Security Forums

Hi Anil and Security Foundation Community, ​As we discuss the core pillars of cloud security (IAM, Encryption, Logging), I want to share a critical finding that challenges our understanding of the "Secure Foundation" for AI and legacy hardware integration. ​I am Davey Hoogland,Security Researcher, independant AI researcher and Author of the Hoogland methodology and contextarchitecting.  My recent research—currently under VRP review and peer review at Springer Nature—demonstrates a vulnerability that bypasses traditional cloud-first security controls by exploiting Cyber-Physical Context. ​The Vulnerability: The "Impossible" Attribution ​Using the Hoogland Methodology, I successfully injected a verified copyright attribution (© 2023 by Davey Hoogland) into the firmware of a deprecated, offline Google Project Tango device. ​Why this matters for Cloud Foundation: According to standard IAM and Network Sec

Hi Community,I'm building a bidirectional integration between Google SecOps and Jira for our SOC operations and would appreciate any guidance, tutorials, or examples from those who've implemented similar workflows. I didn’t find any good tutorial to create a playbook.

Hi Security & SecOps Community,​As organizations rush to deploy Agentic AI, CISO’s and Security Architects face a new dilemma. Standard security tools (Firewalls, IAM) protect the perimeter, and standard MLOps tools protect the performance.​But who protects the Integrity?​With the enforcement of the EU AI Act and ISO 42001, we need a new layer of defense. An AI Agent that performs technically well but violates regulatory boundaries is not an asset; it is a liability.​Today, on behalf of CreativeMindSolutions (Research), I am sharing the high-level methodology of our Compliance Auditor. This is a novel, zero-storage framework built on Google Cloud (Vertex AI) designed to enforce "Artificial Wisdom"—a verifiable state of operational integrity.​1. The Core Innovation: Artificial Wisdom (AW) as a Security Layer​In our research, we moved beyond the philosophical definition of wisdom. We define Artificial Wisdom (AW) as a technical Integrity S

Youtube

Hello,I’m trying to implement an SLA workflow for Cases in Google SecOps, specifically around analyst assignment and investigation timing, and I’d appreciate guidance on best practices.From what I can see today, at the system level, Google SecOps provides: Alert Stage Severity However, there is no native SLA mechanism for: Time to analyst assignment (Owner) Time spent in specific case phases (Triage / Investigation) SLA logic I’m trying to enforceMy desired SLA flow is: Case created (Unassigned) → Triage: 30 minutes to assign an analyst → Assigned → 15 minutes to move to Investigation → Investigation → 1 hour to progress / respond   What is the recommended way to implement SLA tracking for:

Hi Folks,I’m new to SecOps and still getting familiar with the platform’s functionality. Apologies if this is a basic question, but I believe it will be helpful not only for me but also for others who are beginning their SecOps journey. I’m looking for guidance on how to search logs in SecOps for the following requirement:We have onboarded Windows servers via Bindplane, and I want to run a query to list all logs coming from a specific Windows server.Currently, we are using a query similar to the one below (Partial query) :metadata.log_type = "WINEVTLOG"$host = strings.coalesce(principal.asset.hostname, principal.hostname)However, we are observing an issue where we have onboarded only 50 Windows servers, but the query returns more than 50 host values. Upon initial review, these additional hosts appear to be introduced during parsing (exact cause not yet confirmed).

Hi Team, I’m reaching out regarding an issue with our Nozomi Guardian integration in Google SecOps. Even though the connection shows as successful in the Nozomi Console, we are not seeing any logs being ingested into Chronicle, even under UDM log type. We have given URI as “https://malachiteingestion-pa.googleapis.com” and Customer ID. We downloaded the service account from collection agents console and the connections shows successful in Nozomi console but logs are not getting into Google SecOps. Please let us know if anyone able to find what the issue is here. This is the documentation we followed: https://technicaldocs.nozominetworks.com/products/n2os/topics/administration/settings/data-integration/c_n2os_admin_settings_data-integration_google-chronicle-2.html Thanks in advance! 

Hi Team,While running a Dashboard query using “Run in Search”, the query returns No results, even though the same query shows results within the dashboard visualization. The issue specifically occurs when applying an equality filter (=) on a derived field created using an if() expression. metadata.product_event_type = "test" $inference = if( security_result.summary = "Client Authentication Bypass", "ABP", if(security_result.summary = "SSH Agent Forwarding Requested", "AFR"))$inference = "ABP"match: principal.ip, target.ip, $inference  When filtering with: $inference = "ABP"  → No results are returned. However, removing the equality filter entirely returns results Using a negation filter:

Hello everyone,  hope you're all having a great day!I tried searching on documentations and in this forum for this specific message but had no success.I'm currently working in the following detection (Parameters were made generic for sharing purposes). The objective of this rule is to detect any occurrence of Event2 for which, in a 24 hours span previous to it's timestamp, there's no Event1 with a mutually shared eventcasenumber value; events:$e1.metadata.log_type = "logsource"$e1.metadata.product_event_type = "event1"$e1.metadata.product_event_type = $event1 $e2.metadata.log_type = "logsource"$e2.metadata.product_event_type = "event2"$e2.metadata.product_event_type = $event1 $e1.additional.fields["eventcasenumber"] = $e2.additional.fields["eventcasenumber"] match:$event2 over 24h after $event1 

