Unanswered questions

Esteemed GCSC & GTIG members,This is Shehab Anwer, I am a cardiologist, and a REDCap administrator - with some coding skills - and following the recent GTIG report on UNC6508 and the INFINITERED malware targeting REDCap servers, and an earlier report in February - I would like to share a project I've been independently developing over the past few months:REDACTS (REDCap Arbitrary Code Threat Scan) is a contract-driven static and dynamic forensic toolkit designed to help detect arbitrary code, persistence mechanisms, and INFINITERED-style threats in REDCap deployments without concurrent execution on live servers.Key points:Built specifically for REDCap environments (often handling sensitive research and clinical data) and runs off-server/oof-cloud on packed content of deployment for local/air-tight execution according to user setup. Performs differential analysis against source REDCap releases (only availabe from REDCap consortium) or those verified by the on-site administrators for

The Featured Content microservice powering the Unified UI appears to be improperly evaluating identity mapping. Because our namespaces are defined but user enforcement is turned off, the API fails to route unscoped global curated rules to the frontend, resulting in a 403.Architecture: Multi-tenant environment using namespaces (Customer A, Customer B) for logical isolation.Current State: Data Access Paradigm Enforcement is currently Disabled/Inactive as our unified analyst team manages all clients globally.Troubleshooting Already Performed:Verified the user has the required legacy permissions (chronicle.curatedRules.*, chronicle.curatedRuleSets.*). The standalone "Curated Detections" tab loads and functions perfectly. Verified the user has the required new permission (chronicle.featuredContentRules.list) attached to their custom Alpha role. 

Analysts are executing an action that I put on a Playbook which requires manual selection from a dropdown list.Main problem is they are sometimes doing it without choosing an option.So I have to prevent this happening, I cant simply blame random analysts.We have only 2 options when i create a manual action from dropdown list. You make that required parameter as MANDATORY. Then you have to give a DEFAULT VALUE when you are implementing it. If you give default value then when it is live, its showing that, action in playbook already filled with your default parameter, just like below image, and you can just press EXECUTE button as an analysts without choosing it. Which we dont want. You make that required parameter as NON-MANDATORY Then when its live playbook will gonna show you a dropdown list, that has “Choose” placeholder on top of it by default.(no real picture but it is just like at “Assign to” option below) Bc the parameter is NOT MANDATORY, then it means it is executable without ch

Hi All, I am testing the Microsoft 365 Defender (XDR) Integration v26.0 and have observed the following which when looking at the documentation seems to be by design. Scenario 1Event triggered and “Incident 1” created in XDR Event triggered and “Incident 2” created in XDR Both incidents and their associated alerts are ingested into the SOAR and created: Case 1 with the name “Incident 1” Case 2 with the name “Incident 2” XDR then correlated Incidents 1 & 2 and based on a rule and renamed “Incident 1” to “Suspicious activity on one endpoint”  moved the alert from “Incident 2” to “Incident 1” and closed “Incident 2” The Sync Job in SOAR attached all alerts to Case 1 but left the Case name as “Incident 1” The SOAR Case “Incident 2” was left open along with it’s associated AlertScenario 2Event triggered and “Incident 1” created in XDR Event triggered and “Incident 2” created in XDR “Incident 1” ingested into SOAR and a Case created with the same name “Incident 1”  Before Ingestion of “I

Hello, team I’d like to understand the delay between when a case is created and when it’s detected. All cases based on CrowdStrike have a delay of 1 to 2 hours before the alert is generated. Can this time be adjusted? Why does this only happen with CrowdStrike? We have two SecOps consoles with different environments, and this delay only occurs on one of them; both have the same collection permissions.  

I am trying to build a SOAR playbook where in I will have a condition block, which if answered “Yes” will continue to the next block, and if ansered “No” that it will repeatedly ask the same question again and again, how do I achieve this ?  

Hello Team,I am writing a rule to detect unknown IPs hitting our public-facing domains. In this rule, I only want to generate an alert when the source IP is not present in GCTI.The reason is that we already have a separate rule that handles IPs found in GCTI, so I want to avoid duplicate detections.Could someone please advise on the best way to implement a “NOT IN GCTI” condition within the rule?Is the below approach the correct way to verify that the principal IP generating the alerts is not present in GCTI? Also, is using the join with entity.ip the correct method for this check? 

I want to mask my client data like phone number account number etc. Is it possible to mask these data field in Secops. If yes then kindly share the related document how it can be done. If no then kindly share any alternative for this.

Hi,Could anyone help me to fetch alert detections (custom as well as curated) of a specific entity from case using UDM Search Query and REST API?So that I can display it on the case overview.  

