Unanswered questions

Hello We are seeing unexpectedly low reCAPTCHA Enterprise scores for our iOS application starting around May 20, 2026.The tokens are valid, but many legitimate users are receiving low scores ( 0.1–0.2 >= ), affecting application flows.We don’t have active support plan, and there is no option to enable support plan for our project, can anyone point to right place for resolving this issueThank you.

Hi all,The Alert Overview widget is blank in all views.The case wall is showing output from the Alert Overview block.Anything I am missing to get this working?

Hello,We're investigating an issue with a Trellix HX Audit integration in Google SecOps and would appreciate any guidance from others who have worked with this feed.EnvironmentGoogle SecOps SIEM Trellix HX / FireEye HX API Feed Log Type: TRELLIX_HX_AUDITIssueThe feed was ingesting normally for an extended period and then abruptly stopped receiving audit events.Observed ingestion pattern:Normal ingestion for several weeksSharp reduction in volumeSubsequently dropped to 0 events/day Current StatusFeed status shows OK/Healthy Feed is enabled Feed was recreated with the same configuration Other Trellix HX-related feeds continue to ingest successfully No parsing errors No validation errors No indexing errorsSpecific Event Type AffectedThe primary missing events are Bulk Acquisition audit events, such as:Bulk Acquisition InitiatedBulk Acquisition Completed These events were previously being ingested into Google SecOps under TRELLIX_HX_AUDIT.Additional FindingsWhile reviewing historical HX au

Is there a documented procedure for ingesting enrichment data (Assets, Identities) in the SIEM when the source is not listed in Supported log types and default parsers?  Let’s say I have sources such as a CMDB, a less common identity provider, or even an EDR with context data.   Is the answer to construct my own process via this?https://docs.cloud.google.com/chronicle/docs/reference/ingestion-methods#importentities 

Hi everyone,I'm working on a Google SecOps Parser Extension for Terraform Enterprise logs.The base parser is successfully extracting data into UDM. For example: extracted.fields["_raw.component"] = "nginx" extracted.fields["_raw.log"] =127.0.0.6 - - [07/Aug/2026:18:12:19 +0000] "GET /api/v2/organizations/uwm/workspaces HTTP/1.1" 304 0 "https://terraform.uwm.com/app/uwm/workspaces" "Mozilla/5.0 ..."Show more linesRaw event:{"_raw": {"component": "nginx","log": "127.0.0.6 - - [07/Aug/2026:18:12:19 +0000] \"GET /api/v2/organizations/uwm/workspaces HTTP/1.1\" 304 0 ..."},"cribl_group": "AzureEastUS2-Upper"}My goal is to create a Parser Extension that parses the nginx access log and maps fields such as:client_iphttp_methodurl_pathstatus_codeuser_agent However, when I try to reference:[_raw][log][_raw][component]or%{_raw.log} I get errors such as: "_raw.log" not found in state data Questions:What is the correct way to reference fields that are already extracted by the base parser, such as:ex

Hello!I have been banned from the Google cloud platform for almost three years (since Dec 22, 2023). I don't know why, I don't know what I've done wrong (if anything). I tried submitting appeals - multiple - but nothing ever works. I only get automated bot replies asking me to provide information (which I already did) and no human ever answers. I practically gave up on appeals since I've provided everything I could but still get only bot replies asking me for more information and not helping at all.I tried contacting other departments (so I could at least speak to a human) but they could never help since it was outside of their scope.My appeal IDs: [removed by moderator] [removed by moderator] [removed by moderator] I don't know to which support to write nor how to resolve this at all. I didn't use the service for any harassment or anything like that.I only had two small projects on there from what I remember. One was a recaptcha test for a website. In the second project, I've been

Hi everyone,Is there a better or recommended way to test integration updates in Google SecOps / Chronicle SOAR, especially for integrations used under Response?

Hello community, question around the sampling for the Bindplane ingestion rate per hour, (last 10 minutes then multiply by 6)?For example, a single source in Bindplane is reporting 389 G/h, however this is not shown in the SIEM, (or I should say I can’t find it in the various dashboards). I understand that some traffic can be dropped because of parsing failures or ingestion issues etc.. To address this issue, I’m thinking of creating a dashboard that will list ingestion by source, is there anyone out there that has encountered this question before and can provide some insight? Basically, I need a way to compare what Bindplane is reporting vs. what the SIEM is getting. Thanks, Steve     

Billing account: 013EAA-30E019-83A787Account: familleguillou92@gmail.comOrganization: 414196513488Every new project I create becomes immediately inaccessible with CONSUMER_INVALID errors. This affects both my personal account and all service accounts. Projects are created (exit 0) but cannot be accessed afterward — even by the creator.I'm building a multi-tenant SaaS (mykrew.pro) where each client gets an isolated Firebase project. During development testing, I created and deleted ~50 projects which likely triggered an anti-abuse flag. My project quota was already increased and approved.I need this flag lifted on my billing account to continue operating my business.