We are raising this concern to the Google Cloud Security / reCAPTCHA community to understand whether the behavior we are observing is expected and to seek guidance on best practices.After deploying reCAPTCHA v3 to our UAT environment, we are consistently receiving lower scores compared to our QA environment, even though the same reCAPTCHA site key and secret key are used in both environments. The QA setup runs on a single server, whereas the UAT environment is deployed across multiple servers with different IP addresses.From an application perspective, the reCAPTCHA integration is functioning correctly in both environments. However, the score variation is impacting our ability to apply a consistent validation threshold.We would like to understand: Is it expected behavior for reCAPTCHA v3 scores to differ between a single-server setup and a multi-server setup with multiple IP addresses, even when using the same keys? Does reCAPTCH

I am facing a few issues while performing event enrichment using entities.One of the issues is related to partial data availability in the Overview tab. When I search for an entity in Google SecOps SIEM search and select any row in the Results section, a panel opens on the right-hand side displaying the entity details (as shown in the image below).   When I navigate to the Entities section from the top-right corner, I am presented with the following view.  Upon clicking the listed Entity IP, a new window opens that is expected to display the entity details. However, in this case, no data related to the selected entity is d

Hey Google Cloud Community -- appreciate any help your able to provide in advance here. Put simply -- I’d like to create a stats search that identifies when an account has not logged in for over 30 days. I’d like to use the metadata.product_event_type = 4624 (windows successful logon) field and basically show how long ago each target.user.userid generates a 4624 event - then filter on traffic that is over 30 days old. I have tried a few stats searches unsuccessfully. I realize there is also a preconfigured dashboard that shows Dormant Accounts but the output it is producing is not accurate. Thanks

Hi folks,I’m trying to create and update an integration via the API. Creating the integration works fine, but after reviewing the Swagger documentation, I don’t see an endpoint for updating it.The creation call (external/v1/integrations/CreateIntegrationInstance) works smoothly, but I’m unable to configure or modify the integration after it has been created.Could anyone point me to the correct endpoint or let me know if updates are supported? Any guidance would be appreciated.

Hello,I have a question about the "Quick Action" Feature. I understand that you can use quick action buttons linked to integration actions. But is there a way to link it to a playbook block? I tried using the "Attach playbook to alert" But this workaround does not allow for custom input for the playbook.Is this something that is on the road map for the "Quick Actions"?https://cloud.google.com/chronicle/docs/soar/investigate/working-with-cases/quick-actions?hl=en

HiiI have a requirement to check for the users that haven't logged in using a VPN.The SIEM has logs for the users that have logged in using a VPN, but is there a way to use these logs and check for the users that havent used the VPN to login during the past 30 days? The requirement is to just get a list of these users?

Hi Team,We would like to seek clarification regarding the implementation of reCAPTCHA v2.We implemented reCAPTCHA v2 a few years ago and would like to confirm whether server-side validation was mandatory at that time. Based on the documentation available then, it does not explicitly state that Step 3 (server-side verification) was mandatory. We are referring to the documentation linked below.reCAPTCHA v2  |  Google for DevelopersPlease note that this clarification is specifically for our old implementation carried out in 2020. Kindly provide your response considering the documentation and circumstances that were applicable during that period, rather than the current implementation guidelines.

Hi Team,In our environment, we are using the Bindplane agent to forward logs to the SecOps console.The Bindplane agent is installed on each server and forwards logs to the Gateway, from where they are sent to the SecOps console.We are currently trying to decide which parser should be used for Windows event logs—WINEVTLOG or WINEVTLOG_XML.Could someone please help us understand: How to determine which log_type should be specified in the Bindplane processor configuration? The key differences between WINEVTLOG and WINEVTLOG_XML The pros and cons of using each parser, and recommended use cases I’m new to SecOps and have done some initial research, but I couldn’t find clear documentation or articles explaining this in detail. Any guidance or best

Hi Everyone,Happy New Year 2026! 🎉I am new to Google SecOps and have a few questions regarding log ingestion via Bindplane, specifically around Google Secops standardization and log visibility.In our environment, we have Bindplane Gateways that collect logs from multiple Bindplane agents and forward the data to Google SecOps. While forwarding the logs, we apply the SecOps Standardization processor so that SecOps can assign a log type (metadata.log_type) and perform UDM field mapping using the appropriate parser.I am looking for clarification on the following scenarios: SecOps Standardization processor not appliedAre the logs still ingested and searchable in Google SecOps? If searchable, what value is assigned to metadata.log_type in the SecOps console ? Does this scenario only impact UDM parsing and detections, or can it affect ingestion itself?SecOps Sta

Hey guys, do any of you know of a way to efficiently identify which log sources you need ingested in order for the curated detections or even custom rules to work as intended? Google secops currently doesn’t tell you which logs are needed and/or missing for a rule to be accurate.