Skip to main content

User Groups
Events

Create topic
Login

Community Webinar: Vibe Coding Google SecOps Parsers with Gemini

(Wed, Jul 8, 3:00 PM)

Security Forums

Welcome to the Google Cloud Security Forums! Your ultimate security conversation spot. Collaborate with peers and experts to solve challenges, together.

Google Security Operations

SecOps starts here! Q&A, ask, share, connect.

Google Threat Intelligence

Google Threat Intelligence chat space. Inquire, contribute, pass it on.

Security Command Center

SCC questions? Join in, discuss, solve together.

Security Validation

Security Validation forum: Engage, be curious, stay up to date

Fraud Defense (reCAPTCHA)

Fraud Defense (reCAPTCHA) troubleshooting. Find out the answers together.

Cloud Security Foundation

Join the discussion. Post, diagnose, get the latest.

Recently active
Help others

LikshitNew Member

Google Security Operations

403 Missing Permissions in SecOps Unified Rules UI (Featured Content API Scope Evaluation Bug)

The Featured Content microservice powering the Unified UI appears to be improperly evaluating identity mapping. Because our namespaces are defined but user enforcement is turned off, the API fails to route unscoped global curated rules to the fronten

Bartosz JBronze 2

Cloud Security Foundation

Lock down your Azure feeds so a leaked credential can't be used from anywhere

When you set up an Azure feed in Google SecOps, you copy a credential into the config — a storage account key, or an Event Hub connection string. By default, that credential has a problem: no IP restriction, no expiry, and full rights to the resource

iLotuusNew Member

Google Security Operations

Can Alert Playbooks be triggered by Case Stage changes (Investigation / Research)?

Hello everyone,I'm trying to build a Google SecOps SOAR integration with Freshdesk using HTTPv2.My goal is to automatically create a Freshdesk ticket when a case is moved to either:Investigation ResearchI created an Alert Playbook with a Custom Trigg

0xM4XDF1RBronze 1

Google Security Operations

Native Markdown Wiki for Google SecOps

Hi everyone, I have a feature proposal that I believe would greatly benefit our workflows.Every SOC team relies heavily on documentation. On any given day, we need quick access to: Playbooks and Standard Operating Procedures (SOPs) Guides and how-t

ckmaiStaff

Google Security Operations

What the Google AI Threat Defense announcement means for SecOps

Hey everyone, You might have caught our recent announcement introducing Google AI Threat Defense. As attackers increasingly leverage AI to find and exploit vulnerabilities at machine speed, human-speed patching simply can't keep up. The core of the n

yuuyakeNew Member

Google Security Operations

How to Prevent Executing an Action Without Filling Required Parameters ?

Analysts are executing an action that I put on a Playbook which requires manual selection from a dropdown list.Main problem is they are sometimes doing it without choosing an option.So I have to prevent this happening, I cant simply blame random anal

delstonBronze 2

Google Security Operations

Microsoft 365 Defender - Integration

Hi All, I am testing the Microsoft 365 Defender (XDR) Integration v26.0 and have observed the following which when looking at the documentation seems to be by design. Scenario 1Event triggered and “Incident 1” created in XDR Event triggered and “Inci

bitshock1015Bronze 1

Google Security Operations

Delay between ingestion and create alert

Hello, team I’d like to understand the delay between when a case is created and when it’s detected. All cases based on CrowdStrike have a delay of 1 to 2 hours before the alert is generated. Can this time be adjusted? Why does this only happen with C

shubmandalBronze 1

Google Security Operations

How to repeatedly loop a playbook prompt until the answer is "Yes"?

I am trying to build a SOAR playbook where in I will have a condition block, which if answered “Yes” will continue to the next block, and if ansered “No” that it will repeatedly ask the same question again and again, how do I achieve this ?

