Security Forums

Hi All, Building a native dashboard to quickly assess entity context and associated detections activity across the environment.Would like to write a query retrieve enriched data of a particular entity (say Domain name, IP) such as first_seen_time, etc. and map all related security detections for that specified domain. Thanks in advance

The rise of AI and agents is fueling API sprawl, making it harder than ever to govern your network and detect dangerous "shadow APIs." +This article introduces key enhancements to API discovery in Apigee Advanced API Security, a critical feature designed to automatically find and manage undocumented APIs across your organization. Product Manager, Megan Bruce details the new Google Cloud-wide scope and agentless observation that leverage your L7 Application Load Balancers. The new integration with Apigee API hub allows for automatic comparison against cataloged APIs, providing a centralized view to help you eliminate security risks and bring all your assets under secure management.Want to learn how to automatically detect, govern, and secure every API across your Google Cloud projects? Discover the complete process in our guide ➡ https://goo.gle/48YHamZ 

Team,Could you please help me understand how to get into Yara-L using this rulePotential beaconing activity ASIM Network Session schema | Microsoft Sentinel Analytic Rules

Hi there,I am writing a custom parser for Microsoft Azure Resource logs. For the below raw log of category “AppServiceConsoleLogs”, I am getting the above error, even though the required field as per the error is mapped in the state data.AppServiceConsoleLogs raw log:{"_time": [removed by moderator] .752,"time":"2025-09-21T01:50:08.8341792Z","resultDescription":"\u0445601b[32m[2025-09-23T07:50:08.833] [INFO] Job API - \u00UID: V920","resourceId":"/SUBSCRIPTIONS/03D-99C8-4JQ25-965150-E09FC4SDFD6EB34/RESOURCEGROUPS/ABCD_EFGH_RG/PROVIDERS/MICROSOFT.WEB/SITES/ABCDEFGH","level":"Informational","operationName":"Microsoft.Web/sites/log","containerId":"e85f5rv6tc17_abcdefhj","location":"Central ","category":"AppServiceConsoleLogs","EventStampType":"Stamp","EventPrimaryStampName":"wawfryus-prod-pn1-011","EventStampName":"waws-progffjjd-pn1-011","Host":"pl0sdlwk001B8Y","EventIpAddress":"10.20.1.201","records":true} And for the other type of log of category “AppServiceHTTPLogs” where records.0.Ho

Hello.I've a simple question about the billing of the reCAPTCHA.To clarify, the charge for the use of reCAPTCHA is only applicable after it is working in Google Cloud ?I mean, in the meantime I won't get billed if I get more than 10000 evaluations before the migration ? Thanks in advance.  

Unified Custom Parser + Feed Setup in Chronicle (Legacy / SecOps) 1. Foundational Concepts (so you and stakeholders speak the same “Chronicle”) Concept Role / Behavior Key Constraints / Notes Custom Log Type Label for logs that don’t map to any built-in type. Must be created (or requested) before you can ingest under it. Feed Mechanism that pulls data from a source (e.g. S3) and sends it into Chronicle, tagged with a log type. Feeds only ingest — they don’t validate or parse.Parser / Custom Parser Logic that converts raw log text into UDM (Unified Data Model) fields. Must be associated with the proper log type. Changes take effect only on new ingestion (not retroactive). Validate / Test in Editor Chronicle UI feature to test parser logic against manually pasted sample logs. Doesn’t pull live logs from feeds. If “no raw logs found,” it means you didn’t paste anything.Parser Extension A lightweight way to augment an existing parser (prebuilt or custom). Adds extraction logic without rewr

Hi,I'm trying to setup Google SecOps(Chronicle) in my client’s environment. They are using legacy Chronicle and not ready to upgrade to the latest version.I'm ingesting the logs from .log files in AWS S3 bucket. I have planned to create Feeds for each file. All my log files are from custom application and I couldn't find a matching supported log type for it. So, I created a custom log type for each of my file. Later, post creating the feeds. I wanted to create a parser to map the raw data to UDM fields. I tested my parser code by manually entering a raw log in the parser editor and it got converted to UDM fields. So, my parser code is working as expected.  Now, I clicked the validate option in the parser editor to save my parser. It was checking for raw logs and validation failed. So, I created feeds using the custom log type. Feed is also working as I configured to delete the files post transferring the logs. File in the AWS bucket got deleted. I went back to validate my parser but it

In the Google Cloud Documentation, https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/connectwiseI see there were two jobs ‘Synchronize Closed Tickets and Dismissed’ and ‘Synchronize Comments’. But in the marketplace, within the ConnectWise Integration, we only have Actions and managers not the jobs. We dont have jobs to sync between Google SecOps cases and ConnectWise tickets.Could you please help us with these jobs? and where can we get these jobs? 

