Google Security Operations

We are configuring remote agents for the SOAR to communicate internally to our tools. We have successfully deployed the remote agents (docker) and they are showing "Lived" status on the web ui.However, during the integration configuration, when we check "run remotely" and select the remote agent, we are unable to save the config. It's showing error "An error occurred while saving instance configuration". We configured everything as the documentation indicated including the service account mapping. The remote agent container does not show any error. 

Hi all,I am attempting to create a new Table chart in Native Dashboards utilizing the recently released SOAR Custom Fields feature.We are referring the Documentation: https://security.googlecloudcommunity.com/google-security-operations-2/new-feature-support-for-soar-custom-fields-in-native-dashboards-7604 I am trying to display standard case fields alongside two of our custom text fields: "Case ID" and "CID".  Per the documentation, I am using the required syntax paths: - case.custom_fields["Case ID"].string_seq.string_vals - case.custom_fields["CID"].string_seq.string_vals Whenever I attempt to run the query, the UI returns the following generic backend error: "An error occurred with your query. An unexpected error occurred. Loading Complete." We have already tried multiple troubleshooting variations to isolate the syntax, all of which fail:  Attempt 1(Using array_distinct in outcome): $case_name = case.namematch:$case_nameoutcome:$custom_case_id = array_distinct(case.custom_fields["C

Hi Google Community,We have already enabled these Google Workspace logs:WORKSPACE_ACTIVITY WORKSPACE_USERS WORKSPACE_GROUPS WORKSPACE_ALERTSWe want to understand clearly what WORKSPACE_PRIVILEGES will do differently compared to the above log sources.Main Questions:What extra things does WORKSPACE_PRIVILEGES handle that the other parsers (especially WORKSPACE_ACTIVITY) do not cover well? Can you explain the benefits of enabling WORKSPACE_PRIVILEGES? Please give some examples of logs/events: How they look in WORKSPACE_ACTIVITY (or others) How they look better / different in WORKSPACE_PRIVILEGES We want to confirm the real value before enabling it for the client.

I am getting cannot import name 'extract_action_param'  & ‘extract_configuration_param’ from 'TIPCommon' error when I am testing the updated SOAR integration in staging mode for Azure Active Directory & Google Chronicle SOAR integrations. How to resolve this error?

How do I automate the process to send an email alert to team if log source is not reporting.1.SOAR Dashboard: I have created a query to fetch last reported time of each log_type, but how do I trigger an email if last reporting time is greater than x hours or something?SOAR Job Script: Anyone has used this to automate this? 

Hi All,I have already created a custom parser that works well for JSON object coming through logs. However, I now need to update the parser to support JSON arrays. but I'm unsure how to loop through a JSON array.Sample log:  [{"test": "testing","hostname":"hostname1"},{"test":"testing","hostname":"hostname2"}]Any guidance or assistance on how to resolve this issue would be greatly appreciated.Thank you!

We have a SOAR Graph mail connector to a mailbox where users submit suspicious emails. Each connector ingestion adds any potentially malicious attachments to the case wall.Is there any way to adjust the permissions so that someone could see the playbook results, the case views etc, post to the case wall but not download a file auto attached to the case wall?

We have completed Stage 2 of SOAR Migration for our SecOps environment using Cloud Identity integration.However, I'm having trouble understanding the IAM mechanism as described in the documentation. Could you please explain it to me?* My understanding of the requirements for SOAR Migration is as follows, but is this correct? (I'm concerned that the requirement to map the PERMISSION GROUP on the Group Mapping page and the mandatory assignment of predefined roles will limit the permission control of SOAR-side functions.)* I've also heard that Workforce Identity integration doesn't have this restriction and allows operation with only custom roles. Why does the more native Cloud Identity integration have this restriction?■IAM RolesWhen accessing SecOps via Cloud Identity integration, it is absolutely necessary to assign one of the following three roles. I was previously told by support that this is required, like an entry ticket for SecOps.roles/chronicle.soarAdminroles/chronicle.soarThrea

We use the Google Chronicle Alerts connector with dynamic environment routing:Environment Field Name: event_metadata_baseLabels_namespaces_1 Environment Regex Pattern: ^(IFAP|UNIFAP|IFPI)$This correctly routes alerts from mapped namespaces (IFAP, UNIFAP → SOC-AP environment; IFPI → SOC-PI environment). Namespaces not matched by the regex (e.g., IFES, IFTM) correctly fall back to the Default Environment.Problem: Even though unmatched namespaces fall back to Default as intended, we keep receiving email notifications:"Alerts were ingested into Environment IFES which does not exist in the system. Please create this Environment in the Settings in order to see the alerts."These institutions don't have a dedicated SOC yet, so we intentionally want them in Default — not their own environment.Questions:Is there a supported way to suppress these "environment does not exist" notifications without creating an environment for every namespace? Can the connector be configured so unmatched namespaces

