Security Forums

Clicking the “Create” button when submitting a new post results in some form of status message.  Maybe it says “Your post has been submitted”.  Maybe it says something about adding tags.  Maybe it says something about duplicate posts. … How about making that status message more visible?  Maybe add it somewhere… I don’t know… even close to the button used to submit the post?  Currently, the window just scrolls up slightly and it’s hidden in a sea of other text using the same font/color.  Super easy to miss if you rarely have time to use the forums.

We successfully established HTTPS log forwarding profiles within Palo Alto Strata Logging Service last year using https://malachiteingestion-pa.googleapis.com/v2/unstructuredlogentries:batchCreate.  Although these profiles continue to forward logs to our SecOps environment, we can no longer manage the profile within Strata due to the following error that follows when testing the connection:  This wasn’t an issue when the forwarding profiles were established and it certainly wasn’t an issue the many times we made adjustments to the profiles throughout last year.  It’s probably been 4-6 months since we last touched these profiles, so it’s unclear when this behavior st

Hello all,Can GTI be used to determine whether a certain IP or domain is linked to bulletproof hosting or commercial VPN services?Alternatively, is it possible to enrich IPs or domains with any ports or services being run/open on them? Akin to what this Microsoft endpoint would do - https://learn.microsoft.com/en-us/graph/api/resources/security-hostport?view=graph-rest-1.0

Hello Team, We are trying to connect palo alto SLS with secops instance. But when test the connection from SLS side we are getting error “ connection to server failed due to incomplete CA chain unable to find valid certificates path to requested target” We tried all different combinations of certificates provided by google.  Is chain getting corrupted or something else is missed ? Any help would be appreciated

Hello Google reCAPTCHA Support Team,We are urgently reaching out because we have exhausted every possible solution recommended by Google documentation, AI tools, and our hosting provider, and nothing has resolved our issue. We need your direct assistance.━━━━━━━━━━━━━━━━━━━━━━WHAT EXACTLY IS HAPPENING━━━━━━━━━━━━━━━━━━━━━━Every single time ANY visitor loads ANY page on our websites, a reCAPTCHA verification spinner appears on the screen. This happens:• On the very first page load• On every subsequent page load• For every single visitor from any country• On ALL pages — homepage, product pages, course pages, checkout, everywhere• On both of our websites simultaneously• Even after the visitor has already passed verification on a previous pageThe spinner appears, runs for 1-3 seconds, then disappears and the page loads. It happens on EVERY page, EVERY time, for EVERY visitor without exception. This is not a one-

Hi! Previously, as per the FAQs, we were able to hide the reCAPTCHA badge on the site, so long as we referenced the branding in the user flow. Now that any references to Google’s Privacy Policy and Terms and Conditions need to be removed, do we need to display the badge at all times?   

Hi. Related to Switching Google’s role with reCAPTCHA from Data Controller to Data ProcessorI’m using Google recaptcha v2 with checkbox, so after 2 April, 2026, the badge with text Privacy - Terms will be removed from UI like this. is it right? Thank you for your supporting 

Hi Team, We have a Intune feed setup in our google chronicle siem but its not working event after we have configured the api key and token properly it is giving the below error while we try updating the client secret.are there any additional permissions needed from entra side ? or we need to look at some other settings? could you please help to sort this out and what exactly we need to do over here to troubleshoot this furthur. 

Hi everyone, I’m running into a persistent issue with my Google SOAR Remote Agent and could use some insight.The Setup: Environment: Remote Agent running inside a Podman container on a Google Cloud (GCP) VM. Status: The agent shows as "Live" in the SOAR Console, confirming that the outbound heartbeat/registration is successful. The Problem: Whenever I attempt to add or save an integration instance in the SOAR UI, the action fails with a "Service Unavailable" error in the console.What I have confirmed so far: Network connectivity from inside the Podman container to the SOAR Publisher endpoint is working (verified via curl). The agent is successfully heartbeating (it appears "Live").  Has

HI, we have salesforce shield licence and I am configuring event logs ingestion to google chronicle. My question is which events google chronicle will pull after configuration. Do we need to have event data streaming option enabled for each of the event type defined in the event manger?    

