Google Security Operations

Hello,I am writing to request an urgent escalation for a suspended project that has been pending a manual review for over three weeks. My project, MindfulFlow (id: mindfulflow-613bc), was suspended due to an API key compromise.Key Timeline: Suspension Date: April 21, 2026 Appeal Submitted: April 21, 2026 Additional Info Requested by Google: April 24, 2026 Detailed Remediation Plan Sent: April 24, 2026 Current Status: No response for 19 days since my last communication. Case ID: [removed by moderator] Remediation Steps Taken: Revocation: I have already revoked the compromised credentials. Architecture Migration: I have committed to mig

I am configuring Google SecOps with Google Chat for a playbook.What works:Ping List SpacesThe target space is returned correctly, and the app is already added to the space.What fails:GoogleChat - Send Message GoogleChat - Send Advanced MessageBoth return this exact error:Error executing action "GoogleChat - Send Advanced Message". Reason: An error occurred: b'<h1>Not Found</h1>\n<h2>Error 404</h2>\n'I also confirmed that Space Name must be passed in the full resource format: spaces/{space}If I pass only the raw space ID, I get a malformed resource name error.At this point, List Spaces works, but sending messages still fails with 404 even though:the Chat app is live the

Is there a supported way to format hyperlinks within the output of a action to create clickable links? The output is going to the case wall. This is for analysts who want to read more about the action results and they currently have to copy and paste the link from the results.  Are HTML widgets the only way to display this? 

I have a real head-scratcher I’m struggling with on google scopes. I'm running queries via the "/legacy:legacyFetchUdmSearchView" API endpoint and seeing what looks like silent failure of "outcome" projections when filtering on a repeated field with "any".This query returns events but each event has an empty "outcomes" field:events: metadata.log_type = "PAN_FIREWALL" any principal.ip = "<source-ip>"outcome: $protocol = network.ip_protocolThe returned events have "network.ipProtocol" populated in the raw JSON (e.g. "ICMP"), so the field is present — it just isn't projecting through "outcome".Rewriting with placeholder binding produces populated outcomes:events: metadata.log_type = "PAN_FIREWALL" principal.ip = $ip $ip = "<source-ip>"outcome: $protocol = network.ip_protocol"$protocol" now comes back with "ICMP" a

Hello team,I’m trying to ingest GCP Monitoring alerts into SecOps using a Pub/Sub push subscription. To do this, I created an alert policy for “agent goes silent” and configured a notification channel using a Pub/Sub topic. That topic is attached to a push subscription that forwards events to the endpoint.I am receiving email notifications (since email is also configured in the notification channel along with the pubsub topic), but the alerts are not being pushed to SecOps from the Pub/Sub topic.I have given the pubsub publisher  permission to the topic My alerts are not getting acknowledged by secops endpointIs there any documentation I can refer to for correctly pushing GCP Monitoring alerts to SecOps?

Hello Team, I keep facing“Your home page does not explain the purpose of your app”“The app name shown on your OAuth consent screen does not match the app name on your home page” I can’t figure out why and what I’m missing. Thanks for any support. My site for my app is: https://www.getdailysolve.com  

Hi All,I just want to know how to calculate the Google SecOps LicenseCan someone confirm whether it calculated from throughput value or ingested eventsWhen I raised case with Google Support, I got to know it is calculated via ingested events, but I didn’t get the formula. Usually, we sign contract with google in GB/TB for period of year.Is that true? ThanksHarsha 

Hello,  I am trying to use the Wiz SOAR integration in Secops to “Get Issue Details” from Wiz. I think I have the integration setup correctly. When I run the “Wiz Ping” action I get a successfully connected to the Wiz server message. However, when I run the “Get Issue Details” on a known Wiz threat issue ID - I get the following error: Any idea why this might be the case? Thanks in advance!  

We have an Aria Operations for Logs and would like to integrate it with Google SecOps. Is it possible to integrate Aria Operations for Logs instead of integrating SecOps with each and every VMware box, example vCenter, ESXi, NSX etc. is there a Bindplane agent available?