For the dashboard filter, is there way we can filter results for the current month? in absolute and relative setting, not able to achieve that. 

It is fantastic that Secops is now offering the capability to search detections and cases in the SIEM.But unfortunately today they are not able to be joined. The prebuilt Detection > Alerts & IOCs dashboard is not enough to cover below cases. Customers are expecting the SIEM to be able to correlate its own data, instead of relying on the usual external workaround culture to fill the gap. Example use cases to cover:MTTA and MTTR calculations, described here by another member.  Monitoring / dashboarding / detection of SIEM alerts that didn't open any SOAR case, because the connector crashed. Requiring to be able to left outer join the detection table with the case table, not possible today.Please Google PM team take into consideration these feature requests.Bonus bug: the detection.case_name is always empty even tho the case is created in the SOAR.

I updated a rule, and a few minutes later I received a new alert triggered by an event from the past. The event has an ingestion timestamp from two days ago.Is this expected behavior? Does updating a rule automatically trigger a retroactive run/reprocessing of previously ingested events, or could this be a bug?

Hi , Greetings!   I am trying to build a Case Dashboard in Google SecOps (Chronicle).I have a Data Table %IP_RANGES with the following columns:IP | SiteMy requirement is:Extract IPs from case alert entities (case.alerts.entities.identifier).Match those IPs against the IP column in %IP_RANGES.Retrieve the corresponding Site value.Group results by Site and display counts. Example:IP                 Site10.1.1.1      Site A10.1.1.2      Site A10.1.1.3      Site BMatching case IPs:10.1.1.110.1.1.210.1.1.3Expected output:Site A -> 2Site B -> 1query : case.alerts.entities.type = "ADDRESS"$ip = case.alerts.entities.identifier$ip in %IP_RANGES$Site = %IP_RANGES.Sitematch:    $Siteoutcome:    $Count = count_distinct(case.alerts.metadata.id)order:    $Count desclimit: 100However, when attempting to reference the Site column from the data table, I receive:joining case with other datasources is not supportedIs there a supported way to enrich Case Search results with Data Table columnsThanks

How can I manage the spacing for column entries in the SecOps dashboard? When I create a report, columns containing lengthy values are truncated, and some of the content is hidden. Is there an option similar to Wrap Text or any other way to display the full column values?

Hi Community,I am seeing round-chemist-rjp1j (and fir-demo-project) listed under my resources, but I do not own this project. When attempting to access or view settings, I get the error:resourcemanager.projects.getIamPolicy (missing)Since I am not an owner, I am unable to file technical support cases or delete the project. Could a Google representative or community manager help disassociate or clear this project listing from my account ( [removed by moderator] )?Thanks!

Hi All, I am testing the Microsoft 365 Defender (XDR) Integration v26.0 and have observed the following which when looking at the documentation seems to be by design. Scenario 1Event triggered and “Incident 1” created in XDR Event triggered and “Incident 2” created in XDR Both incidents and their associated alerts are ingested into the SOAR and created: Case 1 with the name “Incident 1” Case 2 with the name “Incident 2” XDR then correlated Incidents 1 & 2 and based on a rule and renamed “Incident 1” to “Suspicious activity on one endpoint”  moved the alert from “Incident 2” to “Incident 1” and closed “Incident 2” The Sync Job in SOAR attached all alerts to Case 1 but left the Case name as “Incident 1” The SOAR Case “Incident 2” was left open along with it’s associated AlertScenario 2Event triggered and “Incident 1” created in XDR Event triggered and “Incident 2” created in XDR “Incident 1” ingested into SOAR and a Case created with the same name “Incident 1”  Before Ingestion of “I

Hi everyone,I'm working on a Google SecOps Parser Extension for Terraform Enterprise logs.The base parser is successfully extracting data into UDM. For example: extracted.fields["_raw.component"] = "nginx" extracted.fields["_raw.log"] = [removed by moderator] - - [07/Aug/2026:18:12:19 +0000] "GET /api/v2/organizations/uwm/workspaces HTTP/1.1" 304 0 "https://terraform.uwm.com/app/uwm/workspaces" "Mozilla/5.0 ..."Show more linesRaw event:{"_raw": {"component": "nginx","log": " [removed by moderator] - - [07/Aug/2026:18:12:19 +0000] \"GET /api/v2/organizations/uwm/workspaces HTTP/1.1\" 304 0 ..."},"cribl_group": "AzureEastUS2-Upper"}My goal is to create a Parser Extension that parses the nginx access log and maps fields such as:client_iphttp_methodurl_pathstatus_codeuser_agent However, when I try to reference:[_raw][log][_raw][component]or%{_raw.log} I get errors such as: "_raw.log" not found in state data Questions:What is the correct way to reference fields that are already extracted by

