Security Forums

Hi Security & SecOps Community,​As organizations rush to deploy Agentic AI, CISO’s and Security Architects face a new dilemma. Standard security tools (Firewalls, IAM) protect the perimeter, and standard MLOps tools protect the performance.​But who protects the Integrity?​With the enforcement of the EU AI Act and ISO 42001, we need a new layer of defense. An AI Agent that performs technically well but violates regulatory boundaries is not an asset; it is a liability.​Today, on behalf of CreativeMindSolutions (Research), I am sharing the high-level methodology of our Compliance Auditor. This is a novel, zero-storage framework built on Google Cloud (Vertex AI) designed to enforce "Artificial Wisdom"—a verifiable state of operational integrity.​1. The Core Innovation: Artificial Wisdom (AW) as a Security Layer​In our research, we moved beyond the philosophical definition of wisdom. We define Artificial Wisdom (AW) as a technical Integrity S

Hi Team, I’m reaching out regarding an issue with our Nozomi Guardian integration in Google SecOps. Even though the connection shows as successful in the Nozomi Console, we are not seeing any logs being ingested into Chronicle, even under UDM log type. We have given URI as “https://malachiteingestion-pa.googleapis.com” and Customer ID. We downloaded the service account from collection agents console and the connections shows successful in Nozomi console but logs are not getting into Google SecOps. Please let us know if anyone able to find what the issue is here. This is the documentation we followed: https://technicaldocs.nozominetworks.com/products/n2os/topics/administration/settings/data-integration/c_n2os_admin_settings_data-integration_google-chronicle-2.html Thanks in advance! 

Hello everyone,  hope you're all having a great day!I tried searching on documentations and in this forum for this specific message but had no success.I'm currently working in the following detection (Parameters were made generic for sharing purposes). The objective of this rule is to detect any occurrence of Event2 for which, in a 24 hours span previous to it's timestamp, there's no Event1 with a mutually shared eventcasenumber value; events:$e1.metadata.log_type = "logsource"$e1.metadata.product_event_type = "event1"$e1.metadata.product_event_type = $event1 $e2.metadata.log_type = "logsource"$e2.metadata.product_event_type = "event2"$e2.metadata.product_event_type = $event1 $e1.additional.fields["eventcasenumber"] = $e2.additional.fields["eventcasenumber"] match:$event2 over 24h after $event1 

We are raising this concern to the Google Cloud Security / reCAPTCHA community to understand whether the behavior we are observing is expected and to seek guidance on best practices.After deploying reCAPTCHA v3 to our UAT environment, we are consistently receiving lower scores compared to our QA environment, even though the same reCAPTCHA site key and secret key are used in both environments. The QA setup runs on a single server, whereas the UAT environment is deployed across multiple servers with different IP addresses.From an application perspective, the reCAPTCHA integration is functioning correctly in both environments. However, the score variation is impacting our ability to apply a consistent validation threshold.We would like to understand: Is it expected behavior for reCAPTCHA v3 scores to differ between a single-server setup and a multi-server setup with multiple IP addresses, even when using the same keys? Does reCAPTCH

I am facing a few issues while performing event enrichment using entities.One of the issues is related to partial data availability in the Overview tab. When I search for an entity in Google SecOps SIEM search and select any row in the Results section, a panel opens on the right-hand side displaying the entity details (as shown in the image below).   When I navigate to the Entities section from the top-right corner, I am presented with the following view.  Upon clicking the listed Entity IP, a new window opens that is expected to display the entity details. However, in this case, no data related to the selected entity is d

Hey Google Cloud Community -- appreciate any help your able to provide in advance here. Put simply -- I’d like to create a stats search that identifies when an account has not logged in for over 30 days. I’d like to use the metadata.product_event_type = 4624 (windows successful logon) field and basically show how long ago each target.user.userid generates a 4624 event - then filter on traffic that is over 30 days old. I have tried a few stats searches unsuccessfully. I realize there is also a preconfigured dashboard that shows Dormant Accounts but the output it is producing is not accurate. Thanks

Hi folks,I’m trying to create and update an integration via the API. Creating the integration works fine, but after reviewing the Swagger documentation, I don’t see an endpoint for updating it.The creation call (external/v1/integrations/CreateIntegrationInstance) works smoothly, but I’m unable to configure or modify the integration after it has been created.Could anyone point me to the correct endpoint or let me know if updates are supported? Any guidance would be appreciated.

HiiI have a requirement to check for the users that haven't logged in using a VPN.The SIEM has logs for the users that have logged in using a VPN, but is there a way to use these logs and check for the users that havent used the VPN to login during the past 30 days? The requirement is to just get a list of these users?

