Specify whether to reopen closed cases when the grouping is by Source Grouping Identifier

You can now specify whether Google SecOps reopens closed cases when grouping SOAR alerts by Source Grouping Identifier. When the option is enabled and a new alert is received with a source grouping identifier of a case that was previously closed in Google SecOps, then Google SecOps reopens the case. For more information, see Configure alert grouping.

Applied Threat Intelligence curated rules now use the GTI_IOC feed

As a follow-up to the release of the GTI_IOC feed and the deprecation of the legacy MANDIANT_ACTIVE_BREACH_IOC, MANDIANT_FUSION_IOC, and OPEN_SOURCE_INTEL_IOC feeds, the Applied Threat Intelligence (ATI) curated detection rules are being updated to match against the GTI_IOC feed. You don't need to take any action for curated rules. Updated rules continue to match only on reviewed, stable indicators. If you have custom rules that still reference the legacy feeds, update them to use the GTI_IOC feed. For more information, see Migrate to GTI_IOC.

The update follows the standard Google SecOps rollout schedule. It starts on Monday, October 12, 2026 and rolls out to all regions during the week.

Change

Google SecOps has updated the list of supported default parsers. Parsers are updated gradually, so it might take one to four days before you see the changes reflected in your region.

The following supported default parsers have been updated. Each parser is listed by product name and log_type value, where applicable. This list includes both released default parsers and pending parser updates.