I would like to see a list of individual devices sending syslog to our SecOps environment.  All syslog is going through Bindplane collection agents.  I’ve configured Bindplane to append IP information for each syslog exporter as an ingestion_label.  It looks like I can use this in the context of a UDM search or maybe a dashboard.  Just checking if this question/problem has already been solved through another approach.

 Anyone has any idea what the below snapshot refers to:I am trying to upgrade an older microsoft graph mail to latest versionDoes it mean entering the parameters in this instance itself  by clicking on configure or is it referring to some other connector ? 

I’m working on setting up the Response Integrations for GCP (i.e. Google Cloud Compute, Google Cloud API, etc).I’m missing a piece of knowledge on how GCP role permissions work across the organization.SecOps setup is in GCP project, we’ll call it “SecureLand”. SIEM/ SOAR migrations have occurred to move to IAM. I created a service account in there, did the work of setting it up for workload federation, did the iam.serviceAccountTokenCreator steps. Created the custom roles in “SecureLand” and assigned to the SA and setup the integrations via Workload Identity Email.The question » Do these custom roles need to be assigned at the Org Level or is there some inherited “hand waving” that happens because its done in the “SecureLand” project where SecOps is setup? Under normal situations I would say a role granted in the “SecureLand” project doesn’t allow acting in other Projects.Example: There is an alert that

Hey Community!  We often think of the power of Community and what we all have to offer each other as we enter into this shared space of knowledge, ideas, questions and connections. Today, I am THRILLED to highlight a masterclass Community user, Eoved, and his blog Beyond Chat: Building an Autonomous SOC Analyst with Claude and the Google MCP!  After catching our recent webinar, "Jump-start your MCP journey with the Google Security Community!" with 

[問題] プレイブックでEmailV2統合を使用してユーザーからの返信を待機していますが、「ユーザーからのメールを待機」アクションが「進行中」の状態で停止し、返信を検出できません。[検証済み構成] ドキュメントに基づいて、以下を検証しました。・認証：Gmail に 16 桁のアプリ パスワードを使用しています。「メール送信」と「Ping」アクションは正常に動作しています。・パラメータ：Email Message_idとEmail Dateは、SendEmail.JSONResult.message_idとSendEmail.JSONResult.email_dateのプレースホルダーを使用して正しくマッピングされます。・フォルダ: 実際のメールボックスに合わせて「受信トレイ」（大文字小文字を区別）に設定します。・メール受信：返信メールが受信トレイに実際に存在することを手動で確認しました。処理は非同期で行われるにもかかわらず、返信を受信して​​も処理が開始されません。【質問】設定が正しくても、この特定のアクションがトリガーされないという同様の状況に遭遇した方はいますか？他に隠れた要件や、取るべきトラブルシューティング手順があれば教えてください。 

Hi Team,I wanted to confirm that if we integrate Microsoft Intune logs via graph API, we will only retrieved audit logs? Is there a limitation what we cannot collect other type of Intune logs such as operational and compliance logs ?

Hi Google Team,We have successfully integrated Microsoft Intune logs into Google SecOps using a third-party Graph API feed. The feed configuration appears to be working — logs are being ingested and the feed shows a healthy status.However, we've noticed a significant discrepancy in log size:- **In Google SecOps (via the feed):** Ingested log size is approximately **40 KB**- **Manual API retrieval (direct Graph API call):** The same file/export is approximately **6 MB**This is roughly a 150x difference, which strongly suggests that the feed is either truncating or only partially ingesting the log data.**What we've already ruled out:**- Feed configuration is confirmed successful with no visible errors- Authentication against the Microsoft Graph API is working correctly- we have verified via direct API calls that pagination exist in the returned logs file and the full dataset is returned when querying manually **Qu

hello Team ,I’m observing that the curated rule “Extortion Email Detected via Subject Keywords” is not generating any alerts in my environment even though alerting is turned on for that rule for both precise and broad. However, when I create a custom detection rule with the same logic, as curated  it successfully triggers alerts on the same dataset.I’m trying to understand the gap between curated and custom detections in this case.Has anyone encountered a similar issue where:Curated rules do not fire, but equivalent custom rules do?Any insights would be helpful.

