Security Forums

Unable to view quick action widget to add in default case view. Please let me know  how can I configure it and trigger a playbkook from case 

Hey everyone,Google SecOps is introducing Advanced Filtering to its native dashboard platform. Note that this feature is currently in Private Preview. Since it fundamentally changes how we can build and interact with dashboards, I wanted to share a quick breakdown of how it works, how to set it up, and a few "gotchas" to watch out for.What is it?Unlike basic filters that are strictly tied to specific fields, advanced filters operate as query variables, or tokens. This allows us to inject dynamic values, complex regular expressions, or boolean logic directly into our YARA-L queries at runtime.Here is what makes it stand out: Dynamic Dropdowns: You can populate your filter choices dynamically using the results of a separate YARA-L query, ensuring users always select from up-to-date data. Flexible Formatting: You can define custom Prefixes, Suffixes, and Delimiters (like / for

I would like to open a discussion around something that repeatedly appears in SIEM operations:Who should own data ingestion?Not for common sources where the path is already clear: Windows, Linux, major firewalls, common EDRs, cloud connectors, etc.I mean the gray area:- a source with partial or outdated documentation- a vendor that only provides guidance for another SIEM- a product owner who knows the platform but not its log export options- a SIEM team that can receive data but does not control the source- a network team that owns the path but not the use case- a client or business team expecting the integration to “just work”In those cases, responsibility becomes blurry very quickly.The vendor owns the product, but not necessarily the SIEM integration.  The SIEM vendor owns the platform, but not every possible source.  The source owner controls the technology, but may not know how

Hello Google, I want to know that why my results test with reCAPCHA enterprise (I use script App Automation - Browser Stack) to trigger reCAPTCHA Button in IOS App. But it always return 0.9.  Note - Code at IOS - I'm not using testing key -  It's demo project but I can't guarantee it works right now. I can't intergrate when it can't not prevent bot spam, bot abuse) - I'm using script for (App Automation - Browser Stack) to test results of reCAPTCHA and it passed all the cases. How can? It's bot, many assessments was created but always return nice scores (0.9)   If you can explain, pls. If you want email me for the iba file

 Hello Team,I am seeing a discrepancy with the stats search.When I run a normal search for EPP high alerts during the specified time range, I get 31 results. However, when I convert the same logic into a stats search with a match window, the result count increases significantly.I expected the count to be equal to or lower than 31, since the match window should group matching alerts within the defined time period. Instead, I am seeing more than 400 results, which is around 15 times higher than the original event count.and when it is run on rules i am getting 23 detectionsCould you please help confirm why the stats-based query is inflating the results and whether the match/window logic is causing duplicate or expanded matches? 

Hello Everyone,Greetings..!!I am trying to build a Google SecOps detection similar to a Splunk behavioral rule for “AWS provisioning activity from a previously unseen geographic region.”Current logic: Detect CloudTrail provisioning actions such as Run* and Create* Baseline source geolocation per activity eg : country,region ,ip ,city  Alert when provisioning comes from a new/unseen location The issue is with the baseline scale.The current baseline stores combinations of: source IP city country region/state Because of this, the baseline has grown to around 600,000 rows.In Splunk, this was implemented using a CSV lookup with historical tracking, but in SecOps we are limited by the Data Table size limit (~1000 rows), so the approach is not scalable as-is.I am looking for recommendations on

A few years ago I was in a client meeting with a senior security engineer — someone with over a decade of experience, certifications on the wall, and a title that put them in charge of guiding the client's security operations.The client asked a technical question about their SIEM configuration. Something specific — how a particular data source was being normalized, why certain events weren't triggering rules.The engineer's answer: "I'm just a security engineer. I don't do that."I've thought about that moment a lot since then. Not because the engineer was incompetent — they weren't. But because that answer revealed something real about how the industry has defined what a security engineer is supposed to know. And what they're allowed not to know.· · ·The blue team knowledge problemBefore going further: this article is not about