• AIX system (AIX_SYSTEM)
• Apache (APACHE)
• AppOmni (APPOMNI)
• Armis Activities (ARMIS_ACTIVITIES)
• Atlassian Cloud Admin Audit (ATLASSIAN_AUDIT)
• Atlassian Bitbucket (ATLASSIAN_BITBUCKET)
• Linux Auditing System (AuditD) (AUDITD)
• AWS Cloudtrail (AWS_CLOUDTRAIL)
• AWS Inspector (AWS_INSPECTOR)
• AWS RDS (AWS_RDS)
• Microsoft Azure Activity (AZURE_ACTIVITY)
• Azure AD Directory Audit (AZURE_AD_AUDIT)
• Azure AD Organizational Context (AZURE_AD_CONTEXT)
• Azure AD Sign-In (AZURE_AD_SIGNIN)
• Azure App Service (AZURE_APP_SERVICE)
• Azure Firewall (AZURE_FIREWALL)
• Azure Application Gateway (AZURE_GATEWAY)
• Azure Key Vault logging (AZURE_KEYVAULT_AUDIT)
• Bitdefender (BITDEFENDER)
• Blue Coat Proxy (BLUECOAT_WEBPROXY)
• Box (BOX)
• Zeek JSON (BRO_JSON)
• Check Point Sandblast (CHECKPOINT_EDR)
• Chrome Management (CHROME_MANAGEMENT)
• CipherTrust Manager (CIPHERTRUST_MANAGER)
• Cisco ACS (CISCO_ACS)
• Cisco ASA (CISCO_ASA_FIREWALL)
• Cisco Email Security (CISCO_EMAIL_SECURITY)
• Cisco Firepower NGFW (CISCO_FIREPOWER_FIREWALL)
• Cisco FireSIGHT Management Center (CISCO_FIRESIGHT)
• Cisco IronPort (CISCO_IRONPORT)
• Cisco Meraki (CISCO_MERAKI)
• Cisco Umbrella Audit (CISCO_UMBRELLA_AUDIT)
• Cisco WLC/WCS (CISCO_WIRELESS)
• Citrix Netscaler (CITRIX_NETSCALER)
• Claroty Xdome (CLAROTY_XDOME)
• Claude Compliance Logs (CLAUDE_COMPLIANCE_LOGS)
• Cloudflare Audit (CLOUDFLARE_AUDIT)
• Corelight (CORELIGHT)
• Palo Alto Cortex XDR Alerts (CORTEX_XDR)
• CrowdStrike Alerts API (CS_ALERTS)
• CrowdStrike Falcon (CS_EDR)
• CrowdStrike Falcon Stream (CS_STREAM)
• CyberArk (CYBERARK)
• CyberArk Privileged Access Manager (PAM) (CYBERARK_PAM)
• Darktrace (DARKTRACE)
• F5 Advanced Firewall Management (F5_AFM)
• F5 BIGIP LTM (F5_BIGIP_LTM)
• F5 VPN (F5_VPN)
• FireEye HX (FIREEYE_HX)
• FireEye NX (FIREEYE_NX)
• Forcepoint DLP (FORCEPOINT_DLP)
• Fortinet FortiAnalyzer (FORTINET_FORTIANALYZER)
• Fortinet Fortimanager (FORTINET_FORTIMANAGER)
• Fortinet FortiSandbox (FORTINET_SANDBOX)
• Fortinet Switch (FORTINET_SWITCH)
• Fortinet Proxy (FORTINET_WEBPROXY)
• Apigee (GCP_APIGEE_X)
• GCP Cloud Audit (GCP_CLOUDAUDIT)
• Cloud DNS (GCP_DNS)
• Security Command Center Threat (GCP_SECURITYCENTER_THREAT)
• GCP Secure Web Proxy (GCP_SWP)
• VPC Flow Logs (GCP_VPC_FLOW)
• Gemini Code Assist (GEMINI_CODE_ASSIST)
• Gitlab (GITLAB)
• AWS GuardDuty (GUARDDUTY)
• Huawei Switches (HUAWEI_SWITCH)
• IBM AS/400 (IBM_AS400)
• Microsoft IIS (IIS)
• Illumio Core (ILLUMIO_CORE)
• Imperva SecureSphere Management (IMPERVA_SECURESPHERE)
• Infoblox (INFOBLOX)
• Jenkins (JENKINS)
• JFrog Artifactory (JFROG_ARTIFACTORY)
• Journald (JOURNALD)
• Juniper (JUNIPER_FIREWALL)
• Juniper Junos (JUNIPER_JUNOS)
• Kiteworks (KITEWORKS)
• Kubernetes Node (KUBERNETES_NODE)
• McAfee IPS (MCAFEE_IPS)
• Microsoft Defender for Endpoint (MICROSOFT_DEFENDER_ENDPOINT)
• Microsoft Defender for Identity (MICROSOFT_DEFENDER_IDENTITY)
• Microsoft Defender for Office 365 (MICROSOFT_DEFENDER_MAIL)
• Microsoft Sentinel (MICROSOFT_SENTINEL)
• Microsoft SQL Server (MICROSOFT_SQL)
• Netskope CASB (NETSKOPE_CASB)
• Netskope Web Proxy (NETSKOPE_WEBPROXY)
• Netwrix (NETWRIX)
• NGINX (NGINX)
• Unix system (NIX_SYSTEM)
• Nutanix Prism (NUTANIX_PRISM)
• Office 365 (OFFICE_365)
• Okta (OKTA)
• Okta User Context (OKTA_USER_CONTEXT)
• Onapsis (ONAPSIS)
• Oracle (ORACLE_DB)
• Palo Alto Networks Firewall (PAN_FIREWALL)
• Palo Alto Panorama (PAN_PANORAMA)
• Palo Alto Prisma Cloud Alert payload (PAN_PRISMA_CA)
• Ping One (PING_ONE)
• Microsoft PowerShell (POWERSHELL)
• Proofpoint Tap Alerts (PROOFPOINT_MAIL)
• Pure Storage (PURE_STORAGE)
• Red Hat OpenShift (REDHAT_OPENSHIFT)
• RSA NetWitness (RSA_NETWITNESS)
• SailPoint IAM (SAILPOINT_IAM)
• Salesforce (SALESFORCE)
• Sangfor Next Generation Firewall (SANGFOR_NGAF)
• Sap Business Technology Platform (SAP_BTP)
• SAP Change Document (SAP_CHANGE_DOCUMENT)
• SecureLink (SECURELINK)
• Sentinelone Alerts (SENTINELONE_ALERT)
• Slack Audit (SLACK_AUDIT)
• Sourcefire (SOURCEFIRE_IDS)
• Squid Web Proxy (SQUID_WEBPROXY)
• STIX Threat Intelligence (STIX)
• Sublime Security (SUBLIMESECURITY)
• Symantec Event export (SYMANTEC_EVENT_EXPORT)
• Synology (SYNOLOGY)
• Sysdig (SYSDIG)
• Tableau (TABLEAU)
• Tanium Stream (TANIUM_TH)
• TCPWave DDI (TCPWAVE_DDI)
• Teleport Access Plane (TELEPORT_ACCESS_PLANE)
• Tenable Security Center (TENABLE_SC)
• Trellix HX Alerts (TRELLIX_HX_ALERTS)
• Trellix HX Audit Events (TRELLIX_HX_AUDIT)
• Trellix HX Event Streamer (TRELLIX_HX_ES)
• TrendMicro Apex Central (TRENDMICRO_APEX_CENTRAL)
• Trend Micro Email Security Advanced (TRENDMICRO_EMAIL_SECURITY)
• Trend Micro Vision One Audit (TRENDMICRO_VISION_ONE_AUDIT)
• Trend Micro Vision One (TRENDMICRO_VISION_ONE)
• Trend Micro Vision One Observerd Attack Techniques (TRENDMICRO_VISION_ONE_OBSERVERD_ATTACK_TECHNIQUES)
• Trend Micro Vision One Workbench (TRENDMICRO_VISION_ONE_WORKBENCH)
• Ubiquiti UniFi Switch (UBIQUITI_SWITCH)
• Uptycs EDR (UPTYCS_EDR)
• Upwind (UPWIND)
• Venafi ZTPKI (VENAFI_ZTPKI)
• Veritas NetBackup (VERITAS_NETBACKUP)
• Vmware Avinetworks iWAF (VMWARE_AVINETWORKS_IWAF)
• VMware ESXi (VMWARE_ESX)
• VMware vCenter (VMWARE_VCENTER)
• VMware vRealize Suite (VMware Aria) (VMWARE_VREALIZE)
• Wallix Bastion (WALLIX_BASTION)
• Microsoft AD (WINDOWS_AD)
• Windows Defender AV (WINDOWS_DEFENDER_AV)
• Windows DHCP (WINDOWS_DHCP)
• Windows DNS (WINDOWS_DNS)
• Windows Sysmon (WINDOWS_SYSMON)
• Windows Event (WINEVTLOG)
• Windows Event (XML) (WINEVTLOG_XML)
• wiz.io (WIZ_IO)
• Workspace Activities (WORKSPACE_ACTIVITY)
• Zoom Operation Logs (ZOOM_OPERATION_LOGS)

The following log types were added without a default parser. Each parser is listed by product name and log_type value, where applicable.

