Recently active topics

My production project is down and suspended for 48h now with no prior notice and no reply for my appeal request. Not sure what to do.  We are facing a huge loss. I have audited all my code for any security leak and it is clean. Not sure what happened.

I'm using React Native (iOS) and Firebase Phone Authentication.At one point, I enabled reCAPTCHA Enterprise from the Firebase Console via:Authentication -> Phone -> App verification -> Enable reCAPTCHA EnterpriseAfter that, phone number auth started triggering reCAPTCHA verification. Later, I disabled reCAPTCHA Enterprise in the console, but Firebase still behaves as if it's enabled. Even though appVerificationDisabledForTesting = true is set in development, production builds continue showing this error:'auth/unknown', '[auth/unknown] The reCAPTCHA SDK is not linked to your app. See https://cloud.google.com/recaptcha-enterprise/docs/instrument-ios-apps'

Hello, I was directed to this specific thread by Forum Admin Miqua to escalate a deadlock between Billing and Trust & Safety.The Context: My academic NLP project was suspended for “Abusive Activity” on 3/4 due to a buggy data ingestion script hitting corrupted legacy URLs.The Fix (Appeal Case # [removed by moderator] ): On 5/4, I submitted a full technical Root Cause Analysis. I have permanently air-gapped the corrupted dataset and implemented strict Magic Byte Pre-Flight validation to prevent any future API flooding. I have had zero response from Compliance for 13 days.The Deadlock: Billing Support (Agent Ayosha, Case #70072588 / Billing ID: 018BDA-1AD09A-F5AFD9) informed me my account is “Closed” due to a refund and requested a new prepayment. However, my console still shows a hard “Abusive Activity” restriction. I cannot responsibly make a new prepayment until Trust & Safety clears the abuse flag, or my funds will be trapped in a locked account. Ayosha has stated she is tran

How to detect cyber security criminals and stop black hat hacker 

Co-Authors: André Naumann, Xavier Morales, Giacomo Gnecchi Ruscone The financial services industry is facing a fundamental shift in the threat landscape. Cyber fraud has been increasing in volume and complexity, and escalating, posing a threat that directly challenges an organization’s financial health and reputation. This concerning trend highlights the overlap between scams and cybersecurity and poses a persistent global challenge.  By way of example, the FBI noted that the cost of cyber fraud was $13.7 billion in 2024 in the US alone. This figure represented a nearly 10% increase from 2023, and constituted 83% of all financial losses reported to the FBI in 2024. Likewise, in 2025 the FTC released data that consumers reported losing more than $12.5 billion to fraud in 2024, representing a 25% increase from the prior year.  Most recently, the World Economic Forum’s fraud report noted that cyber-enabled fraud ranks as the second-highest organizational cyber risk after ransomware, furth

When building playbooks for Chronicle SOAR, I often run into a limitation around looping logic. Specifically, there doesn’t appear to be a supported way to create nested loops (a loop within another loop).This becomes an issue in fairly common use cases. For example:Iterating over all entities of a specific type in a case, and then looping through the values of a particular field for each entity. Looping through all alerts associated with a case, and within that loop, iterating through each alert’s entities or a specific type of entity.These types of nested iterations are typical in automation workflows, so I’m curious about the rationale behind the current limitation. Is there a design or technical reason nested loops aren’t supported today, and is this functionality something Google plans to add in the future?

