Solved

https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.investigations/list?rep_location=africa-south1using the above doc, im trying to pass an alertId or caseId as parameters in the filter field, but i keep getting this error - INVALID_ARGUMENTCan anyone help on this. Many Thanks in advance.    param = {        "filter": "alertId=<alert_id>"    } base = "https://us-chronicle.googleapis.com/v1alpha/projects/<project_id>/locations/us/instances/<instance_id>/investigations"     try:         response = mysession.session.get(url=base, params=param)        rt = response.json()        print(rt)        except Exception as e:        print("\nError ",e)error im getting :{'error': {'code': 400, 'message': 'failed to list investigations', 'status': 'INVALID_ARGUMENT'}}

I have an MSV Director account but am unable to access Mandiant documentation.Legacy accounts in our organization still have access, whereas newer accounts do not.Is documentation access managed separately after the Google acquisition?If so, could you please advise on which role is required or how users can request access to Mandiant documentation? 

I’m looking for guidance on the appropriate contact point within Google for reporting and following up on unauthorized administrative actions performed by an external party with (current or former) Google Workspace admin access.More specifically, I’m trying to understand: Which Google team or function is responsible for handling this type of incident (e.g. Workspace Support, Trust & Safety, Abuse, Partner oversight, etc.)? Through which channel (ticket type, form, or email) such reports should be submitted to ensure proper review and ownership? Whether there is a defined process for incidents involving actions performed through the Google Workspace Admin Console by a third party? What kind of information or audit logs are typically expected to support an investigation? My goal is to avoid being redirected between multiple teams and to engage the correct channel from the start.Any guidance or direction would be greatly appreciated. Thank you.

Hello guys,I’m working on SecOps Audit events for MOC purposes.I wrote a query to identify modifications on Parsers & Extensions.Here’s my query :events: metadata.log_type = "GCP_CLOUDAUDIT" target.application = "chronicle.googleapis.com" // Filter on Parser Mgmt events metadata.product_event_type = /\.ParserService\./ $action = re.capture(metadata.product_event_type, `ParserService\.(.*)$`) // Exclude 'Read' events not $action = "GetParser" not $action = "ListParsers" not $action = "ListParserExtensions" not $action = "GetParserExtension" $evtid = metadata.id match: $evtidoutcome: $timestamp = array(timestamp.get_timestamp(metadata.event_timestamp.seconds, "SECOND", "Europe/Paris")) $audit_action = array_distinct($action) $log_type = array_distinct(re.capture(target.resource.name, `logTypes/([^/]+)`)) $actor = array_distinct(principal.user.email_addresses)order: $timestamp descunselect: $evtidUnfortunately, my filters to remove ‘Read’ events seem to be not wor

Hi Team,While running a Dashboard query using “Run in Search”, the query returns No results, even though the same query shows results within the dashboard visualization. The issue specifically occurs when applying an equality filter (=) on a derived field created using an if() expression. metadata.product_event_type = "test" $inference = if( security_result.summary = "Client Authentication Bypass", "ABP", if(security_result.summary = "SSH Agent Forwarding Requested", "AFR"))$inference = "ABP"match: principal.ip, target.ip, $inference  When filtering with: $inference = "ABP"  → No results are returned. However, removing the equality filter entirely returns results Using a negation filter: $inference != "ABP"  → Also returns results The issue is reproducible across multiple dashboard queries using similar derived-field logic. The problem appears to be specific to equality (=) filtering on fields derived via if() expressions. Dashboard widgets show results, but “Run in S

Hi Community,I came across a use case where a Chronicle detection rule uses a reference list to check if a certain value (like a source and destination IP pair) already exists. If it does, the rule suppresses the alert; if not, it triggers an alert and then adds that value to the reference list to avoid duplicate alerts for a certain duration.I’d also like to understand the best way to implement it - Do I need to create any playbook for this?Below is the use case I’m referring to:  events:    $e.metadata.vendor_name = "AMAZON"    $e.metadata.product_name = "AWS VPC Flow"    $e.metadata.event_type = "NETWORK_CONNECTION"     $e.security_result.action != "BLOCK"    $e.principal.ip = $sourceip    not $e.principal.ip in cidr %internal_ips    $e.target.ip = $targetip    not $e.target.ip in %nat_ips    not strings.concat("vpc_blacklisted_inbound_traffic", ",", $sourceip, ",", $targetip) in regex %suppress_list    $gcti.graph.entity.artifact.ip = $sourceip    $gcti.graph.metadata.threat.confid

Now that multi-stage queries are available as pre-GA, is it possible to create a dashboard KPI for MTTX using case_history data? An easy example would be a measure of the avg time cases were in Triage before going to Investigation.My organization has been trying various yara-l approaches but to no avail.  The examples in the multi-stage documentation do not seem to be related to this type of use case. Thanks

Hello, All! After perusing the group and finding some excellent info, I was able to get GitSync up and running between our SecOps instance and GitHub, thanks to the official document as well. I’ve successfully sent out various folders, playbooks, etc. but am looking to automate this process via scheduled times. I’ve found this document which highlights this capability on what looks to be an older version of GitSync but I can’t find it on the current version (unless I’m missing it, of course): How to Use GitSync. If anyone has any insight, I’d greatly appreciate it.Thx much, in advance!

