Recently active topics

We ingest high-volume GCP Cloud DNS query logs into Google SecOps through Cloud Logging direct ingestion. We want to reduce ingestion volume without randomly sampling security events.Is there a supported native way in Cloud Logging, Log Router or Google SecOps to aggregate repeated events, for example: key = vmProjectId + queryName + responseCode + queryType window = 5 minutes output = one event with count, firstSeen and lastSeenWe would keep NXDOMAIN, SERVFAIL, first-seen domains, unknown domains and security-sensitive destinations at 100%.If this is not supported natively, what architecture does Google recommend: Pub/Sub/Dataflow, Bindplane, or another collector? Can the aggregated records still be parsed as GCP DNS events in Google SecOps?

We host a number of servers for customers, sharing a public IP range. We have been having intermittent problems with customers receiving ReCAPTCHA challenges in a loop. They are presented with an endless stream of images and therefore can't reach the website they need. This problem is particularly frequent when using a particular piece of software which uses the CefSharp framework as an integrated web browser. We believe that our IP range has a poor reputation with ReCAPTCHA, perhaps due to the high volume of users sharing the IP range. Is there anything we can do about this?

Hi all,As far as I know, it is possible to use Chronicle SIEM in multi-tenant environments, and using labels you can "separate" the information for each client. I would like to ask some doubts about this approach:Since several clients use the same Chronicle instance, how is the information for each client separated? We understand that it is not a physical separation, but a logical one. Are there any details on this?Do you recommend using the "environment" field for this separation of clients or does it have another function?Also, since the rules are executed for "all events" matched in the rule, what would be the good practice to delimit/not mix the analysis between clients? Is it done automatically based on some field? Should this logic be added to each rule? We have not seen any documentation on this but we understand that the logic of the rules must contemplate this multi-tenancy, it does not seem to be something internal.Thanks for your help.Regards.M.

Hello All ,Issue - reCAPTCHA Enterprise Policy-Based Challenge consistently returns BROWSER_ERROR for some usersWe are using reCAPTCHA Enterprise Policy-Based Challenge on an ASP.NET Web Forms application.Site key integration type: Policy-Based ChallengeAction: confirmThreshold: 0.3For some production users, grecaptcha.enterprise.execute() returns a token successfully, but when we create the server-side assessment at backend code , Google returns:TokenProperties.Valid = falseInvalidReason = BROWSER_ERROROther fields are:Score = 0Challenge = UNSPECIFIEDOne affected user received the same result repeatedly over several hours rather than just once.Questions:What exactly causes BROWSER_ERROR for Policy-Based Challenge? We did see that its not only for Policy-Based but also for a Score based also we do get some times. If execute() returns a token but the subsequent assessment returns BROWSER_ERROR, what browser/network communication is failing? Is there a recommended list of Google endpoint

Hi everyone,We are currently evaluating the Triage and Investigation Agent (TIN) in Google SecOps, but we haven't had the opportunity to test it in our environment yet.We would mainly like to understand how well it works overall in a real SOC environment, and also how it performs with third-party security products such as Cortex XDR, CrowdStrike, Fortinet, etc.For those already using it: Overall, how has your experience with TIN been so far? Does it genuinely help with triage and investigation, or is it still fairly limited? How well does it investigate alerts coming from third-party products? Does it understand and correlate the context properly once those logs are ingested into SecOps? Have you tested it with Cortex XDR or similar EDR solutions? Is the TP/FP verdict generally reliable, or do analysts still need to redo most of the investigation manually? Does it work well with custom detections/YARA-L rules built on top of third-party data? Are there any important limit

There’s a variety of endpoints listed in the Chronicle API documentation that still have “legacy” in the name. ​@SoarAndy in a post about five months mentioned that this just reflects the API call not being the Google structure yet. However, I am concerned that these endpoints are only usable using the v1alpha version, which Google documentation warns is not suitable for production as it could be changed unpredictably. With the migration deadline so close, I am concerned about being forced to switch existing use cases to use these unstable endpoints while knowing I have no choice. Does the use of the v1alpha with these legacy endpoints truly mean that they are unstable and not fit for production?

