Solved

Hello, I'm currently developing a custom detection rule and I'm looking to incorporate MANDIANT_ACTIVE_BREACH_IOC data into it.I would appreciate any guidance or best practices on how to effectively use this data within my rules. Specifically, how can I leverage the attributes associated with MANDIANT_ACTIVE_BREACH_IOC  for domains and how use that to enhance threat detection? Any examples or experiences would be greatly appreciated.Right now I have something like this rule for test :rule test_rule {  meta:    author          = "Test"    description     = "Mandiant IOC Feed in rule"    yara_version    = "YL2.0"  events:    $e.metadata.event_type = "NETWORK_CONNECTION"    $e.target.hostname = $ioc     $context_graph.graph.entity.hostname  = $ioc     $context_graph.graph.metadata.product_name = "MANDIANT_ACTIVE_BREACH_IOC"    $context_graph.graph.metadata.entity_type = "DOMAIN_NAME"    $context_graph.graph.metadata.source_type = "GLOBAL_CONTEXT"  match:    $ioc over 2h  outcome:    $targ

I have built a custom connector and now i have alerts flowing in and now i want to customize alert name with some enriched values  how can i achieve this ? kindly help me with thisand please dont provide answers from AI 

We successfully established HTTPS log forwarding profiles within Palo Alto Strata Logging Service last year using https://malachiteingestion-pa.googleapis.com/v2/unstructuredlogentries:batchCreate.  Although these profiles continue to forward logs to our SecOps environment, we can no longer manage the profile within Strata due to the following error that follows when testing the connection:  This wasn’t an issue when the forwarding profiles were established and it certainly wasn’t an issue the many times we made adjustments to the profiles throughout last year.  It’s probably been 4-6 months since we last touched these profiles, so it’s unclear when this behavior started. I also noticed SSL Labs is having issues obtaining detail for malachiteingestion-pa.googleapis.com.  Not sure if this is the expected behavior, but figured it was worth mentioning. I have a support case open with Palo first, but figured I’d ask here as well before opening a Google support case.

Hi all,I am wondering whether this is a Canary issue or a Secops one but I am trying to send alerts from a free Canarytokens into a Google SecOps SOAR webhook.What I have configured: In SecOps SOAR, I created and enabled a webhook. The mandatory alert fields are mapped from a Canarytokens payload as follows:TicketId → token SourceSystemName → static value: Canarytokens Name → token_type DeviceVendor → static value: Thinkst RuleGenerator → static value: Canarytokens StartTime → timeThis is what the payload looks like: {  "channel": "DNS",  "token_type": "adobe_pdf",  "src_ip": "0.0.0.0",  "token": "example-canary-token-id",  "time": "2026-09-09 15:27:23 (UTC)",  "memo": "Test",  "additional_data": {    "geo_info": {      "country": "US",      "city": "Example City",      "org": "Example ISP"    },    "time_hm": "15:27",    "time_ymd": "2026/09/09"  },  "public_domain": "canarytokens.org"} The Testing feature in the SecOps webhook returns:{  "status": 200,  "statusText": "OK"}ProblemWhen

I noticed that some of the new curated rules land with detecting (status) disabled and alerting enabled.I was wondering if this is a misconfiguration or if alerting will continue to work even though detecting (whose field name in the API calls is actually status) is disabled. 

Hi Fam,Where do i exactly need to go and check if this is applicable to my secops :can someone suggest steps where to go and check this out and identify if its applicable to us or we need to take any action.thanks  

I would like to create some detection rules around Google Workspace App Passwords. I generated a few in an environment, but I can’t find the specific event indicating that an app password was created. Does anyone have any idea, or is it a logging gap?

When checking the score-distribution on https://console.cloud.google.com/security/recaptcha/the scores dropped from this (first week of June) to this (first week of July)Obviously, this has a major impact on our users (schools & pupils, often starting our app at more or less the same time)Any idea why this is happening?  What I can do to improve this? ...