• Amazon Bedrock Model Invocation Logging (AMAZON_BEDROCK_MODEL_INVOCATION_LOGGING)
• AppTrana Web Application Firewall (AWS_APPTRANA)
• Azure Machine Learning (AZURE_MACHINE_LEARNING)
• Bitstamp (BITSTAMP)
• Cloud 9 (CLOUD9)
• Cloudflare Brand Protection (CLOUDFLARE_BRAND_PROTECTION)
• Cloudflare Browser Isolation (CLOUDFLARE_BROWSER_ISOLATION)
• Delinea Cloud Platform (DELINEA_CLOUD_PLATFORM)
• Honeywell Cyber Proactive Defense (HONEYWELL_CPD)
• Huntress EDR (HUNTRESS_EDR)
• IBM Cloud Alert Notification (IBM_CLOUD_ALERT_NOTIFICATION)
• Meter Firewall NIDS (METER_FIREWALL_NIDS)
• OutSystems Cloud (OUTSYSTEMS_CLOUD)
• Staffbase Audit (STAFFBASE_AUDIT)
• Statsig (STATSIG)
• Temporal Cloud Audit Logs (TEMPORAL_CLOUD_AUDIT_LOGS)
• Twilio Segment (TWILIO_SEGMENT)

Feature

[Spotlight Feature] Monitor response and playbook health with the Response Health Hub

Google SecOps now includes the Response Health Hub curated dashboard, a central location for monitoring playbook performance, execution latency, automation effectiveness, and integration health across environments.

Key capabilities include:

• Volume and adoption tracking: Monitor total playbook execution volume, daily trends, completion success rates, and queued playbook backlogs.
• Attachment and rerun insights: Track average and maximum playbooks attached per case or alert, and identify playbooks with high rerun counts.
• Execution latency diagnostics: Compare end-to-end playbook execution time against active action execution time, and drill down into the 30 slowest playbook and action runs.
• Playbook and integration health monitoring: Investigate the latest failed playbook runs, highest failure-rate and terminated playbooks, and integration action error reasons.
• Automation effectiveness metrics: Compare automated versus manual case closure rates and Mean Time to Resolve (MTTR).

For more information, see Monitor response and playbook health.

Announcement

The deadline for the migration of SOAR APIs to the Chronicle API has been extended from November 30, 2026 until March 31, 2027. For more information, refer to SOAR Migration overview

[Spotlight Feature] Terraform and client libraries for multiple features using Chronicle API

Terraform providers and Google Cloud client libraries are now available for several Google SecOps features using Chronicle API including Feeds, Parsers, Rules, Findings Refinements, Retrohunts, Dashboards, Data Tables, Watchlists, Custom Lists, Environments, Environment Groups, Data Export, SOAR Domains, and SOAR Networks. For more information, see Terraform reference.

Terraform providers enable programmatic provisioning and management of Google SecOps resources as code, while Client Libraries enable developers to build custom integrations and automate Google SecOps workflows in their preferred programming languages. For more information, see Client libraries.

Expanded read-only permissions for Chronicle API Restricted Data Access Viewer

Google SecOps has updated the predefined Chronicle API Restricted Data Access Viewer (roles/chronicle.restrictedDataAccessViewer) IAM role to include all read-only permissions available in the Chronicle API Viewer (roles/chronicle.viewer) role, excluding global data access (chronicle.globalDataAccessScopes.permit).

With this update, users assigned to roles/chronicle.restrictedDataAccessViewer IAM role will have read-only access across Google SecOps features—including SOAR cases and playbooks, investigations, threat collections, findings, security validation, and ingestion resources within their assigned data access scopes.

For more information, see Configure data RBAC for users.

Google Cloud organization ID enrichment for direct ingestion

Google SecOps now automatically enriches logs ingested through Google Cloud direct ingestion with the originating Google Cloud organization ID.

Previously, direct ingestion did not include organization-level identifiers, requiring customers with multiple Google Cloud organizations to configure separate Cloud Logging sinks and feeds to distinguish their log sources. With this update, you can easily identify the source organization for each event, filter UDM searches, scope detection rules, and configure Data RBAC or Data Processing Pipelines across multi-organization environments without additional configuration.

In UDM events, the organization ID appears automatically under metadata.base_labels.ingestion_kv_labels:

• key: "gcp_organization_id"
• value: "<YOUR_GCP_ORGANIZATION_ID>"

Rollout details: This feature will roll out gradually starting September 21, 2026, through September 28, 2026. No action or configuration change is required.

Resizable side panels in the Investigation Management experience

You can now dynamically resize the Case preview and Alert and detection preview side panels in the revamped Investigation Management experience in Google SecOps. You can adjust the panel width using your mouse or keyboard shortcuts to view detailed telemetry, parsed UDM records, and raw logs without navigating away from your main case queue.

To explore the complete triage workflow, see Investigation and case management overview.