September 22, 2026 Key Takeaway: An unvalidated playbook is automated technical debt. Before enabling automated containment or complex enrichments on live alerts, execute a structured testing lifecycle to prevent execution failures during live security incidents.Why Playbook Testing MattersA playbook designed in theory rarely survives contact with production data unchanged. In high-pressure incident response environments, untested playbooks cause silent failures, alert backlogs, and accidental disruption: Incomplete Payloads: A field expected in alert metadata is null for certain upstream log sources. API Rate Limits and Timeouts: An external threat intelligence endpoint times out, causing the entire execution pipeline to halt. Schema Drift: Third-party integration updates change key JSON response fields without advance notice. The 6-Step Playbook Validation LifecycleFollow this structured workflow before promoting any playbook to active status:Phase Core Objective Success Crit

"In our Google SecOps SOAR tenant, we want to build a custom Python integration/action (to pull data from an external Excel file into a case). We don't see 'Use the IDE' / 'Develop custom capabilities' under Build and integrate, and there's no custom-integration option visible in our Marketplace. Is custom Python scripting (the IDE feature) gated behind a specific license tier or role permission? If so, which role/permission or SKU do we need enabled, and who in our org (or at Google) can turn it on?"

Overview: Breaking the One-Way Intelligence Trap In modern Security Operations Centers (SOCs), threat intelligence integrations typically operate as a one-way funnel. External indicators and intelligence feeds are ingested into SIEM and SOAR platforms to enrich telemetry, score alerts, and provide context during triage.However, during active investigations, Tier 2 and Tier 3 analysts uncover novel, high-fidelity attacker infrastructure—such as zero-day command-and-control (C2) IPs, adversary staging domains, and customized malware payloads. In most organizations, these verified indicators remain trapped in the resolution notes of a closed incident ticket.This guide demonstrates how to establish an automated, bidirectional intelligence feedback loop between Google Security Operations (SecOps SOAR) and Google Threat Intelligence (GTI Enterprise+ / VirusTotal API v3). When an investigation is confirmed as a true positive, SecOps automatically pushes sanitized indicators to a dedicated, pr

I have a workflow that requires a case be created in an environment if certain conditions are met. I was able to create a custom action to do this fine a few weeks ago, but since a new scope (also the first scope) was added in our SIEM settings, I notice the action is failing. Error: {"errorCode":2000,"errorMessage":"DataAccessScope is required.","innerException":null,"innerExceptionType":null, This new scope has nothing to do with the environment I am trying to create the case for. The environment itself does not have any scopes applied to it at all, it is ‘Global’. The Swagger docs for the CreateManualCase endpoint specify dataAccessScope should be a string, I’ve tried a selection of strings such as “*”, “Global”, “<ENVIRONMENT_NAME” etc but have had no luck. I’ve also tried not settings it obviously.  Is there a specific string I should be using here? Or should I create a new scope with access to all data? Thanks

Hi, I am looking for 4 to 5 usecases by leveraging WIZ telemetry + Google Secops telemetry. Further I want to understand,  the basic differences between Google Security Operations investigations and Blue Agent analysis. it seems both are doing almost similar type of work. Can you help me to understand the difference and similarity. 

Security operations teams are constantly searching for innovative ways to streamline threat investigations and outpace sophisticated adversaries. To address this critical challenge, Google Threat Intelligence has introduced an exciting new feature called Agentic Flows. This powerful capability is designed to transform guided agentic workflows into highly scalable, automated solutions. Built directly within the Agentic Workspace, this built-in analysis platform is specifically optimized for conversational threat investigation and triage.By combining multi-step reasoning with telemetry-grounded intelligence, Agentic Flows can automatically unpack complex scripts, decode command-and-control infrastructure, and map attacker techniques in seconds. Importantly, every single insight generated is backed by real-time Google data, complete with clear citations and transparent reasoning. Organizations can leverage Agentic Flows through three distinct automation pathways: First, the Ask Agentic op

In modern cybersecurity, speed and precision are paramount. Traditional threat intelligence often waits until an adversary strikes multiple organizations before establishing a formal campaign profile. Google Threat Intelligence introduces Single Target Operations, an innovative capability that moves beyond multi-victim constraints to convert active frontline breach investigations into enterprise-wide protection in under twenty four hours.Powered by Mandiant Managed Threat Defense, Single Target Operations capture realtime, single organization intrusions with remarkable velocity. Rather than waiting days or weeks for comprehensive post-incident analysis, security operations centers gain sub twenty four hour delivery from an active frontline incident to a fully published intelligence profile. This capability also includes an instant two-year historical backfill of verified adversary missions, allowing security teams to query hundreds of live and historical investigations.What makes this