If you are looking to advance your threat hunting capabilities, this webinar provides a practical deep dive into mastering GTI Dorking within Google Threat Intelligence. The session focuses on how to transform standard IoC lookups into sophisticated, multi-parameter searches that uncover hidden threats. Led by Technical Solutions Consultant Robert Parker, this session highlights the shift from searching for single indicators to building complex, behavioral-based queries. It demonstrates how to leverage advanced modifiers and AI-powered insights to move from manual investigation to automated, proactive alerting. For example, instead of just searching for a suspicious domain name, the demonstration shows how to combine parameters to find high-confidence phishing pages: "Find domains containing the word 'Google' that use a .xyz top-level domain, return a successful HTTP 200 response, and have at least five malicious detections."The Result: Users can identify precisely which "needles in th

I have looked over a number of posts regarding this but did not see an example of how to do it being posted.I need to make routine calls to a platform to pull reports and upload them to a Sharepoint and send an email to a list of users. Below is some dummy data that matches the structure of the response from a httpv2 call I made."response_data": [ { "id": "rpt_001a4f92", "name": "Q1 Sales Summary", "lastRun": "2026-04-14T08:00:00.000Z"}, { "id": "rpt_002b8c31", "name": "Monthly Active Users", "lastRun": "2026-04-14T07:45:22.000Z”} ]How do I iterate over the response_data  in a SOAR block, preserving the name (for comparison with a custom list to identify the email contacts) and id (used to pull the reports last run in another httpv2 call)?Flow should be:Get List of Reports (httpsv2) → For Each Item in Get List of Reports.response_data → Get Last Run data → Save to CSV (use loop.item name to name it with the current timestamp) → Upload to folder in Sharepoint (based on a custom list or

If you are new to Model Context Protocol (MCP), this webinar provides a practical introduction to using MCP within the Google Cloud Security ecosystem, specifically focusing on how it transforms manual security workflows into conversational ones. Led by Vasken Houdoverdov, Google Security Technical Solutions Consultant, this session focuses on the shift from agents that simply provide information to agents that can take direct action. It breaks down the foundational architecture of MCP and demonstrates how it can be applied to tools like Google SecOps and Google Threat Intelligence. For example, instead of writing a custom Python script or manually navigating the Google SecOps interface, the demonstration shows an agent processing a natural language request:"Use remote secops to see which cases are in a triage state. Present them in a table."The Result: The agent communicates through the MCP server to identify the necessary tools, pulls live data from the SecOps environment, and organi

In the fast-paced world of security operations, consistency and speed are paramount. SOC analysts often find themselves running the same set of searches for specific alert types—looking for user logins after a suspicious authentication or checking Windows Event Logs for specific error codes.What if you could standardize these searches, store them centrally, and have your playbook automatically run them before an analyst even opens the case?By utilizing Data Tables in Google Security Operations (SecOps), you can store predefined searches—both static UDM queries and Natural Language prompts—that trigger automatically based on a keyword submitted to a playbook block. This approach creates a reproducible, efficient workflow that aggregates critical data into a single, powerful widget. The Strategy: Data Tables as a Search Repository The core of this solution is the Data Table. Instead of hardcoding queries into individual playbook blocks or actions, you treat the Data Table as a repository

Author: Dominic Chua Introduction to the Agentic Platform The cybersecurity industry is currently undergoing a fundamental transformation, moving away from static automation and reactive detection towards the era of Agentic Artificial Intelligence. While previous iterations of Generative AI (GenAI) functioned primarily as "copilots" or passive assistants for summarization and query translation, Agentic AI introduces autonomous operators capable of perceiving, reasoning, planning, and executing tasks independently. In the context of Google Threat Intelligence,  this shift transforms threat intelligence from a static database into a dynamic, interactive partner for security teams.  The Agentic platform, serving as the sophisticated conversational gateway to Google’s expansive threat intelligence ecosystem, empowers security professionals to engage with specialized autonomous agents to dramatically accelerate investigations and threat analysis. This environment is engineered to transform

Author: Gaurav Sood  Modern security operations require a standardized and efficient way to collect, refine, and export telemetry data from diverse environments into Google Security Operations (SecOps). This document provides a comprehensive adoption guide for Bindplane, that would help the teams get insights into the technicalities involved with Bindplane implementation. By following the structured implementation workflow and field-tested best practices detailed here, teams can ensure a robust, scalable, and cost-effective logging architecture. High-Level Bindplane Concepts Bindplane - Where does it fit in the SecOps ecosystem?Bindplane is a telemetry pipeline designed to collect, refine, and export logs from various sources into Google Security Operations (SecOps). It provides a management layer (Bindplane console) and data transport mechanism (OTEL Agents)  that standardizes how security data reaches Google SecOps.In the Google SecOps ecosystem, it fits into the Data Ingestion layer

