Google Security Operations

I am trying to work out how to get Akamai Log Stream of events into SecOps and have some option to Filter out events along the way.Akamai have provided a recipe to get to GCP Cloud Storage, but not one to get the SecOps.I see many other of the big names.Does anyone have any hints on options.<URL Removed by Staff>

Hey there, I have some issues with a custom parser, and it’s erroring out with panic encountered: non-unsigned-integral type given for backstory.Network.sent_bytes: int 103454713"  if ![no_bytes] { mutate { replace => { "event1.idm.read_only_udm.network.received_bytes" => "%{srcbytes}" "event1.idm.read_only_udm.network.sent_bytes" => "%{dstbytes}"} } mutate { convert => { "event1.idm.read_only_udm.network.received_bytes" => "integer" "event1.idm.read_only_udm.network.sent_bytes" => "integer"} } } } If I don’t do the convert, it errors out on “   “string 103454713” Thank you in advance.  

Hi,I’m encountering a scalability issue with our malware playbook after the recent Cortex XDR integration update.The problem is the following: Cortex XDR now generates a separate Issue for each file detected as malicious during periodic scans. All malicious files are also stored under Key Assets & Artifacts in Cortex. In Google SecOps, each XDR Issue becomes one Alert associated with the same Case. However, each Alert contains all existing Artifacts, not only the ones related to that specific Issue When the malware playbook runs on each alert, it sends one VirusTotal request per hash.Since the Case contains 27 alerts, and each alert includes the same 48 artifacts, the playbook ends up sending:27 alerts × 48 artifacts = 1,296 VirusTotal API requestsMost of these requests are redundant, because the artifacts are identical across alerts.We only need to submit 48 VirusTotal lookups, not 1,296.This behavior causes unnecessary API consumption and may lead to quota exhaustion or del

I facing an issue for parsing RFC3339 can anyone help meIn statedump it is showing the time stamp like this"ts": "2025-11-18T21:17:14.026+10:00"the code i am using is  date {      match => ["ts", "RFC3339"]      target => "event.idm.read_only_udm.metadata.event_timestamp"      on_error => "date_parse_failed"    }but i am getting error"date_parse_failed": true

Is this correct way to track device not reporting lookml:- dashboard: device_reporting_ description: "" elements: - col: 0 column_limit: 50 conditional_formatting_include_nulls: false conditional_formatting_include_totals: false defaults_version: 1 enable_conditional_formatting: false explore: events_connector fields: - events.count - events.metadata__event_timestamp_max_second - events__metadata__base_labels__namespaces.events__metadata__base_labels__namespaces filters: events.metadata__log_type: -NULL events.time_filter: "" events__metadata__base_labels__namespaces.events__metadata__base_labels__namespaces: -"AWS_Cloudtrail_Staging",-"AWS_Cloudtrail_SharedServices",-"AWS_Cloudtrail_SharedServices",-"AWS_Cloudtrail_Production",-"AWS_Cloudtrail_PrintProd",-"AWS_Cloudtrail_Dev",-"AWS_Cloudtrail",-"AWS_GuardDuty_SharedServices",-"AWS_GuardDuty",-"SonicWall_Firewall_Logs",-"Cradlepoint_NetCloud_Logs" header_font_size: "12" header_text_alignment: left height: 13 hidden_pivots: {} hide_row_

 I already setting data access scope to the user account and the user account only can find own data  Now I create native dashboard to this limit user account I found problem  I use two query function UDM seach and ingest search The UDM search can find data but ingest search can’t I asign two role  for this accountChronicle API Restricted Data Access (Beta)Chronicle API Restricted Data Access Viewer (Beta)UDm searchingestion search  If i want ingestion search work and i need to give the account with global data access permission But give  global data access permission I can find any data so how can i do?

Hi Everyone,I am writing this post to request clarification on “NOZOMI_GUARDIAN” integration, we followed the below document from Nozomi, where it is directing us to add our service account in the Nozomi instance and log will start flowing to Google SecOps. The connection is successful but the logs are getting in to the log type “UDM” whereas we were expecting it to be in to “NOZOMI_GUARDIAN”.I understand this integration is designed to send logs to the log type “UDM” because the title of the document says “Google Chronicle (Ingestion API - UDM)”. Can we change the log type to “NOZOMI_GUARDIAN”? if not, how to get the logs in to the log type “NOZOMI_GUARDIAN” ?Nozomi Documentation: https://technicaldocs.nozominetworks.com/products/n2os/topics/administration/settings/data-integration/c_n2os_admin_settings_data-integration_google-chronicle-2.htmlThanks so much in advance.Aravind Sreekumar

Is there a documentation or list of response integrations and/or curated detections that are only available for Enterprise plus? and for Enterprise? I know there are limitations for this integrations depending on your license for SecOps, but i have not found any reference for it. If someone can give me some clarity, would be appreciated.

