Google Security Operations

Hi Everyone,Happy New Year 2026! 🎉I am new to Google SecOps and have a few questions regarding log ingestion via Bindplane, specifically around Google Secops standardization and log visibility.In our environment, we have Bindplane Gateways that collect logs from multiple Bindplane agents and forward the data to Google SecOps. While forwarding the logs, we apply the SecOps Standardization processor so that SecOps can assign a log type (metadata.log_type) and perform UDM field mapping using the appropriate parser.I am looking for clarification on the following scenarios: SecOps Standardization processor not appliedAre the logs still ingested and searchable in Google SecOps? If searchable, what value is assigned to metadata.log_type in the SecOps console ? Does this scenario only impact UDM parsing and detections, or can it affect ingestion itself?SecOps Standardization processor applied with an incorrect log type (Example: Windows event logs standardized as NIX_SYSTEM)Are these events s

Hey guys, do any of you know of a way to efficiently identify which log sources you need ingested in order for the curated detections or even custom rules to work as intended? Google secops currently doesn’t tell you which logs are needed and/or missing for a rule to be accurate.

Hello Community,I successfully calculated average ingestion time using a SIEM search by comparing metadata.ingested_timestamp and metadata.event_timestamp, and aggregation functions like avg(), min(), and max() worked as expected. metadata.ingested_timestamp.seconds > metadata.event_timestamp.seconds //excluding logs that have not Time in UTCmetadata.log_type = "OFFICE_365" $Timestamps = timestamp.get_timestamp(metadata.event_timestamp.seconds, "DATE")match: $Timestamps,metadata.log_type, metadata.event_type, principal.namespace // we can add or remove fields here to make it more specific or broadoutcome: $eventsCount = count(metadata.id) $avg_delay_minutes = avg((metadata.ingested_timestamp.seconds - metadata.event_timestamp.seconds) / 60) $max_delay_minutes = max((metadata.ingested_timestamp.seconds - metadata.event_timestamp.seconds) / 60) $min_delay_minutes = min((metadata.ingested_timestamp.seconds - metadata.event_timestamp.seconds) / 60) $bool = if($avg_delay_minutes

Hi,I’m trying to create an alert based on multiple alerts from the same source, my goal here is to raise an alert when more than 2 different alerts from the same source were triggered, and from there if i have two alerts with low severity maybe raise one with medium severity and if i have two medium rise one high an so on.So far I have this alert:rule Multiple_events_same_source { meta: author = "" description = "this rule " severity = "High" events: $e.detection.collection_elements.references.event.principal.hostname != "" $e.detection.collection_elements.references.event.principal.hostname = $SourceHost NOT $e.detection.detection.rule_name IN %WHITELIST_MULTIPLE_EVENTS_RULE match: $SourceHost over 1h outcome: $risk_score = 0 condition: #e > 2 }  But what i want to achieve is to just get different alerts (by alert name), i mean, I just want this alert be triggered when the alert name of the events that make this alert raise was different one to the o

Is there a way I can continuously export the SOAR case data used in dashboards to BigQuery?

Hello,below is my scenario:for the logs that are sent to google secops, there is already a pre-built parser available, but it does not parse the logs.when i check, grok pattern to match the syslog header of logs is not available in the parser code.i have created the grok pattern and i can see that all the other fields are parsed to udm field correctly. now, my question: is it possible to create a parser extension to match only the syslog header and leave everything else as optional ?if the above is possible, i tried no-code option → i put my grok pattern in syslog box and target field, it is validated sucessfully. but when i tried to preview udm, it does not give me the output, the logs are still droped due to the pattern that are available in pre-built parser. can you please help me with this ? Thanks,

🔥 Thrilled to announce two opportunities to join our comprehensive deep-dive training, developed by the FLARE Team at Google Cloud Security. This course moves beyond the basics, equipping you with the practical, hands-on tradecraft needed to dissect today's most sophisticated Windows malware. Whether you prefer the convenience of virtual learning or the intensity of an in-person event, we have a session for you!What You Will Learn:Time Travel Debugging (TTD) →  Leverage this powerful tool to trace and query execution for efficient behavioral analysis. EDR Evasion Bypass → Defeat advanced anti-analysis tricks and uncover techniques like process injection and indirect syscalls used to bypass modern EDR systems. Complex Binary Analysis → Reverse complex C++ and .NET (C#) malware with confidence  Windows Internals → Gain low-level knowledge necessary to understand how advanced threats operate on the OS.Virtual Training - RingZer0 CounterMeasure👀 Course: The FLARE Guide to Windows Interna

