User Groups
Events

Create topic
Login

Community Blog

Welcome to the Google Cloud Security Community blog. We bring you expert perspectives from Googlers and seasoned users, offering the insights you need to effectively utilize and optimize your security tools.

New to Google SecOps: Leveraging Okta Curated Detections to Detect ShinyHunters Related Activity

Today, Mandiant released a blog highlighting an expansion of ShinyHunters-branded extortion across multiple threat clusters. This activity isn’t assoc

Forum|Forum|17 days ago

15630

Switching Google’s role with reCAPTCHA from Data Controller to Data Processor

We are excited to announce that reCAPTCHA is switching from a “data controller” offering to a “data processor” offering on April 2, 2026 and will begi

Forum|Forum|21 days ago

2347026

A fake EPUB lecture

An EPUB (short for Electronic Publication) is the most widely used file format for digital books (e-books). Think of it like a zipped website that con

Forum|Forum|24 days ago

3250

Blog Articles

Recent Posts

mhmStaff

Community Blog

Building Towards an Agentic SOC: Introducing SecOps Labs

The Agentic SOC isn't a distant goal; it's a journey we are already embarking on with our customers. Building the future of security is a collaborative effort, one that requires a deep partnership with the defenders on the front lines. Our vision for

42364

3 days ago

suzhuangStaff

Community Blog

Your New Way to Ingest Data into Google SecOps

By January 2027, Google Security Operations will be deprecating the SecOps legacy forwarder and transitioning to OpenTelemetry (OTel) collectors with the Bindplane server as the official data ingestion method for the platform. This change is designed

21753

4 days ago

ipninichuckStaff

Community Blog

From Text to Telemetry: How MITRE ATT&CK v18 Changes the Game for Detection Engineers

For nearly a decade, the "Detection" section of the MITRE ATT&CK framework was the industry’s most important afterthought. It was the section every analyst read but no engineer could easily use. With the release of version 18 in October 2025, tha

37611

5 days ago

David-FrenchStaff

Community Blog

Getting Started with Detection-as-Code and Google SecOps (Part 1 of 2)

Many security teams, especially those in larger enterprises are adopting “Detection-as-Code” to automate their Detection Engineering workflows. Detection-as-Code is a set of principles that use code and automation to implement and manage threat detec

32179

5 days ago

SheikStaff

Community Blog

Switching Google’s role with reCAPTCHA from Data Controller to Data Processor

We are excited to announce that reCAPTCHA is switching from a “data controller” offering to a “data processor” offering on April 2, 2026 and will begin processing reCAPTCHA data in alignment with other Google Cloud services. With this switch, custome

2347026

5 days ago

jstonerStaff

Community Blog

New to Google SecOps: Build Rules while Appending Data Tables to the Entity Graph

OK, I promise we will build rules using the graph_append in this blog post! Our previous post covered the data preparation step which ensured that the data table had the appropriate fields in it. These include mapping to the metadata.interval.start_t

3973

7 days ago

jstonerStaff

Community Blog

New to Google SecOps: Building Rules with Your Own Threat Intel Part 1

"New to Google SecOps" is a deep-dive series by Google Cloud Principal Security Strategist John Stoner which provides practical guidance for security teams that are either new to SIEM or replacing their SIEM with Google SecOps. Threat intel

8083

11 days ago

DanDyeStaff

Community Blog

Bulk closing alerts with Python and the Google Security Operations API

In the postscript of my last blog post, I scripted 99 calls to the Ingestion API to create 99 USER_LOGIN Unified Data Model (UDM) events where the principal.ip was one of the known-malicious IPs from an Abuse IPDB blocklist (stored as a reference lis

3051

11 days ago

TJAStaff

Community Blog

Agentic Threat Intelligence: Your security team just grew

How many browser tabs do you have open right now? If you’re a threat analyst or security practitioner, the answer is likely “too many.” Your day is a constant race to connect disparate dots—sifting through lengthy threat reports, parsing OSINT articl

15942

12 days ago

jstonerStaff

Community Blog

New to Google SecOps: Leveraging Okta Curated Detections to Detect ShinyHunters Related Activity

Today, Mandiant released a blog highlighting an expansion of ShinyHunters-branded extortion across multiple threat clusters. This activity isn’t associated with a specific vendor vulnerability, but rather is focused on social engineering. One group,

15630

17 days ago

Powered by Gainsight

Terms & Conditions Cookie settings Accessibility statement