Google Security Operations

Does anyone have any solutions/integrations/tools that they use to run Google searches via the SOAR and then display the results in some fashion?One use case could be to track hits for search terms on new items.

Hello community! Does anybody know if it is possible to change the GSO UI language to spanish (either LATAM or Spain)?

Hi AllI am working on a query in Google Chronicle SIEM where I have predefined list of 15 events. However, only 11 of those events are currently present in the SIEM Logs. My requirement is to use the full list of 15 events as a reference and build a query that validates whether each exists in the SIEM logs or not. The output should includes all 15 events, not just the ones found in the logs.  Expected output format:PRODUCT | EVENT (From predefined list) | status----------------------------------------------------------------------------------Product | Event1 | Logs are AvailableProduct | Event1 | Logs are not Available Logs Available - events exists I'm both siem and predefined listLog not Available - event exists in the predefined list but not in siem logs.  I attempted using Data Tables, but I'm facing issues correlating the table values with Metadata field's. I was also una

Hello Community Managers,Our live production financial application (Project ID: kinta-app-1dfa4) was hit by an automated suspension loop regarding an unrestricted Gemini API key profile. We have already completed 100% of the technical remediation:1. All unrestricted API keys inside Google AI Studio have been completely purged and deleted.2. Local tracking build caches have been destroyed and our git repository is fully sanitized.A live support engineer (Glenn) has opened Firebase Support Case ID: 10407557, and our official GCP Trust & Safety Appeal Reference ID is BQVZXMYPO7564J2WSJEEPB52MI.Because this is a false-positive on an entirely secured backend, and we have over 5,000 live production users currently experiencing a total outage, we urgently request a Community Manager to internally flag or escalate our Appeal Reference ID to the Trust & Safety manual review team. Thank you for your urgent assistance.

Hi everyone,I’m currently exploring how to detect potential data exfiltration using firewall logs (FortiGate) in Google Security Operations, and I’d really appreciate some feedback from others who have worked on similar use cases.I’m noticing that a lot of legitimate traffic (e.g. Microsoft services, video streaming, web analytics, normal browsing) can generate significant outbound activity, which makes it challenging to distinguish between normal behavior and potential exfiltration.I’d be interested to understand how others are handling this in practice: What signals or patterns do you rely on when working primarily with firewall logs? Do you focus more on behavioral anomalies, destination-based detection, or a combination of both? How do you effectively reduce noise without missing real threats? Are there specific indicators that you’ve found particularly reliable for detecting exfiltration?

At present, playbooks can only be triggered based on information available at the time a case is created, such as initial case fields or other creation‑time metadata. This is a significant limitation, as it prevents triggering playbooks based on later context, including alert data from additional systems, case stage changes, enrichment results, or information added manually by an analyst.As a result, it’s difficult to design playbooks that respond dynamically as a case evolves, which is a common requirement in real‑world SOC workflows.Based on the discussion in Unable to trigger playbook when case is set to notify (linked above), it sounds like expanded triggering capabilities are planned for Q2 this year. Is there any additional clarity on what functionality this feature will include, and whether there is a more specific timeframe for its release?In the meantime, is there a recommended workaround from Google to address this limitation, or is manually a

Hey Community,  Due to popular demand, we are excited to announce our 2026  Agentic SOC workshop series! Building on the success of our 2025 program, which trained over 600 practitioners, we will have something new for everyone. We are building the next class of security experts empowered by AI, and we want you there. This year’s tour introduces several critical updates to keep you ahead of the evolving threat landscape. Updated Curriculum: We have refreshed our sessions to include the latest product launches, such as the Triage and Investigation Agent. Deeper Hands-on Focus: The 2026 workshops move even further into practical application, with more in-product experimentation.

