Security Forums

Hello Team,I hope you’re doing well.We are planning to integrate IPAM data with Google SecOps by ingesting it as Entity Data into the Entity Context Graph (ECG) instead of traditional point-in-time log events. This approach is intended to enable better correlation of subnet/VLAN and IP data, helping us analyze traffic more effectively at the subnet level rather than individual IPs.Please let us know if this approach aligns with best practices.

Has any one completed the stage 2 of SOAR migration to GCP ?Could you simply explain the pointers that you followed for the same.  

According to the official documentation, the multi-event rules capacity under the “Enterprise” license is 125 rules. However, we have noticed that in a few of our customer environments licensed under the Enterprise license, the multi-event rules quota has been increased to 200. Is this an official update? If so, why has it not been mentioned in any of the release notes or official documentation yet?  

Hi All,We have onboarded logs from multiple GCP projects using direct ingestion into SecOps.  However, the GCP projects belong to different business solutions.The objective is to tag the logs from GCP projects based on the business owner or solutions.I have read some article suggesting to use custom ingestion pipelines: Multi-Tenant Google Cloud log collection with PubSub Push | by Chris Martin (@thatsiemguy) | Medium and like the article confirmed - it’s going to incur additional cost.Please, anyone know how best to tag logs from multiple GCP projects with the existing ingestion method.Regards.

I would like to clarify one point regarding context enrichment in Google SecOps.Currently, our logs are already ingested and enriched with Azure AD context in UDM fields. As I understand, if we update Azure AD context, SecOps will ingest the updated data into the entity context, and future logs will use this updated information for enrichment.However, I would like to confirm what happens to the previously ingested logs that were already enriched using the older context. Will those historical logs get updated automatically, or will they retain the past original enrichment values. Example 1:A user’s location was initially enriched as:City = Chennai Country = USLater, the information was corrected to:Country = IndiaIn this scenario, if historical correlation is used, earlier events may continue to reflect the previously enriched country value (US), even after the correcti

Hello Everyone,Greetings..!!I am trying to build a Google SecOps detection similar to a Splunk behavioral rule for “AWS provisioning activity from a previously unseen geographic region.”Current logic: Detect CloudTrail provisioning actions such as Run* and Create* Baseline source geolocation per activity eg : country,region ,ip ,city  Alert when provisioning comes from a new/unseen location The issue is with the baseline scale.The current baseline stores combinations of: source IP city country region/state Because of this, the baseline has grown to around 600,000 rows.In Splunk, this was implemented using a CSV lookup with historical tracking, but in SecOps we are limited by the Data Table size limit (~1000 rows), so the approach is not scalable as-is.I am looking for recommendations on

Hi everyone,I’m currently exploring how to detect potential data exfiltration using firewall logs (FortiGate) in Google Security Operations, and I’d really appreciate some feedback from others who have worked on similar use cases.I’m noticing that a lot of legitimate traffic (e.g. Microsoft services, video streaming, web analytics, normal browsing) can generate significant outbound activity, which makes it challenging to distinguish between normal behavior and potential exfiltration.I’d be interested to understand how others are handling this in practice: What signals or patterns do you rely on when working primarily with firewall logs? Do you focus more on behavioral anomalies, destination-based detection, or a combination of both? How do you effectively reduce noise without missing real threats? Are there specific indicators that you’ve found particularly reliable for detecting exfiltration?

Is there a way to add a Tag to an Alert via a playbook? I can add one to the case but I don’t see an option to add to the Alert.

Hello Everyone,Greetings..!!I am trying to build a Google SecOps detection similar to a Splunk behavioral rule for “AWS provisioning activity from a previously unseen geographic region.”Current logic: Detect CloudTrail provisioning actions such as Run* and Create* Baseline source geolocation per activity eg : country,region ,ip ,city  Alert when provisioning comes from a new/unseen location The issue is with the baseline scale.The current baseline stores combinations of: source IP city country region/state Because of this, the baseline has grown to around 600,000 rows.In Splunk, this was implemented using a CSV lookup with historical tracking, but in SecOps we are limited by the Data Table size limit (~1000 rows), so the approach is not scalable as-is.I am looking for recommendations on

Hello SecOps Community!If you are building custom Native Dashboards to track SOC performance metrics like Mean Time to Resolve (MTTR), analyst workloads, or SLA compliance, you know that the data you need often lives in two different places: the current case state (case) and the audit log of actions taken on that case (case_history).I want to provide some quick guide on how to seamlessly join these two data sources within your dashboard queries to unlock deeper insights into your case lifecycles.The Secret Sauce: Aliasing and Shared VariablesIn Native Dashboard queries, you do not need to use YARA-L rule or events blocks to join data. Instead, you establish the relationship by assigning an alias to each data source and mapping their unique identifiers to a single, shared placeholder variable.To successfully join case and case_history, focus on this core syntax:Co

 At Google Cloud Next we introduced a new security and governance paradigm for managing agent identity and access. This comprehensive framework focuses on foundational Agent Identity and an Agent Gateway with Identity-Aware Proxy, while integrating robust agent access management, agent guardrails, and runtime defense to enable a secure cloud environment for your organization. Check out this blog to learn on all new capabilities announced at Next 2026.

Hi All ,  Im not able to submit file in CS what this error means? 

According to the official documentation, the multi-event rules capacity under the “Enterprise” license is 125 rules. However, we have noticed that in a few of our customer environments licensed under the Enterprise license, the multi-event rules quota has been increased to 200. Is this an official update? If so, why has it not been mentioned in any of the release notes or official documentation yet?  

By default Google Secops compress the x-axis on its visualizations.For instance in any timechart if there is no value on any given timeslot, it’d just compress the x-axis making it non-linear. Sometimes this might be helpful but other times it could be misleading.We need a way to switch between compressed and linear x-axis.

Hello Google SecOps Community!We know that building the perfect dashboard is crucial for your SOC's visibility, but we've also heard your feedback: mastering the underlying data schemas and getting the hang of YARA-L 2.0 queries for charting can come with a steep learning curve.To help you get the most out of your data and accelerate your custom dashboard creation, we are thrilled to announce a major revamp to our Google SecOps Dashboard documentation, along with a brand-new reference query library!Here is what’s newly available to you:📊 Revamped Native Dashboards Documentation We have overhauled our dashboards documentation to give you more clarity and control. You will now find in-depth details about the schemas for the different supported data sources. To make getting started even easier, we have included ready-to-use templates and practical examples for each data source. 👉