 Hi everyone,I’m currently in the process of setting up my Google Cloud environment and awaiting my monthly innovator credits. In the meantime, I’m not letting the grass grow under my feet! I’m kicking off my first security-focused project: The Automated IAM "Least Privilege" Auditor.The Goal: I want to build a tool (using Python and Cloud Functions) that audits IAM policies across a project and flags any identities holding the primitive "Owner" or "Editor" roles where a more granular predefined role would suffice.While I wait for my credits to clear, I’m focusing on: Mapping out the service account hierarchy. Writing the logic to parse IAM policy JSON objects. Designing a dashboard layout for security alerts. My Questions for the Experts: For a project like this, do you recommend pulling data via the Cloud Asset Inventory API or directly through IAM Policy calls? Are there specific "hidden" permissions you've seen cause the most trouble in production environments? I’m excited to

Author: Jeremy Land Efficient data ingestion is the cornerstone of any successful Security Operations Center (SOC). In Google SecOps, how you bring data into the platform directly impacts your detection latency, data enrichment quality, and overall operational costs.This guide provides a framework for selecting data sources based on the value they bring to your desired security outcomes, and then has an overview of available ingestion methods with strengths, limitations,  and critical differentiators which will allow you to select the most appropriate method for your data.Instead of going deep into all configuration options for every method this supports determining what data you should be ingesting and what approach to take, but for the specifics of how to configure any particular path you should refer to the documentation for that specific method. Planning for Data Ingestion: A Use-Case Driven ApproachRather than ingesting every available log, a successful strategy begins with the de

We currently have SIEM only for Google SecOps and we want to create dashboards and send reports.  Previously, we were using the Legacy Dashboards and it gave us the option to send them.  We are now moving to the new Dashboard but we are not able to see where we can send these as reports to an email. Can someone help me find where this is setup on the new Dashboards?

Hi, I am trying to install reCaptcha on my site but when I copy and paste that snippet of code with my site key, I get a submit button that appears at the top of my website. (Not the checkbox I was going for). 

Hi All,First may I apologise for the incorrect place for this topic - but right now I feel completely out of options.Our production SOAR instance became unresponsive yesterday around 13:45BST (503 errors from a number of API’s meaning we can’t authenticate into the system at all)- I raised a support ticket (Ref 70050003) which I was told due to technical reasons could be no higher than a Priority 2, and right now the only outcome I have received between yesterday and today (22 hours) is “We’re still looking for an engineer”.I am completely dismayed, that a production service outage has not only been left to placeholder SLA matching updates, but there is a complete lack of information, timelines and indeed any form of troubleshooting or breakfix been applied.I have asked a number of questions which have been met with silence, and this reflects on us as this then translates to the only updates we can give customers.I’ve been a proponent of SIEMplify/Chronicle SOAR/Google SecOps for over

Hi,I am integrating reCAPTCHA Enterprise with Account Verification (MFA).Flow:1. Frontend calls grecaptcha.enterprise.execute() with action LOGIN and twofactor: true2. Backend calls createAssessment with accountVerification enabled3. Response contains accountVerification with requestToken4. When I call grecaptcha.enterprise.challengeAccount() with:- account-token- containerHowever:- No popup UI is rendered- No verification code is sentCode snippet:const triggerMFA = async (requestToken: string): Promise<string> => { if (!window.grecaptcha?.enterprise) { throw new Error("reCAPTCHA not ready"); } return window.grecaptcha.enterprise.challengeAccount( import.meta.env.VITE_RECAPTCHA_SITE_KEY, { 'account-token': requestToken, // requestToken is coming from Account verification 'container': 'mfa-container', // Binded to div in log-in page } );};Sample Response:{ ..., "accountVerification": { "endpoints": [{ "emailAddress": " [removed by moderator] ", "requestToken": "tplIUFvvJUIpLaOH

