Google Security Operations

I have created a new custom field in close case settings for the analysts to enter while closing the case, but it wont show up in the playbook while closing the case. Someone please help

Ok, I can’t figure it out and could not find any good examples on the internet, how do I use searchRawLogs endpoint? Use case:  For research, we want to export a “small” subset of data that matches a rawLog. Time is usually paramount, so I cannot use the data-export-api, as that gets queued for DAYS sometimes. So I’m attempting to see if searchRawLogs will fulfill our needs for targeted export of raw logs via api calls. (I understand that we can use raw log search and export csv from the UI, but I need to do it via the API for integrations). I’m trying this:POST https://us-chronicle.googleapis.com/v1alpha/projects/<project>/locations/us/instances/<uuid>/:searchRawLogs BODY: {   "baseline_query":  "/ASA/",   "baseline_time_range": {       "start_time": "2025-08-11T01:00:01Z",      "end_time": "2025-08-12T02:00:01Z”   }no matter what I try, I just get 400, Request contains an invalid

I recently did a CTF with a tool I had no experience with (Obsidian) and I found it very useful to very quickly get up to speed on how to use the platform. We need to get our analysts trained on how to use SecOps (both SIEM and SOAR components) and any resource that could be leveraged to make the process easier would be helpful. Any thoughts?

Hello, During testing a custom rule, we are not able to test the rule against logs for the latest 4hours.https://cloud.google.com/chronicle/docs/detection/manage-all-rules Point 8.The end time available is 4hours ago.Example: UTC Time: 6pm. Possiblity to select only 2pm as end time.If I changed my preferred timezone to EST, I ‘ll also get a 4 hours delays.Is it an expected behavior ? Thanks

Has anyone successfully filtered on key/values being NULL with the dynamic list on the ingestion connector?Use case, I want to route all Google SecOps SIEM alerts to one SOAR environment if a specific key/value doesn't exist whatsoever in a rule meta block. https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/google-chronicle#dynamic-list-filter The above documentation doesn't seem to talk about it. 

I am unable to loop the playbook.i have created the playbook for automating the eml analysis If eml file is not uploaded it should notify the again. For notifing again ihave 2 optionsLooping as shown in imageRerun the playbook if failes. (Configure action retries in playbooks  |  Google Security Operations  |  Google Cloud)Regarding Rerun(retries) feature do i need to raise a techinical ticked to enable it.Thanks in advance.

Hello team, I'm encountering an issue with the native dashboard I created for silent host monitoring. The same host keeps repeating with the same timestamp. My goal is to visualize hosts that have recently stopped sending logs — for example, a host that was active around 20 minutes ago. However, it seems that the time-based aggregation in my query isn't working as expected. The same host keeps appearing repeatedly with the same timestamp. thanks in advance  

When I run a UDM search directly in Google SecOps, it returns exactly the data I need, including aggregated statistics. However, when I use the 'Execute UDM Query' playbook action, it only returns raw UDM events without any aggregation or statistical summaries. Is there a way to configure the playbook action so that it returns the same aggregated results as a standard SIEM search?

I’m looking to get SOAR playbook data across multiple tenants. Is there a way to get the data that populates the dashboards via API or access all of the data from one location? 

I don’t see a way to use placeholders on an action parameter that is a List. I have found out that you can duplicate the action, and change the parameter type, but that is not very convenient.Can this be looked at? Anybody else have this issue?

Good morning -- Is there a way within SecOps search to return the PDT timestamp rather than the default UTC (Z)?

Hi team,I want to run "Execute custom query" from Microsoft365Defender Integration. query is:EmailEvents | where Subject contains "testvalue".This query returns result table which has rows and columns in json format.for example,row1 {col1:val1, col2:val2,..}, row2{col1:val1, col2:val2,..},row...DeliveryLocation is one of the column names from the json result.I need to check whether DeliveryLocation=Inbox/folder and for each row where this condition is met, should remediate those mails accordingly.I exported the json result of this action and imported it in the IDE for this integration.How can I iterate through each row from json result and fetch DeliveryLocation. In the placeholder of the condition, check for DeliveryLocation and remediate particular emails in every row where DeliveryLocation=Inbox/folder.Thanks,Tejaswini

I really love the new “Quick Actions” widget, but I want to create similar thing using HTML, just with our own styling. What is the right way to call the manual action “Attach new playbook” API using HTML?  

Does anybody know what the Case / Widget Refresh Rate is?After an analyst has responded to a Playbook action it can take an age for the Widget “Pending Actions” to get updated and they find themselves refreshing the Case manually which is very frustrating.

