Skip to main content

User Groups
Events

Home
Community
Security Forums

Security Forums

Welcome to the Google Cloud Security Forums! Your ultimate security conversation spot. Collaborate with peers and experts to solve challenges, together.

2640 Topics

cmerchantBronze 1

asked in Google Security Operations

Account for Yara Empty Arrays

Is there a way to account for null/zero values that show up when you run a match window? For example this query - ingestion.log_type != ""$log_type = ingestion.log_typematch:$log_typeoutcome:$event_count = sum(ingestion.event_count)$event_type_count = count_distinct(ingestion.event_type)$event_types = array_distinct(ingestion.event_type)order:$event_count desc Gives results back like the followinglog_type - Testevent_count - 4event_type_count = 3event_types - USER,,EDRas you can see it accounted for the zero value but I do not want it to account for the empty value in that count for event_type_count

cmerchantBronze 1

asked in Google Security Operations

Account for Yara-L Empty Arrays

Is there a way to account for null/zero values that show up when you run a match window? For example this query - ingestion.log_type != ""$log_type = ingestion.log_typematch:$log_typeoutcome:$event_count = sum(ingestion.event_count)$event_type_count = count_distinct(ingestion.event_type)$event_types = array_distinct(ingestion.event_type)order:$event_count desc Gives results back like the followinglog_type - Testevent_count - 4event_type_count = 3event_types - USER,,EDRas you can see it accounted for the zero value but I do not want it to account for the empty value in that count for event_type_count

asked in Google Security Operations

YARA-L rule exclusion based on multiple data table columns with REGEX

I see this was already asked here, but the "solution" is strange and counters the whole purpose of having actual tables with columns. If I need to do a concat of all my columns into a SINGLE column for comparison, aka, a single dimension, aka exactly how it worked with reference lists, then this is useless! This exact same behaviour was possible with reference lists as you could have a line like `john@example.com_1.1.1.1` and do a concat on the UDM fields in the rule to compare them against the value from the reference list! My use case: I have a data table `common_behaviour` that is populated according to a business logic. That table contains the following columns:user: STRINGroute: STRINGmethod: STRINGisp_name: REGEXisp_country: REGEXuser_agent: REGEX Note that some columns are REGEX, not string. I need them to be REGEX to handle high-volume repeated requests and to also handle some internal business logic in the rule that updates that data table.For example: if `isp_name` is "My Spe

Greg_BammelNew Member

posted in Google Security Operations

Does anyone have a solution to easily run integrations in Pycharm or a debugger not within SOAR?

Does anyone have a wrapper or code sample to easily run integrations in Pycharm or a debugger not within SOAR? It's brutal building in the IDE.

ongsoai1991New Member

asked in Google Security Operations

huóng dẫn cụ thể giám xác ip khách hàng tiềm năng bằng thời gian thực

giám sát jp khách hàng tiềm năng bằng thời gian thực

mikelmi01New Member

asked in Google Security Operations

Create events in alert with webhook

Hey everyone!I am trying to create an alert using a webhook. This is the json sample I used for my webhook:{ "name": "Alert test", "environment": "EnviName", "rule_generator": "Test rule", "alert_identifier": "Alert-Test-1", "priority": 10, "display_id": "[Case.Id]", "start_time": "2025-08-14T14:00:00Z", "end_time": "2025-08-14T14:00:00Z", "device_product": "RULE", "events": [ { "name": "Event_No_Name1", "type": "Event_No_Type1", "severity": 1, "source": "Origin", "device_product": "RULE" }, { "name": "Event_No_Name2", "type": "Event_No_Type2", "severity": 1, "source": "Origin", "device_product": "RULE" } ], "custom_fields": { "detected_from": "Perseus", "source_case": "[Case.Id]", "playbook_origin": "Create Cortex Alert", "extracted_domains": "[Entity.Identifier]" }}In the Data Mapping, for EventName I wrote in the Expression builder "events.name". As you can see here:However, what this does is giving me as a result a list of all the events’ names, like

zwerdNew Member

posted in Google Security Operations

Integration Salesforce with Google SecOps

We are trying to make new FEED on google SecOps in order to make an API call to get Salesforce logs. We set all fields on Google SecOps FEED that include the following:API HOSTNAME: https://xxxxxxx.lightning.force.com/ TYPE:OAuth password grantOAUTH TOKEN ENDPOINT: https://xxxxxxx.my.salesforce.com/services/oauth2/tokenSalesforceConsumerKey(OATH CLIENT ID):3MVG9XXXXXXXXXXXSalesforceConsumerSecret(OAUTH CLIENT SECRET):1286XXXXXXXXXXXXXXXXXXXXSalesforceUser(USERNAME):someuser@somedomain.comSalesforceConsumerSecret(PASSWORD):somePassw0r5After activating the FEED we have got this following error:Error: REMOTE_SERVER_REPORTED_BAD_REQUESTA connection to the source was established, but the source rejected the request.Does anyone know this error and can help us with it? I am sure that I am not the first one who's trying to get salesforce events log on the Google SecOps SIEM.Regards 

LazyBeanNew Member

posted in Google Security Operations

How to Separate Timeout and Decline Flows in Approval Links?

