Google Security Operations

Im using set context on alert level and i have multiple duplicate values.Now i need to remove all duplicates

Hey Community, I'm working on configuring a detection rule in SecOps to monitor and generate an alert when a file owned/signed by my company is uploaded to VirusTotal. Has anyone worked on a similar task in the past? 

I am having difficulty writing a detection rule to identify VPN IPs, specifically for services like Mullvad VPN and other similar VPN providers, using only built-in threat feeds (no external data sources). I do not want to hardcode ASN numbers.

Hello,I have a bindplane configuration that collects logs from Active Directory and Windows Events. However, I noticed that some events are not being sent to the blindplane, but are generated on the server.For example, event 4740. I can see this event in the event viewer, but at no point is it consumed by the bindplane.What could be causing these events not to be brought in?

hello, has anyone encountered or have used security_result.variables.key before? i would like to ask for your help with the parser syntax for it. tyia!

Hi All,I’ve integrated Microsoft Graph Mail with Google SecOps SOAR. For the Delete Mail  action, if we don’t provide specific values for the Sender or Subject filters, will the action delete all emails from the user’s mailbox?

I’ve been using this page to reference collector ID values in ingestion metrics.https://docs.cloud.google.com/chronicle/docs/ingestion/ingestion-notifications-for-health-metricsRecently, I’m seeing bbbb1111-bbbb-1111-bbbb-1111bbbb1111and ffffffff-ffff-ffff-ffff-ffffffffffffvalues returned for ingestion.collector_id -- are these documented anywhere? Seeing UDM as the ingestion.metadata.log_type for these -- I assume one or the other of these corresponds with entity risk change UDM events which have recently been enabled, but not sure about the other.https://docs.cloud.google.com/chronicle/docs/release-notes#October_28_2025

I am pulling in AD Context Logsas per Collect Microsoft Windows AD logs  |  Google Security Operations  |  Google Cloud For user accounts, I am seeing the Enrichment in my event logs, however for Computer objects I am not seeing this? Here’s the context dataBut when I check event logs for that host:although the IP is there, which I doubt is from enrichment, the other attributes not… I need at least the role.  

I have seen “Integration - Updated integration action definitions to meet the new requirements of IDE” come up in lots of SOAR integration updates. What new requirements are being referenced? Is there some kind of deadline by which these updates have to be implemented?

Can anyone identify the difference in the maximum result when using different over values in the match?Example: I search the last hour of logs by log_type: events: $event.metadata.event_timestamp.seconds > timestamp.current_seconds() - 3600 $silent_hostname = $event.metadata.log_type And in the match I insert: match: $silent_hostname over 30 min This shows me 2 groups of logs:Group A (the first 30 minutes) and Group B (the last 30 minutes).With the following outcome, to show me the max timestamp of each group: outcome: $max_event_time = max($event.metadata.event_timestamp.seconds) I get 2 results, each with the max timestamp for its group.However, if I change the over value to 1 hour, it is supposed to return only one result, with the max timestamp equal to the max timestamp from Group B. But th

There are two endpoints for log ingestion into SecOps:europe-malachiteingestion-pa.googleapis.comchronicle.googleapis.comWhether using the APIs directly, or via the bindplane agent, we can get successfully logs into our SecOps instance.The "legacy" Malachite API works perfectly. The logs, labels, and base_labels are added, meaning Data RBAC works as expected.metadata.base_labels.allow_scoped_access = true metadata.base_labels.ingestion_kv_labels[0].key = "attempt_id" metadata.base_labels.ingestion_kv_labels[0].value = "597901e6cbfb490e8903fb660da2b4e0" metadata.ingestion_labels[0].key = "attempt_id" metadata.ingestion_labels[0].value = "597901e6cbfb490e8903fb660da2b4e0"The v1alpha, chronicle API allows our logs to be ingested. The ingestion labels are visible in SecOps, but the

Hi everyone,I’m working on a YARA-L detection rule in Google SecOps for Intune wipe operations. The rule should alert when any user performs more than 3 device wipe attempts within a 1-hour window.However, I need to add an exception for one specific identity (X), where the threshold should instead be 6 wipe attempts.In other words: in one hour For all attempts alert if wipe count > 3 For user X → alert only if wipe count > 6 My current simplified condition is: This triggers for all identities—including X—even though X should only alert after 6 events.I’m trying to implement logic like: IF identity == "X" THEN threshold = 6 ELSE threshold = 3Does any