Hi team,We are working on developing playbooks from scratch and was wondering what would be the best way to read a case wall note/comment and process specific data and pass it as input to another action?Ex: Lets say we have a servicenow action configured in playbook workflow - 1, which would fetch a record details based on place holder values given and now i want to pass a specific value from JSON output returned (which i can see in the case wall tab) from servicenow action within workflow 1as input to another workflow -2 or to same workflow - 1Any insights would be helpful to address this problemThanks.

Hi AllHow fast is Google SecOps' Gemini Summary? When a case was first created and a summary is generated, the speed at which Gemini Summary is generated varies depending on the situation, ranging from as fast as 1 minute to over 5 minutes. Is this normal? How about others?Also, why does Gemini not generate a summary immediately when a case is created, but instead requires the user to click to perform the summary? If Gemini generated the summary immediately, we wouldn't have to worry about this. Regards. 

Hi everyone,When creating a search filter in Native Dashboard I’ve noticed that the filter seems to be case-sensitive.For example: Searching for johndoe will miss results containing JOHNDOE or JohnDoe Is there a way to make the filter case-insensitive so that user input matches regardless of letter case?

If I attempt to integrate a custom IOC threat feed from a private closed source, are those indicators kept inside my own tenant or are they used with all customers/instances of secops?

Hi,Currently creating a playbook where its needed to do a UDM query to find a events that are created around the same time of the events of the case.When the case starts runs the playbook and the GoogleChronicle - Execute UDM Query action, where it doesnt find the specfic event. i even made sure that the time range is correct and its not missing the event for a couple minutes by generating the start time and end time based on the timestamp of the events of the case using the action “Functions - Convert Time Format”, start time being 2 months before and the end time being 2 DAYS AFTER.The action run but doesnt return any result, but if i do the EXACTLY same query directly on the SIEM, it is able to find that event.

I need to create an exclusion setting based on the values of multiple fields in a YARA-L rule.I've been trying and erroring using a data table, but I'm not getting anywhere so I'd appreciate any advice.○What I want to doIf principal.user.email_addresses is aaa@sample.com and principal.ip is x.x.x.x, do not send an alert.(I want these two fields to be an and condition, not an or condition)If this cannot be done with a data table, could you tell me if there is another way to do it?I look forward to your reply. rule sample_rule { meta: author = "sample" description = "testrule" severity = "MEDIUM" events: $e.metadata.log_type = "GCP_CLOUDAUDIT" ($e.principal.user.email_addresses != %sample_rule.useremailaddresses or $e.principal.ip != %sample_rule.ip) $user_id_for_match = $e.principal.user.userid match: $user_id_for_m

If I attempt to integrate a custom IOC threat feed from a private closed source, are those indicators kept inside my own tenant or are they used with all customers/instances of secops?

Im using this endpoint https://cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances/summarizeEntitybut the issue not able to figure out  the URL Params valuesI tried like this {"timeRange": { "start_time": "2025-07-10T00:00:00Z", "end_time": "2025-07-12T00:00:00Z" }, "pageSize": 10, "returnPrevalence" : true, "entityId" : "xxxxxxxxxxxxxxxxxx" }Also how to pass entity and entity type and how to get entityid? 

GWS License: Enterprise Plus Ingestion method to SecOps: Direct Ingestion configured in GWS Admin Console Issue: User/Device Entity Enrichment is missing. Have a look in the screenshot where I compared a log from SecOps when the ingestion was done through SIEM Feeds versus collected through Direct Ingestion. Any idea if there’s an additional configuration to get this?    

Hi, I am trying to apply my terraform code to create access scopes in SecOps SIEM and I get the following error even though the service account running this has the Chronicle API admin and Security Admin roles assigned: │ Error: Error creating DataAccessScope: googleapi: Error 403: Permission 'chronicle.dataAccessScopes.create' denied on resource '//chronicle.googleapis.com/projects/<project name>/locations/europe-west3/instances/<customer ID>' (or it may not exist).│ Details:│ [│ {│ "@type": "type.googleapis.com/google.rpc.ErrorInfo",│ "domain": "chronicle.googleapis.com",│ "metadata": {│ "permission": "chronicle.dataAccessScopes.create",│ "resource": "projects/<project name>/locations/europe-west3/instances/<customer ID>"│ },│ "reason": "IAM_PERMISSION_DENIED"│ }│ ]││ with google_chronicle_data_access_scope.data_access_scope["scope-v

We’re planning some file enrichment / manipulation in a SOAR playbook and it looks like we can “get the file on the SOAR case wall.” Where is this file actually?Example - using the Gmail integration and able to put eml file on wall.Context is what if the file is malicious - what’s in the immediate environs of the file - i.e. what’s the blast radius?