Google Security Operations

First of all this issue appear around 1month ago? Before I am sure that we were able to see highlights.I am having an issue with Highlighted Fields properties not rendering below entity inside the Entities Highlights widget at the bottom of the Alert View/Case View.Specifically, Google SecOps automatically maps our network ranges and populates the Network Name property for IP addresses (ADDRESS entity type). But same is for custom ones created by us that worked previously.Although the data is successfully populated and visible in other parts of the UI, it refuses to appear directly on the entity rows/cards in the main alert view.What I have already checked and verified: Properties Metadata: The Network Name field has both Is displayed and Is highlighted checkboxes checked. Side Panel & Entity Details: The configuration works perfectly for the right-hand side panel (Highlighted Fields section) and inside the SOAR Search -> Entity Details view. The field is there, and the value

Hi All,Anyone has performed a complete end to end implementation of multi tenancy in google secops SOAR SIEM.I need real example with implementation steps for typical GCP environment.Also if any relevant documents will be helpful

Hello Community Managers,I am posting on behalf of the project owner and urgently asking for guidance or manual escalation.Our GCP project appears to have been affected by credential exposure, hijacked resources, or unauthorized usage.Affected project:- Project name: my digital twin- Project ID: my-digital-twin-5561f- Appeal / Ticket Reference ID: T4RJ5FJRTGPBQAPKNBAOMHF6R4The project was first suspended on May 9, 2026 due to activity related to hijacked resources / malicious activity. We submitted an appeal and explained that a Firebase/API key may have been unintentionally exposed during development, and that remediation steps had been taken.Google restored the project on May 11, 2026 and instructed us to resolve the remaining compliance issues.However, around June 4, 2026, the project appears to have been suspended again after subsequent legitimate use/testing. Since then, we have been unable to access the project normally through the Google Cloud Console. We are redirected to the a

Hi All,  We received notifications that some Gemini versions that we were relying on for Playbooks were going to be deprecated: https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/model-versions. Based on this, we needed to identify the versions that were currently in use within our SecOps environment.  In some cases, e.g. VertexAI, we have a default set which is great if all playbooks use the default, but that didn’t turn out to be the case. The method we used to identify the playbooks/blocks using the soon-to-be-deprecated AI models is as follows:ProcessExported all playbook/block definitions from SecOps. Extracted the JSON contents into a local folder. Ran a Python parser to: Search JSON files for Gemini and/or Vertex references. Identify affected playbooks. Extract configured model IDs from playbook step parameters. Generated a list of playbooks using affected Gemini/Vertex models. Output The scan reports: Playbook name Detection type (Gemini, Vertex, or

I’m looking for a way to map case attributes using Expression Builder for a GSO playbook/block.Scenario: I’m working with the ServiceNow integration that accepts discreet values for urgency and impact when creating/updating incidents. 1 = High, 2 = Medium, 3 = Low.The case priority in GSO is an integer between 0 and 100. 100 = Ciritical, >= 80 <= 99 = High, >=60 <= 79 = Medium, >= 40 <= 59 = Low, etc.As such, the GSO priority value needs to be transformed to something that ServiceNow will accept. Unfortunately, I can’t find a way to achieve this using the function available in the Expression Builder.The most logical function is ifthenelse, but there are some initial short-comings:You can’t chain functions to emulate else if; You can’t return the initial value on a false evaluation to then pipe to a subsequent ifthenelse.e.g.  [Priority | ifThenElse(">", "79", "1", ifThenElse(">", "59", "2", “3”))] < Can’t process the chained ifthenelseor[Priority | ifThenElse

Hello,I’ve noticed a new ingestion metric popup from SecOps in GCP Cloud Monitoring. An “is_unhealthy” metric, which I’m seeking to understand a bit further to figure out what it can do. If it lets us do real time alerting based upon findings from Health Hub, that’ll be awesome. If it’s doing something else, some insight here would be rather useful.So, I’ve set a basic threshold based alert, but the “is_unhealthy” metric appears to return a numeric value, which depending on the log type can be anywhere between 40 and 110 in this environment. Is there any view as to what this number represents?  Here’s a view of what I’ve initially setup, which has blasted me with 10-15 alerts on a nightly basis:"conditions": [    {      "name": "projects/redacted",      "displayName": "Chronicle Collector - Ingestion Health Status",      "conditionThreshold": {        "aggregations": [          {            "alignmentPeriod": "7200s",            "groupByFields": [],            "perSeriesAligner": "ALIG

I have a field :udm.additional.fields[“eventAnnotationManagerTime”] = [removed by moderator] How do i fetch this in the dashboard query?

