Google Security Operations

Just wanted to share some quick things I’ve learned about migrating to use the newq Chronicle API endpoints: 1. The APIs are maturing (but not uniformly)Over roughly the last four months, a number of endpoints that were previously available only through the unstable v1alpha API have become available through production-ready v1 endpoints.There are still exceptions, though.A number of endpoints with “legacy” in their names remain available only through v1alpha, largely because their payloads still mirror the structure of the older SOAR APIs.2. Your GCOM migration state mattersSome functionality will not work completely until the tenant has completed GCOM Stage 2 migration.This has been particularly noticeable with integrations.For example, exporting an integration from a migrated tenant and importing the resulting ZIP into a tenant that has not yet migrated currently isn't viable for us.That can leave manual transfer of custom actions as the only practical option.3. Migrating custom acti

Project ID: meeings-acc6e (Aura Notes)Ticket Reference ID: ZH4ATUO7HEX2U3633LN6LOUSLUSuspension reason: account hijacked (compromised credentials)Suspended since: September 4, 2026Appeal history (all under the same ticket):- Appeals submitted: Sept 12, Sept 25, Oct 7, Oct 12 (plus Sept 5 original)- Follow-up emails to the compliance address: Sept 9, Sept 10- Each submission produced only an automated "Appeal Received" email.  No human response or request for more information in 41 days.Root causes found and fixed:1. API keys were committed to Git history of a private repository.   History was cleaned and the keys were deleted.2. A config file containing an API key was bundled as a plain asset in   the published Android app. The asset has been removed from the app   source and the key was deleted. A new release will not include it.3. Local tooling access was reduced: Firebase CLI access was revoked   from the Google account, and no service account key files exist on   the development ma

Hi everyone,We have noticed that when certain detection rules exceed resource consumption limits, Google SecOps automatically transitions them to a PAUSED state (following the LIMITED throttling period). Because paused rules stop evaluating events and generating alerts, we need to monitor these operational status changes closely.I have two questions regarding identifying and tracking these transitions: Native Notifications: Does Google SecOps support any built-in alerting or notification mechanism (such as in-console alerts, bell notifications, or automated emails) when the platform suspends a rule due to high resource usage? Identification & Auditing: What is the recommended way to capture the exact timestamp when a rule moves to PAUSED? Should we be just polling the SecOps REST API (rules.list / rules.get with executionState)?   How are other teams tracking degraded or paused rules to ensure detection coverage isn't silently lost? Any API query examples, or best practices would

IntroductionWhen building custom HTML views in Google SecOps, one common challenge is making embedded content adapt to the application's current visual theme.A custom HTML view may look perfectly fine in light mode but become difficult to read when the surrounding application switches to dark mode. Hardcoded backgrounds, text colors, and link styles can create visual inconsistencies and reduce readability.Fortunately, a small JavaScript and CSS addition can make an HTML view respond dynamically to theme changes and, where supported, synchronize its appearance with the background color provided by the parent application.How does it work?The solution combines three mechanisms: System theme detection — Uses prefers-color-scheme to detect the user's operating-system preference as an initial fallback. Parent-window communication — Listens for messages from the parent window containing a background color, allowing the embedded view to infer whether the surrounding interface is light or dar

Hey folks,As you all know, our built-in IDE, despite being a powerful tool, still has a lot of limitations, which can make the development process frustrating. Instead of trying to reinvent the wheel, we want to enable developers to work in the environments they are more used to and to be able to leverage all of the latest technologies to make this process as simple as possible.   In this post, we would like to present a new flow, which enables you to use the local IDE environment to create/update integrations and manage it on Github. In simple terms, this new approach consists of 2 steps:Make all of the changes in the forked version of our existing Github repository Pull/Push updated content to Google SecOps via our developed mp toolMain benefits of this approach is that you fully own your version of Github repository. You can add dedicated CI/CD workflows, pre-commit hooks, AI integrations, Github actions  - anything to operate efficiently. ❗Note: this is still a Preview version  and

