Google Security Operations

Hi,I'm seeking help reaching the Trust & Safety team on a long-pending appeal. Workspace Supportc and Swedish Phone support redirected me here. My production project was suspended on May 18, 2026. I filed an appeal immediately with a full remediation report.Ticket reference: EGRCW6HSJWPDIIENTWYN4CQ5VUTimeline:May 18: Suspension. Appeal filed same day, automated confirmation received. May 19 - 24: Follow-up appeals get on the same ticket. Only automated responses. May 25 (today): 7 days suspended, zero human response.We have fully remediated the underlying configuration issue, verified it in code review, and added structural safeguards to prevent recurrence. All details were included in the original appeal.Business impact:This is a production B2B application with active customers. We are losing revenue every day.What I'm asking:If anyone here can help me reach a human at Trus

Hello community,I am currently working on building analytical dashboards within Google SecOps, querying directly against the detections table using the Detection Schema via the Dashboard/Analytics query engine.While writing my dashboard aggregation queries, I often need to pivot and filter based on specific rule metadata. For example:$Rulename = detection.detection.rule_name ( $Rulename = /AWS/ nocase or detection.detection.rule_set_display_name = /AWS/ nocase or detection.detection.rule_set = /AWS/ nocase)detection.detection.rule_set != "Mandiant Hunt Cloud Identification Rules"detection.detection.rule_set_display_name != "Mandiant Hunt Cloud Identification Rules"$rule_set = detection.detection.rule_set_display_namematch: $Rulename outcome: $Count = count_distinct(detection.id) $ruleSet = arr

Hello,I am trying to find a way to dynamically fill the timezone in timestamp function for example like below:timestamp.get_day_of_week($timestamp, $user_timezone) but unfortunately, this did not work for me and i got this error: parsing: unknown time zone type: <nil>do we have a way to dynamically fill out the timezone in timestamp functions in google secops rules ?Any help will be appreciated !!Thanks,Leo 

Will the SOAR SDK and Siemplify methods be deprecated after migrating SOAR to GCP?References:https://docs.cloud.google.com/chronicle/docs/soar/admin-tasks/advanced/migrate-to-gcp https://docs.cloud.google.com/chronicle/docs/soar/admin-tasks/advanced/api-migration-guideBackground:We are in the process of migrating to GCP for Google SecOps SOAR. We currently have an integration that uses the SOAR SDK internally, and that SDK is built on the older Siemplify APIs.Questions:1. Will the SOAR SDK be fully migrated to the new Chronicle API?

I have looked over a number of posts regarding this but did not see an example of how to do it being posted.I need to make routine calls to a platform to pull reports and upload them to a Sharepoint and send an email to a list of users. Below is some dummy data that matches the structure of the response from a httpv2 call I made."response_data": [ { "id": "rpt_001a4f92", "name": "Q1 Sales Summary", "lastRun": "2026-04-14T08:00:00.000Z"}, { "id": "rpt_002b8c31", "name": "Monthly Active Users", "lastRun": "2026-04-14T07:45:22.000Z”} ]How do I iterate over the response_data  in a SOAR block, preserving the name (for comparison with a custom list to identify the email contacts) and id (used to pull the reports last run in another httpv2 call)?Flow should be:Get List of Reports (httpsv2) → For Each Item in Get List of Reports.response_data → Get Last Run data → Save to CSV (use loop.item name to name it with the

Hello SecOps Community!We are excited to announce that Support for SOAR Custom Fields in Native Dashboards is now generally available and enabled for all customers!What are SOAR Custom Fields?While SecOps Native Dashboards have long supported querying a comprehensive set of standard SOAR fields (such as case names, priorities, assignees, and stages) to track alerts and cases, we know that every organisation's incident response process is unique. SOAR custom fields allow your team to capture specific business contexts—such as an affected business unit, internal tracking IDs, or specific threat tags.This update officially extends our existing standard SOAR data capabilities. You can now seamlessly query dynamically created SOAR custom fields directly within the native dashboard platform. Analysts can leverage YL2 queries to read, filter, and aggregate data based on these unique business contexts.Note: For historical reference o

The alert included in the case has a product field.In "SOAR Reports legacy", the product field is available. Where can I find this field when using Dashboards and the "Cases and alerts" data source? https://cloud.google.com/chronicle/docs/reference/soar-data-dashboard#cases-and-alertsI reviewed all the fields, but I didn’t find any product field. Anyone would know?   