Google Cloud’s agentic architecture provides strong controls for identity, isolation, prompt protection, observability, and tool access.However, once an AI agent is allowed to trigger a consequential operation — such as approving a financial condition, changing an account state, executing a transaction, or closing a security alert — observability alone is not authorization.We are currently testing the following separation of responsibilities for a regulated financial workflow:1. **The AI interprets**   - Understands the user’s intent.   - Retrieves permitted context.   - Selects a potential action and its parameters.   - Produces a proposal, not an authorization.2. **A deterministic policy service authorizes**   - Evaluates the end-user identity, agent identity, tenant, purpose, consent, policy version, transaction parameters, authority limits, and risk constraints.   - Returns either a denial or a short-lived, single-use authorization artifact.   - Operates fail-closed.3. **The transa

In modern multi-tenant enterprise architectures, centralizing security operations across distinct Google Cloud Platform (GCP) organizations is a common yet complex challenge. When security teams need to route telemetry from a production environment to a Google Security Operations (SecOps) SIEM tenant running under a completely different GCP organization, they must carefully balance real-time visibility, security boundaries, and cost. Fortunately, GCP offers multiple robust paths to achieve this—ranging from zero-infrastructure native direct ingestion to custom-filtered Cloud Storage and Pub/Sub pipelines—allowing organizations to bridge security perimeters without compromising their defensive posture. Let's see the direct and indirect ways to achieve this goal. In the screenshots:Organization A is catmuslabs.joonix.netOrganization B is secops.okkeslab.com Option 1: Direct Ingestion - RealtimeThe below screenshot represents Organization A (catmuslabs.joonix.net). An admin or owner user

Greetings Team,If we do not want to use Google Cloud's native silent log source monitoring, is there any alternative approach using a scheduled YARA-L rule, similar to the one below that runs hourly?I understand that this approach has a few limitations: The rule requires at least one event from the log source within the previous 24 hours  If incase  a log source has been completely silent from the beginning (i.e., no events have been ingested within the 24-hour lookback window), the rule will not detect it. For intermittently logging sources, because the rule is scheduled to run every hour, it will continue to generate an alert every hour until the log source resumes sending logs consistently. i am aware that even  configuring alert suppression to reduce repeated alerts for the same log source, However, will introduces another limitation: if the log source resumes logging and then becomes silent again during the suppression period, the subsequent log stoppage may not be detected beca

Hi,I am observing 25-45 mins of delay in SecOps case generation.I compared this using alert created time and SOAR case created time.Does anyone know what could be causing this delay issue? This is really critical issue for High and Critical priority incidents. 

Post inspired by recent struggle with csv/pdf output generation and hastle it take to find output in wall to get them.Preview:Here's the full working setup, including a few gotchas that cost me some time.Playbook steps:FileUtilities → Get Attachment — pulls all attachments from the case (returns a list, even for a single file, with evidenceName, fileType, base64_blob, etc.) TemplateEngine → Render Template — takes the JSON from step 1 and renders it into HTML using the Jinja template below. Email template -skip-Configuration for step 2:JSON Object: [FileUtilities_Get Attachment_1.JsonResult] ⚠️ If the field auto-populates with a trailing {} after the placeholder, remove it — it breaks JSON parsing and throws JSONDecodeError: Extra data. Jinja (dropdown): HTML Editor: paste the template below — this is the only field that actually needs your code Template (dropdown further down, e.g. "Email Template"): leave this alone. It's a separate, unrelated mechanism (pre-built email templates) a

This is Part 3 of a four-part series on running many tenants on one Google SecOps instance. Part 1 built the mental model: this kind of multi-tenancy is really three independent isolation challenges, and a single-slug naming convention can help overcome all of them! Part 2 got each tenant's telemetry in, correctly tagged, without trusting the partner's machines or leaking the ingestion key. This part takes the tagged data and answers the last two questions: can each analyst see only their own tenant's data, and does each alert land in the right queue? The final Part 4 closes the series with detection and response content that respects the boundary.By now the data is in the Google SecOps instance and every event carries its tenant slug as a namespace label. That was the hard, physical part. It happens on the wire, once, and the stamp lives on the event forever (or until it ages out past the data-retention period, 12 months by default). What remains is entirely a control-plane exercise t

This is Part 1 of a four-part series on running many tenants on one Google SecOps instance. Part 1 sets up the mental model and the naming convention the rest of the series builds on. Part 2 covers getting telemetry in safely; Part 3 covers who sees what and where each alert lands; Part 4 covers writing detection and response content (rules and playbooks) that works correctly across tenants.If you run security operations for more than one customer (a managed security service provider, a SOC watching several business units, a parent company monitoring its subsidiaries, or just a customer that requires strict isolation), you eventually reach the same fork. Do you stand up one Google SecOps instance per customer, or put everyone on a single shared instance and keep them apart logically?The shared-instance model is appealing for various reasons:It is cheaper, It gives your analysts one console instead of many, and It allows for one (or many) well-written detections that protect every custo