I am working on a use case in Google SecOps SOAR where I want to automatically retrieve files attached to a case and submit them to an external platform for further analysis.We are using the get_attachments function from the Siemplify SDK to retrieve attachments associated with a case. However, we have noticed that this function retrieves attachments added through case comments but does not seem to return attachments added by other actions.For example, suppose an action adds a file attachment when it is executed within a case. The attachment is visible in the result of that action. Later, when another action runs on the same case and uses the get_attachments function from the Siemplify SDK, the attachment added by the previous action is not returned. However, attachments added through case comments are returned successfully.Our goal is to retrieve files associated with a case, regardless of whether they were added through case comments or by other actions, so that we can use them in su

Hi, is there a way to check the user that has last updated a rule from the SecOps platform without checking cloud looging? 

Hi Google SecOps Community,i would like to confirm whether YARA-L supports Levenshtein distance (edit distance) or any equivalent fuzzy string-matching functionality.Use Case:We have a detection that identifies potential data exfiltration through Microsoft 365 Exchange emails by comparing the username portion of the sender's corporate email address with the username portion of the recipient's personal email address.The objective is to identify sender and recipient usernames that are identical or differ by fewer than three character edits.For example: [removed by moderator] → [removed by moderator] (distance = 1) [removed by moderator] → [removed by moderator] (distance = 2) Questions: Does Google SecOps YARA-L 2.0 provide a built-in function for calculating Levenshtein distance between two strings? If Levenshtein distance is not supported natively, is there another supported YARA-L function or approach for fuzzy string matching? Can this comparison be implemented directl

Hi All, Can someone please clarify how custom IOC data is stored in the SecOps? I am coming from Splunk ES, where IOC indicators are stored in KVStore as simple lookup lists.However, when setting up third-party API feeds for IOC ingestion (Anomali) the data is ingested into SIEM with time dimension. (e.g. graph.metadata.vendor_name = "ANOMALI_IOC" over last 30 days gives 30 matchies for the same IOC).Wouldn’t it make more sense to store IOC as timeless data? Thanks!

When creating a saved/dynamic search in Search Manager using the ${variable} placeholder syntax, the input box generated at runtime only supports exact string equality matching. There appears to be no way to pass a regex pattern (e.g., wildcard .*) through this input box to perform pattern-based matching on UDM fields.Steps to ReproduceNavigate to Search Manager and create a new saved search with the following query: metadata.log_type = ${log_type}   Save and run the search — an input box is correctly generated, prompting for a value for log_type. Enter a regex pattern as the value, e.g.: .* Observed result: The query executes as metadata.log_type = ".*", treating the input as a literal string rather than a regex pattern. No results are returned (since no log_type literally equals .*).Attempted WorkaroundsAttempt 1: Replaced = with =~ operator for regex matching:metadata.log_type =~ ${log_type}  Result: Compilation error:lexer error: token recognition error at: '~' line: 1 column:

I am working on a use case in Google SecOps SOAR where I want to automate file processing using file paths available in alert details.In some scenarios, an integration adds a file path to an alert's details. This path points to a file stored on a specific remote machine, such as an endpoint or server. However, the action that needs to process the file may be running on a different machine, so the file is not directly accessible using the provided path.For example, an alert might contain a file path such as C:\Users\user\Downloads\suspicious.exe. This file exists on the endpoint that generated the alert, but the action running in Google SecOps SOAR may not have direct access to that endpoint or its local file system.My goal is to automate the process of retrieving the file from the machine where it resides and then submitting it to an external analysis platform or processing it through another action.I understand that accessing a file using its path requires access to the machine or a m

Hi,Can anyone explain about the SOAR based approach to ingest alerts from MDE to SecOps SOAR instead SecOps SIEM?  Does anyone faced any challenges? Which connector I should use? Microsoft Graph Security

