Security Forums

Hey Google Cloud Community -- appreciate any help your able to provide in advance here. Put simply -- I’d like to create a stats search that identifies when an account has not logged in for over 30 days. I’d like to use the metadata.product_event_type = 4624 (windows successful logon) field and basically show how long ago each target.user.userid generates a 4624 event - then filter on traffic that is over 30 days old. I have tried a few stats searches unsuccessfully. I realize there is also a preconfigured dashboard that shows Dormant Accounts but the output it is producing is not accurate. Thanks

Hi folks,I’m trying to create and update an integration via the API. Creating the integration works fine, but after reviewing the Swagger documentation, I don’t see an endpoint for updating it.The creation call (external/v1/integrations/CreateIntegrationInstance) works smoothly, but I’m unable to configure or modify the integration after it has been created.Could anyone point me to the correct endpoint or let me know if updates are supported? Any guidance would be appreciated.

HiiI have a requirement to check for the users that haven't logged in using a VPN.The SIEM has logs for the users that have logged in using a VPN, but is there a way to use these logs and check for the users that havent used the VPN to login during the past 30 days? The requirement is to just get a list of these users?

Hi Team,We would like to seek clarification regarding the implementation of reCAPTCHA v2.We implemented reCAPTCHA v2 a few years ago and would like to confirm whether server-side validation was mandatory at that time. Based on the documentation available then, it does not explicitly state that Step 3 (server-side verification) was mandatory. We are referring to the documentation linked below.reCAPTCHA v2  |  Google for DevelopersPlease note that this clarification is specifically for our old implementation carried out in 2020. Kindly provide your response considering the documentation and circumstances that were applicable during that period, rather than the current implementation guidelines.

Hi Team,In our environment, we are using the Bindplane agent to forward logs to the SecOps console.The Bindplane agent is installed on each server and forwards logs to the Gateway, from where they are sent to the SecOps console.We are currently trying to decide which parser should be used for Windows event logs—WINEVTLOG or WINEVTLOG_XML.Could someone please help us understand: How to determine which log_type should be specified in the Bindplane processor configuration? The key differences between WINEVTLOG and WINEVTLOG_XML The pros and cons of using each parser, and recommended use cases I’m new to SecOps and have done some initial research, but I couldn’t find clear documentation or articles explaining this in detail. Any guidance or best

Hi Everyone,Happy New Year 2026! 🎉I am new to Google SecOps and have a few questions regarding log ingestion via Bindplane, specifically around Google Secops standardization and log visibility.In our environment, we have Bindplane Gateways that collect logs from multiple Bindplane agents and forward the data to Google SecOps. While forwarding the logs, we apply the SecOps Standardization processor so that SecOps can assign a log type (metadata.log_type) and perform UDM field mapping using the appropriate parser.I am looking for clarification on the following scenarios: SecOps Standardization processor not appliedAre the logs still ingested and searchable in Google SecOps? If searchable, what value is assigned to metadata.log_type in the SecOps console ? Does this scenario only impact UDM parsing and detections, or can it affect ingestion itself?SecOps Sta

Hey guys, do any of you know of a way to efficiently identify which log sources you need ingested in order for the curated detections or even custom rules to work as intended? Google secops currently doesn’t tell you which logs are needed and/or missing for a rule to be accurate.

Hello Community,I successfully calculated average ingestion time using a SIEM search by comparing metadata.ingested_timestamp and metadata.event_timestamp, and aggregation functions like avg(), min(), and max() worked as expected. metadata.ingested_timestamp.seconds > metadata.event_timestamp.seconds //excluding logs that have not Time in UTCmetadata.log_type = "OFFICE_365" $Timestamps = timestamp.get_timestamp(metadata.event_timestamp.seconds, "DATE")match: $Timestamps,metadata.log_type, metadata.event_type, principal.namespace // we can add or remove fields here to make it more specific or broadoutcome: $eventsCount = count(metadata.id) $avg_delay_minutes = avg((metadata.ingested_timestamp.seconds - metadata.event_timestamp.seconds) / 60) $max_delay_minutes = max((metadata.ingested_timestamp.seconds - metadata.event_timestamp.seconds) / 60) $min_dela