Can Someone please let me know how to enable SecOps internal logs and how to search or view them in the SecOps console.

Hi Community,I am currently architecting a security hardening roadmap for a client using Google Workspace (upgrading from basic settings).We are planning to implement Context-Aware Access and a Zero Trust model, but I am analyzing the potential friction with end-users (specifically in a Spanish-speaking non-tech environment).My question for the experts here: In your experience, what are the most common "blind spots" or pitfalls when moving from a legacy setup to a Zero Trust model in GWS?I'm interested in hearing about architectural challenges or specific configurations in DLP that you recommend prioritizing to avoid false positives during the transition.Any advice or resources on this transition strategy would be greatly appreciated.Thanks!

I’ve got Sentinel one feeds installed for sometime as follows:Cloudfunnel for all the agents procexec  (via s3 buckets Alert feeds via api  Recently, I started to use  SentinelOne new  SOC UI and I realized they have new rules/detections (“platform Detections and Alerts”). I enabled many of these detections based on my environment for they are not enabled by default.  Performed a few tests and they fired as expected, I can see them on the S1 Console, yet, on Google Secops, none of my feeds seems to receive any of these new “platform detections /alerts”.  the old custom and malware detections seems to be fine though.I opened a case with S1 and they are thinking that perhaps the current S1 alert api feed  setup still not updated to get these new “platform detections” .   Do any have any idea if this is case? if so, how do I proceed to get Google SecOps update their Alert feed connection to support these new alerts?  Thanks,Eric Thank you for that update and clarification!  If you are ing

Good afternoon, I'm trying to integrate AWS CloudTrail, CloudWatch, and GuardDuty alerts with Google SIEM Secops. My question is, what are the differences between sending these logs to Amazon S3 or Firehose and then to Google SIEM? Is it possible to send the logs from these cloud resources directly via API without any intermediary? Why? What do you recommend?

Hello,I’m trying to implement an SLA workflow for Cases in Google SecOps, specifically around analyst assignment and investigation timing, and I’d appreciate guidance on best practices.From what I can see today, at the system level, Google SecOps provides: Alert Stage Severity However, there is no native SLA mechanism for: Time to analyst assignment (Owner) Time spent in specific case phases (Triage / Investigation) SLA logic I’m trying to enforceMy desired SLA flow is: Case created (Unassigned) → Triage: 30 minutes to assign an analyst → Assigned → 15 minutes to move to Investigation → Investigation → 1 hour to progress / respond   What is the recommended way to implement SLA tracking for: Analyst assignment Is the expected approach to use: Case-based Rules? Tags / labels? External reporting (e.g., BigQuery)? Are there any product roadmap plans for native SLA support on Cases? Any guidance, documentation, or real-world implementation examples would be greatly

Hello,I have a question about the "Quick Action" Feature. I understand that you can use quick action buttons linked to integration actions. But is there a way to link it to a playbook block? I tried using the "Attach playbook to alert" But this workaround does not allow for custom input for the playbook.Is this something that is on the road map for the "Quick Actions"?https://cloud.google.com/chronicle/docs/soar/investigate/working-with-cases/quick-actions?hl=en

Hey Google Cloud Community -- appreciate any help your able to provide in advance here. Put simply -- I’d like to create a stats search that identifies when an account has not logged in for over 30 days. I’d like to use the metadata.product_event_type = 4624 (windows successful logon) field and basically show how long ago each target.user.userid generates a 4624 event - then filter on traffic that is over 30 days old. I have tried a few stats searches unsuccessfully. I realize there is also a preconfigured dashboard that shows Dormant Accounts but the output it is producing is not accurate. Thanks

Hi Everyone,Happy New Year 2026! 🎉I am new to Google SecOps and have a few questions regarding log ingestion via Bindplane, specifically around Google Secops standardization and log visibility.In our environment, we have Bindplane Gateways that collect logs from multiple Bindplane agents and forward the data to Google SecOps. While forwarding the logs, we apply the SecOps Standardization processor so that SecOps can assign a log type (metadata.log_type) and perform UDM field mapping using the appropriate parser.I am looking for clarification on the following scenarios: SecOps Standardization processor not appliedAre the logs still ingested and searchable in Google SecOps? If searchable, what value is assigned to metadata.log_type in the SecOps console ? Does this scenario only impact UDM parsing and detections, or can it affect ingestion itself?SecOps Standardization processor applied with an incorrect log type (Example: Windows event logs standardized as NIX_SYSTEM)Are these events s

Hey guys, do any of you know of a way to efficiently identify which log sources you need ingested in order for the curated detections or even custom rules to work as intended? Google secops currently doesn’t tell you which logs are needed and/or missing for a rule to be accurate.

