Security Forums

[Quick Tip] Use new "Calculate Timestamp" action to improve the timestamp precision of Send Query/Search Logs use cases

Hey folks,Yesterday, we released a small, but impactful update to the “Functions” PowerUp. Now, this PowerUp contains a new action called “Calculate Timestamp”. BackgroundYou might’ve seen that in a lot of actions, the time range management is handled in the same way. You would have 3 parameters that dictate the time for the action execution:Time Frame Start Time End TimeHere is an example from a real action: This handling is unofficially standartized and we aim to have the same implementation to be on all actions, where it’s relevant. There would be some basic predetermined values and ability to provide a custom time range.For custom input, we work with ISO8601 format (eq 2025-10-31T10:21:00Z).The common challenge that

700

20 days ago

matthewnicholsCommunity Manager

New SecOps Videos! New Emerging Threats Center! Alert Triage Agent!

Hey Community, Wanted to share some of the exciting things that have been released recently in Community! We have new SecOps tutorial videos. Check them out here!We just announced our new Emerging Threats Center for SecOps. Say good bye to fire drills and hello to faster mitigation!And don't forget to dive into our Google SecOps Alert Triage and Investigation Agent! Go from alerts to action! We want to hear from you on all of these topics. Drop a comment below.

1360

22 days ago

gkushStaff

New Google SecOps Video Series!

Today Google introduces a new video demo series that speaks to practical ways Google SecOps helps you defend your institution. While there are a lot of features built into the platform, I wanted to show how Google SecOps helps security practitioners do their important work and be better at it. It’s easy to know what people find important: I’ve had customers asking for things for years. When I first joined Google, a lot of what customers wanted to see simply didn’t exist or required considerable customization. SecOps has come a long way from its days as Backstory and Chronicle, which had raw power and a barebones, DIY analysis engine, having grown into a much more capable platform. This didn’t happen in a vacuum! Much of what has come about in the product is the direct result of customer feedback, with customers telling us what they need to arm their tea

2980

1 month ago

matthewnicholsCommunity Manager

30 Days of UNLIMITED Searching with Google Threat Intelligence!

This November, Explore and Share with Google Threat Intelligence! Join the #MonthOfGoogleTISearch initiative This November, we’re inviting all Google Threat Intelligence users to explore, investigate, and share - unrestrictedly.For the entire month, searches made through the GUI (only GUI, not API) will not consume any quota — so you can go further and deeper in your investigations.From malware analysis to actor tracking and campaign correlation, this is your chance to experiment freely with advanced Google TI searches, discover new use cases, and uncover insights that connect the dots across the threat landscape. What you can expectNo quota consumption for all searches performed via the Google TI web interface during November. Note that API interaction will continue to consume quota.

2280

1 month ago

f3rzStaff

Creating a Playbook with Approval Links and Timeout Handling

First, you need an action that sends the approval link to the relevant person. The best way to do this is with a Send Email action, as it allows you to embed the approval link directly in the message. See more in Public Documentation. Next, you must create a dummy action, such as Case Comment, that will be the target of the approval link as displayed below Within this action, set the "If step fails" setting to "Sk

2220

3 months ago

Joseliyo_JstnkStaff

Supercharging Your Threat Hunts: Join Google Threat Intelligence at Labscon for a Workshop on Automation and LLMs

We are excited to announce that our colleague Joseliyo Sánchez, will be at Labscon to present our workshop: Advanced Threat Hunting: Automating Large-Scale Operations with LLMs. This workshop is a joint effort with SentinelOne and their researcher, Aleksandar Milenkoski.In today's rapidly evolving threat landscape, security professionals face an overwhelming tide of data and increasingly sophisticated adversaries. This hands-on workshop is designed to empower you to move beyond the traditional web interface and harness the full potential of the Google Threat Intelligence API for large-scale, automated threat intelligence and hunting.We will dive deep into how you can use the Google Threat Intelligence API with Python and Google Colab notebooks to automate the consumption of massive datasets. You'll learn how to track the behaviors of advanced persistent threat (APT) actors and cybercrime groups through practical, real-time exercises.A key part o

