Console, we are not seeing any logs being ingested into Chronicle, even under UDM log type. We have given URI as “https://malachiteingestion-pa.googleapis.com” and Customer ID. We downloaded the service account from collection agents console and the connections shows successful in Nozomi console but logs are not getting into Google SecOps. Please let us know if anyone able to find what the issue is here. This is the documentation we followed: https://technicaldocs.nozominetworks.com/products/n2os/topics/administration/settings/data-integration/c_n2os_admin_settings_data-integration_google-chronicle-2.html Thanks in advance! 

Hi Team,While running a Dashboard query using “Run in Search”, the query returns No results, even though the same query shows results within the dashboard visualization. The issue specifically occurs when applying an equality filter (=) on a derived field created using an if() expression. metadata.product_event_type = "test" $inference = if( security_result.summary = "Client Authentication Bypass", "ABP", if(security_result.summary = "SSH Agent Forwarding Requested", "AFR"))$inference = "ABP"match: principal.ip, target.ip, $inference  When filtering with: $inference = "ABP"  → No results are returned. However, removing the equality filter entirely returns results Using a negation filter:

Hello everyone,  hope you're all having a great day!I tried searching on documentations and in this forum for this specific message but had no success.I'm currently working in the following detection (Parameters were made generic for sharing purposes). The objective of this rule is to detect any occurrence of Event2 for which, in a 24 hours span previous to it's timestamp, there's no Event1 with a mutually shared eventcasenumber value; events:$e1.metadata.log_type = "logsource"$e1.metadata.product_event_type = "event1"$e1.metadata.product_event_type = $event1 $e2.metadata.log_type = "logsource"$e2.metadata.product_event_type = "event2"$e2.metadata.product_event_type = $event1 $e1.additional.fields["eventcasenumber"] = $e2.additional.fields["eventcasenumber"] match:$event2 over 24h after $event1 

I am facing a few issues while performing event enrichment using entities.One of the issues is related to partial data availability in the Overview tab. When I search for an entity in Google SecOps SIEM search and select any row in the Results section, a panel opens on the right-hand side displaying the entity details (as shown in the image below).   When I navigate to the Entities section from the top-right corner, I am presented with the following view.  Upon clicking the listed Entity IP, a new window opens that is expected to display the entity details. However, in this case, no data related to the selected entity is d