Hello Folks, I am running a google secops POC, so till now i have installed bindplane agent on Windows endpoints and connected their feed to google secops. The issue im facing is that im unable to collect the correct telemetry and also unable to collect the powershell telemetry data. I have these logs forwarded to google secops SIEM, but im unable to create a CASE which is basically SOAR. Ive tried using the chronicle connector but unable to push these alerts to soar and create a case. If possible please help me out to the earliest. Thank you

Hi,Does anybody have insights on how to handle compliance regulations such as GDPR with specific requirements to delete ingested logs after a specific time interval?In Europe there quite stringent regulation for data retention, and some metadata and log types are required to be deleted after some weeks or months.If my understanding is correct, SecOps has a flat retention of 1 year and there is no way to enforce data retention policies for specific log types or based on other parameters.Is this not going to be an issue for audits? Is there no current way to handle the matter? Thank you all,

Previously, we experienced an issue where cases were not created due to a bug in Google SecOps.This was resolved by updating the connector to the latest version. To ensure we are aware of similar issues in the future, we have decided to transfer Google SecOps logs to Google Cloud and monitor them using Cloud Monitoring. To do this, we would like to know what error log will be issued if cases are no longer created.

Hello,Is there any way to create a loop action inside the SOAR playbook? 

Hey Community, we just dropped the Debugging SOAR Integrations in IDE Like it’s a VIBEwebinar from this week in Webinars & Podcasts. Includes debugging SOAR Integrations and essential techniques, how Gemini analyzes your debugging errors, integrating GitSync for seamless development and best practices for VIBE coding!  Go check it out and get your learning on! And don't forget to ask any questions you have in the webinar post. The Community is here to help answer! Enjoy! 

Last year I added the Wordfence plugin to my woocommerce/wordpress site to add a level of security to my online shop. I set up the reCaptcha V3 site key and reCaptcha v3 Secret via the Google console - It was a while ago, but it all worked and set up fine. I was just checking through settings today and in the google console I was prompted to migrate and switch to Google Cloud, so I did so and now my reCaptcha status is saying I’m unprotected and I have no idea how to resolve this.I don’t fully understand any of this, so if someone could help explain what I need to do to resolve this all and to protect my website, I’d really appreciate it.When I click on the word Unprotected, I get a popup saying the following with a link to ‘Request Tokens’ UnprotectedYour key isn't requesting tokensYour key was requesting tokens (executes), but isn't any more. Something is set up incorrectly in your front-end environment. Your site or app isn't protected. The link takes me here: https://cloud.google.c

Hello All,I'm working on setting up alerting rules in SecOps, and I’m encountering an issue where some alerts are critical but tend to trigger frequently, creating unnecessary noise in the alert stream.I’m thinking of implementing a rule where, once an alert is triggered, subsequent alerts of the same type (or related) would be suppressed until a specified time window has passed. The goal is to avoid alert fatigue and ensure that we’re not overwhelmed with redundant notifications while still tracking important events.Has anyone implemented a similar mechanism? If so, could you share some insights on how you went about this or any best practices you’d recommend? I’m particularly interested in solutions where the suppression is time-based (e.g., 30 minutes after an alert is triggered, suppress any similar alerts during that period).Thanks,Suraj Kadav

I want to assign a department name to each feed ID using a data table.I want to assign a department name to the Department variable for each feed_id used for import.The data table contains a combination of feed_id and department name for each row. For example, when the feed_id is "86d50640-a952-4723-8001-fbbc22e7c446", I want the Department variable to be set to "C".Is this possible?I tried creating the following query, but it didn't work.---------ingestion.log_type = "CISCO_MERAKI"$Department = if(ingestion.feed_id in %imano_feed_id.feed_id,%imano_feed_id.department ,"other")match:$Departmentoutcome:$Volume = math.round(sum(ingestion.log_volume) / (1000), 2)order:$Volume desc---------The error message is as follows:compilation error compiling query: validating query: unsupported Data Table field imano_feed_id as argument in function IfThenElse line: 4 column: 1-97 : invalid argumentIf the above is difficult, is it possible to manually set the department and only compare the feed_id fr

Hi experts,Do you have any demo logs that I can simulate and show case to people about google chronicle? 

