Google Security Operations

Hey folks,Yesterday, we released a small, but impactful update to the “Functions” PowerUp. Now, this PowerUp contains a new action called “Calculate Timestamp”.  BackgroundYou might’ve seen that in a lot of actions, the time range management is handled in the same way. You would have 3 parameters that dictate the time for the action execution:Time Frame Start Time End TimeHere is an example from a real action:  This handling is unofficially standartized and we aim to have the same implementation to be on all actions, where it’s relevant. There would be some basic predetermined values and ability to provide a custom time range.For custom input, we work with ISO8601 format (eq 2025-10-31T10:21:00Z).The common challenge that

Are you hungry for more Google Security content? Craving a way to easily find those hidden gems of knowledge? I'm Marie Chudolij, your new User Community Manager, and I'm here to deliver!  This new role is a chance for us to collaborate – I find the content you need, and get your feedback to create even better resources. Let's experiment together to discover the best ways to keep you informed! My Story: From Network Admin to Community Champion I've been immersed in tech my entire career, from hands-on support to network administration.  My mentor, Doug, saw my potential and sparked my passion for Network Security (thank you, Doug!). Later, I managed security projects and had the privilege of working with talented engineers at Siemplify to streamline SOC workflows around the world. Joining Google was a dream come true, and now I'm excited to connect with you, our amazing community! What to Expect: Your

Hello, I am getting below error for API call to list custom detection rules: Querying URL: https://backstory.googleapis.com/v2/detect/rules?page_size=2000{'error': {'code': 403, 'message': 'The caller does not have permission', 'status': 'PERMISSION_DENIED'}}object of type 'NoneType' has no len() I validated and the permissions seems good for service account (Chronicle API Admin).  Any guidance, examples, or best practices would be really helpful.Thanks in advance! Thanks,Suraj

Hello Team, I am looking to get ingestion bytes/rate per second for log sources. I saw it in Ingestion Dashboard, but not able to get each log bytes. I checked the documentation and found log export can provide log with byte information.https://docs.cloud.google.com/chronicle/docs/reference/data-export-api-enhanced#:~:text=exportedVolume%3A%20For%20completed%20jobs%2C%20the%20actual%20volume%20of%20data%20exportedbut i want only ingestion bytes/rate per second for log sources, not the complete log.Has anyone been able to retrieve this kind of data? Any guidance, examples, or best practices would be really helpful.Thanks in advance!

Gemini CLI was launched this morning and I'm excited to share ways to use it with the MCP Servers for Google Cloud Security. Configuration MCP Servers in Gemini CLI are configured using the same JSON that we describe in MCP Server Configuration Reference. The mcpServers key is at the top-level along with the theme and selectedAuthType keys: ❯ head ~/

Hi All,  I am trying to use the “Is Value in Data Table” to look for an IP address within a list of IP CIDR ranges Datatable.  When I run the action, the action does not find a match - however I know the IP address is in the CIDR range within the data-table.  Below is the settings for the SOAR action:  Below is the Data table which contains the CIDR ranges for Mandiant ASM IPs:  Output from the action:  Is it perhaps to do with the type associated with the co

We are facing the issue where we are not able to ingest the AWS EC2 , ECS , IAM and VPC, We are using these logs types as AWS context data to enrich the Guarduty and Cloudtrail logs. We are using the thirdparty api to ingest the logs and providing the access and secret key to fetech the data and relevant permission are already in place.Does anybody faced the same issue?

I want to know whether it is possible for the parser to add a timezone when the log timestamp is in Unix time.I tried the following code, but when logtime is in Unix time, it results in an error, and I confirmed that the current time is inserted as the timestamp instead.---------------date {match => ["logtime", "yyyy-MM-dd HH:mm:ss"]timezone => "America/New_York"on_error => "no_match"}---------------I also considered adding a numeric timezone offset to the Unix time before the date function, but it seems that the parser cannot perform arithmetic operations.Is it technically possible to add a timezone to a Unix timestamp in the first place?

I have been working with using playbooks to assist the analyst by automating command line explanations. As an example we have some alerts that are built out to look to certain command line behaviors. The idea is to take that command line and feed it to Gemini to return an explanation and a verdict.  The playbook and the results look really good. The issue that I see is we are having about a 20% failure rate on the API endpoint returning a 503 error.  We are only doing this in Dev, and the volume is very low.  While I concept looks valid, it seems the infrastructure will not support our initiative. Has anyone else worked with this or seen this behavior? Also, there should is no Gemini Tag that I can add to this.

I want to create a custom dashboard to display duplicate alerts within a 5-minute window, based on event type. For example, if the same event triggers an alert multiple times within 5 minutes, it should be visible on the dashboard.

In Google SecOps SOAR playbooks, When I am trying to enrich IP/domain, all the IPs/Domains are being enriched. I dont see any option to use a particular IP in Enrich IP action of VirusTotalV3 integration. How can we enrich only desired IPs.

We have a requirement to ingest the audit and sign in logs of entra id to secops using the SecOps third party APIs.We have tried using the graph API method from O365 for this, and the audit logs are being ingested successfully, but the sign in logs are failing with an error. Since it was failing, we tried ingesting by creating a separate client ID for the sign in logs , which was also failing. is there a reason for this?  

I am trying to find API list for SIEM but unable to get it.I have SOAR Swagger API, but not able to find SIEM. Please let me know if anyone has any idea.