Hello Community,I successfully calculated average ingestion time using a SIEM search by comparing metadata.ingested_timestamp and metadata.event_timestamp, and aggregation functions like avg(), min(), and max() worked as expected. metadata.ingested_timestamp.seconds > metadata.event_timestamp.seconds //excluding logs that have not Time in UTCmetadata.log_type = "OFFICE_365" $Timestamps = timestamp.get_timestamp(metadata.event_timestamp.seconds, "DATE")match: $Timestamps,metadata.log_type, metadata.event_type, principal.namespace // we can add or remove fields here to make it more specific or broadoutcome: $eventsCount = count(metadata.id) $avg_delay_minutes = avg((metadata.ingested_timestamp.seconds - metadata.event_timestamp.seconds) / 60) $max_delay_minutes = max((metadata.ingested_timestamp.seconds - metadata.event_timestamp.seconds) / 60) $min_delay_minutes = min((metadata.ingested_timestamp.seconds - metadata.event_timestamp.seconds) / 60) $bool = if($avg_delay_minutes

Hi all, I have one V2 Tickbox for years. It got automatically migrated towards the end of 2025, and I finally got around to having a closer look at the Google Cloud environment, which is completely new for me. Everything looks OK when accessed from the legacy google.com/recaptcha/admin reCAPTCHA administration. Also, the reCAPTCHA technically works, but I am not sure for how long. I have already enabled the free $300 testing period in Google Cloud and inserted the Credit Card details into the Google Cloud billing. But I am getting the following error when looking at Google Cloud → Security → reCAPTCHA administration page.The overview of Keys lists my key with a “Status” displayed as a dark grey/black circle followed by “Unknown” Once I open the detail at the “Overview” page, in the top right column, there is the dark circle with “Unknown” repeated and the below reads: “Something went wrong Unable to determine the status of your key. Try refreshing the page or checking back later.” The

Hi,I’m trying to create an alert based on multiple alerts from the same source, my goal here is to raise an alert when more than 2 different alerts from the same source were triggered, and from there if i have two alerts with low severity maybe raise one with medium severity and if i have two medium rise one high an so on.So far I have this alert:rule Multiple_events_same_source { meta: author = "" description = "this rule " severity = "High" events: $e.detection.collection_elements.references.event.principal.hostname != "" $e.detection.collection_elements.references.event.principal.hostname = $SourceHost NOT $e.detection.detection.rule_name IN %WHITELIST_MULTIPLE_EVENTS_RULE match: $SourceHost over 1h outcome: $risk_score = 0 condition: #e > 2 }  But what i want to achieve is to just get different alerts (by alert name), i mean, I just want this alert be triggered when the alert name of the events that make this alert raise was different one to the o

Is there a way I can continuously export the SOAR case data used in dashboards to BigQuery?

Hi everyone,I’m new to Google SecOps and currently working with the Enterprise edition. I’d like to understand how I can get the most benefit from the platform’s threat intelligence capabilities.I’m aware that I can use VirusTotal Context in my use cases for enrichment and detection, but I’m curious about how I can leverage Mandiant intelligence in a similar way. I can see Mandiant alerts and IOCs in the interface, but I’m not entirely sure how to make the best use of that data for proactive threat hunting, detection rule development.Could anyone share best practices or examples of how they’re using Mandiant within Google SecOps Enterprise? Any tips or guidance for someone new to SecOps would be greatly appreciated.Thanks in advance!

is it possible today (or upcoming feature request) to add a static timestamp as the starting time of a YARA-L dashboard query and have it ending dynamically at current date/time?  use cases --any data from year to date, ingestion from start of contract period to present etc.

Hello everyone,I am currently facing a challenge where I need to perform data matching based on a specific field. However, this field contains enriched values that lead to incorrect matches. I want to ensure that my matches are based solely on the original values in this field, without considering the enriched information.Is there a way to configure my detection logic to exclude these enriched values? Any guidance, instructions, or best practices on how to achieve this would be greatly appreciated.