I'm trying to configure drilldown functionality on a Table widget in Google SecOps Dashboards, where one of the displayed fields is an array (repeated field). I'm running into a rendering/drilldown limitation and would appreciate guidance or confirmation if this is a known gap.metadata.log_type = "ZSCALER_DNS"additional.fields["dns_record_type"] = "A"network.dns.questions.name = $requestnetwork.dns.answers.data = $responsematch: $requestoutcome: $ips = array_distinct($response)limit: 10000This groups results by $request (the queried domain) and aggregates all resolved IPs into a deduplicated array $ips.Problem:When $ips is displayed as a column in a Table widget, the array is rendered as a single comma-separated string in one cell, e.g.:142.250.122.94, 142.251.106.94, 142.250.118.94  I configured a drilldown mapping on $ips pointing to the UDM field network.dns.answers.data (operator =). However, since the entire array is flattened into one string value per cell, clicking on i

I'm trying to configure drilldown functionality on a Table widget in Google SecOps Dashboards, where one of the displayed fields is an array (repeated field). I'm running into a rendering/drilldown limitation and would appreciate guidance or confirmation if this is a known gap.metadata.log_type = "ZSCALER_DNS"additional.fields["dns_record_type"] = "A"network.dns.questions.name = $requestnetwork.dns.answers.data = $responsematch: $requestoutcome: $ips = array_distinct($response)limit: 10000This groups results by $request (the queried domain) and aggregates all resolved IPs into a deduplicated array $ips.Problem:When $ips is displayed as a column in a Table widget, the array is rendered as a single comma-separated string in one cell, e.g.:142.250.122.94, 142.251.106.94, 142.250.118.94  I configured a drilldown mapping on $ips pointing to the UDM field network.dns.answers.data (operator =). However, since the entire array is flattened into one string value per cell, clicking on i

We are migrating some workloads from Azure to GCP and in Azure we have Azure policy which requires resources to have contact tag and value of the tag shall be ending with @company.com, so no resources can be created without that tag being present.I tried to perform the same in GCP and it does not seem to work, tag with dynamic values does not seem to be attached to new resources at all. Environment isTag key [removed by moderator] /Product (tagKeys/ [removed by moderator] ): predefined values, e.g. DevOpsTag key [removed by moderator] /contact (tagKeys/ [removed by moderator] ): dynamic values, allowedValuesRegex: ^[A-Za-z0-9._%+-]+@company[.]com$My condition is condition: resource.hasDirectTagKey(" [removed by moderator] /Product") && resource.hasDirectTagKey(" [removed by moderator] /contact")methodTypes: [GOVERN_TAGS]resourceTypes: [compute.googleapis.com/Instance]actionType: ALLOWStep to reproducegcloud compute instances create tag-test --project comp-dev1 --zone us-east1-b

I’m evaluating integration approaches for ingesting alerts from Microsoft Defender for Endpoint (MDE) into Google SecOps and facing challenges with both SIEM and SOAR options.  With Google SecOps SIEM:  MDE alerts and their evidences are ingested as individual events rather than a single alert/incident This requires building additional detection rules to stitch events back together Due to high alert volume from MDE, suppression via SIEM detection rules becomes difficult to manage   With Google SecOps SOAR:  Using the MDE connector results in 1 alert = 1 case (e.g., 1000 alerts/day → 1000 cases) There is no pre-ingestion suppression/filtering mechanism Any update to an alert (e.g., assignment change) generates a new alert in SOAR, leading to duplication   Key Questions:  What is the recommended architecture for integrating MDE with Google SecOps? Is SIEM-based ingestion preferred over SOAR, or a hybrid approach? How do you handle alert suppression and deduplication at scale? Are there b