As you may know, Google SecOps lets you search raw logs using the `raw = "value"` syntax. That is useful during investigation, especially when a value exists in the original log but was not normalized into UDM. Raw Log Search can help you find artifacts, validate parser gaps, or confirm whether a value exists in the ingested raw event. However, this is not the same as being able to use the raw log directly inside a detection rule. In YARA-L rules, you normally operate on UDM fields. That means you cannot simply write a rule that searches the raw log the same way you would use `raw = "value"` in investigation search. You also cannot directly add the raw log as an outcome unless that value exists in a field the rule can reference. That creates a practical gap: - you may need to filter on a string that exists only in the raw log- you may need to exclude a known marker that was not parsed- you may need t

Hi Community, we’re launching a new post every Monday (well this week is Tuesday since the US had a holiday Monday). Our goal is to bring you the latest updates to Google SecOps every Monday: what you should know, what you should care about and why it matters. We want to hear if this content is helpful so give us a thumbs up or share your feedback in the comments.  These great tips and reads are brought to you by Chris Martin, Google Security Specialist. Thank you Chris. Keep the insights coming!  What’s New in Google SecOps for the interval May 18th through May 24th 2026.  Product Updates & New Features 

Hey all,Long-time SIEM user here. Just open-sourced something and would love eyes on it.The problem I keep running into is feed health. Feeds go silent, and nobody notices in time. SecOps shows feed state in the GUI (Active, Archived, Error), but a feed can remain Active even when no events are being ingested. Cloud Monitoring metrics are more reliable but have their own gaps. And manually putting it together every time - detect, restart, ticket, and notify the owner- is just too much work.I read the existing threads here, plus David French's two-part series and thatsiemguy's forwarder telemetry walkthrough. All useful, and they confirmed a lot of us are struggling with the same thing. So, I built something to automate it.What it does: a Cloud Run Job runs on a schedule and applies three independent checks per feed. First, Chronicle's feed state. Second, an ingestion anomaly check using the median and MAD, so that one quiet day doesn't drag the baseline.

At present, playbooks can only be triggered based on information available at the time a case is created, such as initial case fields or other creation‑time metadata. This is a significant limitation, as it prevents triggering playbooks based on later context, including alert data from additional systems, case stage changes, enrichment results, or information added manually by an analyst.As a result, it’s difficult to design playbooks that respond dynamically as a case evolves, which is a common requirement in real‑world SOC workflows.Based on the discussion in Unable to trigger playbook when case is set to notify (linked above), it sounds like expanded triggering capabilities are planned for Q2 this year. Is there any additional clarity on what functionality this feature will include, and whether there is a more specific timeframe for its release?In the meantime, is there a recommended workaround from Google to address this limitation, or is manually a

i need some good websites/reference for having kube use-cases. Please share the link if anyone come across.

Hi everyone,I am trying to send notifications from a Google SecOps SOAR playbook to a Microsoft Teams channel using the Microsoft Teams integration.The message is sent successfully to the Teams channel, but the issue is that the Text field seems to be handled as plain text only and does not preserve formatting.I have tested several formats:Plain text with real line breaks:info AlertDXX: XXXXXIXXX XXXXXXXXX status: XXXXXXXXX status: XXXXXHTML formatting using basic tags such as p, b, br, ul and li.Markdown formatting using bold text and bullet lists.I have also tested br tags, newline characters and HTML entities such as line break entities.In the Teams channel, the result is that everything is displayed in a single line, or the HTML and Markdown are shown as literal text. Line breaks, bullet lists, bold text and HTML are not rendered.The only Teams-related action I can see that includes Cont

Hello everyone, I have a question about a dashboard that I found in a repository in git hub which measures the daily intake in GB for Google SIEM. My question is about the filters, what is the exact amount it measures including all sources and integrations, I have the Forwarder, Ingestion API, Out of Brand Processor option selected by default, additionally the Normalizer option is unchecked, if the framework increases my intake considerably, should the latter be selected for an exact measurement or is it not necessary?     

