Skip to main content

User Groups
Events

Home
Community
Security Forums

Security Forums

Welcome to the Google Cloud Security Forums! Your ultimate security conversation spot. Collaborate with peers and experts to solve challenges, together.

2639 Topics

ylandovskyyStaff

posted in Google Security Operations

[Important] Custom Fields are now supported in Case Closure Form - Full Guide

Hey folks! This week we released an important update to Custom Fields. They are now supported as part of Case Closure Form. When talking Case Closure Form, we are talking about this form: Dynamic Fields MigrationIn 2024 we added an ability to add additional metadata to Case Closure Form via “Dynamic Fields”. Dynamic Fields were the predecessor for the Custom Fields.Dynamic Fields were lacking some critical features and eventually were completely independent from Custom Fields. For example, if you had a Dynamic Field called “Business Impact” and a Custom Field called “Business Impact”, they would not share the same data.This is obviously a problem as users would need to fill out the same field twice, when managing the case. Now we have properly unified the architecture and Custom Fields completely replaced the Dynamic Fields❗❗.If you previously had some Dynamic Fields in your environment, then those fields were recreated as Custom Fields with a special suffix “[Dynamic Fields Migration

f3rzStaff

posted in Google Security Operations

Creating a Playbook with Approval Links and Timeout Handling

First, you need an action that sends the approval link to the relevant person. The best way to do this is with a Send Email action, as it allows you to embed the approval link directly in the message. See more in Public Documentation. Next, you must create a dummy action, such as Case Comment, that will be the target of the approval link as displayed below Within this action, set the "If step fails" setting to "Skip step." This is critical for handling timeouts. If the recipient doesn't click the link within the "Time to respond" (e.g., 5 minutes), the action will "fail," but the playbook won't stop. Instead, it will skip this action and continue to the next step, allowing you to handle the timeout scenario. After your dummy approval action, add a Condition Flow to handle the different outcomes: approved, declined, or timed out. How it works: Approved: If the recipient clicks the approval link from the email, the dummy action (Siemplify_CaseComment_1 in this example) will execute s

matthewnicholsCommunity Manager

posted in Google Security Operations

New Professional Security Operations Engineer Certification!

Hey Community and SecOps enthusiasts! Google Cloud just released its next certification for Google Cloud Professional Security Operations Engineers. This cert program is all about assessing your ability to conduct platform operations, data management, threat hunting, detection engineering, incident response, observability and more! Check out all the details here.

Joseliyo_JstnkStaff

posted in Google Threat Intelligence

Supercharging Your Threat Hunts: Join Google Threat Intelligence at Labscon for a Workshop on Automation and LLMs

We are excited to announce that our colleague Joseliyo Sánchez, will be at Labscon to present our workshop: Advanced Threat Hunting: Automating Large-Scale Operations with LLMs. This workshop is a joint effort with SentinelOne and their researcher, Aleksandar Milenkoski.In today's rapidly evolving threat landscape, security professionals face an overwhelming tide of data and increasingly sophisticated adversaries. This hands-on workshop is designed to empower you to move beyond the traditional web interface and harness the full potential of the Google Threat Intelligence API for large-scale, automated threat intelligence and hunting.We will dive deep into how you can use the Google Threat Intelligence API with Python and Google Colab notebooks to automate the consumption of massive datasets. You'll learn how to track the behaviors of advanced persistent threat (APT) actors and cybercrime groups through practical, real-time exercises.A key part of our workshop will focus on leveraging L