Hello I’m working on extending a JSON parser, and I want to insert the value of my variable Hostname into the field about.asset.hostname.Right now, I can capture the value into a variable, but when I try to add it into the JSON with this code: if [Hostname] != "" { mutate { replace => { "temp.asset.hostname" => "%{Hostname}" } } mutate { merge => { "event.idm.read_only_udm.about" => "temp" } } mutate { replace => { "temp" => "" } } } the parser replaces the entire about structure, instead of just adding the hostname.How can I modify this so that only my string is added to about.asset.hostname without overwriting the rest of the JSON structure?

I have a requirement to ingest logs from GCS Bucket to Google SecOps(Chronicle). I have done role binding and provided object viewer role to the Global Service account managed by Google. I have added VPC ingress rules to the projects. The bucket is cmek encrypted. In the feed I am getting authorization error. How to proceed with the same?

When running a SIEM search for a specific file, results return enriched values from third-party sources rather than actual findings within the network. This leads to excessive, non-actionable results, making investigations inefficient. How can we refine SIEM searches to exclude enriched data that does not directly correlate with internal network findings? Are there tuning methods to ensure only relevant results are returned?

Hello!I successfully integrated Noname Api Security with Secops via webhook, according to the documentation. However, I'm still not receiving incident logs. According to the client API, I should be receiving these types of logs, but I only have a test message from the integration that is “Noname webhook integration". Do I need to configure anything else on Noname's side to receive these logs via webhook? I use theses documentation https://cloud.google.com/chronicle/docs/administration/feed-management#webhook-endpoint-url. The status from the feed is active, so I don’t know if I need to configure something more on Noname to receive this events.

Authored by Raimundo Alcazar and myself, this guide is your resource for leveraging Google Threat Intelligence Profiles. Learn the practical steps to create and manage profiles that provide a clear, tailored view of the most relevant cyber threats to your business, helping you make smarter, faster security decisions. The link is live now. Do share with your customers and partners where GTI, Threat Profile topics comes up!

Hello,Does anyone was able to  upload data tables by api, we have this documentation, but when trying to make the post we get error saying that the "Service Unavailable for url” https://cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.dataTables/upload?rep_location=usUsing this "POST https://chronicle.us.rep.googleapis.com/upload/v1alpha/{parent}/dataTables:bulkCreateDataTableAsync”

Hi all,I'm building a detection rule in Google Chronicle using metrics.auth_attempts_total to retrieve the first_seen and last_seen values for a user login event. I'm trying to exclude results where these timestamps are defaulted to "1970-01-01 00:00:00", which I understand represents a lack of metric history (i.e., a value of 0).Here’s what I’m doing:metadata.event_type = "USER_LOGIN"principal.ip = /[1.1.1.1/target.user.userid = /[jdoe/$date = timestamp.get_timestamp(metadata.event_timestamp.seconds, "%b %d %H:00")$logon_outcome = security_result.actionprincipal.ip_geo_artifact.network.carrier_name = $IP_Carrier_Nameprincipal.location.country_or_region = $IP_Region$userid = target.user.useridmatch:$userid, $logon_outcome, principal.ip, $IP_Carrier_Name, $IP_Regionoutcome: $first_seen = timestamp.get_timestamp(cast.as_int(max(metrics.auth_attempts_total( period:1d, window:30d, metric:first_seen, agg:min, target.user.userid: $userid )))) $last_seen = timestamp.get

Hey Everyone! We are exploring better ways to work with CrowdStrike Automated Leads within Google SecOps SOAR, and I’m curious how other teams and organizations are approaching these new alerts - both from a grouping and process perspective. Since the Automated leads was released earlier this month, I have heard a fair bit of mixed feedback. Some teams find value, while others feel overwhelmed by the volume or unclear on how to operationalize these alerts effectively (like me). A few things I am curious about are:How is your organization grouping Automated Leads? How are you handling the volume? Are Automated leads being handled differently from your existing process? i.e. If it’s an automated lead alert/detection, escalate it to another team to review and thoroughly evaluate or close based on predefined logic. (I heard a lot of false positives coming from automated leads.) Have you developed any custom logic or playbooks to prioritize/deprioritize Automated leads? Has your organizati