Security Forums

Hello everyone,I am currently facing a challenge where I need to perform data matching based on a specific field. However, this field contains enriched values that lead to incorrect matches. I want to ensure that my matches are based solely on the original values in this field, without considering the enriched information.Is there a way to configure my detection logic to exclude these enriched values? Any guidance, instructions, or best practices on how to achieve this would be greatly appreciated.

I have a warning on my account that I can't remove. I didn't use the service and I want to contest the payment.   Pré-pagamento pendente.Google Cloud 01C130-FE3231-967E6A: Pré-pagamento pendente: o serviço requer um pré-pagamento único de pelo menos R$ 200,00 para ser ativado. Se você já tiver feito isso, o pagamento será creditado na sua conta em breve.

I have a warning on my account that I can't remove. I didn't use the service and I want to contest the payment.   Pré-pagamento pendente.Google Cloud 01C130-FE3231-967E6A: Pré-pagamento pendente: o serviço requer um pré-pagamento único de pelo menos R$ 200,00 para ser ativado. Se você já tiver feito isso, o pagamento será creditado na sua conta em breve.

Is there a way I can continuously export the SOAR case data used in dashboards to BigQuery?

Hi all, I am writing phishing investigation playbook, I want to validate SPF, DKIM, and DMARC status for the sender domain on Google SecOps SOAR playbook. Is there any integration which supports this action? Thanks!

Hello team, do you have any guidance on developing a risk analytics rule that identifies when an entity exhibits a sudden spike in risk score? In the rule below, I can generate an alert when an entity’s risk score on the Risk Analytics dashboard exceeds a defined threshold. However, I’m more interested in detecting a sudden spike in the entity’s risk score rather than relying on a static benchmark.i have two use cases one is to alert when any user’s risk score in analytic dashboard crosses a benchmark and the other one to detect on sudden spikeAlso, for Risk Analytics, I could not find a UDM field that represents a normalized risk score. I only see the raw risk_score and the delta_risk_score fields.Which of these fields would be the most appropriate to use for t

Hello everyone, I’m trying  to add Custom Tags to Defender Unified Portal Alerts. Prior to the migration I was able to do this with the Sentinel Connector after the SIEM Migration into Defender the only action I can find is “Update Alert” from the GraphApi Integration.Is the Update Alert Action working on Incidents or Alerts?As far as I can see only on Incidents you can update Tags ->Update incident - Microsoft Graph v1.0 | Microsoft Learnnot on Alerts. When trying to update an Incident I get this:The Incident does exist: 

We are raising this concern to the Google Cloud Security / reCAPTCHA community to understand whether the behavior we are observing is expected and to seek guidance on best practices.After deploying reCAPTCHA v3 to our UAT environment, we are consistently receiving lower scores compared to our QA environment, even though the same reCAPTCHA site key and secret key are used in both environments. The QA setup runs on a single server, whereas the UAT environment is deployed across multiple servers with different IP addresses.From an application perspective, the reCAPTCHA integration is functioning correctly in both environments. However, the score variation is impacting our ability to apply a consistent validation threshold.We would like to understand: Is it expected behavior for reCAPTCHA v3 scores to differ between a single-server setup and a multi-server setup with multiple IP addresses, even when using the same keys? Does reCAPTCH

Hi All,Would like to know if there is a possibility to monitor the changes made to a reference list such as adding / deleting a value from the reference list? As we have for changes made to rules from GCP console. Thanks!

Hi everyone,I’m new to Google SecOps and currently working with the Enterprise edition. I’d like to understand how I can get the most benefit from the platform’s threat intelligence capabilities.I’m aware that I can use VirusTotal Context in my use cases for enrichment and detection, but I’m curious about how I can leverage Mandiant intelligence in a similar way. I can see Mandiant alerts and IOCs in the interface, but I’m not entirely sure how to make the best use of that data for proactive threat hunting, detection rule development.Could anyone share best practices or examples of how they’re using Mandiant within Google SecOps Enterprise? Any tips or guidance for someone new to SecOps would be greatly appreciated.Thanks in advance!