Hi everyone.Our current environment is deployed with one principal tenant and three additional tenants containing client data.My team consolidates all cases within the principal tenant for centralized analysis and reporting.Is it possible to build dashboards from the principal tenant? For example, we want to visualize how many cases my team has analyzed, broken down by client. Is this feasible within the current architecture? Regards,Silas Muniz

Hello Team,I am writing a rule to detect unknown IPs hitting our public-facing domains. In this rule, I only want to generate an alert when the source IP is not present in GCTI.The reason is that we already have a separate rule that handles IPs found in GCTI, so I want to avoid duplicate detections.Could someone please advise on the best way to implement a “NOT IN GCTI” condition within the rule?Is the below approach the correct way to verify that the principal IP generating the alerts is not present in GCTI? Also, is using the join with entity.ip the correct method for this check? 

Direct ingestion configured in GCP to Google SecOps. I noticed that, in our case, the GCP_BIGQUERY_CONTEXT dataset is very large and we would want to drop those but I can’t see where the ingestion is configured. Any tips?

Hi,I'm struggling to get cases into the right Environments in Google SecOps.I have my environments defined in the SOAR settings, and I’ve set the Ingestion Label and Namespace correctly in the feeds. I also configured the Chronicle Alerts connector to use a UDM field that carries the environment name, but for some reason, all cases still land in the "Default Environment."I've already tried swapping fields in the connector but no luck. Is there something specific about how the connector parses UDM fields for environment mapping that I might be missing?Any advice would be appreciated!Thanks 

Hey all,  Detection engineer here. Just open-sourced something that's been saving me a lot of time and wanted to share it.  The problem is well-known: Chronicle has a genuinely powerful API — rules management, bulk operations, UDM search, feed control — but most   security engineers never touch it. Not because they don't want to, but because using it requires writing Python against an SDK that has  its own undocumented quirks, field names that don't match the docs, and behaviors that only appear when you run code against a live  tenant.  Some of us script around it. Most don't, and end up doing things manually that should take one command: filtering rules by alerting  status, exporting 200 YARA-L rules to individual files, toggling alerting on a subset of rules, validating that credentials actually work.  So I built a Claude Code skill that removes the Python layer. You describe what you need in plain English. Claude maps it to the

The Mandiant Security Validation (MSV) team is pleased to announce version 4.14.6.1 of the MSV platform.Bug fixesThis hotfix release addresses the following critical issues:Resolved an issue where repeated checks on Protected Theater VNC status could overload the system, potentially leading to unresponsiveness. Fixed issues related to Google Authenticator two-factor authentication (2FA) after upgrading to 4.14.6.0, ensuring that 2FA configurations are correctly retained and preventing users from being incorrectly redirected to User Preferences with a false warning to re-enable Google Authenticator upon sign in.Known issuesLocal Event Filtering works as expected but is limited to Match Action, Match Integration, and Match Events (when the latter involves Raw Events). If a rule has a Match Event condition for any field other than Raw Event, the rule does not apply to Local Events. It only applies to events from standard l

Hello Team,I hope you’re doing well.We are planning to integrate IPAM data with Google SecOps by ingesting it as Entity Data into the Entity Context Graph (ECG) instead of traditional point-in-time log events. This approach is intended to enable better correlation of subnet/VLAN and IP data, helping us analyze traffic more effectively at the subnet level rather than individual IPs.Please let us know if this approach aligns with best practices.

According to the official documentation, the multi-event rules capacity under the “Enterprise” license is 125 rules. However, we have noticed that in a few of our customer environments licensed under the Enterprise license, the multi-event rules quota has been increased to 200. Is this an official update? If so, why has it not been mentioned in any of the release notes or official documentation yet?  

