Community

Hello, Cloud Security Enthusiast! 👋 Introduce Yourself!

How to set alert name ?

I have built a custom connector and now i have alerts flowing in and now i want to customize alert name with some enriched values how can i achieve this ? kindly help me with thisand please dont provide answers from AI

414

V

4 hours ago

matthewnicholsCommunity Manager

News & Announcements

Hey Everyone!Welcome to the Google Cloud Security Community! We want to kick things off by getting to know each other better. This space is all about connecting, sharing, solving, and building the future of cloud security – and that journey starts wi

182564

1 day ago

CoryCousinsNew Member

Issues with malachiteingestion-pa.googleapis.com?

We successfully established HTTPS log forwarding profiles within Palo Alto Strata Logging Service last year using https://malachiteingestion-pa.googleapis.com/v2/unstructuredlogentries:batchCreate. Although these profiles continue to forward logs to

2433

mccrilbSilver 2

How We Use Chronicle YARA-L and Gemini SecOps to Catch SaaS Account Takeovers (Without Flooding the SOC)

Here is how we combine Chronicle YARA-L correlation with Gemini SecOps to solve a tricky detection challenge:What the rule captures in Chronicle: We watch for a single user account accessing Workday from at least two completely different external ne

170

New to Google SecOps: Building Your First Search with SQL Pipes

jstonerCommunity Manager

Community Blog

I’m excited to write this blog as we start a new journey to leverage SQL to build searches in Google Security Operations (SecOps). Over the past four years, search in Google SecOps has evolved from boolean logic to adding YARA-L constructs that enabl

2031

Fraud Defense (reCAPTCHA)

michal-devBronze 1

reCAPTCHA Android SDK: valid tokens score 0.0 with empty riskAnalysis.reasons on a Pixel device

I'm seeing a specific Android device consistently receive floor scores from reCAPTCHA Enterprise, and I can't find any signal that explains why. Looking for anyone who has seen this pattern or knows what an assessment with score: 0 and no reason code

1333

CalsyNew Member

ServiceNow and Google SecOps Sync

Hi everyone,I am attempting to set up ServiceNow CMS as our ITSM for ticket management, and I am wanting to implement a sort of polling in Google SecOps to check if any updates have been made to the ServiceNow case.I am not too concerned with comment

302

arv261095Bronze 2

GCP - Secops ingestion filter change / update activity detection

Hi Team,I have below ingestion filter in GCP which is applied to logs sent out to secops someone changed the filter but i am not able to search for log for the same to identify who updated / changed the filter is there a way to get that details from

221

ssuluguriNew Member

Office 365 Parser extension to extract array of mail_ids from InternetmessageID

Hi Team,We have a sample log where the internetmessageID field is being mapped to network.email.mail_id in UDM. We need to create an array for this field using a parser extension.As I am new to parser development, could someone please guide me on how

110

RLee11212016New Member

Help with mapping multiple values to a single UDM field to create an array that can be queried

I need to map specifically internet message ids from the Office 365 logs. Issue is in the mailitemsaccess logs that are bind events, multiple internet message ids can be captured within a single json path. I need to be able to iterate through and gra

1654

Fraud Defense (reCAPTCHA)

michal-devBronze 1

reCAPTCHA Android SDK: valid tokens score 0.0 with empty riskAnalysis.reasons on a Pixel device

I'm seeing a specific Android device consistently receive floor scores from reCAPTCHA Enterprise, and I can't find any signal that explains why. Looking for anyone who has seen this pattern or knows what an assessment with score: 0 and no reason code

1333

CalsyNew Member

ServiceNow and Google SecOps Sync

Hi everyone,I am attempting to set up ServiceNow CMS as our ITSM for ticket management, and I am wanting to implement a sort of polling in Google SecOps to check if any updates have been made to the ServiceNow case.I am not too concerned with comment

302

GCP Cloud NGFW issued TLS certificates don't have AKID extension

SeethaarBronze 1

Security Validation

We noticed that the GCP Cloud NGFW Enterprise endpoints issue impersonation certificates without AKID extension. This violates https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.1While Cloud NGFW is claimed to be powered by Palo Alto network

101

K

KarthikTechNew Member

Integrating Bindplane OP console Audit logs with Secops

Hi All,In our environment, we are using the Bindplane OP Console. As part of our logging and monitoring requirements, we need to forward the Bindplane OP Console Audit logs to the SecOps console for centralized visibility and analysis. Could someone

1454

Fraud Defense (reCAPTCHA)

R

rdhd0701New Member

reCAPTCHA Enterprise checkbox image-challenge renders button/error text as corrupted strings for non-latin languages

Summary:In the checkbox image challenge popup, the instruction line renders correctly in Japanese (e.g. 「横断歩道のタイルをすべて選択してください」), but the red hint/error text and the verify/skip button labels render as random-looking strings (e.g.F&JfWOUD, 9-CW`).

2023

5 days ago

soaruserBronze 2

Google SecOps Scheduled Report via Email

Hi everyone,How to change the "From Email address" in SecOps Scheduled Reports. As I can see it is being sent from Google SMTP server, But I don't want to send data to Google SMTP instead I want to use our internal SOAR Email Integration to send this

373

5 days ago

FounderbyledBronze 1

Where should deterministic authorization live before an AI agent executes a transaction?

Google Cloud’s agentic architecture provides strong controls for identity, isolation, prompt protection, observability, and tool access.However, once an AI agent is allowed to trigger a consequential operation — such as approving a financial conditio

684

5 days ago

TheDani3000New Member

Unknown Google Cloud project appears in my account and I cannot remove access

My personal Google account unexpectedly has access to a Google Cloud project that I do not recognize.Project ID: enhanced-epoch-kf6jrProject number: 379531433770Organization ID: 71994629047The project is inside an organization and folder hierarchy th

221

6 days ago

lifeofmorpheusNew Member

Setting the Ingestion Namespace

Hi,I’m trying to build a Native Dashboard that would show the log_count and log_volume for GCP Projects but owned by different business units in the org.Also, all ingestion into SecOps is via Direct IngestUsing the below query, the namespace returns

251

6 days ago

hliuBronze 4