I have written a query to fetch the key value pair correct .But the result is not accurate .Could you please anyone guide me to get the key vale from repeated list ? ($e.target.resource_ancestors.attribute.labels.key = "res_spec_container_security_context_privileged" AND  $e.target.resource_ancestors.attribute.labels.value = "true")

hello Team ,I’m observing that the curated rule “Extortion Email Detected via Subject Keywords” is not generating any alerts in my environment even though alerting is turned on for that rule for both precise and broad. However, when I create a custom detection rule with the same logic, as curated  it successfully triggers alerts on the same dataset.I’m trying to understand the gap between curated and custom detections in this case.Has anyone encountered a similar issue where:Curated rules do not fire, but equivalent custom rules do?Any insights would be helpful.

How can we use group email addresses to assign permission groups and SOC roles in SOAR regardless of what IAM roles they were given in the project IAM? (e.g. Two groups with the same IAM role but who should have different permissions and SOC Roles in SOAR?) I tried to use the email address of a google group instead of a IAM Role Name but it doesn't seem to work.Docs: https://cloud.google.com/security-command-center/docs/map-users-in-secops 

I have created a new(custom) log type, Then created a custom parser for that specific log type.When I try to parse the log on UI, I get the correct UDM mapping. But when I try to send logs from the python script and check from Investigation > SIEM Search, i see that those logs are unparsed The issue that i am facing is - while validating the parser, I am getting error - Error: No sample logs exist for this log type in the last 30 days. Can someone ple

Project ID: Sporcle-952Case ID: Y5I2DIE6LAEXFVEE6GLENYG37QDuration: 14 days without a human response.The Issue: Suspected credential leak. However, we observed a legitimate traffic spike from our mobile app, Sporcle Party, on Wednesday, April 15th  with zero unauthorized billing.The Blocker: We are willing to rotate all keys and apply strict IP restrictions, but the Project is Disabled, preventing all administrative actions.Request: Can a Community Manager please escalate this Case ID for a manual review? We are currently in a 2-week total service outage for our users.  

Here are links to the things my team spoke about at Google Cloud Next '26 in John Stoner's workshop on Tuesday, all week in the Learn Pod on the expo floor, and in a breakout session on Friday. We demonstrated custom security operations agents in Gemini Enterprise, which I've previously showed in this YouTube video:Building a custom SOC agent with Gemini Enterprise The source code for that is in this GitHub repo The reference architecture (co-authored with Ben Perel) also describes that:Agentic AI use case: Orchestrate security operations workfl

I have an playbook that extracts IOCs from an email, and then adds them to reference lists. These lists are then referred in stats UDM queries that are executed using the marketplace “Execute UDM Query” action in the Google Chronicle.Reference lists will no longer be usable after Sep 2026 so I’m trying to replace them with data tables. However when doing testing and encountering a 400 error, a limitation was flagged to me saying that data tables cant be used in searches via the Chronicle API: https://docs.cloud.google.com/chronicle/docs/investigation/data-tables#search-data-tablesIs that correct? given the nearing EoL deadline for reference lists, do we have an ETA on getting the limitation removed?

 In the May 3rd release notes for Google SecOps, we announced that enhanced options are available for multi-choice question steps in a playbook.  Specifically, you can now choose to proceed with one of the predefined answer branches or to create a dedicated branch to handle this scenario.  You can also still stop the playbook like before. To read more about this feature, see our documentation for Add a multi-choice question flow. How do you plan to use this feature in your workflows?  Do you have any ideas on how this can improve an existing playbook by allowing these additional options when the time to r