Security Forums

Hey folks,As you know, managing credentials in Google SecOps can be quite tedious. To address this, we released a new integration called “Secret Manager”. The purpose of this integration is to allow you to automatically manage all of the credentials associated with Response Integrations, Connectors and Jobs from 1 place.  How it works?Inside the integration, there is a job called “Sync Integration Credential Job”. This job is responsible for the synchronization of credentials.As part of the job, you will need to provide a configuration JSON that will map the Google SecOps content to Secret Manager entries.AuthenticationJust like all other Google Cloud integrations, this integration supports authentication via Workload Identity and Service Account key. You will need to assign “Secret Manager Secret Accessor” Role.Note: for situations, where you have identity created in Project A, but your Secret Manager credentials are located in Project B, you should use parameter Project ID, which wil

I wanted to share the workflow we’ve been using to connect Chronicle detection rules with SOAR (Gemini) playbooks, specifically focusing on how rule design directly drives playbook effectiveness.The key idea is:The rule is not just a trigger — it is responsible for providing all the context the playbook needs to make a decision.1. Rule as the Context EngineInstead of relying on the playbook to “figure things out,” we push as much structure and meaning as possible into the rule itself.Each rule is responsible for:Identifying the behavior Normalizing key fields Providing investigation-ready context via the outcome sectionBy the time the alert reaches the playbook, it should already answer:What happened? Who did it? On what system? Why is it suspicious?2. Outcome Section as the ContractThe outcome section acts as a contract between the detection rule and the playbook.We standardize outcomes across rules so every playbook receives consistent inputs.Core pattern we use:$outcomeUserIsTechnic

Hey folks, As Microsoft is deprecating the Microsoft Sentinel portal and transitions into Unified XDR platform by March 30th 2027, we want to proactively announce that some of the connectors will be considered deprecated on the same date.Additionally, we reviewed existing connectors and observed that there are multiple connectors that are solving the same use case. As part of this initiative, we want to consolidate and also deprecate redundant connectors to offer better supportability.  The following connectors will be considered deprecated on March 30th 2027:Microsoft Azure Sentinel Incident Connector v2  (Microsoft Sentinel) Microsoft Sentinel Incident Tracking Connector (Microsoft Sentinel) Microsoft Defender ATP Connector V2  (Microsoft Defender for Endpoint) Microsoft Defender ATP Connector  (Microsoft Defender for Endpoint) Microsoft Graph Security Connector  (Microsoft Graph Security) Microsoft Graph Office 365 Security and Compliance Connector (Microsoft Graph Security)What is

Financial institutions face an ongoing battle against card fraud and credential leaks. A common challenge for security teams is identifying when Bank Identification Numbers (BINs) are leaked across underground channels. To address this, Google Threat Intelligence (GTI) provides advanced, real-time dark web search capabilities to gain direct visibility into illicit communication networks.This article details how to leverage GTI’s advanced dark web search capabilities to automate BIN leak monitoring, transitioning from manual searching to a scalable, automated pipeline. Harnessing Modern Dark Web Search Capabilities Google Threat Intelligence indexes underground communication platforms dynamically, allowing security teams to query massive volumes of raw dark web data using precise, granular filters. For a deeper understanding of these capabilities, you can review the Google Threat Intelligence Dark Web Guide.By interacting with these capabilities via the API, analysts can continuously sc

📣 New Feature Alert: Generate Threat Profile Recommendations directly from Splunk Events! 📣 With our latest release, you can now seamlessly map threat associations from IOC matches in Splunk directly into your Google Threat Intelligence (GTI) Threat Profiles! What’s New?By leveraging the Google Threat Intelligence for Splunk app, your administrators can automatically synchronize observed threats—straight from your Splunk Adversary Intelligence dashboard into your chosen GTI Threat Profile.Key Highlights: 🎯 Accurate & Noise-Free: The integration only sends automatically correlated data. Manual SPL query investigations are excluded to ensure your Threat Profile remains highly relevant and actionable. 🛡️ Comprehensive Coverage: Automatically sync specific threat association types including Threat Actors, Malware Families, Software Toolkits, and Campaigns. 🏷️ Clear Visualization & Filtering: Synchronized collections automatically populate in Google TI with "Observed" and "

Building true operational resilience requires moving faster than the threats you face. That starts with understanding exactly how adversaries are finding success, so you can use that intelligence to stop them.Today, we are proud to announce the release of the M-Trends 2026 report! Distilling insights from over 500k hours of incident investigations executed by Mandiant in 2025, and supporting Google Threat Intelligence Group (GTIG) research, this year’s edition reveals the critical shifts defining today's threat landscape. This post provides a quick preview of the themes from this year's report. Download the M-Trends 2026 report now for a comprehensive dive into our frontline data, and review the supporting resources below for more. The collapse of the "hand-off" window One of the most notable trends identified in Mandiant investigations is the increased specialization within the cybercrime ecosystem. In 2022, the median time between an initial access event and the hand-off to a seconda

Hello Everyone,As we realized, the impact of the React Vulnerability is very critical among your workloads. The React vulnerability, CVE-2025-55182, has a CVSS score of 10 and is being actively exploited. Customers need to be aware if their organization is impacted with this CVE. Google has created a pre-defined security graph rule for SCC Enterprise  and Premium customers that will generate an "Issue" if your GKE workloads or Compute instances are externally exposed and vulnerable. You can view these alerts in the "Issues" queue within your environment.A sample representation of how this Issue appears in your SCC console is shown below, with the associated Findings for the vulnerability displayed within the Issue.If you are an SCC Premium or Enterprise customer, you can use Graph Search to check if your organization is impacted with this vulnerability. You can also use reachability context in Graph Search to prioritize remediation among impacted workloads with the CVE and focus on tho