Google Security Operations

Hi everyone, I’ve been exploring how AI and cloud tools can help automate everyday tasks while keeping data secure. One area I’m curious about is managing personal finances—specifically, using secure methods to check bank balances without logging into a bank branch or multiple apps. I’m interested in approaches that could work with cloud-based AI tools or secure automation scripts, and banks like FAB. How can such systems be designed to stay safe, respect privacy, and integrate with existing cloud security best practices? Any guidance or examples would be really appreciated.

Log Parsing Issue in Restricted Pipeline (Chronicle/CBN/Logstash) We are encountering persistent syntax and parsing errors in a highly restricted log processing pipeline (likely based on Logstash/Grok, possibly within Google Chronicle or CBN). We need help structuring the code to handle the strict syntax and mixed log types without using advanced conditional logic. 1. Environment and Constraint  Environment: Highly restricted log parsing pipeline (cannot use standard Logstash features). Confirmed Constraints (Key Failures): NO if/else conditionals (if [field] fails, if "tag" in [tags] fails). NO semicolons (;) allowed anywhere in the config. Field names must use snake_case (e.g., host_name).

Hi everyoneI’m currently testing log ingestion from a Linux VM to Google SecOps (Chronicle) using Bindplane (no Chronicle Forwarder, only the Bindplane agent and gRPC).In the Bindplane destination, I’m using: Protocol: gRPC Endpoint: malachiteingestion-pa.googleapis.com Auth: json, with the Ingestion Authentication File from SecOps Correct Customer ID But on the VM, the Chronicle exporter always shows:"error": "upload to chronicle: Permanent error: 403 Forbidden" Any idea what can cause a 403 in this case, or anything that must be enabled/checked on the SecOps side?Thanks!

I am encountering indexing errors in the Chronicle Ingestion Health Dashboard and would like to understand the specific scenarios or conditions that lead to these errors. Could you please provide insights on the possible causes of these errors, along with the count or frequency of occurrences, and any recommended steps to resolve or mitigate them?  

I have integrated Azure Event Hub with GCP SecOps; however, we are receiving Event Hub operational logs instead of the Azure Activity logs. Can we discuss this?

Risk Analytics is a crucial feature within Google SecOps SIEM designed to help security teams identify unusual behavior and quantify the potential risk that various entities pose to the enterprise. It empowers analysts to move beyond basic alert triage and focus on the entities that represent the most significant threat. Key Components of the Risk Analytics Dashboard The central hub for this feature is the Risk Analytics dashboard, which provides a holistic view of entity risks, accessible to users with global scope in RBAC systems. Behavioral Analytics: This section lists entities (such as user accounts, servers, or laptops) based on their calculated Google Security Operations Entities risk scores. This allows tracking an entity's risk over time and serves as a metric for detection use c

 I've tried following the steps to configure the new ThreatConnect version 3.0, but the indicated log type, ThreatConnect IOC V3, doesn't appear. Do I need to request this new log type somehow? 

Hi All,In a manual case i have created entity username. I have executed Azure active directory - disable user accounts, revoke user sessions actions successfully.  when i have executed Reset User Password action im getting output as “No user passwords were reset.”. Could you please assist

Hello community,I’m sharing a composite detection pattern that took me quite some time to figure it out, because it addresses a limitation in Chronicle composite rules that isn’t clearly documented.This pattern may help whoever needs to build OR-based composite detections across heterogeneous telemetry (for example, host-based vs user-based signals). I needed a composite rule that triggers when either of the following detections fires for a watchlist entity: USB File Write activity  (host-centric) Outbound personal email attachments (user-centric) Constraints: The USB rule only has hostname The Email rule only has email address There is no common identity field across the two detections The watchlist contains both email and hostname Chronicle composite rules require all event groups in events: to be joined by equalities

There are two endpoints for log ingestion into SecOps:europe-malachiteingestion-pa.googleapis.comchronicle.googleapis.comWhether using the APIs directly, or via the bindplane agent, we can get successfully logs into our SecOps instance.The "legacy" Malachite API works perfectly. The logs, labels, and base_labels are added, meaning Data RBAC works as expected.metadata.base_labels.allow_scoped_access = true metadata.base_labels.ingestion_kv_labels[0].key = "attempt_id" metadata.base_labels.ingestion_kv_labels[0].value = "597901e6cbfb490e8903fb660da2b4e0" metadata.ingestion_labels[0].key = "attempt_id" metadata.ingestion_labels[0].value = "597901e6cbfb490e8903fb660da2b4e0"The v1alpha, chronicle API allows our logs to be ingested. The ingestion labels are visible in SecOps, but the

Hi Team, We have integrated CrowdStrike via remote agent. For ‘Submit File’ action we need to give the file path. What is the process of submitting file- is it possible to attach the file to case wall and then pass that file to CrowdStrike for analysis?For Analyst, they only have access to case wall, they don't have access to remote agent server. File may be malicious, is it safe to upload such files on case wall?