Security teams today face an overwhelming volume of vulnerability disclosures, with more than twenty-five thousand common vulnerabilities and exposures emerging each year. Sifting through this relentless stream often leads to acute analyst fatigue, while critical edge zero-day threats risk being overlooked. Relying solely on generic base scoring metrics without asset visibility makes prioritizing remediation exceptionally difficult. Google Threat Intelligence introduces Target Technology Watchlists to directly address this persistent operational challenge by delivering focused, asset-matched intelligence.Target Technology Watchlists allow security professionals to define and monitor their exact technology footprint. Organizations can configure custom threat scenarios by supplying standard Common Platform Enumeration (CPE) strings or simple product names, such as Apache HTTP Server, Oracle WebLogic, or Palo Alto Networks PAN-OS. Instead of wading through irrelevant notices, teams receiv

Hi,I’m trying to build a Native Dashboard that would show the log_count and log_volume for GCP Projects but owned by different business units in the org.Also, all ingestion into SecOps is via Direct IngestUsing the below query, the namespace returns null value - which tells me the namespace must be set somewhere pre-processing:ingestion.component = "Ingestion API"$Namespace = ingestion.namespacematch: $Namespaceoutcome: $Total_GB = math.round(sum(ingestion.log_volume) / math.pow(1000, 3), 2) Please, any ideas on how to set the namespaces or perhaps other methods that would extract the project names or IDs pre-processing and can be used in a dashboard. All suggestions would be greatly appreciated.

What’s New in Google SecOps for the interval September 13th through September 20th, 2026. What’s New in the World of Google SecOps, September 20th 2026 Highlights 🔥 🥳 The major SecOps update this week is the release of GoogleSQL support in UDM Search. I wrote a detailed post the topic this week too.|> SQL in Google SecOpsGoogle SecOps has launched into public preview SQL support for Search 🥳medium.com 🔥🤖 Google Cloud’s hosted MCP servers now support the new Stateless MCP Protocol (Version 2026–07–28) ⚠️💀 The following global context sources MANDIANT_ACTIVE_BREACH_IOC, MANDIANT_FUSION_IOC, and OPEN_SOURCE_INTEL_IOC are replaced by the single source GTI_IOC. If you use any of these for custom rules, read about the changes and start planning accordingly. ✍️ 🔥 Several of the sessions from the recent Mandiant Cyber Defense Summit are available on YouTube, e.g., Cloud CISO Perspectives: How Google monitors AI threats and advances AI defenses  Product Updates & New Feature

I'm trying to calculate mttr and mtta per environment; this metric is important for each existing environment. Does anyone know how I can do this in the case_history table?I notice that the `cases` table contains the `cases.environment` field. Is it possible to perform this calculation using that table?MMTR: stage stage1{$case_id = case_history.case_response_platform_info.case_idmatch:    $case_idoutcome:    $case_close_time = max(if(case_history.case_activity = "CLOSE_CASE", case_history.event_time.seconds, 0))    $status = array_distinct(case_history.case_activity)    $TTC = $case_close_time - min(case_history.event_time.seconds)condition:    arrays.contains($status, "CREATE_CASE") and arrays.contains($status, "CLOSE_CASE")        }outcome:    $case_count = count($stage1.case_id)    $MTTC = (math.round(avg($stage1.TTC)/60))MTTA:stage stage1{$case_id = case_history.case_response_platform_info.case_idmatch:    $case_idoutcome:    $case_assign_time = min(if(case_history.case_activity =

Hello, I'm currently developing a custom detection rule and I'm looking to incorporate MANDIANT_ACTIVE_BREACH_IOC data into it.I would appreciate any guidance or best practices on how to effectively use this data within my rules. Specifically, how can I leverage the attributes associated with MANDIANT_ACTIVE_BREACH_IOC  for domains and how use that to enhance threat detection? Any examples or experiences would be greatly appreciated.Right now I have something like this rule for test :rule test_rule {  meta:    author          = "Test"    description     = "Mandiant IOC Feed in rule"    yara_version    = "YL2.0"  events:    $e.metadata.event_type = "NETWORK_CONNECTION"    $e.target.hostname = $ioc     $context_graph.graph.entity.hostname  = $ioc     $context_graph.graph.metadata.product_name = "MANDIANT_ACTIVE_BREACH_IOC"    $context_graph.graph.metadata.entity_type = "DOMAIN_NAME"    $context_graph.graph.metadata.source_type = "GLOBAL_CONTEXT"  match:    $ioc over 2h  outcome:    $targ

I’m working for vendor risk assessment or Bank compliance review for the following documents and reports. I’ve tried to access the “Compliance Reports Manager” but it seems that I have no access. Please someone advice.Google SOC2 Type II Google ISO27001 Google DPA Google Data Retention Statement Google Responsible AI Documentation Google AI Security Documentation