Google Security Operations

Hi all,Does anyone know why Google Cloud Platform Trust & Safety team does not reply to an appeal?This has been for over 8 days and I sent them many times but they don't respond-The GCP console is directing me to send appeal and I can not use anything or view the dashboard or take any corrective action  Pleas share any info that may help me in this situation  Kind regards  

The use case is to drop the logs matching metadata.log_type = “WORKSPACE_ACTIVITY” AND metadata.product_name = “chrome”.Is there any other option besides Parser Extensions? From what I read, parser extensions are applied to the raw events. Is that right, or is there a method where I can also use UDM events on the normalized events to build the drop filter?

I’ve been using this page to reference collector ID values in ingestion metrics.https://docs.cloud.google.com/chronicle/docs/ingestion/ingestion-notifications-for-health-metricsRecently, I’m seeing bbbb1111-bbbb-1111-bbbb-1111bbbb1111and ffffffff-ffff-ffff-ffff-ffffffffffffvalues returned for ingestion.collector_id -- are these documented anywhere? Seeing UDM as the ingestion.metadata.log_type for these -- I assume one or the other of these corresponds with entity risk change UDM events which have recently been enabled, but not sure about the other.https://docs.cloud.google.com/chronicle/docs/release-notes#October_28_2025

I’ve created a firewall rule to stop all traffic on all protocols from all countries except one.However when I look at my VMs network stats, the chart titled “Firewall incoming packets denied” shows less than one packet stopped per second.This is during a DDOS attack with millions of hits per second from around the world.How come the firewall does not stop 99% of these, if 99% of all countries are blocked?

Hello Team,We are currently ingesting the following Google Workspace logs into Google SecOps: WORKSPACE_ACTIVITY WORKSPACE_ALERTS WORKSPACE_CHROMEOS WORKSPACE_GROUPS WORKSPACE_MOBILE WORKSPACE_USERS I would like to check whether Google Vault logs are also included as part of the Workspace log ingestion, or if any additional configuration is required to ingest Vault-related audit logs.Could you please confirm if Vault logs are supported automatically or if we need to enable any specific settings or APIs to receive them?Thank You

Hi Team,I am looking to get an alert if I miss a log from an endpoint from a server. Since the ingestion API monitoring is not granular enough to get this info, I planned to create a dedicated Yara-L rule for the said server. The rule I had planned for looked something like this:    rule silentLogFromCriticalEndpoint { meta: author = "Srijan Kafle" description = "Detects missing logs from server" severity = "MEDIUM" created = "2024-06-03" events: $session.principal.namespace = "prodSydney" and $session.principal.hostname = "redacted" $source = $session.principal.hostname $tenant = $session.principal.namespace match: $source,$tenant over 12h outcome: $risk_score = 3 // logic to check delay here which is not working $delay = $session.metadata.event_timestamp - timestamp.current_seconds() condition: $session and $delay >= xyz }  line 2

We are setting up Google Cloud Load Balancer, and wish to distribute load to a number of webservers/VMs.We wish to keep external IPs on the VMs to allow for software updates etc.We also wish to protect the webservers from external traffic with a firewall, so only the load balancer can access them.Is that possible? As the load balancer only functions as a passthrough, the visitor IP is what the firewall sees.How can we use the firewall to only allow traffic from the loadbalancer?