Google SecOps organizes data very well by log type, but it does not provide a simple native "data sources" view where you can reliably list every sending host or source IP across log types. That becomes a practical problem when you need to answer questions like: - which devices are sending this log type?- which source stopped sending logs?- how many unique senders do I have for this source?- which new source IPs appeared recently? Relying only on UDM hostname fields is not always enough. Fields such as `principal.hostname`, `target.hostname`, or `asset.hostname` depend on the parser and on what the original product included in the payload. In real environments, hostnames can be duplicated, missing, misleading, or unrelated to the device that actually sent the log. For syslog-style ingestion, the sender IP is often known at the transport or receiver layer, but it may not exist inside the raw me

Hello community! Does anybody know if it is possible to change the GSO UI language to spanish (either LATAM or Spain)?

Has any one completed the stage 2 of SOAR migration to GCP ?Could you simply explain the pointers that you followed for the same.  

I know that Google is currently increasing the API limits for Google SecOps to go up to 2000 for APIs. I imagine that this would also apply to the the “Execute UDM Search” action in the GoogleChronicle integration? Would the same API quota also apply to stats searches launched through that action?

Hello,Can someone please let me know if it is possible to create a drill-down for Open and Closed Cases in dashboards?For example, if I click on the “Open Cases” or “Closed Cases” count/chart, I would like it to redirect me to the Cases page filtered specifically for Open or Closed cases.Is this functionality currently possible in Google SecOps dashboards?Thank you.

Hello I am new to the sscops world and my mentor tasked me with integrating the successful and unsuccessful login attempts from the admin console to SecOps platform. I know that we can export the login logs as a csv file, is there any automated way where we can like send these logs to the cloud console for the eecops directly or at least the logs explorer Thank you!

I wanted to share a practical workflow pattern I’ve been using with Google SecOps for detection rule management.This is not meant as a replacement for the Gemini capabilities already available in Google SecOps. In my environment, Gemini has mostly been relevant on the SOAR / automation decisioning side, while Claude Code has helped in a different layer: as an external workflow layer on top of the Google SecOps API for repetitive rule-management tasks.That distinction matters.I’m not using Claude Code to “chat about alerts.” I’m using it to operate on top of real rule workflows that are usually slow, manual, and inconsistent when done only through the console.The common problems are familiar to anyone who has operated a SIEM for a while:rules become outdated over time rules are created by different engineers or different teams

Does anyone have any solutions/integrations/tools that they use to run Google searches via the SOAR and then display the results in some fashion?One use case could be to track hits for search terms on new items.

Hi AllI am working on a query in Google Chronicle SIEM where I have predefined list of 15 events. However, only 11 of those events are currently present in the SIEM Logs. My requirement is to use the full list of 15 events as a reference and build a query that validates whether each exists in the SIEM logs or not. The output should includes all 15 events, not just the ones found in the logs.  Expected output format:PRODUCT | EVENT (From predefined list) | status----------------------------------------------------------------------------------Product | Event1 | Logs are AvailableProduct | Event1 | Logs are not Available Logs Available - events exists I'm both siem and predefined listLog not Available - event exists in the predefined list but not in siem logs.  I attempted using Data Tables, but I'm facing issues correlating the table values with Metadata field's. I was also una

Hello Community Managers,Our live production financial application (Project ID: kinta-app-1dfa4) was hit by an automated suspension loop regarding an unrestricted Gemini API key profile. We have already completed 100% of the technical remediation:1. All unrestricted API keys inside Google AI Studio have been completely purged and deleted.2. Local tracking build caches have been destroyed and our git repository is fully sanitized.A live support engineer (Glenn) has opened Firebase Support Case ID: 10407557, and our official GCP Trust & Safety Appeal Reference ID is BQVZXMYPO7564J2WSJEEPB52MI.Because this is a false-positive on an entirely secured backend, and we have over 5,000 live production users currently experiencing a total outage, we urgently request a Community Manager to internally flag or escalate our Appeal Reference ID to the Trust & Safety manual review team. Thank you for your urgent assistance.

Hi everyone,I’m currently exploring how to detect potential data exfiltration using firewall logs (FortiGate) in Google Security Operations, and I’d really appreciate some feedback from others who have worked on similar use cases.I’m noticing that a lot of legitimate traffic (e.g. Microsoft services, video streaming, web analytics, normal browsing) can generate significant outbound activity, which makes it challenging to distinguish between normal behavior and potential exfiltration.I’d be interested to understand how others are handling this in practice: What signals or patterns do you rely on when working primarily with firewall logs? Do you focus more on behavioral anomalies, destination-based detection, or a combination of both? How do you effectively reduce noise without missing real threats? Are there specific indicators that you’ve found particularly reliable for detecting exfiltration?