Google Security Operations

Hello,I’m implementing SLA tracking for Cases in Google SecOps and would like to understand the best practice for building dashboards.My SLA logic includes: Time to analyst assignment (unassigned → assigned) Identification of SLA-breached cases Visibility at both case level and analyst level Currently, I don’t see native SLA fields for Cases, so SLA is derived from case metadata (Created Time, Owner, Status).Questions: What is the recommended way to build dashboards showing: Cases that breached SLA SLA compliance per analyst Are SecOps dashboards expected to rely only on: Case filters and saved views? Case-based rules and tags? For analyst-level S

Hello,I have a QRadar connector configured on my SOAR instance, it is working fine, the logs arrive correctly and cases are being generated.The issue is that in QRadar there are some Custom Fields that are not ingested correctly.I do have configured the custom fields on the connector page like this:The fact is that I get the Filename and Request field, but I got some issue on the "SHA 256" field, I think the problem is the space present in the custom field.How do the SOAR translate the space? Do I have to write SHA_256 or something like this?Thanks in advance!

Hi team,In Chronicle SOAR case queries, I want to retrieve the Event Type value shown in the Events tab (for example RESOURCE_CREATION).In the UI this appears under the TYPE column for the event. What is the correct field to reference in a case query to fetch this value?Thanks!

The alert included in the case has a product field.In "SOAR Reports legacy", the product field is available. Where can I find this field when using Dashboards and the "Cases and alerts" data source? https://cloud.google.com/chronicle/docs/reference/soar-data-dashboard#cases-and-alertsI reviewed all the fields, but I didn’t find any product field. Anyone would know?   

The native dashboard does not auto-refresh. How can we enable automatic refresh for the dashboard? 

Hi Everyone,I’m writing to check whether it’s possible to monitor and alert on ingestion delays (i.e., lag between event time and ingestion time in logs/SecOps) for more than 1 hour using the Google Cloud Monitoring console. Thank you in advance.Aravind Sreekumar

Hi everyone,I'm currently integrating Jira with Google Security Operations (Chronicle SOAR) using the native Jira integration, specifically the Sync Closure Job and Sync Comments Job.The integration is working as expected in terms of synchronization:Jira issues are created and updated correctly Status changes are synced bidirectionally Cases/alerts are closed when the corresponding Jira issue is closedHowever, I noticed an issue with the closure reason in SecOps:When a Jira issue is closed and synced back to SecOps, the alert/case is closed with:Reason: MaintenanceComment: "Alert was closed by Jira - SyncClosure"From reviewing the job script, it seems that the closure is performed using:siemplify.close_alert( root_cause=ROOT_CAUSE, reason=REASON, comment=COMMENT,

After performing the Stage 2 migration of the SOAR environment, we started experiencing intermittent issues when accessing the SecOps (SIEM) web interface.At certain moments, specific pages fail to load and remain stuck in an infinite loading state (loading spinner displayed indefinitely, with no content rendered).  Technical Analysis: Using browser DevTools (Network tab), we identified that one of the backend endpoints is returning HTTP 403 (Forbidden) during page load. This behavior appears to be session-related: When accessing the SIEM using a clean browser session (no cookies/cache), the page loads successfully.

HI, we have salesforce shield licence and I am configuring event logs ingestion to google chronicle. My question is which events google chronicle will pull after configuration. Do we need to have event data streaming option enabled for each of the event type defined in the event manger?    

Hello,Is there any options to show pending action to user with dynamic field inside?I know how to create IDE that will prompt user with plaintext, same as Flow > Instruction. But is there any option to prompt user with something dynamic? Even as a text field where he can just go “ok”.Purpose - to not force user to go to wall to look for answer of some regular actions.Example - Playbook get information about IP and instead of post insight it will provide another pending action prompt that when you click respond it will have output from that previous gathering action listed.Looking forward to suggestions.

So it seems is not possible to nest placeholders in the expression builder right?I have several fields that come with comma separated values, pretty much like field1: “value1, value2, value3”.So I wanted to iterate over a list of items and do operations like conditions, as in “item 1 = value1”.I created a loop and I thought in in the expression builder I could just add something like [item_list | split(“,”)] getbyindex(“[Loop.Index]”) ](Also adding an incremental value of -1 since loops are based 1 and positions based 0) Either I’m missing something or I just need a new approach like just go ahead and code a new action in IDE. 

Hi everyone,I want to export raw logs from our Google SecOps instance to a GCS bucket in the same region (northamerica-northeast2, Toronto) using the Data Export (Enhanced) API (directly with curl or the secops export CLI (https://github.com/google/secops-wrapper).However, I’m running into two main issues: Listing export jobs secops export list and the corresponding GET projects/.../dataExports REST call both return: { "error": { "code": 403, "message": "The caller does not have permission", "status": "PERMISSION_DENIED" }} This happens for me and for our SecOps administrator, who supposedly has full admin access in the SecOps

Hi, I want to get a report using the dashboards for a time period exceeding 92 days that is currently permitted for stats dashboards. i cant do this using a UDM search result since the requirement i have is to only get the latest login which is not possible through the CSV file that i can get by doing a udm search. The query i need is this:events: $e.metadata.log_type = <logtypevalue> $e.metadata.product_log_id = <value> $e.principal.user.userid = $userid $userid != "" $e.principal.user.group_identifiers = $group $seconds = $e.metadata.event_timestamp.seconds $date = timestamp.get_date($e.metadata.event_timestamp.seconds) match: $userid, $groupoutcome: $event_count = count($e.metadata.id) $Last_login_date = timestamp.get_timestamp(max($e.metadata.event_timestamp.seconds) + 19800) //adding +5.30 in minutes to utc time