Hi everyone. I am working on enabling curated detections via composite detections. One issue that I have not been able to figure out yet so far is, is there a UDM value that defines whether a curated detection rule is broad or precise? I looked at the meta fields of the curated detections and used the network inspection tool as well to look at the actual json format. So far I have not been able to find such a field.My usecase is to write separate composite detections for precise curated detections and broad curated detections. I have a rule that consumes detections from curated detections but, as far as I know, it is not possible to distinguish whether these detections come from precise or broad rules. Thanks in advance.

Hi All,I am configuring the ServiceNow integration in Google SecOps / Chronicle SOAR, and the Test Connectivity action is failing with the following error:Exception: User Not Authorized----------------- Main - Finished -----------------status: 2result_value: Falseoutput_message: Connection Failed. Error is User Not AuthorizedFrom the logs, the integration appears to be trying to access the incident table using:GET https://<masked-instance>.service-now.com/api/now/v1/table/incident?sysparm_limit=1The response is:403 Client Error: ForbiddenMy current configuration is:API Root: https://<masked-instance>.service-now.com/api/now/v1/Incident Table: incidentAuthentication: <Basic/OAuth>Integration Version: ServiceNow V58.0The credentials seem to be accepted, but the user appears to be blocked by permissions, roles, or ACLs when trying to read the incident table.Has anyone faced this issue before? Which ServiceNow roles or ACLs are required for the integration user to success

Hey everyone!I am working on setting up a multi-tenant dashboard in Google SecOps SIEM and could use some advice from the community.Right now, we are tracking specific entities: files, domains, and URLs. We want to find a clean way to separate this data so each tenant only sees their own information on the dashboard.I have two main questions:1. How are you handling multi-tenancy? What is the best way to structure dashboards in Google SecOps when dealing with multiple tenants for file, domain, and URL data?2. Is there a common field we can use for filtering? We are looking for a standard field where we can append the tenant's name to easily group and filter these specific entities. What fields do you recommend for this?Additionally, how should we handle deduplication across tenants? Should we deduplicate within each tenant's data separately, or is there a global deduplication strategy that works better when dealing with shared entities (like domains or URLs that might appear across mult

Hi, I’m referring to the config GCP console / Google SecOps / Ingestion / Custom export filter settingsAFAIK there are no Terraform support for having the export filter settings in IaC.Looks like there is no API for editing these either. Is this on a roadmap?

Hello. We re using S1. When we`re closing alerts in SECOPS we need also to close alert in S1 console using:Mitigate option in S1Choosing suitable option (kill, Unquarantie, Remediate, Rollback, Add to Blocklist) and naturally mark alert as resolved in S1 without touching S1 console.We would like to do all of theses jobs directly from SECOPS console. Is it doable? 

Hi,I wanted to know global time filter of the Google SecOps SIEM dashbaord works on which field of IOC model if we have only IOC model data coming from IOC matches?Also, I have one observation that , match which is visible in IOC match table which is not returning while quering through dashboard for same time range?

Hi All,We would like to authenticate with Google SecOps MCP ( Remote MCP) using an MCP Proxy in between.  Our current setup is using Workforce Identity Federation with Microsoft Entra as IDP. Anyone who has achieved this in past or knows how this can be achieved.Our goal is to have controlled communication via central exit point (MCP Proxy Server) and use our existing SecOps user creds for users to query Google SecOps MCP.   

I am currently testing the Microsoft 365 Defender Integration (XDR) v26.0 and have noticed that if I trigger 2 x events that create 2 x Incidents in XDR that become correlated under a new Incident Name, the new Incident Name is not reflected in Google SecOps SOAR, this seems to be by design however, I would like the case in SecOps SOAR to reflect the new Incident Name in XDR, I was thinking of utilising a KQL Query in a playbook to do this, any thoughts? Trigger an event Incident 123456 (Test Incident 1) created in XDR Trigger an event Incident 123457 (Test Incident 2) created in XDR Ingest takes place in SOAR Case 5672 created with the Name Test Incident 1 Correlation takes place in XDR Incident 123457 closed and alert moved to 123456 in XDR Incident 123456 renamed from Test Incident 1 to Suspicious Activity on Endpoint SOAR Case attaches new Alert to Case 5672 and Case name stays as Test Incident 1ThanksDaryll

Hello team, Is it possible to use UDM filters to filter the events that triggered a rule?In QRadar, you can apply this type of filter to determine which event actually triggered the rule, and I’d like to know if SecOps has the same search mechanism, since we use this data to create a report.Regards,Renato Ferreira​​​​​​​

I am building a small phishing-reporting workflow to identify credential-harvesting pages and submit confirmed malicious URLs quickly.The goal is to reduce the lifespan of phishing pages and disrupt the attackers’ ability to profit from stolen credentials. The workflow reviews suspicious links, records the relevant indicators, and submits only URLs that appear to be genuine phishing or credential-harvesting pages.I am interested in using the Web Risk Submission API, but I have not found a self-service enrollment path. I have setup the oauth and generally have it working but the documentation mentions “Contact sales or your customer engineer to obtain access to this feature.” which has been a vortex of disappointment.Can an individual developer or small security-focused project request access? If so, what is the correct process? If not, is there another supported way to submit confirmed phishing URLs programmatically?Thank you.