Hi,I have a use case where an IP address is blocked based on the button clicked by the end user in an approval link. If the user declines, the playbook ends.However, I also need to add a timeout that sends a follow-up email to the user. The problem is that both "decline" and "timeout" currently behave the same way in my flow.Is there a way to separate these two flows so that the timeout triggers a different path from the decline?I've attached an image of my current setup for better understanding. Any guidance would be appreciated! 

JMon38New Member

posted in Google Security Operations

Office 365 Raw Logs does not contain Recipient

Hello, I've been noticing email raw logs from Office 365 does not contain the recipient email address or user name. How to resolved this issue or are there configurations needs to be fixed?

KWinpennyNew Member

asked in reCAPTCHA

reCAPTCHA seems to be causing issues and blocks on our system for unknown reason

Timeframe:Since 09:00 on 28/08/2025 (GMT) we have been getting errors which seem to be related to google reCAPTCHACall is made to:https://www.google.com/recaptcha/api2/clr?k=6LeeZmsfAAAAAK-SB2w-6_XpkLha7vsRLlRvH8e1 Issue:Because of the errors it is blocking our endpoints from being successful. This call is being made immediately after an internal server call that we make, example below Question:Can we see / do we know of anything within Google reCAPTCHA which could be causing this / anything which we can do or be pointed into the direction of being able to find out more information on this.

Kohei1117New Member

asked in Google Security Operations

How to quickly detect bugs that don't create cases

Previously, we experienced an issue where cases were not created due to a bug in Google secops.This was resolved by updating the connector to the latest version.We are currently considering preventative measures and solutions for this issue.For example, is it technically possible to use a playbook or something to issue an alert when an issue occurs where a case is not created? If the above is not possible, we would appreciate it if you could share any ideas you have for checking the latest update announcements as a preventative measure, or for quickly noticing bugs like this one.

ArunthavarajNew Member

asked in Google Security Operations

YARA-L rule error: "validating intermediate representation: event variables are not all joined by equalities"

Hello,I’m trying to create a rule that detects alerts from Check Point firewall, but excludes alerts related to authorized pentest activities.For this, I created a data table named authorized_scanners with the following columns: activity_name source_ip destination_ip start_date end_date I want the rule to reference this table, but I’m running into the following error:"validating intermediate representation: event variables are not all joined by equalities, the joined groups are: (authorized_scanners), (e)" Could someone help me resolve this? Here is my rule rule checkpoint_fw_medium_alert{ meta: ... priority = "Medium" events: $e.metadata.vendor_name = "CheckPoint" nocase $e.security_result.severity > "MEDIUM" $alert_name = $e.security_result.description $targeted_host = $e.target.ip $attacker_host = $e.principal.ip $date = timestamp.get_date($e.metadata.event_timestamp.seconds) //Exclude authorized activities and

Rob_PStaff

posted in Google Threat Intelligence

How to Better Identify Typo-squatting Domains

Hi Everyone! My name is Robert Parker and I'm a Technical Solutions Consultant with Google Cloud Customer Success. I work with our customers in deploying and integrating Google Cloud Solutions, including Google Threat Intelligence. Within Google Threat Intelligence, we have a module known as Digital Threat Monitoring, which helps users to protect their organization against activity in the Darknet. One of its capabilities, is Domain Protection Monitoring, which helps you to identify when threat actors are registering look-alike, or similar domains to your own organizations. This is often a trick used in phishing campaigns, where threat actors try to trick their victims into visiting a spoofed (fake) copy-cat version of the trusted organization’s website. While DTM is great at identifying potential matches, or ones that do look similar your own domain, it’s not always immediately clear why it returned some of the results. I often see this when a customer asks me “Why did this domain

ylandovskyyStaff

posted in Google Security Operations

[Important] Google Chronicle Response Integration now supports aggregated queries!