1791

3 months ago

Dmitry_SarakeevStaff

Google Threat Intelligence support transition to Google Cloud console

Update November 2025:We are extending the transition period for migrating to the GCP support flow - the final date to open new cases using the old contact form is now January 14th, 2026. After this date, new support cases for the Google Threat Intelligence should be opened using the new GCP support process described in the original post. Hi Google Cloud Security Community Users,We want to use this forum to inform you of upcoming changes to how technical support is provided for the Google Threat Intelligence service.To ensure continuous support, all Google Threat Intelligence customers must transition to receiving technical support through the Google Cloud console no later than December 2, 2025

2531

3 months ago

GoobleNew Member

Product field in Dashboards

The alert included in the case has a product field.In "SOAR Reports legacy", the product field is available. Where can I find this field when using Dashboards and the "Cases and alerts" data source? https://cloud.google.com/chronicle/docs/reference/soar-data-dashboard#cases-and-alertsI reviewed all the fields, but I didn’t find any product field. Anyone would know?

281

1 hour ago

Bawou marketNew Member

asked in Security Command Center

False Positive: "Deceptive Site Ahead" warning on my new Firebase website

Hello Google Support Team,I am the owner and developer of the website: https://www.bawoumarket.com (and the hosting URL: [suspicious link removed]).I recently deployed this website using Firebase Hosting. It is a legitimate e-commerce project currently under development. I added a login.html page for user authentication, and immediately after deployment, Google Chrome started flagging my site as "Dangerous / Deceptive Site Ahead".This is a false positive. The site is clean, safe, and does not contain any phishing or malicious content. It is simply a new project with a login form.I have verified my ownership in Google Search Console.Please review the site and remove the red warning screen so I can continue my developme

152

1 hour ago

JithendraChowdaryNew Member

Sending logs to Google Secops (legacy version) using Logstash

Hi,I have installed Logstash in few of my servers and trying to send the raw logs to my Google SecOps platform (legacy version). My Google SecOps is a google-managed one.I have shared the Integration API Key from Google SecOps with my application team who is setting up the Logstash in the servers. They are stuck with authentication issue in the logstash pipeline when they tried to send the data via Google SecOps Ingestion API.I would like to understand how logstash will be connected with Google SecOps. I couldnt find any official documentation to follow the setup as well. Thanks.

4 hours ago

ar3diuSilver 2

Filter by the SOAR Environment Name in the Case History dataset from Dashboards

I’m trying to build a dashboard for SOAR Case Data.I couldn’t find a field in the `case_history` object that will allow me to filter by the environment name. Any suggestions?

4 hours ago

malzahnOptivBronze 4

Multi-stage queries to compare SOAR case_history events in dashboards

Now that multi-stage queries are available as pre-GA, is it possible to create a dashboard KPI for MTTX using case_history data? An easy example would be a measure of the avg time cases were in Triage before going to Investigation.My organization has been trying various yara-l approaches but to no avail. The examples in the multi-stage documentation do not seem to be related to this type of use case. Thanks

18111

4 hours ago

havoxNew Member

Chronicle re.capture() Limitation: Only Returns First Match (Cannot Extract Multiple Expressions)

The Chronicle re.capture() function only returns the first match in the text, and it supports only 0 or 1 capture group. If the regex contains 0 capture groups, Chronicle returns the first full substring that matches the expression. If the regex contains 1 capture group, it returns only the first captured value from that match. Chronicle never scans beyond the first match and cannot return multiple matches like extracting all regex on the statement. If the regex contains two or more capture groups, Chronicle throws a compiler error.Used Regex : (?:%3A%3A|::)?[?&][^=]+=([A-Za-z0-9+/]{8,}(?:={0,2})|[0-9]{1,3}(?:\.[0-9]{1,3}){3})Error : compilation error compiling query: generating predicates: regex passed to capture() must have 0 or 1 capture groups, but got: 4 capture groups line: 7 colum

121

7 hours ago

bitshock1015New Member

Windows Events Partially ingested to secops

Hello,I have a bindplane configuration that collects logs from Active Directory and Windows Events. However, I noticed that some events are not being sent to the blindplane, but are generated on the server.For example, event 4740. I can see this event in the event viewer, but at no point is it consumed by the bindplane.What could be causing these events not to be brought in?