HiAm trying to use the FortiSIEM connector+integration but get the below error when using the test button.Username: adminVerify SSL: False----------------- Main - Started -----------------General error performing action Fortinet FortiSIEM - PingAn error occurred: 401 Client Error: Not authorized for url: https://[redacted]/phoenix/rest/deviceInfo/monitoredDevices b'GlassFish">http://www.w3.org/1999/xhtml">GlassFish Server Open Source Edition 5.1.0 - Error report HTTP Status 401 - Not authorizedtype Status reportmessageNot authorizeddescriptionThis request requires HTTP authentication.GlassFish Server Open Source Edition 5.1.0 '----------------- Main - Finished -----------------I've triple-checked the password and it's correct. What am I missing? Is there a toggle somewhere to enable the API?

Hi everyone,I’m new to Google SecOps and currently working with the Enterprise edition. I’d like to understand how I can get the most benefit from the platform’s threat intelligence capabilities.I’m aware that I can use VirusTotal Context in my use cases for enrichment and detection, but I’m curious about how I can leverage Mandiant intelligence in a similar way. I can see Mandiant alerts and IOCs in the interface, but I’m not entirely sure how to make the best use of that data for proactive threat hunting, detection rule development.Could anyone share best practices or examples of how they’re using Mandiant within Google SecOps Enterprise? Any tips or guidance for someone new to SecOps would be greatly appreciated.Thanks in advance!

Hi community,I am working on YARA-L detection rules in Google Chronicle to identify suspicious self-equality assignments (tautologies) in SQL logs. These patterns, like "1=1" or "test=test", are often used in SQL injection attempts to bypass filters or force true evaluations.Goal: Detect patterns where the left side of "=" exactly matches the right side, such as:test=test1=1time=timestatus = statusflag=flagadmin=adminbypass=bypassenabled=enabledid=idversion=versionBut not detect mismatches like:1=2a=B(and similar non-tautologies)Challenges in Chronicle:I Tried regex ->([A-Za-z0-9'-]+)\s*=\s*\1were i used /1 #BackReference, but unfortunately backreference is not supported in YARAL,so using re.regex to directly check for equal values on both sides of "=".Then i used were grouping issue => The Chronicle re.capture() function only returns the first match in the text, and it supports only 0 or 1 capture group. If the regex contains 0 capture groups, Chronicle returns the first full su

is it possible today (or upcoming feature request) to add a static timestamp as the starting time of a YARA-L dashboard query and have it ending dynamically at current date/time?  use cases --any data from year to date, ingestion from start of contract period to present etc.

I tried using the zip_integration_by_version to zip my package and test it before pushing the changes but it gives the below error - ValueError: No commit found for integration doppel_vision at version 1.0 in branch origin/develop2025-12-12 14:45:17,484 - INFO - Restoring Git environment...2025-12-12 14:45:17,536 - INFO - Successfully restored to branch: doppel-auth-update also the repository has a different structure than zip file I was using initially to test the integration. for ex - the zip file has a Integration-<package-name>.def file and the content-hub repository doesnt. Can anyone guide me to zip my integration so I can test it and push my changes to content-hub repository? Thank you in advance.

I have a warning on my account that I can't remove. I didn't use the service and I want to contest the payment.   Pré-pagamento pendente.Google Cloud 01C130-FE3231-967E6A: Pré-pagamento pendente: o serviço requer um pré-pagamento único de pelo menos R$ 200,00 para ser ativado. Se você já tiver feito isso, o pagamento será creditado na sua conta em breve.

Hello everyone,I am currently facing a challenge where I need to perform data matching based on a specific field. However, this field contains enriched values that lead to incorrect matches. I want to ensure that my matches are based solely on the original values in this field, without considering the enriched information.Is there a way to configure my detection logic to exclude these enriched values? Any guidance, instructions, or best practices on how to achieve this would be greatly appreciated.

I have a warning on my account that I can't remove. I didn't use the service and I want to contest the payment.   Pré-pagamento pendente.Google Cloud 01C130-FE3231-967E6A: Pré-pagamento pendente: o serviço requer um pré-pagamento único de pelo menos R$ 200,00 para ser ativado. Se você já tiver feito isso, o pagamento será creditado na sua conta em breve.

