Finding Malware: Unveiling LUMMAC.V2 with Google Security Operations
Learn about LUMMAC.V2 and the detection and threat hunting opportunities you can use within Google Security Operations.
Blog Articles
New to Google SecOps: Composite Rule Fundamentals
Composite rules in Google SecOps unlock additional methods to build detection and hunting rules. In the first of a mini-series on composite rules, let’s tackle the fundamentals of a composite rule tha...
From Clicks to Code: Automating Your SecOps Workflow with the Google SecOps SDK and CLI
Introducing the Google SecOps SDK and CLI, your new toolkit for automating security workflows in Google Security Operations. Discover how to programmatically search logs, manage detections, ingest dat...
Manufacturing Evolution and a CISO’s First Principle
This blog post discusses the role of a CISO in today's manufacturing landscape, emphasizing that security must be integrated into all business and engineering processes. CISOs should evaluate the impa...
Google SecOps: Elevate Your Threat Detection Capabilities with Composite Detections
We are thrilled to announce the public preview announcement of Composite Detections in Google SecOps, empowering security teams with a new level of flexibility and sophistication in their threat detec...
Building an open ecosystem for AI-driven security with MCP
Bring AI to your security tools with open-source Model Context Protocol (MCP) servers for SecOps, Google TI and Security Command Center. Learn how to seamlessly connect security tools to LLMs.
The next evolution of active threat defense and hunting on Google Security Operations
Mandiant Threat Defense evolves active threat detection and hunting within Google SecOps, combining AI and frontline intelligence for comprehensive security.
New to Google SecOps: Cast-ing a Wider Net: It’s a Float!
Want to convert that string to a numeric and do some math for your latest search, rule or dashboard? This blog explores how we can take strings and convert them to numeric floats in Google SecOps!
From Inventory to Agility: A CISO's Guide to Robust Key Management
Beyond PQC prep: A CISO's must-read on building a strong crypto foundation through key inventory & management for business continuity. #Security #PQC #googlecloud
Protecting your Google Cloud Workloads: Foundational Controls and Strategies
Learn how Google Cloud Security Foundation helps you address cloud adoption use cases with built-in platform security controls.
Getting Started with Data Tables in Google Security Operations
Learn how to create data tables in Google SecOps and leverage them in your detection logic for event filtering.
Detecting the Execution of IngressNightmare via Security Command Center
Detecting IngressNightmare CVE-2025-1974 using Security Command Center’s Container Threat Detection.
Demystifying AI Security: New Paper on Real-World SAIF Applications
Think securing AI is just about prompt injection? Think again. Our latest paper shows how to practically apply SAIF in the real world.
Detecting IngressNightmare Without the Nightmare: A Non-Intrusive Yet Active Methodology
Learn about Google Cloud's innovative, agentless approach using a non-intrusive DNS technique to reliably detect the complex IngressNightmare vulnerability, achieving accurate detection without the op...
Shadow AI Strikes Back: Enterprise AI Absent Oversight in the Age of Gen AI
Unapproved enterprise AI is the new Shadow AI. Learn how to balance innovation with security and prevent data leaks.
Building Sovereign AI Solutions with Google Cloud - Cloud Run
Discover how to deploy a Gemma 3 model in Google Cloud's Sovereign Cloud. Ensure data privacy, security, compliance and trust for your AI services.
UEBA - A Key Detection Ingredient
Tired of alert fatigue? Learn how User and Entity Behavior Analytics (UEBA) can cut through the noise and deliver security alerts that actually matter.
New to Google SecOps: Cast-ing a Wider Net: True or False?
Converting data types within your searches, rules and dashboards is often needed but how do we do this? In this blog we will explore how we can take strings or integers and convert them to boolean in ...
The Director's Guide: IAM Security at Scale
Identity and Access Management (IAM) is difficult at scale. Learn how to unlock efficiency and security through automation.
New To Google SecOps: It’s All Relative (in Dashboards)
Relative time can be a funny thing and building dashboards for users who talk about last week or last month can be tricky because these relative times can mean different things to different people. Th...
AI Adoption: Learning from the Cloud's Early Days
AI adoption mirrors cloud's early days: innovation, excitement, and security risks. Learn from past mistakes to avoid pitfalls in your AI journey.
Transform Your Cloud Migration: Align with a Strategic Journey Map
While many key elements of successful cloud migration are well-known, organizations often still struggle in this area. We've gathered valuable insights from countless conversations about successful cl...
Community-Driven Detection Content for Google SecOps
Discover and collaborate on community-driven detection content for Google SecOps.
Counting Characters to Find Obfuscated Commands
Bad guys hide their malicious commands using sneaky tricks – we call that obfuscation, and it's amazing how often it works. Here's an approach to write a YARA-L rule to identify obfuscated command lin...
New To Google SecOps: Filtering Dashboards
Today we are adding filters to our Google SecOps dashboards and demonstrating how this capability can easily be deployed and provide users with greater visibility on the items they most care about!
Finding Malware: Detecting Fake Browser Updates Attacks with Google Security Operations
Learn about FAKEUPDATES and the detection opportunities within Google Security Operations.
The SOC Metrics that Matter…or Do They?
Security leaders have struggled to identify metrics that demonstrate the value that the SOC delivers and how it performs. So how do you choose the metrics that matter?
Analyzing Security Data with Google SQL Pipe Syntax
Dave Herrald takes a look at using BigQuery’s new SQL pipe syntax for common security analysis tasks.
Isolator OSS
In today's data-driven world, securely collaborating on sensitive information is more crucial (and challenging) than ever. How can organizations unlock the power of collaborative partnerships and thei...
Securing AI Supply Chain: Like Software, Only Not
AI supply chains, like software, face security risks such as data poisoning and model tampering. Robust provenance tracking and security measures are crucial to mitigate these threats and ensure the i...