I spent a good amount of time, well, AI and I spent a good amount of time,  working out a regex that would actually work in our environment. What I ended up with seems to work very well. I wanted to share this, and maybe someone has a better way, or there is some obvious gap that I am not taking account for?  (((($event.metadata.event_type = "PROCESS_LAUNCH"               and $event.target.process.command_line = /.*powershell.*/ nocase        and $event.target.process.command_line = /(?:^|\s)-(?:encodedcommand|enco(?:ded)?|enc|ec)\b\s*:?\s*(?:"([^"]+)"|'([^']+)'|([A-Za-z0-9+\/=]+))(?:\s|$)/ nocase        and $encodedPS = re.capture($event.target.process.command_line, `(?i)(?:-encodedcommand|-enco(?:ded)?|-enc|-ec|-en)\s*:?\s*(?:["'])?([A-Za-z0-9+/]+={0,2})(?:["'])?(?:\s|$)`)           and $decoded_value = re.replace(            strings.base64_decode(            re.capture(                        $event.targ

The Chronicle re.capture() function only returns the first match in the text, and it supports only 0 or 1 capture group. If the regex contains 0 capture groups, Chronicle returns the first full substring that matches the expression. If the regex contains 1 capture group, it returns only the first captured value from that match. Chronicle never scans beyond the first match and cannot return multiple matches like extracting all regex on the statement. If the regex contains two or more capture groups, Chronicle throws a compiler error.Used Regex : (?:%3A%3A|::)?[?&][^=]+=([A-Za-z0-9+/]{8,}(?:={0,2})|[0-9]{1,3}(?:\.[0-9]{1,3}){3})Error : compilation error compiling query: generating predicates: regex passed to capture() must have 0 or 1 capture groups, but got: 4 capture groups line: 7 colum

Introduction In the world of Security Operations, data is only as good as its metadata. Have you ever encountered events in your SIEM that appear to have occurred decades ago, or thousands of events clustered at the exact same second?An example of "time-warped" data in Google SecOps where an entity appears to have been seen for the first time 56 years ago (epoch) due to unvalidated ingestion.Ingesting logs into Google SecOps SIEM without proper validation often leads to "time-warped" data. This isn't just a visual nuisance—it breaks your detections and complicates investigations. In this guide, I’ll demonstrate how to use BindPlane to build robust ingestion pipelines that validate data and fix timestamp errors before they ever reach your SI

Is there a way where i can generate a report that will include all comments added in the case wall too.  The case report that is generated for cases on SecOps does not include all the comments added to the case wall. 

Hi Everyone,We’re trying to integrate AWS CloudWatch with Google SecOps using Amazon Data Firehose integration method, but we’re encountering the following error:“The response received from the endpoint is invalid. See Troubleshooting HTTP Endpoints in the Firehose documentation for more information. Reason: Response for request {Masked} is not recognized as valid JSON or has unexpected fields. Raw response received: 403 { "error": { "code": 403, "message": "permission denied", "status": "PERMISSION_DENIED" } }”For the Firehose HTTP endpoint, we configured the webhook URL in this format:{ENDPOINT}?key={key}We also entered the secret key in the Firehose Access key field. However, we’re still getting the error.Could anyone please confirm if we’re configuring this correctly, or if there’s an additional steps we might be missing?Thanks in advance,Aravind

Hi Team,I need to ingest SOAR audit logs into our SecOps SIEM and would appreciate your guidance on the process. If we are already ingesting these logs, could you please provide the steps or documentation on how it is done?I have reviewed the relevant documentation but was unable to complete the process successfully.https://cloud.google.com/chronicle/docs/soar/investigate/collecting-soar-logsThanks,Manoj

Hi All,Just wanted to know if we are integrating splunk cloud with Secops SOAR do we need to allow the Ingress & Egress IP & Port : 8089 at the firewall level?

Hello,We are looking for a way to get the total volume of logs, data being ingested in SecOps which has feeds setup with multiple tools like AWS, GitLab, Azure etc. Is there a way to get the ingestion matrix and also the to billing associated with the ingestion. Thanks 

I have been thinking about how google is assures log data post ingestion is stored in an immutable state for assurance from data security viewpoint.  I tried searching for SecOps documentation but unable to find a straightforward statement. Also, once data is stored, is there a way one could delete/alter the data, if one has an appropriate permission to do so.  And how to keep a tap to such actions.?  

I recently setup an integration in between SecOps and SailPoint IAM for ingestion of sailpoint logs. The pipeline setup works fine but upon searching for the logs, almost 91% of the logs were unparsed and out of the total log events ingsted.Has anyone while ingesting Sailpoint IAM logs has had the same issue and is the best suggestion to write out your own custom parser? Sailpoint IAM logs collection: https://docs.cloud.google.com/chronicle/docs/ingestion/default-parsers/sailpoint-iam 

We recently launched Model Context Protocol (MCP) servers for Google Security Operations (SecOps), Google Threat Intelligence, and Google Cloud Security Command Center. These MCP servers can be used with LLMs such as Gemini to execute actions autonomously via API calls. Think of these MCP servers as building blocks that enable you to create custom AI-powered workflows. During the last couple of weeks, I’ve been experimenting with using MCP servers to automate specific security operations workflows. The video below demonstrates how to tune detection rules in Google SecOps with the help of Gemini, Google SecOps and GitHub’s MCP servers, and Cline. My rules in Google SecOps are being mana

Understandably, a SOAR role can only see its cases and cases of other roles configured under “Additional Roles Access” but does this include closed cases?  And if so, does that make sense? I have an instance where alerts are coming in and the playbook is sending emails to a SOC with links to the cases.  However, on occasion an administrator will take ownership and close a case causing the link in the email to now go to an empty screen.Thanks