Skip to main content

FREE John Stoner Virtual SecOps Workshops and Dave Nehoda Webinar: Detecting Compromised AI Agents

8 days ago

Security Forums

Welcome to the Google Cloud Security Forums! Your ultimate security conversation spot. Collaborate with peers and experts to solve challenges, together.

Google Security Operations

SecOps starts here! Q&A, ask, share, connect.

Google Threat Intelligence

Google Threat Intelligence chat space. Inquire, contribute, pass it on.

Security Command Center

SCC questions? Join in, discuss, solve together.

Security Validation

Security Validation forum: Engage, be curious, stay up to date

Fraud Defense (reCAPTCHA)

Fraud Defense (reCAPTCHA) troubleshooting. Find out the answers together.

Cloud Security Foundation

Join the discussion. Post, diagnose, get the latest.

Recently active
Help others

toksikwisNew Member

Google Security Operations

SecOps SOAR Integration via Remote Agent

We are configuring remote agents for the SOAR to communicate internally to our tools. We have successfully deployed the remote agents (docker) and they are showing "Lived" status on the web ui.However, during the integration configuration, when we ch

iLotuusNew Member

Google Security Operations

Can Alert Playbooks be triggered by Case Stage changes (Investigation / Research)?

Hello everyone,I'm trying to build a Google SecOps SOAR integration with Freshdesk using HTTPv2.My goal is to automatically create a Freshdesk ticket when a case is moved to either:Investigation ResearchI created an Alert Playbook with a Custom Trigg

ckmaiStaff

Google Security Operations

What the Google AI Threat Defense announcement means for SecOps

Hey everyone, You might have caught our recent announcement introducing Google AI Threat Defense. As attackers increasingly leverage AI to find and exploit vulnerabilities at machine speed, human-speed patching simply can't keep up. The core of the n

k3lly_bNew Member

Cloud Security Foundation

OAuth verification stuck "Under Review" — Homepage requirement resolved via Search Console but UI is locked

Hello Google Community Team,My OAuth app verification is currently stuck and I need an internal engineer to manually trigger a status refresh or pass this along to the Trust & Safety team.* Project ID: dev-workrate* The Issue: The Cloud Console V

0xM4XDF1RNew Member

Google Security Operations

Native Markdown Wiki for Google SecOps

Hi everyone, I have a feature proposal that I believe would greatly benefit our workflows.Every SOC team relies heavily on documentation. On any given day, we need quick access to: Playbooks and Standard Operating Procedures (SOPs) Guides and how-t

SaitejaKattaBronze 4

Google Security Operations

Native Dashboards - "Unexpected Error" when querying SOAR Custom Fields

Hi all,I am attempting to create a new Table chart in Native Dashboards utilizing the recently released SOAR Custom Fields feature.We are referring the Documentation: https://security.googlecloudcommunity.com/google-security-operations-2/new-feature-

havoxNew Member

Google Security Operations

Why do we need WORKSPACE_PRIVILEGES if we already have WORKSPACE_ACTIVITY, WORKSPACE_USERS, WORKSPACE_GROUPS, and WORKSPACE_ALERTS?

Hi Google Community,We have already enabled these Google Workspace logs:WORKSPACE_ACTIVITY WORKSPACE_USERS WORKSPACE_GROUPS WORKSPACE_ALERTSWe want to understand clearly what WORKSPACE_PRIVILEGES will do differently compared to the above log sources.

Security Command Center

Empower Your Cloud Audits: Compliance Manager in Security Command Center!

I speak with customers daily. A challenge many security teams face isn't just finding vulnerabilities—it is mapping those vulnerabilities to compliance frameworks in a way that satisfies both internal security teams and external auditors.The monitori

soaruserBronze 1

Google Security Operations

Fetch Alerts By Entity (via UDM and REST API)

Hi,Could anyone help me to fetch alert detections (custom as well as curated) of a specific entity from case using UDM Search Query and REST API?So that I can display it on the case overview.

soaruserBronze 1

Google Security Operations

Entity related alerts via UDM and REST API

Hi,Could anyone help me to fetch alert detections (custom as well as curated) of a specific entity from case using UDM Search Query and REST API?So that I can display it on the case overview.