I am trying to write a rule for Google Workspace password resets initiated from a country that has not been seen in the last 30 days.For some reason, the `first_seen` metric is malfunctioning (returning 0 even though the user has logged in from that country before).Any tips? $password_change.metadata.log_type = "WORKSPACE_ACTIVITY"$password_change.metadata.product_name = "login"$password_change.metadata.product_event_type = "password_edit"$password_change.principal.ip_geo_artifact.location.country_or_region != ""$user = $password_change.security_result.about.email$country = $password_change.principal.ip_geo_artifact.location.country_or_regionmatch: $user, $countryoutcome:$first_seen_country = max(metrics.auth_attempts_success( period:1d, window:30d, metric:first_seen, agg:max, target.user.email_addresses:$user, principal.ip_geo_artifact.location.country_or_region:$country))condition: $password_change and $first_seen_country = 0 

This is Part 2 of a four-part series on running many tenants on one Google SecOps instance. Part 1 set up the mental model: multi-tenancy is three independent isolation problems (ingestion tagging, data access, case routing), and one hierarchical slug per tenant, used byte-for-byte across the namespace, the Data RBAC scope, the SOAR environment, and the Bindplane project (when applicable), is the thread that ties them together. This part takes up the first plane: ingestion.In Part 1 the namespace did all the work. We said: stamp each tenant's telemetry with its slug at ingestion, and the SIEM and SOAR layers have something to key off. That sentence hides the entire problem of this article...The moment you ingest telemetry from an organization you do not fully control, two questions open up that have nothing to do with access control and everything to do with whether you can trust what just arrived:Can someone get access to the credential that lets you write into your SIEM? Can one thir

Hi,I have wrote a custom actions that gets attachments from the case wall and creates a html table, allowing the user to click a button to download the attachment. This had been working okay but we have now been experiencing this following error:  File "/opt/siemplify/siemplify_server/bin/Scripting/PythonSDK/SiemplifyBase.py", line 170, in validate_siemplify_error raise Exception("{0}: {1}".format(e, response.content))Exception: 500 Server Error: Internal Server Error for url: http://server:80/v1alpha/projects/project/locations/location/instances/instance/legacySdk:legacyAttachmentData?attachmentId=3157&format=snake: b'{"errorCode":2000,"errorMessage":"An error has occurred. Search for Log identifier c55c79701e3341e380d50c8167df02c9 in the Google Cloud Logs Explorer.","innerException":null,"innerExceptionType":null,"correlationId":"c55c79701e3341e380d50c8167df02c9"}'This is happening when calling siemplify.get_attachment(attachment_id), although not entirely consistent but it s

Hi All,I am looking for a way to manage attachments other than on the Case Wall if such a thing exists? If not is there an elegant way to read a case for all attachments and then display them in an HTML Table with the ability to download? Having them on the case wall means they are missed once there are numerous Actions, Status Changes etc... A simple solution would be an Attachments option to pin them as with other items such as "Status Changes"Thanks, Daryll

Palo Alto Network Firewall Logs Not Parsing. We are using Palo’s Strata Logging to forward Palo Alto Network Firewall Logs to Google Secops Webhook. Some logs are getting parsed and some are not.When we take a look at the logs not getting parsed it shows the raw logs are coming in as a Stacked JSON with no way to do split delimiter due to the structure of the JSON. Has anyone seen this issue?

Hi all, I am trying to test googles “Data processing using API methods” (No bindplane)I was wondering has anyone tried to use this feature yet and have any tips.I am testing with OKTA_USER_CONTEXT and trying to redact PII but just for testing I am trying to redact the “Title” field. I tried it but not sure if I can redact a whole field using blockedKeyPatterns or does it only work on with blockedValues. Documentation used: Hi all,I am testing Google SecOps Data Processing Pipelines using the API methods directly, without deploying Bindplane agents/collectors. My use case is OKTA_USER_CONTEXT, where I am trying to redact PII from the Okta user profile payload before the data is stored/parsed in Google SecOps.For initial testing, I associated a data processing pipeline to a specific OKTA_USER_CONTEXT and confirmed the pipeline is associated using fetchAssociatedPipeline. The pipeline currently has a redactProcessor. I first tried testing field-based redaction using blockedKeyPatterns aga

Dear Google Cloud Compliance Team, I am writing to follow up on this urgent case (Ticket ID: BCVPFWJK2QYD72JIOE423ELZAQ), which has been pending for over a month.As previously stated, my project has been completely hijacked, and my IAM Owner permissions have been revoked by an attacker using a compromised "Linux" session. I am fully locked out and cannot manually delete the resources.To prevent further malicious activities and financial damage, I am requesting Google Cloud to IMMEDIATELY SUSPEND and DELETION/TEARDOWN this specific project.Here is the verified information you requested:Incident Date & Time: 2026/06/03, 10:25:00Time Zone: ICT (UTC+7)Project ID to be Deleted: psyched-crowbar-hf4njImpacted Owner Account: james.dynamicdev@gmail.com Please escalate this to your senior engineering/security team to take down the project immediately. I consent to the total erasure of this project to mitigate this security threat. Best regards,Thanathip Samart+66 95-360-5964