Google Cloud Security Forums

Recently active
Help others

Remote SecOps MCP server: all SOAR-backed tools return "Internal error encountered." on one instance, while SIEM tools work fine

Hi all,We operate multiple Google SecOps instances and use the managed remote MCP server (chronicle.<region>.rep.googleapis.com/mcp, negotiated protocol version 2025-11-25) from an AI agent. On one specific instance, every SOAR-backed tool fail

112

52 minutes ago

matthewnicholsCommunity Manager

Google Security Operations

🚀 Exciting News: Introducing "The Weekly Brief" — Your Ultimate Guide to Mastering Google Security!

Hey Google Cloud Security Community!Whether you are a security engineer building custom parsers, a SOC analyst hunting threats, or a security leader keeping up with rapid product releases, staying ahead of the threat landscape requires continuous le

1156

2 hours ago

spanuganti

Google Security Operations

CTime / MTime Change Monitoring/Tracking

Hello,I'm parsing Qumulo JSON audit logs in Google SecOps and I'm able to successfully extract top-level and nested fields such as:{"operation": "fs_write_metadata","details": {"file_id": "9283XXXXXXXXXX329","path": "/smb/underwritingscan/Windows (C)

130

5 hours ago

ranasab12New Member

Cloud Security Foundation

Optimizing asynchronous execution flows in modern custom web extensions

Hi everyone,While developing custom browser extensions and lightweight client-side tools, managing background script lifecycles and asynchronous data serialization can sometimes introduce performance bottlenecks if event listeners aren't properly opt

9 hours ago

joaocarvalhoBronze 2

Google Security Operations

Procedure or best practices to purge ingested data by specific Log Type in Google SecOps?

Hello everyone,I'm currently looking into data lifecycle management and retention within Google SecOps, and I have a specific use case I was hoping to get some insights on from the community.We have a scenario where we might need to remove historical

633

10 hours ago

arv261095Bronze 2

Google Security Operations

Multi tenancy in google secops siem soar

Hi All,Anyone has performed a complete end to end implementation of multi tenancy in google secops SOAR SIEM.I need real example with implementation steps for typical GCP environment.Also if any relevant documents will be helpful

1016

10 hours ago

ranasab12New Member

Cloud Security Foundation

Securing data pipelines and managing access controls in modern cloud architectures

Hi everyone,While designing scalable cloud environments and handling continuous data workflows, maintaining strict security controls around API endpoints and background processing tasks is essential. Implementing least-privilege access and optimizing

15 hours ago

delstonBronze 2

Google Security Operations

Microsoft 365 Defender - Integration

Hi All, I am testing the Microsoft 365 Defender (XDR) Integration v26.0 and have observed the following which when looking at the documentation seems to be by design. Scenario 1Event triggered and “Incident 1” created in XDR Event triggered and “Inci

1119

17 hours ago

AnimSparrowBronze 5

Google Security Operations

Highlighted Fields not visible in Entities Highlights widget

First of all this issue appear around 1month ago? Before I am sure that we were able to see highlights.I am having an issue with Highlighted Fields properties not rendering below entity inside the Entities Highlights widget at the bottom of the Alert

212

19 hours ago

Rob_PStaff

Google Threat Intelligence

Agentic Prompt for URL and Domain Analysis

Hi Everybody! I’m developing a prompt that can help intelligence analysts and security professionals with assessing the malicousness of a URL or a Domain. I was inspired after working with one of my clients who asked me:“What workflow would you foll

181

22 hours ago

kataroBronze 2

Google Security Operations

Remote SecOps MCP server: all SOAR-backed tools return "Internal error encountered." on one instance, while SIEM tools work fine

112

52 minutes ago

spanuganti

Google Security Operations

CTime / MTime Change Monitoring/Tracking

130

5 hours ago

ranasab12New Member

Cloud Security Foundation

Optimizing asynchronous execution flows in modern custom web extensions

9 hours ago

arv261095Bronze 2

Google Security Operations

Multi tenancy in google secops siem soar

1016

10 hours ago

delstonBronze 2

Google Security Operations

Microsoft 365 Defender - Integration

1119

17 hours ago

AnimSparrowBronze 5

Google Security Operations

Highlighted Fields not visible in Entities Highlights widget

212

19 hours ago

jayminBronze 5

Google Security Operations

How to map the payload field to the SOAR Webhook Fields in Google SecOps SOAR? (Severity Mapping, Nested IfElse, and Storing Full JSON)

I need to create a webhook to ingest the alerts from my platform.I have a few questions regarding the field-mapping capabilities: Mapping Severity: In the mapping section i didn’t see the alert severity field. I need to map that field from my json pa

2763

1 day ago

DrVigilantNew Member

Google Security Operations

Trellix HX Audit Feed (TRELLIX_HX_AUDIT) No Longer Receiving Bulk Acquisition Audit Events

Hello,We're investigating an issue with a Trellix HX Audit integration in Google SecOps and would appreciate any guidance from others who have worked with this feed.EnvironmentGoogle SecOps SIEM Trellix HX / FireEye HX API Feed Log Type: TRELLIX_HX_A

211

1 day ago

swaqasNew Member

Fraud Defense (reCAPTCHA)

reCAPTCHA Cloud migration security issue

Hi,I'm a developer who set up reCAPTCHA keys for a client's 300 websites, and I'm trying to fully remove myself as an owner. I've hit a dead end created by the migration and need your help.Here's what happened, in order:1. I first tried to transfer/

100

1 day ago

VictorSOARBronze 1

Google Security Operations

Custom Field Dashboard Query Failing with "invalid argument" Error

Hello Google SecOps Community,I am facing an issue with a dashboard query that retrieves custom field values from SOAR cases.The dashboard was working correctly until last week, and no changes were made to the query. However, it has recently started

252