toksikwisNew Member

Google Security Operations

SecOps SOAR Integration via Remote Agent

We are configuring remote agents for the SOAR to communicate internally to our tools. We have successfully deployed the remote agents (docker) and they are showing "Lived" status on the web ui.However, during the integration configuration, when we ch

k3lly_bNew Member

Cloud Security Foundation

OAuth verification stuck "Under Review" — Homepage requirement resolved via Search Console but UI is locked

Hello Google Community Team,My OAuth app verification is currently stuck and I need an internal engineer to manually trigger a status refresh or pass this along to the Trust & Safety team.* Project ID: dev-workrate* The Issue: The Cloud Console V

SaitejaKattaBronze 4

Google Security Operations

Native Dashboards - "Unexpected Error" when querying SOAR Custom Fields

Hi all,I am attempting to create a new Table chart in Native Dashboards utilizing the recently released SOAR Custom Fields feature.We are referring the Documentation: https://security.googlecloudcommunity.com/google-security-operations-2/new-feature-

havoxNew Member

Google Security Operations

Why do we need WORKSPACE_PRIVILEGES if we already have WORKSPACE_ACTIVITY, WORKSPACE_USERS, WORKSPACE_GROUPS, and WORKSPACE_ALERTS?

Hi Google Community,We have already enabled these Google Workspace logs:WORKSPACE_ACTIVITY WORKSPACE_USERS WORKSPACE_GROUPS WORKSPACE_ALERTSWe want to understand clearly what WORKSPACE_PRIVILEGES will do differently compared to the above log sources.

soaruserBronze 1

Google Security Operations

Fetch Alerts By Entity (via UDM and REST API)

Hi,Could anyone help me to fetch alert detections (custom as well as curated) of a specific entity from case using UDM Search Query and REST API?So that I can display it on the case overview.

rav1and3Bronze 5

Google Security Operations

cannot import name 'extract_action_param' from 'TIPCommon'

I am getting cannot import name 'extract_action_param' & ‘extract_configuration_param’ from 'TIPCommon' error when I am testing the updated SOAR integration in staging mode for Azure Active Directory & Google Chronicle SOAR integrations. How

arv261095Bronze 1

Google Security Operations

Multi tenancy in google secops siem soar

Hi All,Anyone has performed a complete end to end implementation of multi tenancy in google secops SOAR SIEM.I need real example with implementation steps for typical GCP environment.Also if any relevant documents will be helpful

harshal.thakorBronze 3

Google Security Operations

Working of time filter of IOC model data in dashboards

Hi,I wanted to know global time filter of the Google SecOps SIEM dashbaord works on which field of IOC model if we have only IOC model data coming from IOC matches?Also, I have one observation that , match which is visible in IOC match table which is

harshal.thakorBronze 3

Google Security Operations

Working of time filter of IOC model data in dashboards

Hi,I wanted to know global time filter of the Google SecOps SIEM dashbaord works on which field of IOC model if we have only IOC model data coming from IOC matches?Also, I have one observation that , match which is visible in IOC match table which is

keiSBronze 5

Google Security Operations

How SOAR Migration works when using Cloud Identity integration

We have completed Stage 2 of SOAR Migration for our SecOps environment using Cloud Identity integration.However, I'm having trouble understanding the IAM mechanism as described in the documentation. Could you please explain it to me?* My understandin

Unsolved Topics

Can you help?

SecOps SOAR Integration via Remote Agent

2

Can Alert Playbooks be triggered by Case Stage changes (Investigation / Research)?

0

What the Google AI Threat Defense announcement means for SecOps

7

OAuth verification stuck "Under Review" — Homepage requirement resolved via Search Console but UI is locked

0

Native Markdown Wiki for Google SecOps

0

Community Leaders

The leaderboard is currently empty. Contribute to the community to earn your spot!

The leaderboard is currently empty. Contribute to the community to earn your spot!

Powered by Gainsight

Terms & ConditionsAccessibility statement

Privacy Policy Terms of Service Gen AI Policy Community Guidelines Cookie Settings

© 2025 Google. All rights reserved.

Sign up

Already have an account? Login

Login with SSO

Login to the community

Login with SSO

Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.

Enter your e-mail address

Back to overview

Scanning file for viruses.

Sorry, we're still checking this file's contents to make sure it's safe to download. Please try again in a few minutes.

OK

This file cannot be downloaded

Sorry, our virus scanner detected that this file isn't safe to download.

OK