Google Security Operations

Hello everyone,I am currently facing a challenge where I need to perform data matching based on a specific field. However, this field contains enriched values that lead to incorrect matches. I want to ensure that my matches are based solely on the original values in this field, without considering the enriched information.Is there a way to configure my detection logic to exclude these enriched values? Any guidance, instructions, or best practices on how to achieve this would be greatly appreciated.

I have a warning on my account that I can't remove. I didn't use the service and I want to contest the payment.   Pré-pagamento pendente.Google Cloud 01C130-FE3231-967E6A: Pré-pagamento pendente: o serviço requer um pré-pagamento único de pelo menos R$ 200,00 para ser ativado. Se você já tiver feito isso, o pagamento será creditado na sua conta em breve.

I have a warning on my account that I can't remove. I didn't use the service and I want to contest the payment.   Pré-pagamento pendente.Google Cloud 01C130-FE3231-967E6A: Pré-pagamento pendente: o serviço requer um pré-pagamento único de pelo menos R$ 200,00 para ser ativado. Se você já tiver feito isso, o pagamento será creditado na sua conta em breve.

Is there a way I can continuously export the SOAR case data used in dashboards to BigQuery?

Hi all, I am writing phishing investigation playbook, I want to validate SPF, DKIM, and DMARC status for the sender domain on Google SecOps SOAR playbook. Is there any integration which supports this action? Thanks!

Hello team, do you have any guidance on developing a risk analytics rule that identifies when an entity exhibits a sudden spike in risk score? In the rule below, I can generate an alert when an entity’s risk score on the Risk Analytics dashboard exceeds a defined threshold. However, I’m more interested in detecting a sudden spike in the entity’s risk score rather than relying on a static benchmark.i have two use cases one is to alert when any user’s risk score in analytic dashboard crosses a benchmark and the other one to detect on sudden spikeAlso, for Risk Analytics, I could not find a UDM field that represents a normalized risk score. I only see the raw risk_score and the delta_risk_score fields.Which of these fields would be the most appropriate to use for t

Hello everyone, I’m trying  to add Custom Tags to Defender Unified Portal Alerts. Prior to the migration I was able to do this with the Sentinel Connector after the SIEM Migration into Defender the only action I can find is “Update Alert” from the GraphApi Integration.Is the Update Alert Action working on Incidents or Alerts?As far as I can see only on Incidents you can update Tags ->Update incident - Microsoft Graph v1.0 | Microsoft Learnnot on Alerts. When trying to update an Incident I get this:The Incident does exist: 

Hi All,Would like to know if there is a possibility to monitor the changes made to a reference list such as adding / deleting a value from the reference list? As we have for changes made to rules from GCP console. Thanks!

Hi everyone,I’m new to Google SecOps and currently working with the Enterprise edition. I’d like to understand how I can get the most benefit from the platform’s threat intelligence capabilities.I’m aware that I can use VirusTotal Context in my use cases for enrichment and detection, but I’m curious about how I can leverage Mandiant intelligence in a similar way. I can see Mandiant alerts and IOCs in the interface, but I’m not entirely sure how to make the best use of that data for proactive threat hunting, detection rule development.Could anyone share best practices or examples of how they’re using Mandiant within Google SecOps Enterprise? Any tips or guidance for someone new to SecOps would be greatly appreciated.Thanks in advance!

Hi,I’m trying to create an alert based on multiple alerts from the same source, my goal here is to raise an alert when more than 2 different alerts from the same source were triggered, and from there if i have two alerts with low severity maybe raise one with medium severity and if i have two medium rise one high an so on.So far I have this alert:rule Multiple_events_same_source { meta: author = "" description = "this rule " severity = "High" events: $e.detection.collection_elements.references.event.principal.hostname != "" $e.detection.collection_elements.references.event.principal.hostname = $SourceHost NOT $e.detection.detection.rule_name IN %WHITELIST_MULTIPLE_EVENTS_RULE match: $SourceHost over 1h outcome: $risk_score = 0 condition: #e > 2 }  But what i want to achieve

Dashboard reports (Non-legacy) have no email delivery . Unable to schedule reports like the legacy ones. Is this feature out yet ? How do we schedule daily report to be sent to an email address

Hi everyone, I’ve been exploring how AI and cloud tools can help automate everyday tasks while keeping data secure. One area I’m curious about is managing personal finances—specifically, using secure methods to check bank balances without logging into a bank branch or multiple apps. I’m interested in approaches that could work with cloud-based AI tools or secure automation scripts, and banks like FAB. How can such systems be designed to stay safe, respect privacy, and integrate with existing cloud security best practices? Any guidance or examples would be really appreciated.