Hi Team,We would like to seek clarification regarding the implementation of reCAPTCHA v2.We implemented reCAPTCHA v2 a few years ago and would like to confirm whether server-side validation was mandatory at that time. Based on the documentation available then, it does not explicitly state that Step 3 (server-side verification) was mandatory. We are referring to the documentation linked below.reCAPTCHA v2  |  Google for DevelopersPlease note that this clarification is specifically for our old implementation carried out in 2020. Kindly provide your response considering the documentation and circumstances that were applicable during that period, rather than the current implementation guidelines.

Hi Team,In our environment, we are using the Bindplane agent to forward logs to the SecOps console.The Bindplane agent is installed on each server and forwards logs to the Gateway, from where they are sent to the SecOps console.We are currently trying to decide which parser should be used for Windows event logs—WINEVTLOG or WINEVTLOG_XML.Could someone please help us understand: How to determine which log_type should be specified in the Bindplane processor configuration? The key differences between WINEVTLOG and WINEVTLOG_XML The pros and cons of using each parser, and recommended use cases I’m new to SecOps and have done some initial research, but I couldn’t find clear documentation or articles explaining this in detail. Any guidance or best

Hi Everyone,Happy New Year 2026! 🎉I am new to Google SecOps and have a few questions regarding log ingestion via Bindplane, specifically around Google Secops standardization and log visibility.In our environment, we have Bindplane Gateways that collect logs from multiple Bindplane agents and forward the data to Google SecOps. While forwarding the logs, we apply the SecOps Standardization processor so that SecOps can assign a log type (metadata.log_type) and perform UDM field mapping using the appropriate parser.I am looking for clarification on the following scenarios: SecOps Standardization processor not appliedAre the logs still ingested and searchable in Google SecOps? If searchable, what value is assigned to metadata.log_type in the SecOps console ? Does this scenario only impact UDM parsing and detections, or can it affect ingestion itself?SecOps Sta

Hey guys, do any of you know of a way to efficiently identify which log sources you need ingested in order for the curated detections or even custom rules to work as intended? Google secops currently doesn’t tell you which logs are needed and/or missing for a rule to be accurate.

Hello Community,I successfully calculated average ingestion time using a SIEM search by comparing metadata.ingested_timestamp and metadata.event_timestamp, and aggregation functions like avg(), min(), and max() worked as expected. metadata.ingested_timestamp.seconds > metadata.event_timestamp.seconds //excluding logs that have not Time in UTCmetadata.log_type = "OFFICE_365" $Timestamps = timestamp.get_timestamp(metadata.event_timestamp.seconds, "DATE")match: $Timestamps,metadata.log_type, metadata.event_type, principal.namespace // we can add or remove fields here to make it more specific or broadoutcome: $eventsCount = count(metadata.id) $avg_delay_minutes = avg((metadata.ingested_timestamp.seconds - metadata.event_timestamp.seconds) / 60) $max_delay_minutes = max((metadata.ingested_timestamp.seconds - metadata.event_timestamp.seconds) / 60) $min_dela

Hello,I’m implementing SLA tracking for Cases in Google SecOps and would like to understand the best practice for building dashboards.My SLA logic includes: Time to analyst assignment (unassigned → assigned) Identification of SLA-breached cases Visibility at both case level and analyst level Currently, I don’t see native SLA fields for Cases, so SLA is derived from case metadata (Created Time, Owner, Status).Questions: What is the recommended way to build dashboards showing: Cases that breached SLA SLA compliance per analyst Are SecOps dashboards expected to rely only on: Case filters and saved views? Case-based rules and tags? For analyst-level S

Hi all, I have one V2 Tickbox for years. It got automatically migrated towards the end of 2025, and I finally got around to having a closer look at the Google Cloud environment, which is completely new for me. Everything looks OK when accessed from the legacy google.com/recaptcha/admin reCAPTCHA administration. Also, the reCAPTCHA technically works, but I am not sure for how long. I have already enabled the free $300 testing period in Google Cloud and inserted the Credit Card details into the Google Cloud billing. But I am getting the following error when looking at Google Cloud → Security → reCAPTCHA administration page.The overview of Keys lists my key with a “Status” displayed as a dark grey/black circle followed by “Unknown” Once I open the detail at the “Overview” page, in the top right column, there is the dark circle with “Unknown” repeated and the below reads: “Something went wrong Unable to determine the status of

Hi,I’m trying to create an alert based on multiple alerts from the same source, my goal here is to raise an alert when more than 2 different alerts from the same source were triggered, and from there if i have two alerts with low severity maybe raise one with medium severity and if i have two medium rise one high an so on.So far I have this alert:rule Multiple_events_same_source { meta: author = "" description = "this rule " severity = "High" events: $e.detection.collection_elements.references.event.principal.hostname != "" $e.detection.collection_elements.references.event.principal.hostname = $SourceHost NOT $e.detection.detection.rule_name IN %WHITELIST_MULTIPLE_EVENTS_RULE match: $SourceHost over 1h outcome: $risk_score = 0 condition: #e > 2 }  But what i want to achieve

Is there a way I can continuously export the SOAR case data used in dashboards to BigQuery?