We're building a production certificate automation tool using Google Trust Services' production ACME API (dv.acme-v02.api.pki.goog).We've observed that when we place a new order and fetch the raw authorization object, the "expires" field is consistently exactly 8 days after the order's creation timestamp — reproduced across 2 different domains and 2 different ACME accounts.Within this 8-day window, a new order for the same domain/account automatically reuses the existing authorization as "valid" — no DNS-01 challenge needed. After 8 days, a new order requires a fresh DNS-01 challenge.GTS's CP/CPS (Section 4.2.1) states validation data may be reused for up to 200 days — but we observe a hard boundary at 8 days.Questions:1. Is this 8-day authorization validity an intentional, fixed, documented policy, separate from the 200-day CP/CPS ceiling?2. Is this duration stable, or could it change without notice?3. Does this differ for wildcard domain authorizations?A clear, authoritative answer w

Hi Fam,Where do i exactly need to go and check if this is applicable to my secops :can someone suggest steps where to go and check this out and identify if its applicable to us or we need to take any action.thanks  

I want to create a playbook that triggers for alerts generated by all of my custom rules, but excludes alerts generated by the built-in Google SecOps rules.Note: Using the rule name pattern is not an option for me at the moment due to some issues in my environment. 

Hello everyone,Due to the parsing of proxy logs, I need to “re-build” the URL from network.application_protocol and target.url: $url = strings.concat($e.network.application_protocol, "://", $e.target.url)I’m getting the following error:compilation error compiling query: validating query: expect type [string int float], got type backstory.Network.ApplicationProtocol for "e.udm.network.application_protocol"I guess I need to convert the enum to string.Any solutions for that ?Thanks,

Hi all, I am trying to test googles “Data processing using API methods” (No bindplane)I was wondering has anyone tried to use this feature yet and have any tips.I am testing with OKTA_USER_CONTEXT and trying to redact PII but just for testing I am trying to redact the “Title” field. I tried it but not sure if I can redact a whole field using blockedKeyPatterns or does it only work on with blockedValues. Documentation used: Hi all,I am testing Google SecOps Data Processing Pipelines using the API methods directly, without deploying Bindplane agents/collectors. My use case is OKTA_USER_CONTEXT, where I am trying to redact PII from the Okta user profile payload before the data is stored/parsed in Google SecOps.For initial testing, I associated a data processing pipeline to a specific OKTA_USER_CONTEXT and confirmed the pipeline is associated using fetchAssociatedPipeline. The pipeline currently has a redactProcessor. I first tried testing field-based redaction using blockedKeyPatterns aga

We manage a multi-tenant Google SecOps (Chronicle) instance ingesting Windows Active Directory data from several independent customer environments, each isolated via Data RBAC namespaces/scopes.We've discovered that some UDM Entities (both well-known built-in accounts like Administrator/Guest/krbtgt, and at least one regular user account) are being merged into a single entity node even though they originate from completely separate AD domains/namespaces. Example of what we're seeing:Say we have two separate tenants, "Tenant A" and "Tenant B", each with their own independent Active Directory domain. When we search for a user entity scoped to Tenant A (e.g., filtering by graph.entity.namespace = "tenant-a"), the returned entity record contains an unexpected mix of data:graph.entity.namespace = "tenant-a"graph.metadata.event_metadata.base_labels.namespaces = "tenant-a"graph.metadata.event_metadata.base_labels.namespaces = "tenant-b"   <- unexpectedmetadata.event_metadata.base_labels.in

I noticed a new native dashboard chart type called Sankey, but I haven't found any Google documentation for it yet. Could you elaborate on how to use it?

Hi Google Cloud Security Community, My Google Cloud Platform account has been suspended since May 29, 2026, and I am looking for guidance on how to get it reinstated. I have already submitted an appeal through the Google Account restrictions page, and I also filed a GCP Account Suspension Inquiry form today, but I wanted to reach out here as well for any additional advice or escalation paths. What happened: I enabled the Google Cloud Translation API for my e-commerce website project (handmyth-indexing). The API usage generated charges of over 200 CNY (~30 USD), which exceeded my expectation. I did not expect the charges to grow so quickly because I was not aware of effective quota/spending safeguards at the time. I did not pay the outstanding balance, and the account was subsequently suspended. My use case: Website: https://handmyth.com Business: Independent online store selling Ming/Qing style teaware and Chinese intangible heritage crafts. Location: Mainland China Purpose: Using Tran