I am trying to enhance / enrich event data / UDM by means of a Data Table. I have the following data table called CrownJewelsColumn 1: Hostname - mapped to entity.asset.hostnameColumn 2: Asset_ID - mapped to entity.asset.asset_idColumn 3: IP - mapped to entity.asset.ipColumn 4: Owner - mapped to entity.asset.attribute.labels.valueColumn 5: CrownJewel - mapped to entity.asset.attribute.roles.nameColumn6: OwnerKey - mapped to entity.asset.attribute.labels.key My goal is to enrich UDM data with data from above,especially I want asset.attribute.roles.name to contain CrownJewel, and I want an asset.attributes.labels entry where by key is called Owner and value from Collumn 4. But whatever I try, following both the google document, as well as the blogs from ​@jstoner  (well written!) But I can’t get any enrichment happening….Here’s t

Hey folks,Yesterday, we released a small, but impactful update to the “Functions” PowerUp. Now, this PowerUp contains a new action called “Calculate Timestamp”.  BackgroundYou might’ve seen that in a lot of actions, the time range management is handled in the same way. You would have 3 parameters that dictate the time for the action execution:Time Frame Start Time End TimeHere is an example from a real action:  This handling is unofficially standartized and we aim to have the same implementation to be on all actions, where it’s relevant. There would be some basic predetermined values and ability to provide a custom time range.For custom input, we work with ISO8601 format (eq 2025-10-31T10:21:00Z).The common challenge that

Are you hungry for more Google Security content? Craving a way to easily find those hidden gems of knowledge? I'm Marie Chudolij, your new User Community Manager, and I'm here to deliver!  This new role is a chance for us to collaborate – I find the content you need, and get your feedback to create even better resources. Let's experiment together to discover the best ways to keep you informed! My Story: From Network Admin to Community Champion I've been immersed in tech my entire career, from hands-on support to network administration.  My mentor, Doug, saw my potential and sparked my passion for Network Security (thank you, Doug!). Later, I managed security projects and had the privilege of working with talented engineers at Siemplify to streamline SOC workflows around the world. Joining Google was a dream come true, and now I'm excited to connect with you, our amazing community! What to Expect: Your

Hello, I am getting below error for API call to list custom detection rules: Querying URL: https://backstory.googleapis.com/v2/detect/rules?page_size=2000{'error': {'code': 403, 'message': 'The caller does not have permission', 'status': 'PERMISSION_DENIED'}}object of type 'NoneType' has no len() I validated and the permissions seems good for service account (Chronicle API Admin).  Any guidance, examples, or best practices would be really helpful.Thanks in advance! Thanks,Suraj

Hello Team, I am looking to get ingestion bytes/rate per second for log sources. I saw it in Ingestion Dashboard, but not able to get each log bytes. I checked the documentation and found log export can provide log with byte information.https://docs.cloud.google.com/chronicle/docs/reference/data-export-api-enhanced#:~:text=exportedVolume%3A%20For%20completed%20jobs%2C%20the%20actual%20volume%20of%20data%20exportedbut i want only ingestion bytes/rate per second for log sources, not the complete log.Has anyone been able to retrieve this kind of data? Any guidance, examples, or best practices would be really helpful.Thanks in advance!

Gemini CLI was launched this morning and I'm excited to share ways to use it with the MCP Servers for Google Cloud Security. Configuration MCP Servers in Gemini CLI are configured using the same JSON that we describe in MCP Server Configuration Reference. The mcpServers key is at the top-level along with the theme and selectedAuthType keys: ❯ head ~/

Hi All,  I am trying to use the “Is Value in Data Table” to look for an IP address within a list of IP CIDR ranges Datatable.  When I run the action, the action does not find a match - however I know the IP address is in the CIDR range within the data-table.  Below is the settings for the SOAR action:  Below is the Data table which contains the CIDR ranges for Mandiant ASM IPs:  Output from the action:  Is it perhaps to do with the type associated with the co

We are facing the issue where we are not able to ingest the AWS EC2 , ECS , IAM and VPC, We are using these logs types as AWS context data to enrich the Guarduty and Cloudtrail logs. We are using the thirdparty api to ingest the logs and providing the access and secret key to fetech the data and relevant permission are already in place.Does anybody faced the same issue?

I want to know whether it is possible for the parser to add a timezone when the log timestamp is in Unix time.I tried the following code, but when logtime is in Unix time, it results in an error, and I confirmed that the current time is inserted as the timestamp instead.---------------date {match => ["logtime", "yyyy-MM-dd HH:mm:ss"]timezone => "America/New_York"on_error => "no_match"}---------------I also considered adding a numeric timezone offset to the Unix time before the date function, but it seems that the parser cannot perform arithmetic operations.Is it technically possible to add a timezone to a Unix timestamp in the first place?

I have been working with using playbooks to assist the analyst by automating command line explanations. As an example we have some alerts that are built out to look to certain command line behaviors. The idea is to take that command line and feed it to Gemini to return an explanation and a verdict.  The playbook and the results look really good. The issue that I see is we are having about a 20% failure rate on the API endpoint returning a 503 error.  We are only doing this in Dev, and the volume is very low.  While I concept looks valid, it seems the infrastructure will not support our initiative. Has anyone else worked with this or seen this behavior? Also, there should is no Gemini Tag that I can add to this.

I want to create a custom dashboard to display duplicate alerts within a 5-minute window, based on event type. For example, if the same event triggers an alert multiple times within 5 minutes, it should be visible on the dashboard.

In Google SecOps SOAR playbooks, When I am trying to enrich IP/domain, all the IPs/Domains are being enriched. I dont see any option to use a particular IP in Enrich IP action of VirusTotalV3 integration. How can we enrich only desired IPs.

We have a requirement to ingest the audit and sign in logs of entra id to secops using the SecOps third party APIs.We have tried using the graph API method from O365 for this, and the audit logs are being ingested successfully, but the sign in logs are failing with an error. Since it was failing, we tried ingesting by creating a separate client ID for the sign in logs , which was also failing. is there a reason for this?  

I’m trying to build a dashboard for SOAR Case Data.I couldn’t find a field in the `case_history` object that will allow me to filter by the environment name. Any suggestions?