Google Security Operations

Custom Malware Named INFINITERED - YARA-L Rules to Detect UNC6508

Google Threat Intelligence Group (GTIG) has identified a sophisticated campaign attributed to UNC6508, a People's Republic of China (PRC)-nexus threat actor, targeting institutions in the North American academic, medical, and military research commun

LikshitNew Member

Google Security Operations

403 Missing Permissions in SecOps Unified Rules UI (Featured Content API Scope Evaluation Bug)

The Featured Content microservice powering the Unified UI appears to be improperly evaluating identity mapping. Because our namespaces are defined but user enforcement is turned off, the API fails to route unscoped global curated rules to the fronten

yuuyakeNew Member

Google Security Operations

How to Prevent Executing an Action Without Filling Required Parameters ?

Analysts are executing an action that I put on a Playbook which requires manual selection from a dropdown list.Main problem is they are sometimes doing it without choosing an option.So I have to prevent this happening, I cant simply blame random anal

delstonBronze 2

Google Security Operations

Microsoft 365 Defender - Integration

Hi All, I am testing the Microsoft 365 Defender (XDR) Integration v26.0 and have observed the following which when looking at the documentation seems to be by design. Scenario 1Event triggered and “Incident 1” created in XDR Event triggered and “Inci

bitshock1015Bronze 1

Google Security Operations

Delay between ingestion and create alert

Hello, team I’d like to understand the delay between when a case is created and when it’s detected. All cases based on CrowdStrike have a delay of 1 to 2 hours before the alert is generated. Can this time be adjusted? Why does this only happen with C

shubmandalBronze 1

Google Security Operations

How to repeatedly loop a playbook prompt until the answer is "Yes"?

I am trying to build a SOAR playbook where in I will have a condition block, which if answered “Yes” will continue to the next block, and if ansered “No” that it will repeatedly ask the same question again and again, how do I achieve this ?

NASEEFSilver 2

Google Security Operations

help needed in verifying alerted IP NOT IN gcti

Hello Team,I am writing a rule to detect unknown IPs hitting our public-facing domains. In this rule, I only want to generate an alert when the source IP is not present in GCTI.The reason is that we already have a separate rule that handles IPs found

Consultant_AmanNew Member

Google Security Operations

Masking of Data

I want to mask my client data like phone number account number etc. Is it possible to mask these data field in Secops. If yes then kindly share the related document how it can be done. If no then kindly share any alternative for this.

soaruserBronze 1

Google Security Operations

Entity related alerts via UDM and REST API

Hi,Could anyone help me to fetch alert detections (custom as well as curated) of a specific entity from case using UDM Search Query and REST API?So that I can display it on the case overview.

greonNew Member

Google Security Operations

How to distinguish between precise and broad curated detections at the alert level in composite detections

Hi everyone. I am working on enabling curated detections via composite detections. One issue that I have not been able to figure out yet so far is, is there a UDM value that defines whether a curated detection rule is broad or precise? I looked at th

vanitharaj1208Silver 4

Google Security Operations

ServiceNow Integration Test Connectivity Failing - User Not Authorized

Hi All,I am configuring the ServiceNow integration in Google SecOps / Chronicle SOAR, and the Test Connectivity action is failing with the following error:Exception: User Not Authorized----------------- Main - Finished -----------------status: 2resul

Unsolved Topics

Can you help?

403 Missing Permissions in SecOps Unified Rules UI (Featured Content API Scope Evaluation Bug)

1

Lock down your Azure feeds so a leaked credential can't be used from anywhere

0

Can Alert Playbooks be triggered by Case Stage changes (Investigation / Research)?

5

Native Markdown Wiki for Google SecOps

2

What the Google AI Threat Defense announcement means for SecOps

9

Community Leaders

The leaderboard is currently empty. Contribute to the community to earn your spot!

The leaderboard is currently empty. Contribute to the community to earn your spot!

Powered by Gainsight

Terms & ConditionsAccessibility statement

Privacy Policy Terms of Service Gen AI Policy Community Guidelines Cookie Settings

© 2025 Google. All rights reserved.

Sign up

Already have an account? Login

Login with SSO

Login to the community

Login with SSO

Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.

Enter your e-mail address

Back to overview

Scanning file for viruses.

Sorry, we're still checking this file's contents to make sure it's safe to download. Please try again in a few minutes.

OK

This file cannot be downloaded

Sorry, our virus scanner detected that this file isn't safe to download.

OK