Grok filter match_all option in parser syntax

The Google SecOps parser syntax is updated to support the match_all option within the Grok filter. This allows parsers to extract all non-overlapping pattern occurrences within a field, rather than returning only the first match.

For more information, see Parser syntax reference.

[Spotlight Feature] GoogleSQL query support in Search

This feature is in public preview. You can now use GoogleSQL in Search to query your security data in Google SecOps, offering a flexible and powerful industry-standard alternative to YARA-L 2.0. GoogleSQL is optimized for broad data exploration, statistical aggregation, and deep-dive ad hoc investigations. You can query telemetry tables including but not limited to UDM events, entity graphs, detection rules, and case management data—using either standard declarative SQL or the linear, sequential Piped SQL syntax.

For more information, see Get started with GoogleSQL.

Deprecated

MANDIANT_ACTIVE_BREACH_IOC,MANDIANT_FUSION_IOC, andOPEN_SOURCE_INTEL_IOC` feeds are being removed

The MANDIANT_ACTIVE_BREACH_IOC, MANDIANT_FUSION_IOC, and OPEN_SOURCE_INTEL_IOC feeds are deprecated in favor of the GTI_IOC feed. After March 18, 2027, we will be removing the MANDIANT_ACTIVE_BREACH_IOC, MANDIANT_FUSION_IOC, and OPEN_SOURCE_INTEL_IOC feeds. For more information on how to migrate, see Migrate Mandiant legacy feeds to GTI.

Deprecation of write permissions from the chronicle.readonly OAuth scope

Effective January 25, 2027, write permissions will be removed from the chronicle.readonly OAuth scope, restricting it strictly to read operations. You can continue using chronicle.readonly for read operations. Make sure you update any workflows performing write operations to use the chronicle OAuth scope.

[Spotlight Feature] Case playbooks

This feature is in preview. Google SecOps now supports case playbooks. You can run playbooks or execute manual actions across an entire case container rather than individual alerts, consolidating response tasks and reducing redundant operations during investigations.

For more information, see Case playbooks overview.

Feature

[Spotlight Feature] Reaction triggers

This feature is in preview. Google SecOps now supports reaction triggers. As post-ingestion triggers, they allow playbooks to automatically fire in response to real-time case or alert updates during active investigations, such as changes to the case assignee, case tags, alert priority, or newly added entities.

For more information, see Use reaction triggers in playbooks.

Self-service Bindplane Enterprise license download

This feature is currently in Preview for Google Security Operations tenants in the US and EU regions. Google Security Operations Enterprise Plus and Google Unified Security (GUS) customers can now download their Bindplane Enterprise (Google Edition) license key directly from the platform console under SIEM Settings > Collection Agents.

For more information, see Bindplane Enterprise (Google Edition).

[Spotlight Feature] Customizable schedules for multi-event rules general availability

The customizable schedules for multi-event rules feature is now in General Availability (GA).

Customizable schedules give security teams granular control and transparency over how multi-event rules execute in Google SecOps, and provide the following capabilities:

• Configure settlement delays: Set first-run delay offsets (from 1 minute up to 48 hours) to account for log ingestion latency and reduce false negatives.
• Leverage automated true-up runs: Automatically re-evaluate time windows at 4 hours (and optionally 30 hours for full context enrichment) to capture late-arriving logs.
• Migrate legacy rules: Upgrade existing custom multi-event rules to customizable schedules directly from the Rules Dashboard.

To manage rule schedules with custom IAM roles, make sure your roles include chronicle.rules.modifyRules and chronicle.ruleDeployments.update. Predefined IAM roles include these permissions automatically.

For more information, see Configure customized schedules for rules and Understand rule run scheduling.

Scheduled maintenance

SOAR database and infrastructure maintenance is scheduled to take place during the standard maintenance window on Sunday, August 30. During this window, your system will experience a brief period of downtime. You don't need to take any action.

[Spotlight Feature] Mandiant Frontline Threats rule packs

Curated Detections has been enhanced with additional Mandiant Frontline Threats detections for Linux, MacOS, and Google Cloud. The following rule packs have been added to the Content Hub:

• Mandiant Frontline Threats for Linux
• Mandiant Frontline Threats for MacOS
• Mandiant Frontline Threats for Google Cloud

Unroll Processor for Data Processing Pipelines

Google SecOps data processing pipelines now support the Unroll processor (event breaking). This processor allows you to split log entries containing arrays or slices of events into multiple individual log events prior to parsing and ingestion.

Key details:

• Event Breaking Capability: Automatically expands log arrays into discrete log events.
• Pre-parsing Requirement: The Unroll processor requires structured data inputs. Raw string payloads must first be parsed using a Transform processor (e.g., set(body, ParseJSON(body))) positioned prior to the Unroll processor in the pipeline execution sequence.

For details on configuring data processing pipelines and processors, see Set up and manage data processing pipelines.

Feature

[Spotlight Feature] Operations in Emerging Threats Center

Google SecOps now supports Operations in the Emerging Threats Center feed to provide rapid visibility into threat activity details involving the targeting of a single organization. Operations complement global Campaigns by providing granular threat intelligence derived from frontline investigations, such as Managed Threat Defense (MTD) engagements. For more information, see Operations in Emerging Threats.