Dmitry_SarakeevStaff

posted in Google Threat Intelligence

Google Threat Intelligence support transition to Google Cloud console

Hi Google Cloud Security Community Users,We want to use this forum to inform you of upcoming changes to how technical support is provided for the Google Threat Intelligence service.To ensure continuous support, all Google Threat Intelligence customers must transition to receiving technical support through the Google Cloud console no later than December 2, 2025.The transition from submitting Technical Support cases through the VirusTotal Contact Us Form to using the Google Cloud console is expected to take time and we’ve provided additional information below to guide you through this transition.What you need to knowGoogle Threat Intelligence support transition to Google Cloud consoleSeptember 2, 2025 - December 2, 2025: Transition Period: During this timeframe, GTI customers will be enabled to submit technical support cases for their Google Threat Intelligence service directly through the Google Cloud console. Cases submitted in the VirusTotal Contact Us Form will still be honored and

ylandovskyyStaff

posted in Google Security Operations

Sample Integration - the go-to place to see the most common design patterns in Response Integrations - Overview

Hey folks, We just released the version 1 of Sample Integration. The purpose of this integration is to provide examples and guidance on how to build custom integrations. In this community post, I will do an overview of everything this integration has to offer. Sample Integration contains the most common design patterns for all supported response integration content - actions, connector, jobs. You will have examples of how to handle different parameter types, how to build async actions, how to add enrichment information onto entities and a lot more! You can easily copy the code provided in the integration and then tweak it to your personal needs. Additionally, it’s accessible through our Github, so you can fork it and use it in your local environment for development purposes (mp tool allows you to push code from local repository into a SecOps instance, but that’s a guide for a different day). Integration Configuration At the core of this integration, we selected an API that does currenc

Sarthakd25New Member

asked in Google Security Operations

How to Parse Nested Complex Objects from CEF Keys with Array Indices (e.g. mitre1.enterprise.10.techniques.5.techniqueID) in Logstash Filter Block

I want to build a Logstash parser to handle CEF-format logs where the field keys resemble nested structures with array indices. The CEF format includes key-value pairs, which I can extract using: kv { source => "cef_event_attributes" field_split => "|" value_split => "=" target => "cef_fields" } Here are a few example key-value pairs: mitre1.enterprise.10.techniques.5.techniqueID = T1047 mitre1.enterprise.10.techniques.4.techniqueID = T1021 mitre1.enterprise.9.techniques.3.techniqueID = T1059 user = abc123 These are flattened field names. For example,mitre1.enterprise.10.techniques.5.techniqueID represents a path-like structure and can be interpreted (conceptually) as:mitre1[0].enterprise[10].techniques[5].techniqueID — though I don't need to construct a nested object, just treat the key as a full string.✅ What I’m Looking For:Is there any Logstash-native way to: Dynamically iterate over all key-value pairs in cef_fields? Skip a known field like user (which I can

Cook942New Member

asked in Google Security Operations

Excluding Tags from dashboard query withoutexcluding the linked cases

So I am creating a dashboard that is breaking down events by event types, we are handling event types with tags within SecOps, however tags are also being used in multiple other areas.What I am trying to create is a dashboard showing all cases with some defined tags in a pie chart, but I only want it to display THOSE defined tags, not any other tags that may be attached to the same cases.Excluding those tags in the query also excludes those cases they are attached to which is no useIs there a way for a defined output list in the query that will only show the required tags (This was possible in the legacy Dashboarding but I cannot seem to do it in the new Dashboarding)

AlexScobleNew Member

asked in Google Security Operations

Automatic Case Creation In Specific Environments From Curated Detection Rules

Hi All, I’ve looked high and low in search of a solution here, so hopefully, someone here can help us. We provide access to specific cases and event data based on environments, but I cannot figure out how to have cases created by curated alerts automatically assigned to the correct environment based on feed. If anyone has documentation or can provide guidance on how this can be done, it would be much appreciated. We have ingestion label of Org set up on specific feeds with the org names set as values, but it’s unclear how we use this to have cases automatically created in the correct environments. If feed namespaces are the better method for this, cool, please let us know how we would go about doing that. Solution doesn’t seem to be at the playbook level, since there’s no action to move cases to specific environments based on conditions. Thanks, [removed by moderator]

masaya.gotouBronze 1

asked in Google Security Operations

Seeking Advice: Best Approach for Feed-Level Monitoring & Alerting in Chronicle SecOps

