Google Security Operations

Hello everyone,I'm currently looking into data lifecycle management and retention within Google SecOps, and I have a specific use case I was hoping to get some insights on from the community.We have a scenario where we might need to remove historical data that has already been ingested, specifically filtered by a single log_type (e.g., the OpenAI log_type).Has anyone here successfully requested or performed a targeted deletion of already ingested data based solely on a specific log_type?I'd like to understand:Is this natively possible via the SecOps UI/API, or is it strictly a backend procedure handled via a Google Cloud Support ticket? If it requires a support ticket, does anyone know if Google typically accommodates granular purges like this without affecting other logs ingested during the same timeframe?Any insights, documentation links, or shared experiences on how you handle targeted data removal would be greatly appreciated.Thanks in advance!João Carvalho

Hi everyone, I am currently developing custom Jobs and scripts in the Google SecOps SOAR IDE using Python, and I'm facing an OpSec and architectural dilemma regarding credential management. When I need to authenticate external API clients (like GCP Service Accounts, API tokens, or third-party platforms), the immediate path of least resistance is to hardcode these credentials directly into the script as dictionaries or string variables. While the automation executes fine, hardcoding credentials in the IDE is obviously not a best practice. As it stands today, the only layer of security preventing exposure of these keys is the IAM role definitions controlling who has access to the SecOps IDE. This violates the principle of least privilege and defense in depth, as anyone viewing, reviewing, or exporting the code can read the sensitive material in clear text. My questions are:Is there a native way to use "Environment Variables" or a built-in Secret Vault specifically for custom Python scrip

Hi Team,Could you please suggest the best approach to integrate Microsoft Copilot logs with Google SecOps.Our objective is to monitor and analyze user interactions with Copilot, including:User prompts submitted to Copilot Copilot responses generated for users

Hi everyone,We are working on integrating Google SecOps SOAR with an external application security platform, and wanted to validate our approach as well as explore better alternatives.Use Case1. Incident Sync (Bi-directional)Sync status and comments: From SecOps SOAR → external platform From external platform → SecOps SOAR Current ApproachUsing a scheduled job (polling) to: Fetch updates from both systems Compare changes Push updates accordingly QuestionsArchitecture Validation Is a polling-based approach considered acceptable for this use case? Or is any other approach recommended? Webhook Capabilities in SecOps SOAR Are there limitations on which fields can be mapped via webhook? Is it possible to map custom fields (status, comments, metadata)? Is there any reference for the list of fields. Comments / Notes Mapping In SecOps SOAR alerts, which field is best suited to store external comments/notes? Is there a recommended standard field (e.g., notes, activity log)?

Hi ALL,is there a way to leverage Google Cloud Threat Intelligence (GCTI) or Mandiant intelligence to identify exploits or vulnerabilities present in our environment? Specifically, does the Context Graph expose relationships between assets, vulnerabilities, exploits, malware, threat actors, or campaigns that can be queried?For example, can we query Context Graph associations like:graph.metadata.threat.associations.type = "MALWARE"   // Something else i might have missedgraph.metadata.threat.associations.role = "Credential Stealer"  // Exploit or something similarAnd similarly pivot to exploit or vulnerability-related entities (e.g., CVEs, exploited vulnerabilities, exploit kits, or malware associated with known vulnerabilities) to identify potential exposure within the environment?