When you add message to prompt it is not shown in pending action sectionbut if you run different prompts 2x in row, second one will have it always visible  anyone know why this is like that? do we have any bug report or ongoing implementation around this fix?​

Is anyone else unable to access Google SecOps (Chronicle) on mobile (Safari)?It was working earlier, but now it’s not loading / getting stuck.Tried clearing cache, cookies, and using private mode — still not working.Works fine on desktop.Is this happening to others?

Is anyone else unable to access Google SecOps (Chronicle) on mobile (Safari)?It was working earlier, but now it’s not loading / getting stuck.Tried clearing cache, cookies, and using private mode — still not working.Works fine on desktop.Is this happening to others?

I would like to get some clarification on two things about suppression via options which are not clear based on the official documentation Options section syntax  |  Google Security Operations  |  Google Cloud Documentation1.) For single event queries, is it possible to use more than one variable for the suppression key?  For example, $suppression_key = $hostname, $cmd does not work (editor throws an error), but using a strings.concat for the two variables does not throw an erroroutcome: $hostname = $e.principal.hostname $user = $e.principal.user.userid $cmd = $e.target.process.command_line $suppression_key = strings.concat($hostname, $cmd)2.) This statement from the doc If you don't specify a suppression_key, all query instances are suppressed globally during the window. What does this exactly mean, the entire rule is suppressed, regardless of what events are matched, during the specified window?

Recently, my ex-partner took off and took the 2FA authenticator with him.Now I want to pay the Google Cloud bill, but I have no access to the Google account anymore.I tried account recovery for 2 weeks at 08:00 AM every day, but it keeps rejecting my attempt to recover with the message that they could not confirm the account belongs to me.The weird part is that I am the actual owner of the email address and domain name (with proof).How can I regain access to my account to pay the bill?

Create and Share Your Security Gemini Gems We're launching a new Community challenge, and this time you not only have a chance to win Google swag, but to also be featured on the Google Cloud Security podcast with Anton Chuvakin and Timothy Peacock. The goal is simple: create and share a Gemini Gem that streamlines security tasks and saves you time. How to Participate:We are looking for creativity and utility.1. Design a Gemini Gem that solves a specific security problem. Crucially, DO NOT put corporate sensitive data in your Gems! 2. Share your submission in the comments below or USE THIS FORM. Ensure your entry includes the following details:    A link to your Gem. Learn about sharing Gems here.     Who it is for (e.g., SOC analyst, CISO, Compliance Manager).     A clear explanation of how to use it and the the value you derive from it (saves time, reduces risk, makes tasks easy, etc) 3. Determining the winner:The post with the most likes in the comment section below will win. Make su

Guests:Eric Foster, CEO, Tenex.AI Bashar Abouseido, President,  Tenex.AITopics: SIEM and SOC Artificial Intelligence Subscribe at YouTubeSubscribe at SpotifySubscribe at Apple Podcasts Topics covered: “10X SOC” sounds great.  But for an organization stuck in "SIEM 1.0" with poor data quality and manual workflows, is “AI-native MDR” a "leapfrog" opportunity or a recipe for disaster? We’ve seen the rise of "Decoupled SIEM" and security data lakes. Does a "Modern SIEM" even need to exist if an MDR platform has an agentic layer doing the heavy lifting?  You’ve argued for AI-native over AI-bolted-on. For an end user, what are the tangible differences of using "AI inside a legacy SIEM" versus using an "AI-native separate product"? What is the one task you thought AI would handle by now that still requires a senior human analyst to step in? If a CISO is using an AI MDR, "Mean Time to Detect" (MTTD) starts to look like a vanity metric because the machine is instant. What is the new gol