Hello,I’m looking for advice regarding the operation of Chronicle SecOps.Currently, we’re managing multiple Feeds (log ingestion sources) in SecOps, and our goal is to detect issues such as ingestion failures or delays on a per-Feed basis as early as possible and trigger alerts accordingly.At the moment, we haven’t decided on any specific implementation method. We’re considering various approaches, including built-in SecOps or Cloud Monitoring features, API integrations, or other cloud services, but we’re not sure which would be the most effective or practical.If anyone has experience implementing Feed-level ingestion monitoring and alerting in Chronicle SecOps, I’d appreciate your recommendations, tips, or any lessons learned.Thank you!

keiSBronze 3

asked in Google Security Operations

Google Chronicle Connector Auto Updates

Occasionally, we are experiencing an issue where a case is not created even though an alert is detected by a rule.When we contact support about this issue, we are usually told to update the Google Chronicle connector to the latest version. Updating often resolves the issue, but is it possible to create some kind of system that will automatically update when the latest version is released?If automatic updates are difficult, we would like to create a system that will notify us when an update is available.We look forward to your response.Best regards

posted in Google Threat Intelligence

How to Migrate from Mandiant’s to Google Threat Intelligence’s API

The Google Threat Intelligence API differs in several aspects from the Mandiant API. Nevertheless, the Google Threat Intelligence API encompasses all data available in the Mandiant API, in addition to further information.There are field name changes. There are different endpoints. There are new Google TI API Functionalities. Field Name Changes:It is important to note that while Google Threat Intelligence provides all information found in Mandiant API objects (and more), the JSON response objects have different structures. The following list shows the most popular objects and links to their respective documentation, where their JSON structure is defined:Indicators of CompromiseFileAdditionally, files can present a Sandbox analysis report represented by the File Behaviour object.URLDomainIP addressDifferent EndpointsAlthough different endpoints exist, Google Threat Intelligence offers comprehensive information equivalent to Mandiant API objects, and more. We have delineated the most comm

asked in Google Security Operations

Multi Event Rule --Bruteforce_with_4624_and_4625--Rule

meta: author = "XXX XXX" description = "Detects a successful logon immediately following multiple failed logon attempts from the same IP or user, using specific Windows Event IDs." severity = "High" priority="High" mitre = "T1110.001" yara_version = "YL2.0" tactic = "Credential Access" technique = "Brute Force" events: // Event 1: Failed authentication attempts from Windows logs (4625). $fail.metadata.event_type = "LOGIN_FAILED" and $fail.principal.asset.ip = $ip_address and $fail.target.user.userid = $user_id // Event 2: A single successful authentication from the same IP (Windows 4624). $success.metadata.event_type = "LOGIN_SUCCESS" and $success.principal.asset.ip = $ip_address and $success.target.user.userid = $user_id match: $ip_address, $user_id over 5m outcome: $failed_attempts = count($fail) $alert_type = array_distinct("Successful Brute Force Attack via Event IDs 4624/4625") condition: $success and $fail an

NoxurgeNew Member

asked in Google Security Operations

Data conversion - Enum to String

Hello Everyone! I trying to build some widgets in my dashboard, but I’ve some problems with my query. I trying to show severity for my custom rule detections and the curated detections in just one field. My problem resume to can’t use field detection.detection.severity in my if condition, because this field is “enum” data type, and another field is string data type. Query → $dynamic_severity = if(detection.detection.severity = “UNKNOWN_SEVERITY”, detection.detection.outcomes["severity"], detection.detection.severity) detection.detection.outcomes["severity"] → This is severity of my custom rules (string data). Feel free to send me another logics for this query!