Hey folks, In version 64 of Google Chronicle Response Integration, we updated the “Execute UDM Query” action to support Aggregated Queries and YL2 functions. ❗❗Important Note: Aggregated Queries are only supported for Chronicle API. Backstory API doesn’t support it. To change the integration to work with Chronicle API, you need to adjust the API Root in the integration configuration. Keep in mind that this will affect the whole integration and some action outputs are slightly different, if executed with Chronicle API.❗❗ Example 1. Basic Matchingprincipal.hostname = "siemplify"match: target.file.vhash UI JSON Result{ "events": [ { "target.file.vhash": { "values": [ { "stringVal": "d6e1387847bdaafd8a024f52a74ace7a" } ] } }, { "target.file.vhash": { "values": [ { "stringVal": "673961a71ba82e0556ef95cb2147e212" } ] } } ]}Widget Example 2. Using Functions and Variables principal.hostname = "siemplify"match: target.file.vhashoutcome: $avg_seconds = avg(metadata.event_timestamp.seconds) UI J

schirokyNew Member

posted in reCAPTCHA

How to remove classic keys?

On reCAPTCHA I do see two domains that I once used, but they are not valid/available anymore; they do not use reCAPTCHA anymore. How to delete those entries from the reCAPTCHA portal?

Z7-MattNew Member

asked in reCAPTCHA

Automatic migration of reCAPTCHA keys into a project where?

We have a number of clients who have access to their reCAPTCHA keys currently via the console. We usually create the keys, then invite the client as an owner of the site. Other clients may even have multiple owners in their organisation. Presumably anyone with access to a reCAPTCHA key will be getting emails about keys for migration.If no action is taken and the keys are migrated automatically, where will the GCP project be created and who will have access to the new project? If there is a single owner, how is the owner determined as reCAPTCHA’s existing admin console doesn’t seem to provide a way of determining who the person who originally created the key is?

okkesStaff

posted in Google Security Operations

Using Pub/Sub to ingest logs to Secops from Cloud Logging

The logs on Cloud Logging can be ingested directly to Google Secops using export filters. You set a sink filter (e.g., logName:"syslog" AND textPayload:("auth failed")) and Secops only receives logs matching that. Although export filters are pretty straightforward and powerful, they have some limitations:Filters are static – you can only control inclusion/exclusion at the time of sink creation. You can’t easily enrich, transform, or route logs differently once they leave Cloud Logging. Scaling is limited – a single sink can push to Secops but lacks intermediate processing. An alternative way to ingest logs from Cloud Logging is to use Pub/Sub. A Pub/Sub topic is a named resource in Google Cloud Pub/Sub that acts as a channel for sending messages from publishers to subscribers.Publishers send (or "publish") messages to a topic. Subscribers subscribe to that topic and receive those messages.The topic itself doesn’t store the messages permanently—it just serves as the communication point

d_patel_djBronze 1

asked in Google Security Operations

Accessing a specific key within UDM Result

Hello, I need help accessing the value from a specific key within the returned results of a UDM query via a playbook. I am looking to use the value from the key “isManaged” within a condition. For example: if isManaged == “True” take branch 1 else, take branch 2 I am struggling to isolate the specific value from that key to use within a conditional action. Here is an example JSON which is returned from the UDM Query within the playbook: { "events": [ { "name": "[REDACTED_EVENT_NAME]", "udm": { "metadata": { "productLogId": "[REDACTED_PRODUCT_LOG_ID]", "eventTimestamp": "2025-08-21T14:43:04Z", "eventType": "USER_LOGIN", "vendorName": "Microsoft", "productName": "Azure AD", "ingestedTimestamp": "2025-08-21T14:49:01.321370Z", "id": "[REDACTED_METADATA_ID]", "enrichmentState": "ENRICHED", "logType": "AZURE_AD", "baseLabels": { "logTypes": ["AZURE_AD"], "allowScopedAccess": true }, "enrichmentLabels": { "logTypes": ["AZURE_AD_CONTEXT", "CS_EDR"], "allowScopedAccess": true } }, "additional":

zkirilovNew Member

asked in reCAPTCHA

reCaptcha problem with instagram

Hi guys,this morning I tried to open my instagram app but there was a recaptcha verification Everythime when I try to do it it says Captcha solution is not correct I tried different browsers like google chrome firefox opera I tried also logging from other devices(I can login but can't complete reCAPTCHA)And I can't write to instagram support because I can't even see my homepage in instagram so I can start conversationPlease someone help me