Unable to view quick action widget to add in default case view. Please let me know  how can I configure it and trigger a playbkook from case 

I’m trying to implement a workflow in Google SecOps SOAR where an analyst can manually select a specific IP address entity within a case and run a playbook that performs a mitigation action (e.g., block that IP).The key requirement is that the playbook should only act on the selected entity, not all IP entities in the case.Is there a way to trigger a full playbook execution scoped to a manually selected entity (similar to how actions can target specific entities), rather than running at the case level?If this isn’t directly supported, what are the recommended workarounds (e.g., Entity Selection, loops, custom lists, or manual input prompts)? For context, I’ve already explored:- Entity Selection in playbooks- Running actions with selected entities- Quick/Manual actionsBut I haven’t found a way to initiate a full playbook execution from a manually selected entity.

Hey everyone,Google SecOps is introducing Advanced Filtering to its native dashboard platform. Note that this feature is currently in Private Preview. Since it fundamentally changes how we can build and interact with dashboards, I wanted to share a quick breakdown of how it works, how to set it up, and a few "gotchas" to watch out for.What is it?Unlike basic filters that are strictly tied to specific fields, advanced filters operate as query variables, or tokens. This allows us to inject dynamic values, complex regular expressions, or boolean logic directly into our YARA-L queries at runtime.Here is what makes it stand out: Dynamic Dropdowns: You can populate your filter choices dynamically using the results of a separate YARA-L query, ensuring users always select from up-to-date data. Flexible Formatting: You can define custom Prefixes, Suffixes, and Delimiters (like / for

I would like to open a discussion around something that repeatedly appears in SIEM operations:Who should own data ingestion?Not for common sources where the path is already clear: Windows, Linux, major firewalls, common EDRs, cloud connectors, etc.I mean the gray area:- a source with partial or outdated documentation- a vendor that only provides guidance for another SIEM- a product owner who knows the platform but not its log export options- a SIEM team that can receive data but does not control the source- a network team that owns the path but not the use case- a client or business team expecting the integration to “just work”In those cases, responsibility becomes blurry very quickly.The vendor owns the product, but not necessarily the SIEM integration.  The SIEM vendor owns the platform, but not every possible source.  The source owner controls the technology, but may not know how

 Hello Team,I am seeing a discrepancy with the stats search.When I run a normal search for EPP high alerts during the specified time range, I get 31 results. However, when I convert the same logic into a stats search with a match window, the result count increases significantly.I expected the count to be equal to or lower than 31, since the match window should group matching alerts within the defined time period. Instead, I am seeing more than 400 results, which is around 15 times higher than the original event count.and when it is run on rules i am getting 23 detectionsCould you please help confirm why the stats-based query is inflating the results and whether the match/window logic is causing duplicate or expanded matches? 

Hi, my Google Cloud/Firebase project was suspended for suspected key misuse (account_hijacked).I submitted an appeal, but after 9 days I still have no response.This is now a production outage: about 1200 paying users cannot log in and trust for my application is starting to go down rapidly. The business impact this has is nothing short of a disaster, and the students that’s using the application to study for exams are panicking and asking for refunds.What I already did:Removed exposed credentials from files/repos Rewrote Git history and force-pushed cleaned history Removed old test/dev files with hardcoded keys Tightened secret handling to prevent re-commitWhat I am ready to do immediately when access is restored:Rotate/revoke all affected keys Apply strict key restrictions (referrer/IP/API allowlist) Move secrets to Secret Manager Review IAM, billing, and audit logs

Hello Everyone,Greetings..!!I am trying to build a Google SecOps detection similar to a Splunk behavioral rule for “AWS provisioning activity from a previously unseen geographic region.”Current logic: Detect CloudTrail provisioning actions such as Run* and Create* Baseline source geolocation per activity eg : country,region ,ip ,city  Alert when provisioning comes from a new/unseen location The issue is with the baseline scale.The current baseline stores combinations of: source IP city country region/state Because of this, the baseline has grown to around 600,000 rows.In Splunk, this was implemented using a CSV lookup with historical tracking, but in SecOps we are limited by the Data Table size limit (~1000 rows), so the approach is not scalable as-is.I am looking for recommendations on