Key capabilities include:

• Focused threat insights: Zero in on localized adversary activity and personalized attack vectors specific to individual missions.
• Holistic threat mapping: View Operations alongside global Campaigns to see the full scope of adversary tactics, techniques, and procedures (TTPs).

[Spotlight Feature] Relative time filtering in Google SecOps

This feature is in public preview. Google SecOps has updated how relative time filters calculate data ranges. You can now choose from three distinct, mathematically precise operators: Past, Previous, and Current. This change eliminates ambiguity between rolling windows and calendar-aligned periods, ensuring consistent behavior across all time units (like seconds, minutes, hours, days, weeks, months, years) and aligning SecOps dashboards with Search and other Google tools (such as Looker).

For more information, see the Relative time range section of the Understand search guide.

Side-by-side view on the Alerts & Detections tab in Cases

This feature is in public preview. The Alerts & Detections tab in the revamped Investigation Management experience now supports a Side-by-side view layout.

You can switch between the default List view and the Side-by-side view to inspect an alert or detection's detailed metadata, status, priority, creation date, and Gemini investigation insights in an adjacent side pane without navigating away from the main list.

For more information, see Investigation and case management overview.

[Spotlight Feature] Evaluate threat coverage and generate rules with the Detection Engineering Agent

This feature is in public preview. You can now evaluate and strengthen your Google SecOps security posture against emerging threats using the Detection Engineering Agent. This AI-powered assistant helps you extract threat intelligence and automatically draft YARA-L detection rules, drastically improves time-to-value for custom security automation and accelerating risk mitigation. The agent is accessible using Model Context Protocol (MCP) tools operated by compatible AI clients (such as Google Antigravity or Claude Code). For more information, see Evaluate threat coverage with the Detection Engineering Agent.

Feature

[Spotlight Feature] Event simulation for detection coverage evaluation

This feature is in public preview. You can now programmatically deliver realistic threat sequences into the live ingestion pipeline using event simulation. Event simulation provides a full-funnel detection coverage evaluation framework embedded directly within Google SecOps, enabling detection engineering and SOC teams to verify the entire detection lifecycle—from UDM normalization to multi-event correlation and alerting—while preserving production SOC workflows.

As a core capability of the Detection Engineering Agent (DEA) architecture, event simulation connects Google SecOps MCP tools with AI assistance (such as Gemini) to automate threat intel processing, synthetic telemetry generation, and YARA-L 2.0 rule coverage evaluation.

For more information, see Use event simulation for detection coverage evaluation.

[Spotlight Feature] Monitor your data latency with the Health Hub

This feature is in public preview. The Health Hub now includes two new tables to track the ingestion latency at both the source level and the log-type level. In addition, you can select a specific source or log type to open the Data Health Deep Dive page and view detailed information about ingestion latency. For more information, see Monitor health of data sources.

Key capabilities include:

• Improve end-to-end visibility and reduce mean time to debug (MTTD): Google SecOps calculates latency at both the source level and the log type level to improve end-to-end visibility and help reduce the mean time to debug (MTTD) for delayed logs.
• Monitor ingestion latency by source: View the ingestion latency for each individual data source.
• Monitor ingestion latency by log type: View the ingestion latency for each individual log type.
• View detailed information about ingestion latency: Select a specific source or log type to open the Data Health Deep Dive page and view detailed information about ingestion latency.

Scheduled Maintenance

SOAR database and infrastructure maintenance is scheduled to take place during the standard maintenance window on Sunday, August 16. During this window, your system will experience a brief period of downtime. No customer action is required.

[Spotlight Feature] Analyze feed activity with Cloud Logging

This feature is in public preview. To use this feature, your Google SecOps instance must be configured with a Bring Your Own Project (BYOP) Google Cloud project. You can now monitor, debug, and troubleshoot Google SecOps ingestion pipelines and feeds using Cloud Logging. By sending, viewing, and querying ingestion and feed activity logs in the Logs Explorer, you can diagnose log delivery issues, such as, missing, delayed, or failing logs, and decrease the time required to resolve ingestion anomalies.

This visibility into push- and pull-based ingestion mechanisms provides the following capabilities:

• Investigate telemetry: Use Gemini Cloud Assist to investigate logging and metrics telemetry directly from the Google SecOps console.
• Debug feeds: Use the Debug with logs option on the Feed management page to open Logs Explorer pre-filtered for a specific feed.
• Filter routed logs: Configure exclusion filters in the Log Router to exclude specific logs, such as Storage Transfer Service (STS) logs, from being routed to Cloud Logging.

For more information, see Analyze feed activity with Cloud Logging.

Updated rich-text editor

Upgraded the rich-text editor across Google SecOps, including the Cases Wall, Use Case Upload dialog, Report Template dialog, and Dashboard Editor widget.

Key changes include:

• Simplified typography: Choose font sizes using semantic options (Small, Normal, Large, Huge). Legacy font sizes on existing text are preserved.
• Streamlined tables: You can insert or remove entire tables. Formatting inside table cells is no longer supported.
• Toolbar cleanup: Removed the Cut, Copy, and Paste buttons from the toolbar. Standard OS keyboard shortcuts remain supported.
• Visual alignment: Improved visual consistency between editor content during editing and after submission.