Hi everyone, We're ingesting Google Workspace logs into Google SecOps using feed-based ingestion (Method 2, Third Party API). Most Workspace feeds work, but we have two issues:1. WORKSPACE_ALERTS only brings in a small subset of the alerts shown in the Workspace Alert Center.2. WORKSPACE_CHROMEOS shows "Completed" but no data is ingested at all. EnvironmentGoogle SecOps (SIEM + SOAR), region: asia-southeast1 Google Workspace editions: Enterprise Starter, Business Starter, Frontline Starter (no Enterprise Standard/Plus) Other subscriptions: Chrome Enterprise Core, Chrome Enterprise Premium, Google Meet hardware, Cloud Identity Free Auth: GCP service account + domain-wide delegation, impersonating a dedicated Workspace admin user What's configuredAPIs enabled in the GCP project: Admin SDK API, Alert Center API Domain-wide delegation for the service account with all 7 documented scopes, including:  - https://www.googleapis.com/auth/apps.alerts  - https://www.googleapis.com/auth/admin.dire

Title: Google Chronicle SOAR Integration Fails "Test Connection" with GA v1 1Platform Endpoint (/ioc/listiocs 404 JSONDecodeError)Product: Google Security Operations (SOAR & SIEM)Integration: Google Chronicle (Marketplace Integration)1. Description of the IssueGoogle’s official Chronicle API Migration Documentation instructs customers migrating away from legacy APIs (Backstory / Ingestion) to use the 1Platform General Availability (GA) regional template:https://{region}-chronicle.googleapis.com/v1/projects/{project}/locations/{location}/instances/{instance_id} However, when configuring the official Google Chronicle integration instance inside Google SecOps SOAR using this documented GA v1 endpoint, clicking Test fails immediately with the following error:Status: 2: Result Value: falseOutput Message: Authentication with Workload Identity to Google Chronicle server resulted in failure. Error: Unable to connect to Google Chronicle, please validate your credentials: Unable to list IOCs

Hi all,In the Google SecOps feed creation UI, the Microsoft Azure Event Hub source type lets me select log types such as Azure AD Directory Audit, Microsoft Defender for Endpoint and Microsoft Defender for Identity.However, the documentation for these log types only describes ingestion through Azure Blob Storage (Event Hub Capture for Entra ID Audit, Streaming API to Storage for MDE/MDI).Is ingesting these log types directly from an Event Hub, without Capture or Blob Storage, officially supported?Thanks!

My customer data is still on Google Cloud, but my entire account has been banned. I only want to restore access as quickly as possible.After I submitted an appeal, I received an email from an address in this format:google-cloud-compliance-reply+{case-tag}@google.comI was not sure whether replying directly to that message would reach the compliance team and be added to my case. I replied to that email one day ago, but I have not received any response yet.I am in a hurry because the Appeals page only allows 500 characters, and I have also read that I should not submit duplicate appeals. Because of that, I cannot tell whether my case is still moving forward.Could someone confirm the correct way to follow up: wait for a reply to that email, or use another channel? I will not post my project ID, case ID, or the full address here.

Hi All, I am testing the Microsoft 365 Defender (XDR) Integration v26.0 and have observed the following which when looking at the documentation seems to be by design. Scenario 1Event triggered and “Incident 1” created in XDR Event triggered and “Incident 2” created in XDR Both incidents and their associated alerts are ingested into the SOAR and created: Case 1 with the name “Incident 1” Case 2 with the name “Incident 2” XDR then correlated Incidents 1 & 2 and based on a rule and renamed “Incident 1” to “Suspicious activity on one endpoint”  moved the alert from “Incident 2” to “Incident 1” and closed “Incident 2” The Sync Job in SOAR attached all alerts to Case 1 but left the Case name as “Incident 1” The SOAR Case “Incident 2” was left open along with it’s associated AlertScenario 2Event triggered and “Incident 1” created in XDR Event triggered and “Incident 2” created in XDR “Incident 1” ingested into SOAR and a Case created with the same name “Incident 1”  Before Ingestion of “I