Sarthakd25New Member

asked in Google Security Operations

Handling CEF Logs With and Without Key-Value Pairs

Hi all,I'm currently working on a custom Chronicle parser using Logstash to handle logs in CEF format. I have already built and tested a parser for CEF logs that include key-value pairs these work correctly and generate UDM events as expected.While parsing these non-KV logs, no UDM events or entities are generated in Chronicle is what I am getting.Format 1 which is paring: <priority>CEF:0|vendor|product|version|signature|name|severity|key1=value1|key2=value2|…Format 2 which is not generating UDM event and not parsing<priority>CEF:0|vendor|product|user|user_full_name|category|action|description|statusand for the format 2 I am getting "No UDM events or entities were generated for the current parser configuration. If this is not intended, rectify the code snippet/UDM mappings and then click preview.”filter { grok { match => { "message" => [ "CEF:(?P<header_version>[^|]+)\\|(?P<device_vendor>[^\\|]+)\\|(?P<device_product>[^\

shashank_bindulbaviNew Member

asked in Google Security Operations

Unable to parse Forcepoint WebProxy Logs

Forcepoint WebProxy logs goes into the S3 bucket(Format: export_timestamp.csv.gz) from where Google Chronicle pulls it in and within Chronicle>Settings>Feeds we have give the path to the S3 bucket.I am able to see the raw logs within SIEM but it isn't getting parsed. I click on the Raw log>Manage Parser>Create New Custom Parser>Start with Exisiting Prebuilt Parser>I am using the Forcepoint Web Proxy Parser. Error: generic::unknown: invalid event 0: LOG_PARSING_GENERATED_INVALID_EVENT: "generic::invalid_argument: *events_go_proto.Event_Webproxy: invalid target device: device is empty" The raw log doesn't have quotes. When I directly give a single row input after manually downloading the S3 log file which consists of double quotes, the issue gets fixed. When I view the raw log as CSV in the parser I get additional coulmns, reason is one user can be part of multiple groups. This is the main reason for the error! The column count should remain same. Example:Category:

Akshay31New Member

posted in Google Security Operations

Gemini Summary in Playbook to integrate with Slack

Hello,I want to send SecOps case alert to Slack, for this I have integrated slack channel with SecOps. But as per requirements main ask is to send Gemini summary of the case along with slack notification using playbook at runtime. But Gemini summary taking some time to generate, so I can't send it at runtime.Is there any way to send Gemini summary at runtime to slack using playbook, immediately after creation of case in SecOps.Thank you.

smit8Bronze 1

asked in Google Security Operations

I have a multi-choice question in a playbook that I need to change to a condition. Is there a way for me to replace the flow without having to delete the existing one and only retaining a single branch?

Rached1996Silver 2

asked in Google Security Operations

Dashboard Query Question - Data table

Hi everyone,I have a data table with two columns: destination_ip and location. The destination IP column contains values in CIDR format. The location column contains strings (e.g., country names). I want to run a search/query where I filter results for location to a specific country (e.g., Italy) from the query directly.What’s the best way to fetch the string value (location) from the data table based on the IP, so I can filter traffic for a country?Thanks in advance for your help!

Kohei1117New Member

asked in Google Security Operations

The "ingestion.log_volume" in the Ingestion metrics is displayed as empty.

To investigate the log ingestion volume by feed ID, I created the following dashboard query:----------ingestion.log_type = "CISCO_MERAKI"$Feed_id = ingestion.feed_id$Date = timestamp.get_date(ingestion.end_time)match: $Feed_idoutcome: $Volume = math.round(sum(ingestion.log_volume) / (1000), 2)order: $Volume desc----------However, in addition to the feed IDs, there is a graph entry labeled as "empty."I would like to understand the reason why this "empty" entry is appearing.I will attach a screenshot of the graph.

1
2
3
4
5
6
...
106

Page 3 / 106

Badge winners

spanugantihas earned the badge Comments Posted 5
Cook942has earned the badge Authored Posts 1
bsalvatorehas earned the badge Comments Posted 25
masaya.gotouhas earned the badge Comments Posted 1
keiShas earned the badge Comments Posted 5

Show all badges

Powered by Gainsight

Terms & Conditions Cookie settings

Sign up

Already have an account? Login

Login with SSO

or

Username *

E-mail address *

First Name

Last Name

Company

Job Title

Product of Interest

SecOps Google Threat Intelligence Security Command Center reCAPTCHA Other

Country

Password *

I accept the terms of use

loginBox.register.email_repeat

Login to the community

No account yet? Create an account

Login with SSO

or

Username or Email

Password

Remember me

Forgot password?

Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.

Enter your e-mail address

Back to overview

Scanning file for viruses.

Sorry, we're still checking this file's contents to make sure it's safe to download. Please try again in a few minutes.

OK

This file cannot be downloaded

Sorry, our virus scanner detected that this file isn't safe to download.

OK

Privacy Policy Terms of Service Gen AI Policy Community Guidelines Cookie Settings

© 2025 Google. All rights reserved.