Google Cloud Security Forums

Recently active
Help others

Converting Decimal IP Address to Standard Format in Google SecOps Parser

Hello Team,I am working with logs in Google SecOps where the IP address fields (such as SourceIPV4, TargetIPV4, and AnalyzerIPV4) are received in decimal (integer) format instead of the standard dotted IPv4 format.For example:750176699 → expected to

291

4 hours ago

JillieNew Member

Cloud Security Foundation

The Straight Talk

"Hi Community!I’m an Innovator currently pushing through the final two modules of the Beginner Cloud Security path. I’ve finished almost 3 models so far, but I’m feeling the mental exhaustion!My big question for those who have already 'gotten in' or

122

4 hours ago

kesoBronze 5

Google Security Operations

Audit logs from SOAR

Being playbooks so critical, there should be a way to alert when they are created/updated/deleted (CUD). There was a way, at least of checking Create and Update by creating an alert in GCP and searching for protoPayload.methodName =~ "malachite.*?(?

141

6 hours ago

GuyIncognitoNew Member

Google Security Operations

Rapid7 Feed Ingestion

New to Google SecOps, so I might not be looking in the right place, hoping to get some help.I setup 2 Feeds to pull from the Rapid7 Insight Cloud console one for assets and one for vulnerabilities. https://docs.cloud.google.com/chronicle/docs/refere

558

7 hours ago

cyberSecGuyBronze 1

Google Security Operations

Google SecOps multitenant Chronicel SOAR connector misses original case ID

Hello, I am working on a parent-child multitenant solution. Child alerts are pulled by the Parent SOAR and a new case is created, however the original case ID (the one created by the Child) is missing. Is there any way to find the original case ID

mikemeeksStaff

VHR20260401 - April 1, 2026The Mandiant Intelligence Validation Research Team (VRT) has published VHR20260401 - Content Expansion. This content pack requires Director version 4.14.1.00/94-0 or higher.If you’ve enabled the Content Service, this conten

9 hours ago

chrisfStaff

Security Validation

Validation Content Update - April 1, 2026

VHR20260401 - April 1, 2026The Mandiant Intelligence Validation Research Team (VRT) has published VHR20260401 - Content Expansion. This content pack requires Director version 4.14.1.0-0 or higher.If you’ve enabled the Content Service, this content pa

9 hours ago

ilantzStaff

Google Threat Intelligence

Announcing M-Trends 2026: Data, insights, and strategies from the frontlines

Building true operational resilience requires moving faster than the threats you face. That starts with understanding exactly how adversaries are finding success, so you can use that intelligence to stop them.Today, we are proud to announce the relea

Jim1234New Member

So we have something along these lines “This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.” on all of our websites and forms. Are we good to remove this completely as of 2nd April, ofcourse we will be updati

12 hours ago

sofnNew Member

Google Security Operations

SCC Enterprise – SyncSCCJiraTickets job failing with HTTP 410 (REST API v2 /search removed)

Integration version: SCCEnterprise_V18.0Platform: Google SecOps SOAR (Siemplify)Jira: Atlassian CloudProblemThe SCC Enterprise - SyncSCCJiraTickets job fails on every execution with an HTTP 410 error when attempting to search for Jira issues:JiraErro

121

1 day ago

manoj610New Member

Google Security Operations

Converting Decimal IP Address to Standard Format in Google SecOps Parser

291

4 hours ago

kesoBronze 5

Google Security Operations

Audit logs from SOAR

141

6 hours ago

cyberSecGuyBronze 1

Google Security Operations

Google SecOps multitenant Chronicel SOAR connector misses original case ID

Jim1234New Member

sofnNew Member

Google Security Operations

SCC Enterprise – SyncSCCJiraTickets job failing with HTTP 410 (REST API v2 /search removed)

121

1 day ago

Alex3Lee5New Member

Google Security Operations

Enrichment proccess

Hello,I have integrated the Azure Organizational Context and noticed that some log sources are now being enriched based on this data. For example, my Netskope logs are successfully using principal.user.userid for enrichment.However, in other log sour

141

1 day ago

EP0Bronze 2

Google Security Operations

Mismatched severity value UNKNOWN_SEVERITY

I’m looking at Crowdstrike events and trying to get an overview of all the detections by first getting a count of unique severity, tactic, technique, description, product event type combinations. events: $e.metadata.log_type = "CS_ALERTS" $e_p

224

1 day ago

keiSBronze 4

Google Security Operations

I am getting a 401 error when trying to log in to Google SecOps.

We are currently experiencing an issue where some users are unable to access Google SecOps.Could you please comment on possible causes?■Premise- Cloud Identity is used as the IdP.- SOAR Migration is complete, and SOAR permissions have been migrated t

565

1 day ago

d_patel_djBronze 2

Google Security Operations

Search for all alerts triggered by a single user

Hello, This might be a very simple request (forgive me) - but how do you SIEM search for a single user to see every alert that user has triggered in the past 7-days. I know you can see the results in the “alerts” tab next to the SIEM results. But I

322

1 day ago

SanzzNew Member

Google Security Operations

Secops Dashboard-Filters Query

Hi , I’ve noticed that when I refer data tables in a dashboard query, I’m unable to apply the global filter to that specific widget. Is this a known limitation in Google SecOps?”Query :case.alerts.entities.type = "ADDRESS"$ip = case.alerts.entities.i

402

2 days ago