acengNew Member

posted in Google Security Operations

Ingestion and handling of CrowdStrike Automated Leads with Google SecOps SOAR

Hey Everyone! We are exploring better ways to work with CrowdStrike Automated Leads within Google SecOps SOAR, and I’m curious how other teams and organizations are approaching these new alerts - both from a grouping and process perspective. Since the Automated leads was released earlier this month, I have heard a fair bit of mixed feedback. Some teams find value, while others feel overwhelmed by the volume or unclear on how to operationalize these alerts effectively (like me). A few things I am curious about are:How is your organization grouping Automated Leads? How are you handling the volume? Are Automated leads being handled differently from your existing process? i.e. If it’s an automated lead alert/detection, escalate it to another team to review and thoroughly evaluate or close based on predefined logic. (I heard a lot of false positives coming from automated leads.) Have you developed any custom logic or playbooks to prioritize/deprioritize Automated leads? Has your organizati

lexrzasa1Bronze 4

asked in Google Threat Intelligence

New Scan Range to Allowlist

For the best results using Mandiant Attack Surface Management,  add the following IP addresses to your allowlists: 34.68.34.64/27 8.34.210.32/27 Visit the documentation for information on the Mandiant ASM scan rages.    

Walker_81Bronze 1

asked in Google Security Operations

Data Tables use for Event and Entity Enrichment

Based on available documentation I created a data table with data about my assets (hosts). I mapped columns to entity.asset.hostname, entity.asset.software.version etc. and I was expecting that this is enough to see this data being used to enrich entities and events. Unfortunately, I’m not seeing any effect neither in entity nor events. I’m running following search to confirm the there is a match between the events and data table (principal.hostname = "my_hostname" and principal.hostname in %my_datatable.Hostname) and I’m getting results, but the enriched data is just not there. I do realize that stitching enrichment takes place once every 24h, but I checked after a few days.User that I have is RBAC based with Chronicle API Admin rights level. What troubleshooting can I do to fix this issue?

ayush_gupta_oakBronze 1

asked in Google Security Operations

Need Help with the Parser grok pattern

# Product: Web Access# Category: Custom - HTTP Access Parser# Last Updated: 08-Sep-2025# Author: Ayush Gupta# Version: 0.1## Fields Mapped to UDM (ACCESS LOGS ONLY)# metadata.event_timestamp ← timestamp (from [01/Sep/2025:07:20:09 +0000])# metadata.event_type ← GENERIC_EVENT# network.application_protocol← HTTP# principal.ip ← client_ip# principal.platform ← user_agent (client device info)# intermediary.hostname ← observer_id (web server instance)# target.hostname ← vhost# target.url ← http://{vhost}{request_path}# network.http.method ← http_method# network.http.response_code ← status# network.http.user_agent ← user_agent# network.http.referral_url ← referrer (when present)filter { # Initialize working variables mutate { replace => { "observer_id" => "" "client_ip" => "" "vhost" => "" "ident" => "" "ts" => "" "http_m

ylandovskyyStaff

posted in Google Security Operations

How to use new Data Tables Actions in Google Chronicle Response Integration - Full Guide

Hey folks! In Q3, it was announced that Data Tables are now officially GA and alongside of it, Google Chronicle integration was updated with new actions that allow you to interact with them. In this guide, I will go through all relevant actions and explain how they work. If you are not familiar with Data Tables, please check this documentation. ❗❗Important Note: Data Table actions are only supported for Chronicle API. Backstory API doesn’t support it. To change the integration to work with Chronicle API, you need to adjust the API Root in the integration configuration. Keep in mind that this will affect the whole integration and some action outputs are slightly different, if executed with Chronicle API.❗❗ Initial StateTo make it easier to follow the guide, I am going to create an initial state of a Data Table, which will be used as a reference across the guide: Get Data Tables ActionThe purpose of this action is to allow you to fetch information about available Data Tables (including

Rached1996Silver 2

asked in Google Security Operations

dashboard based on data table / filter question

i have a question if you can help me i have a dashboard : contains 3 columns 1: ip , cidr 2: region , string3: country : string i have put in my query principal.ip in %datatable.cidr and i want to add a condition where i filter on the ips related to a specific country and get that as outpout ( the principal ip in india country only for example ) but i was not able to do that can you help please ?