Hi community,I’m looking for best practices or supported mechanisms for handling OAuth token refresh securely within SecOps SOAR — especially for integrations where access tokens expire periodically. Does SecOps provide any native method, or do we need to manage the token lifecycle externally ? 

Hello,  I am using the latest version of the Default GCP Cloud Audit parser of 2025-11-05.But unfortunately, when I go through the Audit Logs, I get to see values in the UDM which are absolutely not there in the raw json. event fields:  I don’t expect this behavior to happen. Why does the parser add more values to the principal object when my other colleague is not mentioned once in the raw json.Of course I have tried to find other way around this, but other objects like which IAM roles are being added or removed are also getting mixed up within the principal object. So when I want to create a window with IAM policy changes, then it gets mixed up with principal fields: 

I am getting stuck with both a custom parser, as well as parser extension, on this error generic::unknown: invalid event 0: LOG_PARSING_GENERATED_INVALID_EVENT: "generic::invalid_argument: *events_go_proto.Event_Webproxy: invalid target device: device is empty" I already have a lot of the UDM mapped out, which am I missing? "@output": [ { "idm": { "read_only_udm": { "metadata": { "event_timestamp": { "nanos": 0, "seconds": [removed by moderator] }, "event_type": "NETWORK_CONNECTION" }, "network": { "ip_protocol": "UDP", "session_id": "SJL0VM-SMAEXT01:691dd63a:00000000" }, "principal": { "asset": { "ip": [ "2.0.0.56" ] }, "hostname": "SJL0VM-SMAEXT01", "ip": [ "2.0.0.56" ], "user": { "user_display_name": "(user)@(Colo Access)", "userid": "user" } }, "src": { "ip": [ "2.0.0.56" ] }, "target": { "user": { "userid": "user" } } } } } ]

Using AWS SQS v2 via Federated IDs to ingest logs to GSecOps I have been trying to ingest AWS Cloudtrail logs into google secops using Federated IDs, I have gone through all the documentation of creating an IAM role, attaching policies as well as setting up Trust relationship for the same and SQS policy too but still I have not been able to have any success. Would really appreciate if I can get some eyes on this. I have looked at similar conversations on the community and tweaked by implementation as per that but still havent had any luck Adding my IAM Role details below and : IAM Trust Policy"Version": "2012-10-17","Statement": [{"Effect": "Allow","Principal": {"Federated": "accounts.google.com"},"Action": "sts:AssumeRoleWithWebIdentity","Condition": {"StringEquals": {"accounts.google.com:sub": "SUBJECT_ID_FROM_STEP_1"}}}]} IAM permissions with the policies attached:S3FullAccess SQSFullAccess Custom Policy for Google Secops cloudtrail role:{"Version": "2012-10-17","Statement": [{"Effe

Regarding SIEM exclusions in Google SecOps:Does an exclusion only suppress the creation of an alert (meaning the detection event itself is still created/triggered and visible), or does it prevent the detection event from triggering altogether?If an exclusion is applied to a specific broad detection rule, will that exclusion also prevent other high-ranking or more precise rules from matching the detection events of the broad rule?

Hello all,Google recently launched nested if for the events part of the rules. I decided to try it out and noticed some problems The exact same rule in doc works without any problems. When I try to remove one of the if and make a simple if , it starts pointing out errors. Another time I encountered an error was when I tried to perform a comparison using data tables.The error message says that I am using an invalid type for the else field, but my else is a simple string. Note: in the documentation, the only limitation is the maximum nesting of 20 if.Has anyone else encountered these problems?doc:  ttps://docs.cloud.google.com/chronicle/docs/yara-l/nested-ifrelease note:  https://docs.cloud.google.com/chronicle/docs/secops/release-notes#November_10_2025

Hi All,We are receiving the above when a Case or Task is assigned via a Playbook but not when it is created manually for instance “Case Task” is this the expected behaviour as it seems a little strange.Thanks,Daryll 

Security Command Center (SCC) has introduced Graph Search, a powerful new capability to discover high-risk issues using natural-language queries like:Which external identities have access to sensitive data? Where do IAM misconfigurations create lateral movement risk?Graph Search can help you see and act on risks in Google Cloud.  