We have Data RBAC configured to segregate visibility between regional SOC teams (per namespace). A scoped analyst group (GRP_SECOPS_SOC-AP) is restricted to namespaces IFAP and UNIFAP via a Data Access Scope using only the standard Namespace label (no custom labels).IAM bindings on the group (all with the condition resource.name.endsWith("/soc-siem-ap")):Chronicle API Restricted Data Access Chronicle API Editor Chronicle Restricted Data Access Reader (no condition — base UI) Custom role with chronicle.nativeDashboards.get/list, chronicle.dashboardCharts.get/list, chronicle.dashboardQueries.get/listProblem: On a native dashboard panel using the Ingestion metrics data source, the following query returns no data for the scoped analyst, but returns data correctly for a global (unrestricted) admin:ingestion.component = "Ingestion API"$namespace = ingestion.namespacematch: $namespaceoutcome: $Total_Log_Volume = math.round(sum(ingestion.log_volume) / (1000 * 1000 * 1000), 4)If we change

Hello everyone,I am trying to build a dashboard in Google SecOps that displays statistics about malicious IP addresses observed in firewall traffic and correlated against Mandiant Fusion IOC data.The correlation works correctly in Log Search using a query similar to the following:$e.metadata.log_type = "CHECKPOINT_FIREWALL"$e.security_result.action = "ALLOW"$origen = $e.principal.ip$origen != ""$gti.graph.metadata.product_name = "MANDIANT_FUSION_IOC"$gti.graph.metadata.vendor_name = "MANDIANT_FUSION_IOC"$gti.graph.metadata.source_type = "GLOBAL_CONTEXT"$gti.graph.metadata.threat.verdict_info.confidence_score >= 90$ip_ioc = $gti.graph.entity.ip$origen = $ip_iocThe query returns results successfully in Log Search.However, when I try to use the same logic in a Dashboard/Report widget, no data is returned. I also tested simplified queries that only reference MANDIANT_FUSION_IOC graph entities (without any UDM event correlation), and they still return no results in Dashboards.My question

Some of our event field names are quite long and subsequently overlap into the event’s value. Is there a way to fix this? We don’t appear to be able to drag or move the columns at all or expand the view.  Thanks,Chris

My GCP account (project ID: project-0b2ff1f9-abbb-46e6-bc1) was restricted on Feb 13, 2026 for a policy violation caused by a software bug — a flawed retry pattern that sent excessive Vertex AI API requests.I submitted an appeal and provided detailed corrective steps. On March 9, I received a project reinstatement email confirming the project is reinstated. However, the account-level restriction still blocks all access to GCP Console, CLI, and all services.Could someone help look into this? The project has been reinstated but the account-level restriction remains, so I cannot access the project to verify compliance.

Hi, my Google Cloud/Firebase project was suspended for suspected key misuse (account_hijacked).I submitted an appeal, but after 9 days I still have no response.This is now a production outage: about 1200 paying users cannot log in and trust for my application is starting to go down rapidly. The business impact this has is nothing short of a disaster, and the students that’s using the application to study for exams are panicking and asking for refunds.What I already did:Removed exposed credentials from files/repos Rewrote Git history and force-pushed cleaned history Removed old test/dev files with hardcoded keys Tightened secret handling to prevent re-commitWhat I am ready to do immediately when access is restored:Rotate/revoke all affected keys Apply strict key restrictions (referrer/IP/API allowlist) Move secrets to Secret Manager Review IAM, billing, and audit logsI’m currently blocked because suspended status prevents console access.Can anyone advise:how to confirm the appeal is act

Dear All, I need your help to understand  log ingestion for vulnerability management tool.   Currently in our environment , we are managing tenable.io vulnerability management console. We need to on-board the  vulnerability logs into GoogleSecops. On search , we found the below article  which is purely related to SOAR concept but we wish to understand how to on-board the logs from SIEM concept. Request  your kind support to address  this issue. As we are running out of time.                                                                    Tenable.io  |  Google Security Operations  |  Google Cloud Documentation

Hi all,Looking for advice from anyone who has navigated a "Hijacked Resource" suspension or has insight into typical Trust & Safety appeal timelines.TL;DR: Production Firebase project (live consumer app) was suspended on May 21 for suspected credential compromise. I had unintentionally committed service account keys to a private repo (months ago) and it has only been pulled by 2 developers.  Despite this exposure, my audit logs show no abusive activity, no foreign IP usage, and total billing for the month was about $1.99. I responded to the Trust & Safety follow-up on May 25 with a full remediation report. 13 days in, still no response. Console is locked behind the appeal screen.What I've done:Revoked all user-managed keys on affected service accounts via gcloud CLI (only SYSTEM_MANAGED keys remain) Deleted exposed Gemini API keys in AI Studio Purged credentials from version control history Rotated third-party keys (payment processor and others in progress) Reviewed 120 days of

I ran across an error in the detection pane for a rule, that does not show up in the rule editor. How is that even possible? 