Hi everyoneI'm getting a JSON in a playbook action. I want to reuse that json in another action of my playbook.I'm trying to get the value of a subkey “category” in a nested json like this{   “a”:{“category”:1},   “b”: {“category”:3}}I haven’t found a way to extract “category” values ignoring the parent keys.Is there a way to do it?I’m expecting to get a result like [1,3]Parent keys are dynamic and I can't predict or list every possibilitiesDo you know how we can do this? Many thanks by advance :)

SUMMARY The address 23.227.38.74 is present in the Google Threat Intelligence curated list`iplist-known-malicious-ips`. IP: 23.227.38.74PTR: shops.myshopify.comWhois: Shopify, Inc. — NetName SHOPIFY-NET, CIDR 23.227.32.0/19 This is core Shopify storefront / webhook infrastructure — the address that Shopifystores resolve to — not a compromised host. Because Google's own recommended predefined firewall rules for network firewallpolicies include an egress deny rule with`destThreatIntelligences = iplist-known-malicious-ips`, any customer who follows thatrecommendation silently loses all outbound connectivity to Shopify. There is nowarning, no changelog and no alert: traffic simply starts being dropped. OBSERVED BEHAVIOUR Egress to 23.227.38.74:443 denied by the predefined threat-intelligence egress rule. In one project, denies ran continuously for about five days before we noticed: First DENY: 2026-08-19T21:34:45ZLast DENY: 2026-08-24T22:38:44ZTotal: 11,998 denied connections Date (UTC) De

Hi all, I wanted to understand how the the winder SecOps community has managed ticket management in a MSSP context. As an example, as a MSSP, and if there is a need to escalate a ticket to a customer, what method have you found worked the best?My initial thoughts would be the have a manually initiated playbook by the analyst summarise and escalate the alert as a servicenow ticket to the client, as well as sending a teams notification. A flow might look something like this:Triage & Investigation → Escalation Required (Additional client information needed/approval for action) →  Playbook to mark case as paused and a notification is sent to client which creates a SNOW/Cherwell ticket → Client updates ticket → case SLA resets and internal analyst is notified via assignment of internal SNOW ticket. Obviously the above would have several integration points, but that is my high level thinking. What has worked for others would be greatly appreciated. 

Can this be updated https://docs.cloud.google.com/chronicle/docs/soar/marketplace-integrations/microsoft-365-defender#sync-alertsThis job is failing as it is not taking into account alerts from insider risk policies for example or dlpThey are prefixed ir or dlp etcadditional.fields["provider_alert_id"]:"86954c42-15b0-4976-8fbf-9fcc9f52bec8" is actually ir86954c42-15b0-4976-8fbf-9fcc9f52bec8[2026-08-18,14:36:50,000 INFO] Found 0 case ids to sync: []Or am I  missing something?Thanks in advance

Hello everyone, I can currently use the SOAR API endpoint /api/external/v1/store/TestIntegration/{integrationInstanceId} as part of a custom script that lists all installed integration instances and then runs the “Ping” action via that endpoint (the equivalent of hitting the “Test” button in the portal when viewing an integration instance) to run the equivalent of a health check (e.g. confirm connectivity and check that auth still works/no secrets have expired). Looking at the SOAR API mapping table (SOAR API mapping table  |  Google Security Operations  |  Google Cloud Documentation), there is no Chronicle API equivalent. Anyone find a solution on how to run the integration ping action via a Chronicle API?

Hi everyone,When creating a search filter in Native Dashboard I’ve noticed that the filter seems to be case-sensitive.For example: Searching for johndoe will miss results containing JOHNDOE or JohnDoe Is there a way to make the filter case-insensitive so that user input matches regardless of letter case?

We have an MS form that posts to GenerateCollaboratorRequest for Travel. In the legacy case view, this data is visible in the Event data:-Can see the custom fields from the form as event data here:-But in the new Cases 2.0 experience, the Event data doesn’t show any of the fields I need:-Am I looking in the wrong place or do I need to perform a different set of steps to pull this into cases 2.0 as I cannot locate this data. Playbook still operates normally and I can reference the Event data in the normal way, it’s just not visually available for analysts to reference.