Hi All Am getting  error “unsupported metric function name NETWORK_CONNECTIONS_SUCCESS”  rule ueba_first_time_outbound_rare_port {  meta:    rule_name = "First Time Outbound Traffic to Rare Destination Port"    description = "Detects the first time outbound traffic is observed to a destination port that has not been seen in the last 30 days. This may indicate anomalous exfiltration, C2 activity, or tunneling."    severity = "Medium"    tactic = "TA0011"  // Command and Control    technique = "T1571" // Non-Standard Port   events:    // Firewall event    $e.metadata.log_type = "SOPHOS_FIREWALL"    $e.metadata.event_type = "NETWORK_CONNECTION"    // Outbound direction only   // $dir = $e.network.direction    //$dir = "OUTBOUND"    //Using below query since direction field is not available in Sophos Firewall    not net.ip_in_range_cidr($e.target.ip, "127.0.0.1/32")    not net.ip_in_range_cidr($e.target.ip, "10.0.0.0/8")    not net.ip_in_range_cidr($e.target.ip, "172.16.0.0/12")    not net

Pulling in the content of an email body as an insight occasionally results in This field contains large amounts of data. Download File to see its content. instead of displaying the content. Does anyone know the max size of an insight and the best way to limit the message body before trying to jam it in an insight?

I'm working with data tables in a SecOps SIEM, where the goal is to evaluate incoming log data against records in the data table. The relevant fields are:Data Table:Logic:%DL_Anomali_High_Critical_Severity_IP_v1.target_ip = $ip$e.principal.ip = %DL_Anomali_High_Critical_Severity_IP_v1.principal_ip$e.metadata.log_type = %DL_Anomali_High_Critical_Severity_IP_v1.log_typeSample Log Data:principal.ip= [removed by moderator]target.ip = [removed by moderator]log_type = PAN_PANORAMA--------------------------------------------------------------------------------------------------------------------------------------------------------------------Existing Behavior:Currently, if the log data exactly matches a row (for example, row 5 in the table above), the rule is triggered.Desired Requirement:I need the opposite behavior:If all log values for target.ip, principal.ip, and log_type match a single row in the data table, the rule should NOT trigger. If even one value does not match (i.e., only partia

Hi,One of our customers has two different tenants in their workspace. They would like to send logs to Google SecOps, but only from one of the tenants.Is there a solution to filter the logs or any alternative approach to achieve this?

Hey Community, Wanted to share some of the exciting things that have been released recently in Community! We have new SecOps tutorial videos. Check them out here!We just announced our new Emerging Threats Center for SecOps. Say good bye to fire drills and hello to faster mitigation!And don't forget to dive into our Google SecOps Alert Triage and Investigation Agent! Go from alerts to action! We want to hear from you on all of these topics. Drop a comment below.   

I am looking to setup github audit logs to be ingested into my Google Secops tenant. As per the documentation, the way to do so is using the AWS S3 V2 feed and this uses setting up IAM user with Access key as well as Secret Access Key. Rather than using access key and secret access key, I would rather want to use a federated identity and setup AWS IAM role for the same. Has anyone done the same and provide some suggestions here? really appreciate everyone’s responses here.

Reference: the rule identifies anomalous spikes in network traffic using baseline comparison and deviation scoringTime series anomaly detection for total volume of traffic | Microsoft Sentinel Analytic RulesIn KQL we can use functions like anomalies , series_decompose_anomalies, time-series metrics, moving averages, baselines, and thresholds. But in YARA-L we don’t have these built-in functions or native anomaly detection capabilities.My question is:How can we replicate this kind of anomaly logic in Chronicle YARA-L?

 # Product: Web Access# Category: Custom - HTTP Access Parser# Last Updated: 08-Sep-2025# Author: Ayush Gupta# Version: 0.1## Fields Mapped to UDM (ACCESS LOGS ONLY)# metadata.event_timestamp ← timestamp (from [01/Sep/2025:07:20:09 +0000])# metadata.event_type ← GENERIC_EVENT# network.application_protocol← HTTP# principal.ip ← client_ip# principal.platform ← user_agent (client device info)# intermediary.hostname ← observer_id (web server instance)# target.hostname ← vhost# target.url ← http://{vhost}{request_path}# network.http.method ← http_method# network.http.response_code ← status# network.http.user_agent ← user_agent# network.http.referral_url ← referrer (when present)filter { # Initialize working variables mutate { replace => { "observer_id" => "" "client_ip" => "" "vhost" => "" "ident" => "" "ts" => "" "http_m

Hi experts,Do you have any demo logs that I can simulate and show case to people about google chronicle?