Hi all, I have one V2 Tickbox for years. It got automatically migrated towards the end of 2025, and I finally got around to having a closer look at the Google Cloud environment, which is completely new for me. Everything looks OK when accessed from the legacy google.com/recaptcha/admin reCAPTCHA administration. Also, the reCAPTCHA technically works, but I am not sure for how long. I have already enabled the free $300 testing period in Google Cloud and inserted the Credit Card details into the Google Cloud billing. But I am getting the following error when looking at Google Cloud → Security → reCAPTCHA administration page.The overview of Keys lists my key with a “Status” displayed as a dark grey/black circle followed by “Unknown” Once I open the detail at the “Overview” page, in the top right column, there is the dark circle with “Unknown” repeated and the below reads: “Something went wrong Unable to determine the status of

Hi,I’m trying to create an alert based on multiple alerts from the same source, my goal here is to raise an alert when more than 2 different alerts from the same source were triggered, and from there if i have two alerts with low severity maybe raise one with medium severity and if i have two medium rise one high an so on.So far I have this alert:rule Multiple_events_same_source { meta: author = "" description = "this rule " severity = "High" events: $e.detection.collection_elements.references.event.principal.hostname != "" $e.detection.collection_elements.references.event.principal.hostname = $SourceHost NOT $e.detection.detection.rule_name IN %WHITELIST_MULTIPLE_EVENTS_RULE match: $SourceHost over 1h outcome: $risk_score = 0 condition: #e > 2 }  But what i want to achieve

Is there a way I can continuously export the SOAR case data used in dashboards to BigQuery?

Hello,below is my scenario:for the logs that are sent to google secops, there is already a pre-built parser available, but it does not parse the logs.when i check, grok pattern to match the syslog header of logs is not available in the parser code.i have created the grok pattern and i can see that all the other fields are parsed to udm field correctly. now, my question: is it possible to create a parser extension to match only the syslog header and leave everything else as optional ?if the above is possible, i tried no-code option → i put my grok pattern in syslog box and target field, it is validated sucessfully. but when i tried to preview udm, it does not give me the output, the logs are still droped due to the pattern that are available in pre-built parser. can you please help me with this ? Thanks,

🔥 Thrilled to announce two opportunities to join our comprehensive deep-dive training, developed by the FLARE Team at Google Cloud Security. This course moves beyond the basics, equipping you with the practical, hands-on tradecraft needed to dissect today's most sophisticated Windows malware. Whether you prefer the convenience of virtual learning or the intensity of an in-person event, we have a session for you!What You Will Learn:Time Travel Debugging (TTD) →  Leverage this powerful tool to trace and query execution for efficient behavioral analysis. EDR Evasion Bypass → Defeat advanced anti-analysis tricks and uncover techniques like process injection and indirect syscalls used to bypass modern EDR systems. Complex Binary Analysis → Reverse complex C++ and .NET (C#) malware with confidence  Windows Internals → Gain low-level knowledge necessary to understand how

HiAm trying to use the FortiSIEM connector+integration but get the below error when using the test button.Username: adminVerify SSL: False----------------- Main - Started -----------------General error performing action Fortinet FortiSIEM - PingAn error occurred: 401 Client Error: Not authorized for url: https://[redacted]/phoenix/rest/deviceInfo/monitoredDevices b'GlassFish">http://www.w3.org/1999/xhtml">GlassFish Server Open Source Edition 5.1.0 - Error report

Hi everyone,I’m new to Google SecOps and currently working with the Enterprise edition. I’d like to understand how I can get the most benefit from the platform’s threat intelligence capabilities.I’m aware that I can use VirusTotal Context in my use cases for enrichment and detection, but I’m curious about how I can leverage Mandiant intelligence in a similar way. I can see Mandiant alerts and IOCs in the interface, but I’m not entirely sure how to make the best use of that data for proactive threat hunting, detection rule development.Could anyone share best practices or examples of how they’re using Mandiant within Google SecOps Enterprise? Any tips or guidance for someone new to SecOps would be greatly appreciated.Thanks in advance!