Hi everyone, I have some issues, since 17th July the connector of Ingest Office 365 Security and Compliance alerts using Graph API The alert that is not ingesting is this one:  I didnt touch anything from the config, this is the config that I didnt touch U guys know if something change? Thanks!

I am looking to build a dynamic asset inventory in Chronicle SIEM to map AWS Account IDs to their respective OUs.My environment has a lot of accounts and CloudTrail logs lack OU context. My plan is to create a Chronicle Data Table with a bulk export of current accounts and then use a YARA-L detection rule to catch CreateAccount events (which contain the OU name). This rule would trigger a SOAR playbook to automatically append the new Account ID and OU mapping to the Data Table. What is the best practice for my problem?Which YARA-L rule and playbook should I create for this solution?Thanks

I'm trying to correlate detection rule data with case information in a dashboard, but I'm getting the error:"Joining Case with other data sources is not supported."My goal is to map detection details to the associated case. For example, for a detection rule like Brute Force, I need to retrieve: Rule name Rule ID Relevant UDM fields from the detection (e.g., principal IDs, principal user ID, etc.) The related case The case closure reason/code Is there a supported way to achieve this correlation, or is there an alternative approach?

For the dashboard filter, is there way we can filter results for the current month? in absolute and relative setting, not able to achieve that. 

I updated a rule, and a few minutes later I received a new alert triggered by an event from the past. The event has an ingestion timestamp from two days ago.Is this expected behavior? Does updating a rule automatically trigger a retroactive run/reprocessing of previously ingested events, or could this be a bug?

Hi team,I noticed an issue with the Google SecOps documentation for the Upwind default parser.The Upwind integration is currently listed on the Supported default parsers page with the ingestion label UPWIND:https://docs.cloud.google.com/chronicle/docs/ingestion/parser-list/supported-default-parsers However, when clicking Upwind to access the parser/integration setup documentation, the following page returns a 404 – Page not found:https://docs.cloud.google.com/chronicle/docs/ingestion/default-parsers/upwind Could you please confirm whether the documentation URL has changed or if the Upwind setup guide is currently unavailable?

I’m building a playbook that runs on new alerts and enriches it’s entities. To avoid unnecessary API calls, I want to only enrich entities that have not already been enriched. Some cases may contain alerts with the same entities, it would be inefficient to run each duplicate entity through enrichment each time. The idea is to have a condition at the start of the playbook that filters on the ‘Entity.IsEnriched’ field. If this field is False, perform enrichment. Once enrichment is complete, the playbook would then set the field to True.I can set the field value for an entity fine using the ‘Enrichment - Enrich Entity With Field’ action. My issue is that I cannot access this field from anywhere in the playbook. Other fields such as ‘Entity.IsInternal’ are exposed, but this is not. Why is this? 

Is there any way to get the number of cases triggered by specific entities through SIEM search? Or would that need SOAR?Trying to make a dashboard widget that shows a SIEM entity and the number of cases it has triggered. I want to use SIEM search instead of SOAR because SOAR entities are username unique, so the same person appears as multiple entities, while SIEM already has it aggregated under a single entity.Is there a way to achieve this?

Project ID: traknly-3cb91App Name: TraknlyIssue:My app verification is currently stuck on the branding guidelines requirement error ("Your app has not met branding guidelines requirements...").I have already updated and saved our app name and branding across our OAuth consent screen and homepage so that they match. However, no initial email thread was received from the Trust & Safety team to reply to, and updating the consent screen settings has not refreshed the verification queue.Could a Community Manager or Google representative please help escalate or route this Project ID to the Trust & Safety team for review?Thank you!

I’m trying to set a dashboard widget and I need to set timeframe as current month (from the month beginning till date)In relative and absolute there’s no such option. Is there a way that we can achieve this?