Hi All,We have onboarded logs from multiple GCP projects using direct ingestion into SecOps.  However, the GCP projects belong to different business solutions.The objective is to tag the logs from GCP projects based on the business owner or solutions.I have read some article suggesting to use custom ingestion pipelines: Multi-Tenant Google Cloud log collection with PubSub Push | by Chris Martin (@thatsiemguy) | Medium and like the article confirmed - it’s going to incur additional cost.Please, anyone know how best to tag logs from multiple GCP projects with the existing ingestion method.Regards.

I would like to clarify one point regarding context enrichment in Google SecOps.Currently, our logs are already ingested and enriched with Azure AD context in UDM fields. As I understand, if we update Azure AD context, SecOps will ingest the updated data into the entity context, and future logs will use this updated information for enrichment.However, I would like to confirm what happens to the previously ingested logs that were already enriched using the older context. Will those historical logs get updated automatically, or will they retain the past original enrichment values. Example 1:A user’s location was initially enriched as:City = Chennai Country = USLater, the information was corrected to:Country = IndiaIn this scenario, if historical correlation is used, earlier events may continue to reflect the previously enriched country value (US), even after the correcti

Is there a way to add a Tag to an Alert via a playbook? I can add one to the case but I don’t see an option to add to the Alert.

Hello SecOps Community!If you are building custom Native Dashboards to track SOC performance metrics like Mean Time to Resolve (MTTR), analyst workloads, or SLA compliance, you know that the data you need often lives in two different places: the current case state (case) and the audit log of actions taken on that case (case_history).I want to provide some quick guide on how to seamlessly join these two data sources within your dashboard queries to unlock deeper insights into your case lifecycles.The Secret Sauce: Aliasing and Shared VariablesIn Native Dashboard queries, you do not need to use YARA-L rule or events blocks to join data. Instead, you establish the relationship by assigning an alias to each data source and mapping their unique identifiers to a single, shared placeholder variable.To successfully join case and case_history, focus on this core syntax:Co

 At Google Cloud Next we introduced a new security and governance paradigm for managing agent identity and access. This comprehensive framework focuses on foundational Agent Identity and an Agent Gateway with Identity-Aware Proxy, while integrating robust agent access management, agent guardrails, and runtime defense to enable a secure cloud environment for your organization. Check out this blog to learn on all new capabilities announced at Next 2026.

Hi All ,  Im not able to submit file in CS what this error means? 

According to the official documentation, the multi-event rules capacity under the “Enterprise” license is 125 rules. However, we have noticed that in a few of our customer environments licensed under the Enterprise license, the multi-event rules quota has been increased to 200. Is this an official update? If so, why has it not been mentioned in any of the release notes or official documentation yet?  

By default Google Secops compress the x-axis on its visualizations.For instance in any timechart if there is no value on any given timeslot, it’d just compress the x-axis making it non-linear. Sometimes this might be helpful but other times it could be misleading.We need a way to switch between compressed and linear x-axis.

Hello Google SecOps Community!We know that building the perfect dashboard is crucial for your SOC's visibility, but we've also heard your feedback: mastering the underlying data schemas and getting the hang of YARA-L 2.0 queries for charting can come with a steep learning curve.To help you get the most out of your data and accelerate your custom dashboard creation, we are thrilled to announce a major revamp to our Google SecOps Dashboard documentation, along with a brand-new reference query library!Here is what’s newly available to you:📊 Revamped Native Dashboards Documentation We have overhauled our dashboards documentation to give you more clarity and control. You will now find in-depth details about the schemas for the different supported data sources. To make getting started even easier, we have included ready-to-use templates and practical examples for each data source. 👉

For the Ingestion scripts of Google SecOps SIEM Repositories:https://github.com/chronicle/ingestion-scripts/tree/mainThere are some apps which have not specified the python version for Cloud Run in README file.I wanted to know that if no --runtime flag provided in cloud function deployment command, which python version would be used?Or Is there any specific python version needs to be passed in --runtime which has not been mentioned currently in README?