Hi,I’m working on enriching AWS CloudTrail logs with Organization Unit (OU) information. Since CloudTrail logs (except for the “CreateAccount” event) do not natively include the OU, I’ve implemented the following workflow:I created a Data Table that maps Account ID to OU and I wrote a detection rule that triggers on the “CreateAccount” log and uses the write_row function to update the mapping in the Data Table.I need the OU information to be available in every case opened for a specific account, even though the logs triggering those cases don't contain the OU field. What is the best practice to enrich a case with a field from a data table in this situation?Can I leverage the outcome section to fetch the OU from my data table and then promote it to the case level?I’m looking for the standard procedure to handle the Alert-to-Case mapping for these enriched values.Or, is graph_override a better approach for this type of enti

Hi Everyone ,Is there a way to export the MITRE ATT&CK matrix/dashboard so the export includes (1) rule names for both curated/built-in and custom rules, and (2) the mapped MITRE ATT&CK TTPs (tactic/technique IDs and names) for each rule. Looking for bothe csv and JSON format.

Hi All,We are observing recurring error logs in the Microsoft Azure Sentinel Incident Connector v2:“Failed to fetch backlog incident 37014. Error: Incident with number 37014 was not found.”This error is being logged continuously, with hundreds of entries generated within a 15-minute window. The issue persists as of today, 3rd October.Background on Incident 37014:The incident was triggered and closed on 13th July 2025 in Sentinel. However, it was not ingested into SOAR, and the reason for this is unclear. Notably, adjacent incidents such as 37013 and 37015 were successfully ingested and corresponding SOAR cases were created.Please advise on how we can proceed with resolving or suppressing this error.

Hi everyone,It has been observed that parser changes can sometimes break existing rules, especially when certain fields are modified, renamed, or their structure changes. This can lead to unexpected issues in rule execution.I wanted to ask how to track which fields have been updated when parser changes are introduced. Are there recommended methods or tools to identify field-level changes between parser versions?Additionally, what are some effective strategies or best practices to handle these situations and prevent rules from breaking when parser updates occur?For example: Do you maintain a field change log or use automated comparisons between parser versions? Are there monitoring or validation techniques to quickly detect when rules are impacted by parser updates? What processes do you follow to safely update rules when parser fields change? Any insights, experiences, or recommended appr

Hey all,Has anyone faced issues ingesting Salesforce logs into Google SecOps using the OAuth JWT grant method?We’re currently seeing authentication failures when configuring the feed using JWT (all required credentials provided as per Google documentation).When switching to OAuth Password Grant, the configuration fails with:No such column 'Interval' on entity 'EventLogFile'From our research, the Interval field appears to require Salesforce Shield / Event Monitoring, but the customer only has Salesforce Enterprise Edition. The Google documentation mentions Enterprise and above should be sufficient.Just checking: Is Shield/Event Monitoring mandatory for this integration? Has anyone successfully used JWT grant without Shield? Any common causes for JWT authentication failure in

I know I can set the connector run frequency to run every so often. Lets say I set it to run every 10 seconds - if the connector run itself takes longer than 10 seconds, does that mean the next connector run is delayed? Is the connector instance only ever running once at a time?

Hello Team,I am working with logs in Google SecOps where the IP address fields (such as SourceIPV4, TargetIPV4, and AnalyzerIPV4) are received in decimal (integer) format instead of the standard dotted IPv4 format.For example:750176699 → expected to be converted to a standard IPv4 format (e.g., x.x.x.x)Could anyone please advise on how to convert these decimal IP values into normal dotted IPv4 format within the Google SecOps parser (UDM mapping)?sample log: EPO_Events.EPOEvents 20XX-03-XXT05:XX:33 HOST123 EPOEvents{"AgentGUID": "XXXX12345678","Analyzer": "_1000","AnalyzerHostName": "HOST001","AnalyzerIPV4": "3232235777","AnalyzerIPV6": "AAAAAAAAAAAAAP//wKgBAQ==","AnalyzerMAC": "001122AABBCC","AnalyzerName": "Drive Encryption","AnalyzerVersion": "7.4.0.11","AutoGUID": "ABCDEF12-34567890AB","AutoID": "123456789","DetectedUTC": "2026-03-17T05:48:33","Received

Hey Community! We have an exciting pilot coming REALLY soon and need your help testing it out!  The Community is hosting it’s first live virtual SecOps Workshop and virtual Capture The Flag challenge. Register for these events and you’ll also get access to two free SecOps training courses. WIN WIN! (yes that’s a win for each free course) Mark these dates on your calendar:Thursday March 5th 9AM PT: Virtual workshop on Search and Rules in SecOpsThursday March 19th 9AM PT: Virtual Capture the Flag built with Search and Rules challenges Thumbs up if you’re in! Or post a comment below. We’ll make sure you get included on the invitation. More details coming Tuesday Feb 17!

Hi everyone,We are troubleshooting an issue related to Raw events in Google Chronicle SOAR.Raw Event properties- Because of this, we are unable to see or select any raw event fields during ontology mapping.Observations: This behavior is occurring across multiple sources/products. Some sources appear to use default views, while others have custom configurations. Normally we would expect raw event data to appear at least at the source level, but currently nothing is populating. Raw events appear to exist in Chronicle, so it’s unclear why they are not appearing in the ontology configuration page. Has anyone encountered a similar issue where raw event properties are not visible in the ontology configuration UI?Could this pot