Ravi0410New Member

asked in Google Security Operations

SLA Configuration

Hi Everyone,I’m working on setting up SLA rules in Chronicle SOAR for cases, and I’ve run into some challenges that I’d like to get your input on. Here’s the scenario:Requirements: First response SLA: Starts when a case is created and stops when the case is assigned or moves out of the Triage stage and period 1 hours. Update SLA: Starts after the case moves out of Triage and resets whenever there’s an update in the case wall and duration is specific to Severity. Stops when the case is closed. The challenge is chronicle doesn’t appear to have a direct SLA reset mechanism to restart timers whenever there’s a casewall update. using the "Get Case Communications" Siemplify Action Module be a viable workaround to detect updates and restart SLA timers dynamically? Has anyone successfully implemented something similar? Timer Start for SLA: The response SLA starts when the case is created, but the Update SLA needs to start when the case exits the Triage stage. How can I configure these sep

Aphex2inBronze 1

asked in Google Security Operations

Issues with re.capture in Google SecOps Dashboards

Anyone is having issues with re.capture function in dashboards? No matter how I tried to write it I get this error:FailureAn error occurred while executing Chart query. generic::unknown if anyone got an example of how they utilized re.capture in their dashboard query I would really appreciate it!

ericv-avaNew Member

asked in Google Security Operations

Setting up and using SQS v2 via Federated IDs to ingest logs to GSecOps

I’m aware there is a new Feature: SQS V2 to ingest logs to Google SecOps using Federated ID as stated in this update.https://cloud.google.com/chronicle/docs/release-notes#May_26_2025 At the moment I’m using SQS and static keys and I’m interested in moving over to Federated IDs. However, I can’t seem to figure out how STS play a role here. Current documentation assumes STS its already present. Do I need to set STS before I can migrate over? if so how can I set up to ingest into my current Google SecOps instance. I’ve opened a support ticket, look for docs to help me get this going. Seems support its lost and so I’m. I can’t find clear docs on this.Has anyone use STS + SQSv2 yet? and or also looking into this? Thanks in advance for any pointers in the right direction.

satya1337New Member

asked in Google Security Operations

pyhton function for creating dasboards

Hi exploring options for creating dashboards using APIs. i found a repository of python functions which helps to create detections rules and can perform may other things in similay way i am searing for dashboards.here is the repository i am refering: https://github.com/chronicle/api-samples-python

BergesNew Member

asked in Google Security Operations

Ingesting 3rd Party Threat Intel feeds

Guys i want to fetch 3rd party threat intel data in my google secops and make its list which will get updating every 24 hour.can any 1 guide.

1
2
3
4
...
106

Page 1 / 106

Badge winners

Cook942has earned the badge Authored Posts 1
bsalvatorehas earned the badge Comments Posted 25
masaya.gotouhas earned the badge Comments Posted 1
keiShas earned the badge Comments Posted 5
Noxurgehas earned the badge Authored Posts 1

Show all badges

Powered by Gainsight

Terms & Conditions Cookie settings

Sign up

Already have an account? Login

Login with SSO

or

Username *

E-mail address *

First Name

Last Name

Company

Job Title

Product of Interest

SecOps Google Threat Intelligence Security Command Center reCAPTCHA Other

Country

Password *

I accept the terms of use

loginBox.register.email_repeat

Login to the community

No account yet? Create an account

Login with SSO

or

Username or Email

Password

Remember me

Forgot password?

Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.

Enter your e-mail address

Back to overview

Scanning file for viruses.

Sorry, we're still checking this file's contents to make sure it's safe to download. Please try again in a few minutes.

OK

This file cannot be downloaded

Sorry, our virus scanner detected that this file isn't safe to download.

OK

Privacy Policy Terms of Service Gen AI Policy Community Guidelines Cookie Settings

© 2025 Google. All rights reserved.