Hi,I’m trying to create an alert based on multiple alerts from the same source, my goal here is to raise an alert when more than 2 different alerts from the same source were triggered, and from there if i have two alerts with low severity maybe raise one with medium severity and if i have two medium rise one high an so on.So far I have this alert:rule Multiple_events_same_source { meta: author = "" description = "this rule " severity = "High" events: $e.detection.collection_elements.references.event.principal.hostname != "" $e.detection.collection_elements.references.event.principal.hostname = $SourceHost NOT $e.detection.detection.rule_name IN %WHITELIST_MULTIPLE_EVENTS_RULE match: $SourceHost over 1h outcome: $risk_score = 0 condition: #e > 2 }  But what i want to achieve

Dashboard reports (Non-legacy) have no email delivery . Unable to schedule reports like the legacy ones. Is this feature out yet ? How do we schedule daily report to be sent to an email address

Hi everyone, I’ve been exploring how AI and cloud tools can help automate everyday tasks while keeping data secure. One area I’m curious about is managing personal finances—specifically, using secure methods to check bank balances without logging into a bank branch or multiple apps. I’m interested in approaches that could work with cloud-based AI tools or secure automation scripts, and banks like FAB. How can such systems be designed to stay safe, respect privacy, and integrate with existing cloud security best practices? Any guidance or examples would be really appreciated.

Log Parsing Issue in Restricted Pipeline (Chronicle/CBN/Logstash) We are encountering persistent syntax and parsing errors in a highly restricted log processing pipeline (likely based on Logstash/Grok, possibly within Google Chronicle or CBN). We need help structuring the code to handle the strict syntax and mixed log types without using advanced conditional logic. 1. Environment and Constraint  Environment: Highly restricted log parsing pipeline (cannot use standard Logstash features). Confirmed Constraints (Key Failures): NO if/else conditionals (if [field] fails, if "tag" in [tags] fails). NO semicolons (;) allowed anywhere in the config. Field names must use snake_case (e.g., host_name).

Hi Community,I'm building a bidirectional integration between Google SecOps and Jira for our SOC operations and would appreciate any guidance, tutorials, or examples from those who've implemented similar workflows. I didn’t find any good tutorial to create a playbook.

Hi everyoneI’m currently testing log ingestion from a Linux VM to Google SecOps (Chronicle) using Bindplane (no Chronicle Forwarder, only the Bindplane agent and gRPC).In the Bindplane destination, I’m using: Protocol: gRPC Endpoint: malachiteingestion-pa.googleapis.com Auth: json, with the Ingestion Authentication File from SecOps Correct Customer ID But on the VM, the Chronicle exporter always shows:"error": "upload to chronicle: Permanent error: 403 Forbidden" Any idea what can cause a 403 in this case, or anything that must be enabled/checked on the SecOps side?Thanks!

I am encountering indexing errors in the Chronicle Ingestion Health Dashboard and would like to understand the specific scenarios or conditions that lead to these errors. Could you please provide insights on the possible causes of these errors, along with the count or frequency of occurrences, and any recommended steps to resolve or mitigate them?  

I have integrated Azure Event Hub with GCP SecOps; however, we are receiving Event Hub operational logs instead of the Azure Activity logs. Can we discuss this?

Hi all, I have one V2 Tickbox for years. It got automatically migrated towards the end of 2025, and I finally got around to having a closer look at the Google Cloud environment, which is completely new for me. Everything looks OK when accessed from the legacy google.com/recaptcha/admin reCAPTCHA administration. Also, the reCAPTCHA technically works, but I am not sure for how long. I have already enabled the free $300 testing period in Google Cloud and inserted the Credit Card details into the Google Cloud billing. But I am getting the following error when looking at Google Cloud → Security → reCAPTCHA administration page.The overview of Keys lists my key with a “Status” displayed as a dark grey/black circle followed by “Unknown” Once I open the detail at the “Overview” page, in the top right column, there is the dark circle with “Unknown” repeated and the below reads: “Something went wrong Unable to determine the status of