[Spotlight Feature] Threat Hunt Agent

The Threat Hunt Agent is now available in Public Preview for Google SecOps Enterprise Plus customers. Powered by Gemini and grounded in Google Threat Intelligence (GTI), Mandiant frontline expertise, and the MITRE ATT&CK® framework, the Threat Hunt Agent autonomously automates proactive threat hunting across your historical security telemetry. For more information, see Threat Hunt Agent.

Key capabilities include:

• Autonomous hunt planning: Generates structured hunting plans tailored to specific threat actors, campaigns, malware families, software toolkits, or MITRE ATT&CK techniques.
• Automated case creation and determinations: Synthesizes findings into summaries, assigns a verdict (Substantial Evidence, Evidence Found, or Threat Not Found), and automatically creates a dedicated case in Case Management.
• Automated query translation and execution: Converts investigative hypotheses into YARA-L 2.0 search queries and executes against historical security telemetry.
• AI-driven evidence extraction: Filters out routine background noise to isolate high-fidelity forensic evidence (hostnames, user accounts, and command lines).

Announcement

The deadline for Stage 2 of the SOAR migration to Google Cloud has been extended from September 30th to November 30th, 2026. For more information, refer to the SOAR migration guide.

Google SecOps has updated the list of supported default parsers. Parsers are updated gradually, so it might take one to four days before you see the changes reflected in your region.

The following supported default parsers have been updated. Each parser is listed by product name and log_type value, where applicable. This list includes both released default parsers and pending parser updates.

• Airlock Digital Application Allowlisting (AIRLOCK_DIGITAL)
• AIX system (AIX_SYSTEM)
• Akamai DataStream 2 (AKAMAI_DATASTREAM_2)
• Akamai SIEM Connector (AKAMAI_SIEM_CONNECTOR)
• Apache (APACHE)
• Arcsight CEF (ARCSIGHT_CEF)
• Armis Alerts (ARMIS_ALERTS)
• Aruba Switch (ARUBA_SWITCH)
• Atlassian Cloud Admin Audit (ATLASSIAN_AUDIT)
• Linux Auditing System (AuditD) (AUDITD)
• Avaya Aura Experience Portal (AVAYA_AURA)
• AWS Cloudtrail (AWS_CLOUDTRAIL)
• AWS CloudWatch (AWS_CLOUDWATCH)
• AWS Control Tower (AWS_CONTROL_TOWER)
• Microsoft Azure Activity (AZURE_ACTIVITY)
• Azure AD (AZURE_AD)
• Azure AD Organizational Context (AZURE_AD_CONTEXT)
• Azure Application Gateway (AZURE_GATEWAY)
• Azure Key Vault logging (AZURE_KEYVAULT_AUDIT)
• Microsoft Azure Resource (AZURE_RESOURCE_LOGS)
• Blue Coat Proxy (BLUECOAT_WEBPROXY)
• BeyondTrust (BOMGAR)
• Cato Networks (CATO_NETWORKS)
• Check Point (CHECKPOINT_FIREWALL)
• Check Point Harmony (CHECKPOINT_HARMONY)
• Chrome Management (CHROME_MANAGEMENT)
• ChromeOS XDR (CHROMEOS_XDR)
• Cisco ASA (CISCO_ASA_FIREWALL)
• Cisco Email Security (CISCO_EMAIL_SECURITY)
• Cisco Firepower NGFW (CISCO_FIREPOWER_FIREWALL)
• Cisco FireSIGHT Management Center (CISCO_FIRESIGHT)
• Cisco ISE (CISCO_ISE)
• Cisco Router (CISCO_ROUTER)
• Cisco Switch (CISCO_SWITCH)
• Cisco UCM (CISCO_UCM)
• Claroty Xdome (CLAROTY_XDOME)
• Claude Compliance Logs (CLAUDE_COMPLIANCE_LOGS)
• HP Aruba (ClearPass) (CLEARPASS)
• Cloudflare (CLOUDFLARE)
• Palo Alto Cortex XDR Alerts (CORTEX_XDR)
• CrowdStrike Falcon (CS_EDR)
• Darktrace (DARKTRACE)
• EfficientIP DDI (EFFICIENTIP_DDI)
• F5 ASM (F5_ASM)
• F5 BIGIP LTM (F5_BIGIP_LTM)
• Fastly CDN (FASTLY_CDN)
• FireEye eMPS (FIREEYE_EMPS)
• FireEye HX (FIREEYE_HX)
• FireEye NX (FIREEYE_NX)
• Forcepoint Proxy (FORCEPOINT_WEBPROXY)
• FortiGate (FORTINET_FIREWALL)
• Fortinet FortiAnalyzer (FORTINET_FORTIANALYZER)
• Fortinet FortiClient (FORTINET_FORTICLIENT)
• Fortinet Switch (FORTINET_SWITCH)
• GCP Cloud Audit (GCP_CLOUDAUDIT)
• Security Command Center External Exposure (GCP_SECURITYCENTER_EXTERNAL_EXPOSURE)
• Gitlab (GITLAB)
• Google Threat Intelligence IOC (GTI_IOC)
• AWS GuardDuty (GUARDDUTY)
• Huawei Switches (HUAWEI_SWITCH)
• IBM Security Access Manager (IBM_SAM)
• Microsoft IIS (IIS)
• Illumio Core (ILLUMIO_CORE)
• Imperva SecureSphere Management (IMPERVA_SECURESPHERE)
• Infoblox (INFOBLOX)
• Infoblox DHCP (INFOBLOX_DHCP)
• Jamf pro context (JAMF_PRO_CONTEXT)
• Mobile Endpoint Security (LOOKOUT_MOBILE_ENDPOINT_SECURITY)
• Apple macOS (MACOS)
• McAfee IPS (MCAFEE_IPS)
• Micro Focus iManager (MICROFOCUS_IMANAGER)
• Microsoft Defender for Endpoint (MICROSOFT_DEFENDER_ENDPOINT)
• Microsoft Defender for Office 365 (MICROSOFT_DEFENDER_MAIL)
• Microsoft Graph API Alerts (MICROSOFT_GRAPH_ALERT)
• Microsoft Sentinel (MICROSOFT_SENTINEL)
• Microsoft SQL Server (MICROSOFT_SQL)
• Mimecast URL Logs (MIMECAST_URL_LOGS)
• MISP Threat Intelligence (MISP_IOC)
• NetApp ONTAP (NETAPP_ONTAP)
• Netskope V2 (NETSKOPE_ALERT_V2)
• Unix system (NIX_SYSTEM)
• Office 365 (OFFICE_365)
• Okta (OKTA)
• Onapsis (ONAPSIS)
• OpenVPN (OPEN_VPN)
• Oracle Fusion (ORACLE_FUSION)
• Ping Identity (PING)
• Proofpoint Sendmail Sentrion (PROOFPOINT_SENDMAIL_SENTRION)
• SailPoint IAM (SAILPOINT_IAM)
• Salesforce (SALESFORCE)
• Sendmail (SENDMAIL)
• Sentinelone Alerts (SENTINELONE_ALERT)
• ServiceNow Audit (SERVICENOW_AUDIT)
• ServiceNow CMDB (SERVICENOW_CMDB)
• ServiceNow Security (SERVICENOW_SECURITY)
• SonicWall (SONIC_FIREWALL)
• STIX Threat Intelligence (STIX)
• Tanium Threat Response (TANIUM_THREAT_RESPONSE)
• Thinkst Canary (THINKST_CANARY)
• ThreatConnect IOC V3 (THREATCONNECT_IOC_V3)
• ThreatLocker Platform (THREATLOCKER)
• Varonis (VARONIS)
• VMware ESXi (VMWARE_ESX)
• Windows DNS (WINDOWS_DNS)
• Windows Event (WINEVTLOG)
• Windows Event (XML) (WINEVTLOG_XML)
• wiz.io (WIZ_IO)
• Workspace Activities (WORKSPACE_ACTIVITY)
• Zoom Operation Logs (ZOOM_OPERATION_LOGS)