A few years ago I was in a client meeting with a senior security engineer — someone with over a decade of experience, certifications on the wall, and a title that put them in charge of guiding the client's security operations.The client asked a technical question about their SIEM configuration. Something specific — how a particular data source was being normalized, why certain events weren't triggering rules.The engineer's answer: "I'm just a security engineer. I don't do that."I've thought about that moment a lot since then. Not because the engineer was incompetent — they weren't. But because that answer revealed something real about how the industry has defined what a security engineer is supposed to know. And what they're allowed not to know.· · ·The blue team knowledge problemBefore going further: this article is not about

Hi everyone.Our current environment is deployed with one principal tenant and three additional tenants containing client data.My team consolidates all cases within the principal tenant for centralized analysis and reporting.Is it possible to build dashboards from the principal tenant? For example, we want to visualize how many cases my team has analyzed, broken down by client. Is this feasible within the current architecture? Regards,Silas Muniz

Hello Team,I am writing a rule to detect unknown IPs hitting our public-facing domains. In this rule, I only want to generate an alert when the source IP is not present in GCTI.The reason is that we already have a separate rule that handles IPs found in GCTI, so I want to avoid duplicate detections.Could someone please advise on the best way to implement a “NOT IN GCTI” condition within the rule?Is the below approach the correct way to verify that the principal IP generating the alerts is not present in GCTI? Also, is using the join with entity.ip the correct method for this check? 

Has any one completed the stage 2 of SOAR migration to GCP ?Could you simply explain the pointers that you followed for the same.  

Direct ingestion configured in GCP to Google SecOps. I noticed that, in our case, the GCP_BIGQUERY_CONTEXT dataset is very large and we would want to drop those but I can’t see where the ingestion is configured. Any tips?

Hi,I'm struggling to get cases into the right Environments in Google SecOps.I have my environments defined in the SOAR settings, and I’ve set the Ingestion Label and Namespace correctly in the feeds. I also configured the Chronicle Alerts connector to use a UDM field that carries the environment name, but for some reason, all cases still land in the "Default Environment."I've already tried swapping fields in the connector but no luck. Is there something specific about how the connector parses UDM fields for environment mapping that I might be missing?Any advice would be appreciated!Thanks 

Hey all,  Detection engineer here. Just open-sourced something that's been saving me a lot of time and wanted to share it.  The problem is well-known: Chronicle has a genuinely powerful API — rules management, bulk operations, UDM search, feed control — but most   security engineers never touch it. Not because they don't want to, but because using it requires writing Python against an SDK that has  its own undocumented quirks, field names that don't match the docs, and behaviors that only appear when you run code against a live  tenant.  Some of us script around it. Most don't, and end up doing things manually that should take one command: filtering rules by alerting  status, exporting 200 YARA-L rules to individual files, toggling alerting on a subset of rules, validating that credentials actually work.  So I built a Claude Code skill that removes the Python layer. You describe what you need in plain English. Claude maps it to the

Hey all,Long-time SIEM user here. Just open-sourced something and would love eyes on it.The problem I keep running into is feed health. Feeds go silent, and nobody notices in time. SecOps shows feed state in the GUI (Active, Archived, Error), but a feed can remain Active even when no events are being ingested. Cloud Monitoring metrics are more reliable but have their own gaps. And manually putting it together every time - detect, restart, ticket, and notify the owner- is just too much work.I read the existing threads here, plus David French's two-part series and thatsiemguy's forwarder telemetry walkthrough. All useful, and they confirmed a lot of us are struggling with the same thing. So, I built something to automate it.What it does: a Cloud Run Job runs on a schedule and applies three independent checks per feed. First, Chronicle's feed state. Second, an ingestion anomaly check using the median and MAD, so that one quiet day doesn't drag the baseline.

Hello Team,I hope you’re doing well.We are planning to integrate IPAM data with Google SecOps by ingesting it as Entity Data into the Entity Context Graph (ECG) instead of traditional point-in-time log events. This approach is intended to enable better correlation of subnet/VLAN and IP data, helping us analyze traffic more effectively at the subnet level rather than individual IPs.Please let us know if this approach aligns with best practices.