I am attempting to parse the following log by using UDM mapping but I am facing the following error:generic::unknown: pipeline.ParseLogEntry failed: LOG_PARSING_CBN_ERROR: "generic::invalid_argument: failed to convert raw output to events: failed to convert raw message 0: field \"idm\": index 0: recursive rawDataToProto failed: field \"read_only_udm\": index 0: recursive rawDataToProto failed: field \"security_result\": index 0: recursive rawDataToProto failed: field \"action\": failed to make strategy: received non-slice or non-array raw output for repeated field" This is the log piece:{"threatType": "General Malware","status": "Blocked"}and this is the parsing code:json { source => "message" array_function => "split_columns" on_error => "error_not_json" } if [status] == "Allowed" { mutate { replace => { "security_result

Hi all,I’m currently working on testing playbooks in my environment and looking for the best practices when it comes to running simulated cases. Specifically, I’d like to know if there’s a way to automatically create cases based on actual events occurring within my environment to help simulate more realistic scenarios.If anyone has experience with this or can provide guidance on how to automate these test cases effectively, that would be greatly appreciated. I’m also interested in hearing how others approach playbook testing in general.Thanks in advance!

I need to create a webhook to ingest the alerts from my platform.I have a few questions regarding the field-mapping capabilities: Mapping Severity: In the mapping section i didn’t see the alert severity field. I need to map that field from my json payload.  Nested If-Else Support: Does the Expression Builder support nested if-else conditions? Something like: IF(condition1, IF(condition2, valueA, valueB), valueC ) Combining fields: Also can i combine few of the fields like classification, id, timestamp fields from my payload to create Alert title? e.g. suscpicios 1.2.3.4 at time. Store Full JSON Response: Is there any method to store or dump the entire webhook JSON payload into a field inside the Event object? This would allow me to reference addi

Hi AllHow to export the list of rule name both curated and custom. (not the rule set name) RegardsAjay P

hello, has anyone encountered or have used security_result.variables.key before? i would like to ask for your help with the parser syntax for it. tyia!

I have been thinking about how google is assures log data post ingestion is stored in an immutable state for assurance from data security viewpoint.  I tried searching for SecOps documentation but unable to find a straightforward statement. Also, once data is stored, is there a way one could delete/alter the data, if one has an appropriate permission to do so.  And how to keep a tap to such actions.?  

Hi everyone,I’m working on a YARA-L detection rule in Google SecOps for Intune wipe operations. The rule should alert when any user performs more than 3 device wipe attempts within a 1-hour window.However, I need to add an exception for one specific identity (X), where the threshold should instead be 6 wipe attempts.In other words: in one hour For all attempts alert if wipe count > 3 For user X → alert only if wipe count > 6 My current simplified condition is: This triggers for all identities—including X—even though X should only alert after 6 events.I’m trying to implement logic like: IF identity == "X" THEN threshold = 6 ELSE threshold = 3Does any

We have just enrolled in Cloud Armor paygo.Two attacks have been identified already. The dashboard reads “Mitigation is enforced. No action is required”.But the VM is still unavailable when we allow external traffic.What else can we do?

Im using set context on alert level and i have multiple duplicate values.Now i need to remove all duplicates

Hey Community, I'm working on configuring a detection rule in SecOps to monitor and generate an alert when a file owned/signed by my company is uploaded to VirusTotal. Has anyone worked on a similar task in the past? 

I am having difficulty writing a detection rule to identify VPN IPs, specifically for services like Mullvad VPN and other similar VPN providers, using only built-in threat feeds (no external data sources). I do not want to hardcode ASN numbers.

Hello,I have a bindplane configuration that collects logs from Active Directory and Windows Events. However, I noticed that some events are not being sent to the blindplane, but are generated on the server.For example, event 4740. I can see this event in the event viewer, but at no point is it consumed by the bindplane.What could be causing these events not to be brought in?

Hi All,I’ve integrated Microsoft Graph Mail with Google SecOps SOAR. For the Delete Mail  action, if we don’t provide specific values for the Sender or Subject filters, will the action delete all emails from the user’s mailbox?

I am pulling in AD Context Logsas per Collect Microsoft Windows AD logs  |  Google Security Operations  |  Google Cloud For user accounts, I am seeing the Enrichment in my event logs, however for Computer objects I am not seeing this? Here’s the context dataBut when I check event logs for that host:although the IP is there, which I doubt is from enrichment, the other attributes not… I need at least the role.