In the last few days I spend hours configuring data RBAC in Google Chronicle (Security Operations) SIEM to restrict users to specific data scopes using Workforce Identity Federation with Azure AD groups. The goal was simple: users in a specific AD group should only see data within their assigned scope, but despite anything and everything I tried nothing seemed to work as expected. I figured, I will share my findings here if somebody else bumps into similar problem.Despite everything appearing correctly configured:Workforce pool working- IDP group showing correctly for the user- IAM condition set on Restricted Data Access role- Chronicle SIEM Settings showing correct scope bindingThe user kept seeing "Scopes Assigned: (No scopes assigned)" or was getting global access instead of scoped access.The predefined Chronicle roles (Chronicle API Editor, Chronicle API Viewer) contain the permission chronicle.globalDataAccessScopes.permit. This permission overrides any scope assignment, forcing t

Hi Everyone! Google SecOps is moving closer to its "OnePlatform" vision by transitioning Google Security Operations (formerly Chronicle) SOAR workloads directly into customer-owned Google Cloud projects. While this Stage 2 migration is great for streamlining identity management and access controls through Google Cloud IAM, it does mean a few engineering updates are required. This post specifically runs through some caveats in the Remote Agent migration. Even though the current documentation contains information about "what we need to do", I found that it was lacking in some areas which is why I put this together.   Permissions Required For this portion of the migration.The new Service account will need the roles/chronicle.soarRemoteAgent role assigned to it. The role is still in Beta and contains a number of legacy permissions, so expect changes to the permissions model in the coming months.  If you are using Terraform for managing your Service Account permissions, I've included some c

We have multiple widgets with buttons in our Alert view. I am wondering if we can somehow nest those widgets into one big widget for better formatting. 

Hi All,I am trying to extract a single value from the Custom Field JSON for use in Reporting, I have the following: ${vw_cases_custom_values.custom_field_json} and want to extract only the field “Case Type”, I have tried various ways but no luck, does anybody have any pointers?  Thanks, Daryll

Hi All, End Goal:Our team is creating a query which triggers on dev vs prod rules and we need to query the friendly rule name within the saved detection rule. Is it possible to query detection data (detection.detection.) inside a UDM rule or is there any other way within UDM to get this information? rule dev_rule_name { meta: author = "SOMEONE" events: $detections.metadata.log_type = "GCP_CLOUDAUDIT" ( detection.detection.rule_name != /prod_/ and $detections.metadata.product_event_type = SOME EVENT ) outcome: //OUTCOME FIELDS condition: $detections} When I try to do something similar to the above, I get parsing errors:  I’ve Tried:Using variables, e.g. $rule_name = detection.detection.rule_name Using Regex, e.g.  re.regex(detection.detection.rule_name, `^prod_`) and Calling it using by prepending $detections, e.g. re.regex($detections.detection.detection.rule_name, `^prod_`)The Raw log and the Event fields do not contain the friendly

▎ My production Google Cloud project has been suspended since June 2, 2026 and I cannot get a ▎ substantive response from the Trust & Safety team. I'm hoping someone here can help ▎ escalate. ▎ ▎ Project: immo-fluss-app-v1-c57c1 (project number [removed by moderator] ) ▎ Appeal ref: [removed by moderator] · Billing/transfer ticket: 72553881 (case 71363477) ▎ ▎ What happened: A leaked, under-restricted API key was abused by a third party for ▎ high-volume Gemini / Generative Language requests — confirmed by Cloud Monitoring (~114k ▎ requests on May 17/18, ~228k on June 2/3, almost entirely from one credential). This was ▎ not authorized usage. ▎ ▎ Remediation done: Deleted the abused key (June 3, verified gone), removed all Gemini usage ▎ from the client (now server-side only behind an authenticated Cloud Function), restricted ▎ all remaining API keys, removed service-account/signing credentials from the repo, added ▎ billing alerts + anomaly monitoring. ▎ ▎ The problem: Imm

Issue:!--tgqphd||[]--> Project suspended due to [stated violation, e.g., API key misuse or data policy].Current Impact:!--tgqphd||[]--> Total service outage for all of my active users.Remediation Ready:!--tgqphd||[]--> We have identified the cause. We have purged client-side keys from our repositories and have our backend proxy ready.Action Plan Upon Re-entry:!--tgqphd||[]--> The moment human support restores access, we will immediately:!--tgqphd||[]-->Rotate and revoke all compromised API keys.!--tgqphd||[]-->!--tgqphd||[]--> Implement strict API Key Restrictions (limiting keys to specific IP addresses/HTTP referrers).!--tgqphd||[]-->!--tgqphd||[]--> Move all credentials into the Google Cloud Secret Manager.Request:!--tgqphd||[]--> Please escalate this case directly to the Trust & Safety team for a manual review.