Hello,below is my scenario:for the logs that are sent to google secops, there is already a pre-built parser available, but it does not parse the logs.when i check, grok pattern to match the syslog header of logs is not available in the parser code.i have created the grok pattern and i can see that all the other fields are parsed to udm field correctly. now, my question: is it possible to create a parser extension to match only the syslog header and leave everything else as optional ?if the above is possible, i tried no-code option → i put my grok pattern in syslog box and target field, it is validated sucessfully. but when i tried to preview udm, it does not give me the output, the logs are still droped due to the pattern that are available in pre-built parser. can you please help me with this ? Thanks,

🔥 Thrilled to announce two opportunities to join our comprehensive deep-dive training, developed by the FLARE Team at Google Cloud Security. This course moves beyond the basics, equipping you with the practical, hands-on tradecraft needed to dissect today's most sophisticated Windows malware. Whether you prefer the convenience of virtual learning or the intensity of an in-person event, we have a session for you!What You Will Learn:Time Travel Debugging (TTD) →  Leverage this powerful tool to trace and query execution for efficient behavioral analysis. EDR Evasion Bypass → Defeat advanced anti-analysis tricks and uncover techniques like process injection and indirect syscalls used to bypass modern EDR systems. Complex Binary Analysis → Reverse complex C++ and .NET (C#) malware with confidence  Windows Internals → Gain low-level knowledge necessary to understand how

HiAm trying to use the FortiSIEM connector+integration but get the below error when using the test button.Username: adminVerify SSL: False----------------- Main - Started -----------------General error performing action Fortinet FortiSIEM - PingAn error occurred: 401 Client Error: Not authorized for url: https://[redacted]/phoenix/rest/deviceInfo/monitoredDevices b'GlassFish">http://www.w3.org/1999/xhtml">GlassFish Server Open Source Edition 5.1.0 - Error report

Hi everyone,I’m new to Google SecOps and currently working with the Enterprise edition. I’d like to understand how I can get the most benefit from the platform’s threat intelligence capabilities.I’m aware that I can use VirusTotal Context in my use cases for enrichment and detection, but I’m curious about how I can leverage Mandiant intelligence in a similar way. I can see Mandiant alerts and IOCs in the interface, but I’m not entirely sure how to make the best use of that data for proactive threat hunting, detection rule development.Could anyone share best practices or examples of how they’re using Mandiant within Google SecOps Enterprise? Any tips or guidance for someone new to SecOps would be greatly appreciated.Thanks in advance!

Hi community,I am working on YARA-L detection rules in Google Chronicle to identify suspicious self-equality assignments (tautologies) in SQL logs. These patterns, like "1=1" or "test=test", are often used in SQL injection attempts to bypass filters or force true evaluations.Goal: Detect patterns where the left side of "=" exactly matches the right side, such as:test=test1=1time=timestatus = statusflag=flagadmin=adminbypass=bypassenabled=enabledid=idversion=versionBut not detect mismatches like:1=2a=B(and similar non-tautologies)Challenges in Chronicle:I Tried regex ->([A-Za-z0-9'-]+)\s*=\s*\1were i used /1 #BackReference, but unfortunately backreference is not supported in YARAL,so using re.regex to directly check for equal values on both sides of "=".Then i used were grouping issue => The Chr

is it possible today (or upcoming feature request) to add a static timestamp as the starting time of a YARA-L dashboard query and have it ending dynamically at current date/time?  use cases --any data from year to date, ingestion from start of contract period to present etc.

I tried using the zip_integration_by_version to zip my package and test it before pushing the changes but it gives the below error - ValueError: No commit found for integration doppel_vision at version 1.0 in branch origin/develop2025-12-12 14:45:17,484 - INFO - Restoring Git environment...2025-12-12 14:45:17,536 - INFO - Successfully restored to branch: doppel-auth-update also the repository has a different structure than zip file I was using initially to test the integration. for ex - the zip file has a Integration-<package-name>.def file and the content-hub repository doesnt. Can anyone guide me to zip my integration so I can test it and push my changes to content-hub repository? Thank you in advance.

I have a warning on my account that I can't remove. I didn't use the service and I want to contest the payment.   Pré-pagamento pendente.Google Cloud 01C130-FE3231-967E6A: Pré-pagamento pendente: o serviço requer um pré-pagamento único de pelo menos R$ 200,00 para ser ativado. Se você já tiver feito isso, o pagamento será creditado na sua conta em breve.