Hi! Is it possible to create cases in SecOps based on emails received in O365?Any experiences?

I’m trying to implement a workflow in Google SecOps SOAR where an analyst can manually select a specific IP address entity within a case and run a playbook that performs a mitigation action (e.g., block that IP).The key requirement is that the playbook should only act on the selected entity, not all IP entities in the case.Is there a way to trigger a full playbook execution scoped to a manually selected entity (similar to how actions can target specific entities), rather than running at the case level?If this isn’t directly supported, what are the recommended workarounds (e.g., Entity Selection, loops, custom lists, or manual input prompts)? For context, I’ve already explored:- Entity Selection in playbooks- Running actions with selected entities- Quick/Manual actionsBut I haven’t found a way to initiate a full playbook execution from a manually selected entity.

Hi all,Does anyone know why Google Cloud Platform Trust & Safety team does not reply to an appeal?This has been for over 8 days and I sent them many times but they don't respond-The GCP console is directing me to send appeal and I can not use anything or view the dashboard or take any corrective action  Pleas share any info that may help me in this situation  Kind regards  

Hi everyone,I’m currently testing the built-in Risk Analytics for UEBA rules in Google SecOps, specifically around Anomalous Network Bytes Outbound detections.While configuring the rule set, I noticed that there are two modes available: Precise and Broad, and I’d like to make sure I fully understand how they behave in practice.From what I’ve observed so far:Precise seems to generate fewer alerts and is likely more strict (lower noise) for my case didnt generate any alert yet. Broad appears to be more sensitive and potentially noisier. A rule only generates alerts if both Status = Enabled and Alerting = ON. ( both broad and precise) Even when Broad is disabled, I still see rules marked with a “B” (Broad) in the UI and the alerting is off .I had a few questions to confirm my understanding:Does the “B” label simply indicate the rule variant, regardless of whether it is enabled? When only Precise is enabled, can I safely assume that only that version is actively generating alerts? In a giv

I'm trying to write a nested if then else condition in the outcomes section and I am getting this error: At first I assumed I was missing but I even tested the statement that's been provided by @jstoner for another question see here: https://www.googlecloudcommunity.com/gc/SecOps-SIEM/Else-if-condition-SecOps/m-p/855792/highlight/true Even this one throws the same error in our instance. Is there any chance nesting needs to be enabled further on the backend or is there something I am missing? 

Hi, for some reason, I cannot give GCP users access to our SecOps instance even when the instance should be configured in a way that authentications and authorizations should just work with IAM. I have added the needed roles for the users. I had to give accesses with the Group Mapping feature, by adding the users there with their email-usernames. They can access but they do not have the chronicle.propertySchemaDefinitions.get permission even if I give them Tier1-Tier3 roles. Therefore, they cannot really work with the cases. How I can give them the permission or how I can fix the IAM access feature? How to debug it? I’m not gonna give them admins to SecOps..

Hey Community!  We have some exciting SecOps enablement events coming your way this month. Sign up now to reserve your seats!  Wednesday, June 10th 7AM PT:  SecOps Webinar with Dave Nehoda: Detecting Compromised AI Agents in Google CloudThis webinar breaks down the AI attack chain, demonstrating how prompt injections can exploit MCPs to compromise cloud infrastructure. You will learn to build a comprehensive detection and automation framework using GCP logs, Google SecOps YARA-L rules, and SOAR playbooks to stop these threats in real time.Register now! Thursday, June 18th: AMER/EMEA & APJ FREE John Stoner Virtual SecOps Workshop: Introduction to Google SecOpsJoin us for a foundational, two-hour virtual workshop designed to simplify Google SecOps navigation by aligning key terminology with everyday analyst workflows. Through interactive, hands-on examples, you will explore real-world user journeys, search concepts, and data connectivity to build the perfect baseline for future techn

Hi All,In Chronicle Soar,3 different Alerts from falcon have been grouped into a single casenote: grouping condition defined is if all entities match then all only it should group But what happened  is that alerts are being grouped together even when not all entities meet the specified grouping conditions, which require all entities to match.Question: Why are these alerts being grouped into a case when not all entities are matching?