The following log types were added without a default parser. Each parser is listed by product name and log_type value, where applicable.

• Adobe Experience Platform (ADOBE_EXPERIENCE_PLATFORM)
• AudioCodes Session Border Controller (AUDIOCODES_SBC)
• Azure Application Gateway for Containers (AZURE_GATEWAY_CONTAINERS)
• Azure Logic Apps (AZURE_LOGIC_APPS)
• Azure NAT Gateway Flow (AZURE_NATGW_FLOW)
• Broadcom DX NetOps Spectrum (BROADCOM_DX_NETOPS_SPECTRUM)
• Carto Activity (CARTO_ACTIVITY)
• Claude Code Observability (CLAUDE_CODE_OBSERVABILITY)
• Cyble Attack Surface Management (CYBLE_ASM)
• Cyble Brand Intelligence & Protection (CYBLE_BIP)
• Darkweb IQ (DARKWEB_IQ)
• Ellio Threat Intelligence (ELLIO_THREAT_INTEL)
• Exeon NDR (EXEON_NDR)
• Gravitee (GRAVITEE)
• Kaspersky anti targeted attack (KASPERSKY_ANTI_TARGETED_ATTACK)
• Microsoft Copilot Interaction (MICROSOFT_COPILOT_INTERACTION)
• OSTTRA MarkitWire (OSTTRA_MARKITWIRE)
• Proofpoint Adaptive Email Security (PROOFPOINT_ADAPTIVE_EMAIL_SECURITY)
• Secomea GateManager (SECOMEA_GATEMANAGER)
• Trend Micro Vision One Risk Event (TRENDMICRO_VISION_ONE_RISK_EVENT)
• TXOne EdgeIPS (TXONE_EDGEIPS)
• Vectra Respond UX (VECTRA_RUX)
• Zoho CRM (ZOHO_CRM)

Feature

View prebuilt parser version content

You can now view the prebuilt parser preview version content even if you are using a custom parser for the same log type. Although the prebuilt parser version is inactive, you can still see the content of the new preview version for this parser.

[Spotlight Feature] Data RBAC for first-party (1P) cases and alerts

Availability This feature is now available in public preview for all regions.

Google SecOps now supports data role-based access control (Data RBAC) for first-party (1P) SOAR cases and alerts. This feature automatically applies SIEM data access scopes to alerts and cases ingested using the Chronicle connector, ensuring analysts only see data they are authorized to access.