Hi community,I am working on YARA-L detection rules in Google Chronicle to identify suspicious self-equality assignments (tautologies) in SQL logs. These patterns, like "1=1" or "test=test", are often used in SQL injection attempts to bypass filters or force true evaluations.Goal: Detect patterns where the left side of "=" exactly matches the right side, such as:test=test1=1time=timestatus = statusflag=flagadmin=adminbypass=bypassenabled=enabledid=idversion=versionBut not detect mismatches like:1=2a=B(and similar non-tautologies)Challenges in Chronicle:I Tried regex ->([A-Za-z0-9'-]+)\s*=\s*\1were i used /1 #BackReference, but unfortunately backreference is not supported in YARAL,so using re.regex to directly check for equal values on both sides of "=".Then i used were grouping issue => The Chr

is it possible today (or upcoming feature request) to add a static timestamp as the starting time of a YARA-L dashboard query and have it ending dynamically at current date/time?  use cases --any data from year to date, ingestion from start of contract period to present etc.

I tried using the zip_integration_by_version to zip my package and test it before pushing the changes but it gives the below error - ValueError: No commit found for integration doppel_vision at version 1.0 in branch origin/develop2025-12-12 14:45:17,484 - INFO - Restoring Git environment...2025-12-12 14:45:17,536 - INFO - Successfully restored to branch: doppel-auth-update also the repository has a different structure than zip file I was using initially to test the integration. for ex - the zip file has a Integration-<package-name>.def file and the content-hub repository doesnt. Can anyone guide me to zip my integration so I can test it and push my changes to content-hub repository? Thank you in advance.

I have a warning on my account that I can't remove. I didn't use the service and I want to contest the payment.   Pré-pagamento pendente.Google Cloud 01C130-FE3231-967E6A: Pré-pagamento pendente: o serviço requer um pré-pagamento único de pelo menos R$ 200,00 para ser ativado. Se você já tiver feito isso, o pagamento será creditado na sua conta em breve.

Hello everyone,I am currently facing a challenge where I need to perform data matching based on a specific field. However, this field contains enriched values that lead to incorrect matches. I want to ensure that my matches are based solely on the original values in this field, without considering the enriched information.Is there a way to configure my detection logic to exclude these enriched values? Any guidance, instructions, or best practices on how to achieve this would be greatly appreciated.

I have a warning on my account that I can't remove. I didn't use the service and I want to contest the payment.   Pré-pagamento pendente.Google Cloud 01C130-FE3231-967E6A: Pré-pagamento pendente: o serviço requer um pré-pagamento único de pelo menos R$ 200,00 para ser ativado. Se você já tiver feito isso, o pagamento será creditado na sua conta em breve.

Hi all, I am writing phishing investigation playbook, I want to validate SPF, DKIM, and DMARC status for the sender domain on Google SecOps SOAR playbook. Is there any integration which supports this action? Thanks!

Hello team, do you have any guidance on developing a risk analytics rule that identifies when an entity exhibits a sudden spike in risk score? In the rule below, I can generate an alert when an entity’s risk score on the Risk Analytics dashboard exceeds a defined threshold. However, I’m more interested in detecting a sudden spike in the entity’s risk score rather than relying on a static benchmark.i have two use cases one is to alert when any user’s risk score in analytic dashboard crosses a benchmark and the other one to detect on sudden spikeAlso, for Risk Analytics, I could not find a UDM field that represents a normalized risk score. I only see the raw risk_score and the delta_risk_score fields.Which of these fields would be the most appropriate to use for t

Hello everyone, I’m trying  to add Custom Tags to Defender Unified Portal Alerts. Prior to the migration I was able to do this with the Sentinel Connector after the SIEM Migration into Defender the only action I can find is “Update Alert” from the GraphApi Integration.Is the Update Alert Action working on Incidents or Alerts?As far as I can see only on Incidents you can update Tags ->Update incident - Microsoft Graph v1.0 | Microsoft Learnnot on Alerts. When trying to update an Incident I get this:The Incident does exist: 

Hi All,Would like to know if there is a possibility to monitor the changes made to a reference list such as adding / deleting a value from the reference list? As we have for changes made to rules from GCP console. Thanks!