I have question does No captcha requests counted with (checkbox and image ) assessments monthly? As per google announcement  if we exceed 10,000 request then we have to pay 8$ to get extra 100,000 requests. As my website have a most of requests as No captcha, so do i have to enable billing to avoid errors or No captcha requests are excluded from assessmnets count ?  One more question does recaptcha detects automation tools or stress tests on form thus it will exceed 10,000 assessments if stress tests applied  ?  

Hello,Is there any options to show pending action to user with dynamic field inside?I know how to create IDE that will prompt user with plaintext, same as Flow > Instruction. But is there any option to prompt user with something dynamic? Even as a text field where he can just go “ok”.Purpose - to not force user to go to wall to look for answer of some regular actions.Example - Playbook get information about IP and instead of post insight it will provide another pending action prompt that when you click respond it will have output from that previous gathering action listed.Looking forward to suggestions.

I am using workload identity for Chronicle api integration, I am getting error” unable to acquire impersonated credentials” . I think the issue is in adding the Principal. I am not sure what Principal needs to be added and how I can find it from scratch. I am not getting the principal in the error log also while testing the instance. Please help me with the steps how and which principal I can use and resolve the issue.Thanks in advance :)

This is more of an awareness post from a lesson learned and a request to probably update the documentation for Retrohunt and a feature request on the SecOps UI.Context:We have a noisy Alerting rule that looks at allowed network traffic from one source IP towards x number of distinct destination IPs within a minute. Today, I made several changes to more appropriately reflect the intent of the said rule. As best practice, I always test rules via “Test Rule” in Rules Editor. So far so good, no results in the last ~2 weeks. And for good measure (or so I thought), I ran a Retrohunt for the rule from a start date of Sept 01, 2025 until today. Result shows 400+ detections, with last detection on Feb 24, 2026. I have ran several Retrohunts before, but in retrospect, this was the first time I ran it on a rule that was already set to Alerting. Lo and behold, we got flooded with 60+ cases from that single rule, including Overflow cases. 

Using Log Manager & The Alerting Platform I’ve noticed over the past year or so continuous enumeration and penetration attack attempts from anonymous sources.   These commonly show up as unauthenticated API calls e.g. `storage.objects.list`, `storage.buckets.get` with known bucket names, “Docker-HeadManifest” (to enumerate artifact registry), IAM GetProject, IAM GetResourceBillingInfo to enumerate project names, billing accounts etc.Ideally I would like to immediately block this traffic and have the ability to automatically detect and block anomalies like this.My Attempts to Fix this:Followed best practices e.g. no SA keys, RBAC, continuous audits, alerting on the attack attempts Reported the issue to Google Cloud Platform -- I was told it wasn’t a support issue Reported frequent IPs using the Abuse contact at the Source IP ISP provider (discovered via WHOIS) Questions for th

Hey all,Has anyone faced issues ingesting Salesforce logs into Google SecOps using the OAuth JWT grant method?We’re currently seeing authentication failures when configuring the feed using JWT (all required credentials provided as per Google documentation).When switching to OAuth Password Grant, the configuration fails with:No such column 'Interval' on entity 'EventLogFile'From our research, the Interval field appears to require Salesforce Shield / Event Monitoring, but the customer only has Salesforce Enterprise Edition. The Google documentation mentions Enterprise and above should be sufficient.Just checking: Is Shield/Event Monitoring mandatory for this integration? Has anyone successfully used JWT grant without Shield? Any common causes for JWT authentication failure in

Hi Team,In one of my widget query i was referencing a data table and i can see the required output.This is my  dashboard widget query,metadata.log_type = /Fortinet/ nocase principal.ip != ""target.ip != "" not principal.ip in %Private_IP_Ranges.cidr  match:  security_result.action,principal.ip,principal.port,principal.ip_geo_artifact.location.country_or_region,target.ip,target.port,target.ip_geo_artifact.location.country_or_region,target.application,network.sent_bytes,network.received_bytes outcome:  $event_time = timestamp.get_timestamp(max(metadata.event_timestamp.seconds), "%F %T", "GMT") limit:    10000after saving the query when i try to apply global filter i am unable to select my widget (it is greyed out)