Log Parsing Issue in Restricted Pipeline (Chronicle/CBN/Logstash) We are encountering persistent syntax and parsing errors in a highly restricted log processing pipeline (likely based on Logstash/Grok, possibly within Google Chronicle or CBN). We need help structuring the code to handle the strict syntax and mixed log types without using advanced conditional logic. 1. Environment and Constraint  Environment: Highly restricted log parsing pipeline (cannot use standard Logstash features). Confirmed Constraints (Key Failures): NO if/else conditionals (if [field] fails, if "tag" in [tags] fails). NO semicolons (;) allowed anywhere in the config. Field names must use snake_case (e.g., host_name).

Hi Community,I'm building a bidirectional integration between Google SecOps and Jira for our SOC operations and would appreciate any guidance, tutorials, or examples from those who've implemented similar workflows. I didn’t find any good tutorial to create a playbook.

Hi everyoneI’m currently testing log ingestion from a Linux VM to Google SecOps (Chronicle) using Bindplane (no Chronicle Forwarder, only the Bindplane agent and gRPC).In the Bindplane destination, I’m using: Protocol: gRPC Endpoint: malachiteingestion-pa.googleapis.com Auth: json, with the Ingestion Authentication File from SecOps Correct Customer ID But on the VM, the Chronicle exporter always shows:"error": "upload to chronicle: Permanent error: 403 Forbidden" Any idea what can cause a 403 in this case, or anything that must be enabled/checked on the SecOps side?Thanks!

I am encountering indexing errors in the Chronicle Ingestion Health Dashboard and would like to understand the specific scenarios or conditions that lead to these errors. Could you please provide insights on the possible causes of these errors, along with the count or frequency of occurrences, and any recommended steps to resolve or mitigate them?  

I have integrated Azure Event Hub with GCP SecOps; however, we are receiving Event Hub operational logs instead of the Azure Activity logs. Can we discuss this?

Risk Analytics is a crucial feature within Google SecOps SIEM designed to help security teams identify unusual behavior and quantify the potential risk that various entities pose to the enterprise. It empowers analysts to move beyond basic alert triage and focus on the entities that represent the most significant threat. Key Components of the Risk Analytics Dashboard The central hub for this feature is the Risk Analytics dashboard, which provides a holistic view of entity risks, accessible to users with global scope in RBAC systems. Behavioral Analytics: This section lists entities (such as user accounts, servers, or laptops) based on their calculated Google Security Operations Entities risk scores. This allows tracking an entity's risk over time and serves as a metric for detection use c

 I've tried following the steps to configure the new ThreatConnect version 3.0, but the indicated log type, ThreatConnect IOC V3, doesn't appear. Do I need to request this new log type somehow? 

Hi All,In a manual case i have created entity username. I have executed Azure active directory - disable user accounts, revoke user sessions actions successfully.  when i have executed Reset User Password action im getting output as “No user passwords were reset.”. Could you please assist

Hello community,I’m sharing a composite detection pattern that took me quite some time to figure it out, because it addresses a limitation in Chronicle composite rules that isn’t clearly documented.This pattern may help whoever needs to build OR-based composite detections across heterogeneous telemetry (for example, host-based vs user-based signals). I needed a composite rule that triggers when either of the following detections fires for a watchlist entity: USB File Write activity  (host-centric) Outbound personal email attachments (user-centric) Constraints: The USB rule only has hostname The Email rule only has email address There is no common identity field across the two detections The watchlist contains both email and hostname Chronicle composite rules require all event groups in events: to be joined by equalities

There are two endpoints for log ingestion into SecOps:europe-malachiteingestion-pa.googleapis.comchronicle.googleapis.comWhether using the APIs directly, or via the bindplane agent, we can get successfully logs into our SecOps instance.The "legacy" Malachite API works perfectly. The logs, labels, and base_labels are added, meaning Data RBAC works as expected.metadata.base_labels.allow_scoped_access = true metadata.base_labels.ingestion_kv_labels[0].key = "attempt_id" metadata.base_labels.ingestion_kv_labels[0].value = "597901e6cbfb490e8903fb660da2b4e0" metadata.ingestion_labels[0].key = "attempt_id" metadata.ingestion_labels[0].value = "597901e6cbfb490e8903fb660da2b4e0"The v1alpha, chronicle API allows our logs to be ingested. The ingestion labels are visible in SecOps, but the

Hi Team, We have integrated CrowdStrike via remote agent. For ‘Submit File’ action we need to give the file path. What is the process of submitting file- is it possible to attach the file to case wall and then pass that file to CrowdStrike for analysis?For Analyst, they only have access to case wall, they don't have access to remote agent server. File may be malicious, is it safe to upload such files on case wall?