The "Find First Alert" and "Change Case Name" actions from the Tools Powerup have been silently failing after the latest update to the powerup (version 81) with IndexErrors for out of range index. Anybody else experiencing this?

Hi,I wanted to know global time filter of the Google SecOps SIEM dashbaord works on which field of IOC model if we have only IOC model data coming from IOC matches?Also, I have one observation that , match which is visible in IOC match table which is not returning while quering through dashboard for same time range?

Good Day.I am trying to parse the following threat inetl log with IP_ADDRESS and I am getting:LOG_PARSING_GENERATED_INVALID_EVENT: "generic::invalid_argument: unknown or unset entity type"If the log is a MD5, SHA1 or SHA256 or DOMAIN_NAME event then the parser works.The log is as follows:{  "id": "2105",  "event_id": "102",  "object_id": "343",  "object_relation": "ip-dst",  "category": "Network activity",  "type": "ip-dst",  "to_ids": true,  "uuid": "c4e7ea82-b7bc-414b-8d68-7b1d5739182f",  "timestamp": "1609421134",  "distribution": "5",  "sharing_group_id": "0",  "comment": "",  "deleted": false,  "disable_correlation": false,  "first_seen": null,  "last_seen": null,  "value": "1.1.1.1"}The parser is as follows:filter {  mutate {    replace => {      "id"           => ""      "type"         => ""      "value"        => ""      "confidence"   => ""      "category"     => ""      "timestamp"    => ""      "entity_type"  => ""      "entity_event" => ""      "u

I am trying to build a SOAR playbook where in I will have a condition block, which if answered “Yes” will continue to the next block, and if ansered “No” that it will repeatedly ask the same question again and again, how do I achieve this ?  

Hello,I am writing here out of absolute desperation. My project curatetours (Billing ID: 01AFC8-EF7732-108B34) was automatedly suspended 13 days ago.This is completely halting my livelihood and business. I have had a live support ticket open: Case #71675942. A billing chat support agent just confirmed today that they manually transferred and escalated the case to the Account & Security Team, but I have not received a single human email or update from that team in nearly two weeks.Because standard support channels are stuck in a loop, my business is facing severe distress. Can a community manager or Google employee please flag Case 71675942 internally so a human can review it?Thank you.

Hi Team,Will there be an option for adding exclusions via REST API or UI for custon rules in future?I can see it is only available for curated rules

The Featured Content microservice powering the Unified UI appears to be improperly evaluating identity mapping. Because our namespaces are defined but user enforcement is turned off, the API fails to route unscoped global curated rules to the frontend, resulting in a 403.Architecture: Multi-tenant environment using namespaces (Customer A, Customer B) for logical isolation.Current State: Data Access Paradigm Enforcement is currently Disabled/Inactive as our unified analyst team manages all clients globally.Troubleshooting Already Performed:Verified the user has the required legacy permissions (chronicle.curatedRules.*, chronicle.curatedRuleSets.*). The standalone "Curated Detections" tab loads and functions perfectly. Verified the user has the required new permission (chronicle.featuredContentRules.list) attached to their custom Alpha role. 

Hi everyone. I am working on enabling curated detections via composite detections. One issue that I have not been able to figure out yet so far is, is there a UDM value that defines whether a curated detection rule is broad or precise? I looked at the meta fields of the curated detections and used the network inspection tool as well to look at the actual json format. So far I have not been able to find such a field.My usecase is to write separate composite detections for precise curated detections and broad curated detections. I have a rule that consumes detections from curated detections but, as far as I know, it is not possible to distinguish whether these detections come from precise or broad rules. Thanks in advance.