Security Forums

HI All, Im not able submit file in GTI . Im getting error for path.  where i need to upload file first ? 

Hello,I am writing to request an urgent escalation for a suspended project that has been pending a manual review for over three weeks. My project, MindfulFlow (id: mindfulflow-613bc), was suspended due to an API key compromise.Key Timeline: Suspension Date: April 21, 2026 Appeal Submitted: April 21, 2026 Additional Info Requested by Google: April 24, 2026 Detailed Remediation Plan Sent: April 24, 2026 Current Status: No response for 19 days since my last communication. Case ID: [removed by moderator] Remediation Steps Taken: Revocation: I have already revoked the compromised credentials. Architecture Migration: I have committed to mig

I am configuring Google SecOps with Google Chat for a playbook.What works:Ping List SpacesThe target space is returned correctly, and the app is already added to the space.What fails:GoogleChat - Send Message GoogleChat - Send Advanced MessageBoth return this exact error:Error executing action "GoogleChat - Send Advanced Message". Reason: An error occurred: b'<h1>Not Found</h1>\n<h2>Error 404</h2>\n'I also confirmed that Space Name must be passed in the full resource format: spaces/{space}If I pass only the raw space ID, I get a malformed resource name error.At this point, List Spaces works, but sending messages still fails with 404 even though:the Chat app is live the

Is there a supported way to format hyperlinks within the output of a action to create clickable links? The output is going to the case wall. This is for analysts who want to read more about the action results and they currently have to copy and paste the link from the results.  Are HTML widgets the only way to display this? 

I have a real head-scratcher I’m struggling with on google scopes. I'm running queries via the "/legacy:legacyFetchUdmSearchView" API endpoint and seeing what looks like silent failure of "outcome" projections when filtering on a repeated field with "any".This query returns events but each event has an empty "outcomes" field:events: metadata.log_type = "PAN_FIREWALL" any principal.ip = "<source-ip>"outcome: $protocol = network.ip_protocolThe returned events have "network.ipProtocol" populated in the raw JSON (e.g. "ICMP"), so the field is present — it just isn't projecting through "outcome".Rewriting with placeholder binding produces populated outcomes:events: metadata.log_type = "PAN_FIREWALL" principal.ip = $ip $ip = "<source-ip>"outcome: $protocol = network.ip_protocol"$protocol" now comes back with "ICMP" a

MSV 4.14.6.0 Product Release - May 13, 2026The Mandiant Security Validation (MSV) team is pleased to announce version 4.14.6.0 of the MSV platform.EnhancementsUpdates to Director and content to support MITRE ATT&CK v18. Added support for Remote Integrations on installable Actors. MSI version downgrades are prevented on Director upgrades. For external database scenarios, upgraded the database encryption to support scram-sha-256 password hashing. Improved memory performance for the /analyze/pivot_data route. To enhance privacy, Azure Client Secrets used for Cloud Validation Modules (CVM) have more redactions. Added a setting to allow administrators to disable the requirement for a local user account when using Google or SAML authentication. That way, all users can use the selected authentication type without needing a local fallback. Updated API calls for the CrowdStrike Intel

Hello team,I’m trying to ingest GCP Monitoring alerts into SecOps using a Pub/Sub push subscription. To do this, I created an alert policy for “agent goes silent” and configured a notification channel using a Pub/Sub topic. That topic is attached to a push subscription that forwards events to the endpoint.I am receiving email notifications (since email is also configured in the notification channel along with the pubsub topic), but the alerts are not being pushed to SecOps from the Pub/Sub topic.I have given the pubsub publisher  permission to the topic My alerts are not getting acknowledged by secops endpointIs there any documentation I can refer to for correctly pushing GCP Monitoring alerts to SecOps?

How exactly does ReCaptcha v3 count the number of assessments? Does it happen after calling the /siteverify method on the server side?

Hello Team, I keep facing“Your home page does not explain the purpose of your app”“The app name shown on your OAuth consent screen does not match the app name on your home page” I can’t figure out why and what I’m missing. Thanks for any support. My site for my app is: https://www.getdailysolve.com  

Hi All,I just want to know how to calculate the Google SecOps LicenseCan someone confirm whether it calculated from throughput value or ingested eventsWhen I raised case with Google Support, I got to know it is calculated via ingested events, but I didn’t get the formula. Usually, we sign contract with google in GB/TB for period of year.Is that true? ThanksHarsha 

Hello,  I am trying to use the Wiz SOAR integration in Secops to “Get Issue Details” from Wiz. I think I have the integration setup correctly. When I run the “Wiz Ping” action I get a successfully connected to the Wiz server message. However, when I run the “Get Issue Details” on a known Wiz threat issue ID - I get the following error: Any idea why this might be the case? Thanks in advance!  

We have an Aria Operations for Logs and would like to integrate it with Google SecOps. Is it possible to integrate Aria Operations for Logs instead of integrating SecOps with each and every VMware box, example vCenter, ESXi, NSX etc. is there a Bindplane agent available?

I would like to see a list of individual devices sending syslog to our SecOps environment.  All syslog is going through Bindplane collection agents.  I’ve configured Bindplane to append IP information for each syslog exporter as an ingestion_label.  It looks like I can use this in the context of a UDM search or maybe a dashboard.  Just checking if this question/problem has already been solved through another approach.

 Anyone has any idea what the below snapshot refers to:I am trying to upgrade an older microsoft graph mail to latest versionDoes it mean entering the parameters in this instance itself  by clicking on configure or is it referring to some other connector ? 