Hi Team,I am looking to get an alert if I miss a log from an endpoint from a server. Since the ingestion API monitoring is not granular enough to get this info, I planned to create a dedicated Yara-L rule for the said server. The rule I had planned for looked something like this:    rule silentLogFromCriticalEndpoint { meta: author = "Srijan Kafle" description = "Detects missing logs from server" severity = "MEDIUM" created = "2024-06-03" events: $session.principal.namespace = "prodSydney" and $session.principal.hostname = "redacted" $source = $session.principal.hostname $tenant = $session.principal.namespace match: $source,$tenant over 12h outcome: $risk_score = 3 // logic to check delay here which is not working $delay = $session.metadata.event_timestamp - timestamp.current_seconds() condition: $session and $delay >= xyz }  line 2

I have been thinking about how google is assures log data post ingestion is stored in an immutable state for assurance from data security viewpoint.  I tried searching for SecOps documentation but unable to find a straightforward statement. Also, once data is stored, is there a way one could delete/alter the data, if one has an appropriate permission to do so.  And how to keep a tap to such actions.?  

I can't add a timezone setting to the timestamp.The part of the parser that extracts the timestamp is below.----------date {match => ["eventtime1", "UNIX", "UNIX_MS"]on_error => "not_eventtime1_valid"}----------I tried the following settings:①----------date {match => ["eventtime1", "UNIX", "UNIX_MS"]timezone => "Asia/Tokyo"on_error => "not_eventtime1_valid"}----------Result:No change.②----------date {match => ["eventtime1", "yyyy-MM-dd HH:mm:ss"]timezone => "Asia/Tokyo"on_error => "not_eventtime1_valid"}----------Result:Syntax error.The current time is stored in UNIX time in timestamp.Is it possible to reflect the time zone setting in the above settings?

Hi,I am developing a custom parser for a email-security product with JSON logs.Everything is working as intended, except for information I want to include under “security_result.action_details” UDM field, which does not get populated whatever I try.My code is as follows:if [event][scan][indicators] != "" { for indicator in [event][scan][indicators] { mutate { replace => { "action_details" => "indicator" } } mutate { merge => { "security_result.action_details" => "action_details" } } mutate { merge => { "udm_event.idm.read_only_udm.security_result" => "security_result" } } }}With the json log having information in this format (redacted all other information about the email and left only the structure and relevant field):

Hi All,Struggling to find "graph.metadata.threat.threat_feed_name"  for info stealers. Also , how to get those list of threat feeds , we can leverage. for both VT and Mandiant.Thanks in advance  

Hi AllHow to export the list of rule name both curated and custom. (not the rule set name) RegardsAjay P

We are encountering an error when attempting to create multiple data feeds in Google SecOps SIEM from a single Azure Event Hub.The error message "Combination is not unique" suggests that the system is not allowing multiple feeds with the same configuration details.We have configured an Event Hub with multiple log sources (Azure Activity, Defender logs)Questions:[1] whether we need to create separate Event Hubs for each data feed or if there's a way to differentiate the data streams within the same Event Hub for ingestion into SecOps SIEM, referencing the documentation on https://cloud.google.com.mcas.ms/chronicle/docs/administration/create-azure-feed

 Hi everyone,I’m reaching out to check whether others are experiencing issues with the curated detection ruleset Workspace: Data Exfiltration from Gmail in Google SecOps.We’re using the recommended direct ingestion path for WORKSPACE_ACTIVITY logs (including Gmail). While the ingestion and parsing work, we’ve noticed that the UDM fields produced by the Workspace Activity parser do not align with what the curated detection rules expect — specifically in the Workspace: Data Exfiltration from Gmail ruleset.Examples of mismatches include:principal.application is populated with only the message_info.source.service value (e.g., gmail-ui), while the curated rule expects a concatenated value such as gmail-ui send. The selector value is placed under additional.fields instead of a field the curated rule monitors. metadata.product_name is mapped as gmai

Hi everyone, I've been exploring Google Cloud's Confidential Computing products like Confidential VMs, GKE Nodes, and Confidential Space. The potential for protecting data-in-use is very promising, especially for sensitive AI workloads. My question is:How can we securely integrate third-party AI models (e.g., from open source or external vendors) into Confidential Space or Confidential VMs without compromising data privacy or the TEE trust boundary? Are there recommended architectural patterns, isolation practices, or attestation tools we should use when the model provider is not part of our organization? Appreciate any insights, resources, or examples you can share! Thanks,