Hello,My Google Cloud project has been suspended due to a security issue (ACCOUNT_HIJACKED).I fully understand the situation and I am ready to take all necessary actions to secure the project. However, I currently do not have access to the project anymore, which prevents me from revoking the compromised API keys or applying the required fixes.As a precaution, I have already stopped billing to prevent any further charges.At the moment, my application is completely down, which is having a severe impact on my business. My clients cannot access the service, and I am receiving increasing complaints and refund requests.I already have an open support case: 70327888This situation is becoming critical, and I would greatly appreciate any help to restore access or guidance on how I can proceed to secure the project.Thank you very much in advance for your support.Vincent

Hello,Has anyone successfully created a simulated case using the API?I'm trying to use the following documentation:https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.legacyCases/simulateAlertHowever, I'm running into some issues. The API call reaches the CreateSimulatedCustomCase method, and the audit logs show that the service account is recognized and has the chronicle.legacyCases.simulate permission. Despite that, the request fails with the following error:Request is missing required authentication credential. Expected OAuth 2 access token, login cookie or other valid authentication credential.I'm authenticating with a Service Account using the cloud-platform scope, and the same token works successfully with other Chronicle APIs.Has anyone encountered this before or managed to create simulated cases through the API?Thanks!

We are configuring remote agents for the SOAR to communicate internally to our tools. We have successfully deployed the remote agents (docker) and they are showing "Lived" status on the web ui.However, during the integration configuration, when we check "run remotely" and select the remote agent, we are unable to save the config. It's showing error "An error occurred while saving instance configuration". We configured everything as the documentation indicated including the service account mapping. The remote agent container does not show any error. 

Hello Google Community Team,My OAuth app verification is currently stuck and I need an internal engineer to manually trigger a status refresh or pass this along to the Trust & Safety team.* Project ID: dev-workrate* The Issue: The Cloud Console Verification Center shows a blocking error under "Homepage requirements" stating: "Your homepage website is not registered to you."* The Resolution: I have successfully verified full domain ownership for our production homepage via Google Search Console using this exact same Google account. The Problem: The console instructs me to "Reply to your email thread with our Trust and Safety team," but I have never received an initial email from the compliance team to reply to. Because the UI is entirely locked in the "Your branding is currently under review" state, I cannot modify fields or trigger a re-scan myself. Could a community manager please escalate this project ID to the Trust & Safety team so they can pull the fresh domain status from

Hi all,I am attempting to create a new Table chart in Native Dashboards utilizing the recently released SOAR Custom Fields feature.We are referring the Documentation: https://security.googlecloudcommunity.com/google-security-operations-2/new-feature-support-for-soar-custom-fields-in-native-dashboards-7604 I am trying to display standard case fields alongside two of our custom text fields: "Case ID" and "CID".  Per the documentation, I am using the required syntax paths: - case.custom_fields["Case ID"].string_seq.string_vals - case.custom_fields["CID"].string_seq.string_vals Whenever I attempt to run the query, the UI returns the following generic backend error: "An error occurred with your query. An unexpected error occurred. Loading Complete." We have already tried multiple troubleshooting variations to isolate the syntax, all of which fail:  Attempt 1(Using array_distinct in outcome): $case_name = case.namematch:$case_nameoutcome:$custom_case_id = array_distinct(case.custom_fields["C

Hi Google Community,We have already enabled these Google Workspace logs:WORKSPACE_ACTIVITY WORKSPACE_USERS WORKSPACE_GROUPS WORKSPACE_ALERTSWe want to understand clearly what WORKSPACE_PRIVILEGES will do differently compared to the above log sources.Main Questions:What extra things does WORKSPACE_PRIVILEGES handle that the other parsers (especially WORKSPACE_ACTIVITY) do not cover well? Can you explain the benefits of enabling WORKSPACE_PRIVILEGES? Please give some examples of logs/events: How they look in WORKSPACE_ACTIVITY (or others) How they look better / different in WORKSPACE_PRIVILEGES We want to confirm the real value before enabling it for the client.