For more information, see the Release Note entry for July 6th.

Customizable schedules for multi-event rules

Customizable schedules for multi-event rules are available in public preview. You can customize rule execution schedules on the Rule schedule tab to specify a first-run delay offset that accounts for data ingestion latency. The system also performs automated background true-up runs to catch late-arriving logs and process metadata enrichment without requiring manual system interventions. This gives you precise control over detection evaluation timing, reduces false negatives without missing detections, and promotes alert accuracy.

To view or modify rule schedules using custom Identity and Access Management (IAM) roles, update your IAM permissions to include the following:

• chronicle.ruleDeployments.update to update individual rule schedules using the API.
• chronicle.rules.modifyRules to modify rule schedules using the web interface or in batch using the API.

If you use predefined IAM roles, such as Chronicle API Admin (roles/chronicle.admin) or Chronicle API Editor (roles/chronicle.editor), these permissions are included automatically.

Feature

[Spotlight Feature] Investigation and case management experience

This feature is in public preview. Google SecOps now includes a revamped Investigation Management experience that supports tracking raw UDM events and detections alongside alerts to accommodate new investigation types (such as retrohunt and threat hunt) and higher investigation volumes in cases. You can navigate your case queue using customizable table views, side-drawer previews, and integrated UDM Search workflows. For more information, see Investigation and case management overview.

This preview is currently supported only for single-SIEM deployments (instances where a single Google SecOps SIEM instance ingests data into SOAR) and does not support federated or MSSP environments.

Additional enhancements include:

• Attach SIEM search results to cases: Manually attach individual UDM events or detections directly from SIEM search results to new or existing cases as core evidence (supporting up to 500 detections and 5,000 UDM events per case). For details, see Attach SIEM search results to cases.
• Interactive Events Viewer: Dive directly into technical evidence from an interactive side panel. Inspect parsed UDM records, review original raw logs, pin key evidence to your case, and build detection exclusions in real time. For details, see Use the Events Viewer.
• Configure new default views: Before enabling the updated Cases experience, set up your default views under SOAR Settings > Case Data > Views. Make sure to manually copy over advanced widget configurations (such as Safe HTML Rendering or custom conditions) from the Default Alert View and Default Case View to the New Default Alert View and New Default Case View to preserve your preferred setups.

[Spotlight Feature] Deprecation of Google SecOps legacy SIEM APIs

Google SecOps is deprecating its legacy SIEM APIs—Backstory API (including Customer Management API) and Ingestion API—in favor of the modern Chronicle API.

Key dates

• October 26, 2026: New Google SecOps instances provisioned from this date will no longer support legacy API calls.
• July 20, 2027: All requests to legacy endpoints fail from this date because legacy APIs for all existing instances will be completely turned down.

This change applies only to custom scripts, integrations, SOAR connectors, or ingestion feeds calling legacy Backstory API or Ingestion API endpoints. Any changes impacting the Google SecOps UI are already addressed and don't call for your action.

Next steps

• Audit API usage to identify any affected components that currently call legacy Backstory API or Ingestion API endpoints, and replace them with Chronicle API endpoints.

• Validate and test that your updated components work properly.

For more information, see Migrate from legacy API to Chronicle API.

[Spotlight Feature] Advanced Filtering in Dashboards

Advanced Filtering in dashboards is now available in Preview. This feature enhances dashboard capabilities by enabling security analysts to use query variables, also known as tokens, to inject dynamic values, complex regular expressions, or boolean logic directly into YARA-L queries at runtime.

Key aspects of Advanced Filtering include:

• Token Variable Definition: When creating an advanced filter, you can define a Token Variable. Token variable names must consist only of alphanumeric characters and underscores (^[a-zA-Z0-9_]+$) and must be unique within the dashboard.
• Filter Value Generation: Token values can be generated dynamically from YARA-L query results or entered manually as a static list.
• Customizable Wrappers: You can specify prefixes and suffixes to wrap token values, enabling specific logic such as regular expressions.
• Multi-Select Support: The ability to select multiple options for a token can be enabled, with a configurable delimiter (for example, |) for combining values in queries.

For more information, see Advanced filtering.

Feature

Parser extensions for code snippets now support Append/Replace for Repeated Fields

You can now use append and replace functionality for repeated fields when creating code snippet extensions. Previously, this was only available for no-code extensions. This enhancement provides more granular control over how data is handled in repeated UDM fields, allowing you to either add new values or entirely replace existing ones.

For more information, see Repeated fields selector.

SOAR migration to Google Cloud validation status

You can now check if the SOAR migration was successful by going to the SOAR Settings > License Management page. After successful completion of Stage 1, it will say Google.com after the system version number. After successful completion of Stage 2 of SOAR permissions to IAM roles, it will say both Google.com and CloudIAM Enabled after the system version number.

For more information on the migration, see the SOAR migration guide

Publisher Agent Version 2.7.0

Publisher Agent Version 2.7.0 is now available for all regions.

This release includes the following updates for the remote agent:

• High Availability support: Adds applicative support for Publisher high availability.
• File transfer support: You can now upload and download files using playbooks and the SDK on agents that have been migrated to the GCOM infrastructure.