Hi all, I am writing phishing investigation playbook, I want to validate SPF, DKIM, and DMARC status for the sender domain on Google SecOps SOAR playbook. Is there any integration which supports this action? Thanks!

Hello team, do you have any guidance on developing a risk analytics rule that identifies when an entity exhibits a sudden spike in risk score? In the rule below, I can generate an alert when an entity’s risk score on the Risk Analytics dashboard exceeds a defined threshold. However, I’m more interested in detecting a sudden spike in the entity’s risk score rather than relying on a static benchmark.i have two use cases one is to alert when any user’s risk score in analytic dashboard crosses a benchmark and the other one to detect on sudden spikeAlso, for Risk Analytics, I could not find a UDM field that represents a normalized risk score. I only see the raw risk_score and the delta_risk_score fields.Which of these fields would be the most appropriate to use for the rule? 

Hello everyone, I’m trying  to add Custom Tags to Defender Unified Portal Alerts. Prior to the migration I was able to do this with the Sentinel Connector after the SIEM Migration into Defender the only action I can find is “Update Alert” from the GraphApi Integration.Is the Update Alert Action working on Incidents or Alerts?As far as I can see only on Incidents you can update Tags ->Update incident - Microsoft Graph v1.0 | Microsoft Learnnot on Alerts. When trying to update an Incident I get this:The Incident does exist: Best regards 

Hi All,Would like to know if there is a possibility to monitor the changes made to a reference list such as adding / deleting a value from the reference list? As we have for changes made to rules from GCP console. Thanks!

Log Parsing Issue in Restricted Pipeline (Chronicle/CBN/Logstash) We are encountering persistent syntax and parsing errors in a highly restricted log processing pipeline (likely based on Logstash/Grok, possibly within Google Chronicle or CBN). We need help structuring the code to handle the strict syntax and mixed log types without using advanced conditional logic. 1. Environment and Constraint  Environment: Highly restricted log parsing pipeline (cannot use standard Logstash features). Confirmed Constraints (Key Failures): NO if/else conditionals (if [field] fails, if "tag" in [tags] fails). NO semicolons (;) allowed anywhere in the config. Field names must use snake_case (e.g., host_name).  2. The Core Problem: Mixed Log Types Our pipeline receives two distinct log formats that crash the system when we try to parse the second one, or when we encounter simple syntax errors.Log Type Sample Log (Raw) Envoy Access Log (Primary Goal) <166>2025-10-22T14:00:00.095

Hi everyoneI’m currently testing log ingestion from a Linux VM to Google SecOps (Chronicle) using Bindplane (no Chronicle Forwarder, only the Bindplane agent and gRPC).In the Bindplane destination, I’m using: Protocol: gRPC Endpoint: malachiteingestion-pa.googleapis.com Auth: json, with the Ingestion Authentication File from SecOps Correct Customer ID But on the VM, the Chronicle exporter always shows:"error": "upload to chronicle: Permanent error: 403 Forbidden" Any idea what can cause a 403 in this case, or anything that must be enabled/checked on the SecOps side?Thanks!

I have integrated Azure Event Hub with GCP SecOps; however, we are receiving Event Hub operational logs instead of the Azure Activity logs. Can we discuss this?

Risk Analytics is a crucial feature within Google SecOps SIEM designed to help security teams identify unusual behavior and quantify the potential risk that various entities pose to the enterprise. It empowers analysts to move beyond basic alert triage and focus on the entities that represent the most significant threat. Key Components of the Risk Analytics Dashboard The central hub for this feature is the Risk Analytics dashboard, which provides a holistic view of entity risks, accessible to users with global scope in RBAC systems. Behavioral Analytics: This section lists entities (such as user accounts, servers, or laptops) based on their calculated Google Security Operations Entities risk scores. This allows tracking an entity's risk over time and serves as a metric for detection use cases. Watchlist: This section highlights entities based on internal enterprise risk calculations, complementing the behavioral analysis with organization-specific context. Risk Calculation Window:

 I've tried following the steps to configure the new ThreatConnect version 3.0, but the indicated log type, ThreatConnect IOC V3, doesn't appear. Do I need to request this new log type somehow? 

Hi All,In a manual case i have created entity username. I have executed Azure active directory - disable user accounts, revoke user sessions actions successfully.  when i have executed Reset User Password action im getting output as “No user passwords were reset.”. Could you please assist