332

7 hours ago

ar3diuSilver 2

Could you please add an RSS feed to security.googlecloudcommunity.com/p/blog?

The title :)

150

10 hours ago

duttyatharthNew Member

SLA dashboard for Chronicle Secops

Hi All,I have a use-case to list out the cases where SLA’s were breached and I am trying to use the dashboard to achieve this.Due to limitations with customising SLAs in chronicle with both case priority and case stage I cannot use the default SLA definition settings.The idea is to get the handling time of each stage and list down the case IDs which breaches the required conditions in the dashboards. Does anyone know how I can get the handling time per case in the new native dashboards? Or should this be tried another way?

341

10 hours ago

0xM4XDF1RNew Member

Microsoft365Defender - Integration - Bidirectional Sync

Hey all! We are trying to get a two-way sync between MSXDR (microsoft 365 defender) and SecOps cases. We have the 365 defender integration configured, and we get secops cases created based on MSXDR incidents. However, we need the following:Secops case closed > XDR incident is set to resolvedXDR incident is resolved (in XDR) > Secops case is closed The need here is:The analyst does not need to close a case in two portals (secops and XDR portal) XDR sometimes does merging or autoclosing, this incident status change should reflect in Secops

1103

11 hours ago

0xM4XDF1RNew Member

Excluding Entity from being created

Hi!We are trying to exclude the MS XDR portal from showing up as a entity in our cases. Tried these 3 variants, but it does not filter it out..What is the correct formatting? (The entities in cases are urls to incidents, so I need to catch all variants of the URL with a wildcard.

353

11 hours ago

melissagrBronze 1

403 Forbidden when sending logs from Bindplane to Google SecOps (gRPC)

Hi everyoneI’m currently testing log ingestion from a Linux VM to Google SecOps (Chronicle) using Bindplane (no Chronicle Forwarder, only the Bindplane agent and gRPC).In the Bindplane destination, I’m using: Protocol: gRPC Endpoint: malachiteingestion-pa.googleapis.com Auth: json, with the Ingestion Authentication File from SecOps Correct Customer ID But on the VM, the Chronicle exporter always shows:"error": "upload to chronicle: Permanent error: 403 Forbidden" Any idea what can cause a 403 in this case, or anything that must be enabled/checked on the SecOps side?Thanks!

455

12 hours ago

preeeyaNew Member

Auditing / monitoring of changes made in reference list

Hi All,Would like to know if there is a possibility to monitor the changes made to a reference list such as adding / deleting a value from the reference list? As we have for changes made to rules from GCP console. Thanks!

15 hours ago

SamNew Member

Monitor for Uploads of My Company Owned/Signed Files to VirusTotal

Hey Community, I'm working on configuring a detection rule in SecOps to monitor and generate an alert when a file owned/signed by my company is uploaded to VirusTotal. Has anyone worked on a similar task in the past?

393

16 hours ago

Rob_PStaff

New Google Threat Intelligence Functionality! Saved Searches for IOC Investigations

New Feature for Saved IOC Searches: We have enhanced the Intelligence Search workflow to eliminate repetitive manual entry. Threat hunters can now build complex queries once and save them for future use. This allows teams t

170

16 hours ago

Rob_PStaff

Month of Google TI Search - Day 19 Recap: Hunting Regional Ransomware

This Google Threat Intelligence search query is designed to identify files submitted from specific countries, along with community feedback indicating the presence of a Ransom note, which strongly suggests a potential victim from that country and is sharing that intelligence. submitter:DE comment:"SUSP_RANSOM_Note"

17 hours ago

Rob_PStaff