I’m working on setting up the Response Integrations for GCP (i.e. Google Cloud Compute, Google Cloud API, etc).I’m missing a piece of knowledge on how GCP role permissions work across the organization.SecOps setup is in GCP project, we’ll call it “SecureLand”. SIEM/ SOAR migrations have occurred to move to IAM. I created a service account in there, did the work of setting it up for workload federation, did the iam.serviceAccountTokenCreator steps. Created the custom roles in “SecureLand” and assigned to the SA and setup the integrations via Workload Identity Email.The question » Do these custom roles need to be assigned at the Org Level or is there some inherited “hand waving” that happens because its done in the “SecureLand” project where SecOps is setup? Under normal situations I would say a role granted in the “SecureLand” project doesn’t allow acting in other Projects.Example: There is an alert that

Hey Community!  We often think of the power of Community and what we all have to offer each other as we enter into this shared space of knowledge, ideas, questions and connections. Today, I am THRILLED to highlight a masterclass Community user, Eoved, and his blog Beyond Chat: Building an Autonomous SOC Analyst with Claude and the Google MCP!  After catching our recent webinar, "Jump-start your MCP journey with the Google Security Community!" with 

I’m looking to set up a process that allows me to monitor a list of vendors and whether they show up in breaches - i.e.search a vendor name, website or email in GTI programmatically via API and see if theyre ivolved in breaches. Is that possible via GTI? What coverage for sources does GTI have if thats possible?

Does GTI have the capabilities to provide information on third parties that we specify - i.e. we want to track to see if our vendors have been breached - does GTI provide any capabilities via API to query  breach info that is collated from open source feeds and any proprietary feds (e.g. the dark web)?

[問題] プレイブックでEmailV2統合を使用してユーザーからの返信を待機していますが、「ユーザーからのメールを待機」アクションが「進行中」の状態で停止し、返信を検出できません。[検証済み構成] ドキュメントに基づいて、以下を検証しました。・認証：Gmail に 16 桁のアプリ パスワードを使用しています。「メール送信」と「Ping」アクションは正常に動作しています。・パラメータ：Email Message_idとEmail Dateは、SendEmail.JSONResult.message_idとSendEmail.JSONResult.email_dateのプレースホルダーを使用して正しくマッピングされます。・フォルダ: 実際のメールボックスに合わせて「受信トレイ」（大文字小文字を区別）に設定します。・メール受信：返信メールが受信トレイに実際に存在することを手動で確認しました。処理は非同期で行われるにもかかわらず、返信を受信して​​も処理が開始されません。【質問】設定が正しくても、この特定のアクションがトリガーされないという同様の状況に遭遇した方はいますか？他に隠れた要件や、取るべきトラブルシューティング手順があれば教えてください。 

Hi Team,I wanted to confirm that if we integrate Microsoft Intune logs via graph API, we will only retrieved audit logs? Is there a limitation what we cannot collect other type of Intune logs such as operational and compliance logs ?

Hi Google Team,We have successfully integrated Microsoft Intune logs into Google SecOps using a third-party Graph API feed. The feed configuration appears to be working — logs are being ingested and the feed shows a healthy status.However, we've noticed a significant discrepancy in log size:- **In Google SecOps (via the feed):** Ingested log size is approximately **40 KB**- **Manual API retrieval (direct Graph API call):** The same file/export is approximately **6 MB**This is roughly a 150x difference, which strongly suggests that the feed is either truncating or only partially ingesting the log data.**What we've already ruled out:**- Feed configuration is confirmed successful with no visible errors- Authentication against the Microsoft Graph API is working correctly- we have verified via direct API calls that pagination exist in the returned logs file and the full dataset is returned when querying manually **Qu

hello Team ,I’m observing that the curated rule “Extortion Email Detected via Subject Keywords” is not generating any alerts in my environment even though alerting is turned on for that rule for both precise and broad. However, when I create a custom detection rule with the same logic, as curated  it successfully triggers alerts on the same dataset.I’m trying to understand the gap between curated and custom detections in this case.Has anyone encountered a similar issue where:Curated rules do not fire, but equivalent custom rules do?Any insights would be helpful.

I have written a query to fetch the key value pair correct .But the result is not accurate .Could you please anyone guide me to get the key vale from repeated list ? ($e.target.resource_ancestors.attribute.labels.key = "res_spec_container_security_context_privileged" AND  $e.target.resource_ancestors.attribute.labels.value = "true")

Hi everyone,I'm facing a critical remediation blocker following a "Hijacked Resource" suspension on theproject. While I am eager to secure my environment and rotate all potentially compromised credentials, I am trapped in a redirect loop that prevents administrative action.The Technical Problem:Whenever I navigate to IAM & Admin or APIs & Services, the GCP Console performs a forced redirect to the suspension warning page. This means I cannot revoke existing API keys or Audit Service Account activity through the standard UI.Investigation Status:Audit: Local .env files and Git history have been reviewed, but I suspect a credential may have been intercepted or leaked elsewhere. Timeline: Appeal submitted 7+ days ago; no response received. Production environment remains offline.Seeking Expert Advi

Hi everyone,I'm facing a critical remediation blocker following a "Hijacked Resource" suspension on theproject. While I am eager to secure my environment and rotate all potentially compromised credentials, I am trapped in a redirect loop that prevents administrative action.The Technical Problem:Whenever I navigate to IAM & Admin or APIs & Services, the GCP Console performs a forced redirect to the suspension warning page. This means I cannot revoke existing API keys or Audit Service Account activity through the standard UI.Investigation Status:Audit: Local .env files and Git history have been reviewed, but I suspect a credential may have been intercepted or leaked elsewhere. Timeline: Appeal submitted 7+ days ago; no response received. Production environment remains offline.Seeking Expert Advi