News & Announcements

Hey Everyone!Welcome to the Google Cloud Security Community! We want to kick things off by getting to know each other better. This space is all about connecting, sharing, solving, and building the future of cloud security – and that journey starts with you!So, don't be shy! Drop a quick intro below and tell us:Who are you? (Your name, role, etc.) What's your cloud security superpower? (What area excites you most, or a cool project you're working on?) What are you hoping to learn or share here? (Let's help each other grow!)We're incredibly excited to learn from your unique experiences and build a vibrant hub where we can all protect, create, and innovate together.Can't wait to meet you all!Matt 

Create and Share Your Security Gemini Gems We're launching a new Community challenge, and this time you not only have a chance to win Google swag, but to also be featured on the Google Cloud Security podcast with Anton Chuvakin and Timothy Peacock. The goal is simple: create and share a Gemini Gem that streamlines security tasks and saves you time. How to Participate:We are looking for creativity and utility.1. Design a Gemini Gem that solves a specific security problem. Crucially, DO NOT put corporate sensitive data in your Gems! 

Hey Community! I have some new updates for you! Get ready for an action-packed Google Cloud Next '25, April 9-11! We're thrilled to announce two hands-on Security Operations workshops sponsored by the Google Cloud Security Community. Check out the details and RSVP! These are in-person workshops at the event, so you'll need a Next '25 pass to attend. (Don't have one yet? Register for NEXT 25) But that's not all! We've also got a Google Threat Intelligence Capture the Flag and a hands-on Security Command Center workshop lined up. Check out all the exciting details below and RSVP to secure your spot! 👇

The FLARE Learning Hub freely distributes quality educational content on reverse engineering and malware analysis from the FLARE team. We are excited to share with the wider security community FLARE’s nearly two decades of experience in instructing thousands of students and professionals across higher education, private industry, government, and premier conferences.Our content emphasizes hands-on practice. Modules include demonstrations and lab exercises that reinforce the material, helping you integrate practical skills into your workflow. The modules are hosted as web-published Google Docs, while the GitH

Hey Community! We just launched our first Virtual Workshop + CTF with 599 people joining us for some fun SecOps learning and challenges! And what an event it was!  A huge thank you to Keith Manville (kman) and JP (cybrshenanigans) for cohosting with me and building the two events! And to John Stoner (jstoner) for letting us use his enablement workshop content that went into all of our development for today’s live events. 🏆  Congratulations to the Top 3 contestants! 🏆  🥇 First Place: kushlendrasingh🥈 Second Place: Snickson

Are you new to Chronicle or SecOps or SIEM? If you answered yes to any of those, this series is for you! When I started at Google in May, I had spent a good portion of my career working with SIEMs and MSSPs like Symantec, ArcSight and Splunk. However, I know from experience that different platforms have different capabilities and different ways to do build content, conduct investigations and hunt. So, this series is designed to provide some insight into how you can use Chronicle to effectively build rules, conduct searches and much much more. You can find the series at https://chronicle.security/blog/?filters=new-to-chronicle-series, we are at eight posts and growing. In fact, today we released a new blog around the improved search capabilities around UDM data. You can find the blog at 

The promise of a future where intelligent agents assist human analysts with routine tasks, decision-making, and workflow automation, as outlined in our vision for the Agentic SOC, is now one step closer to reality. We are excited to announce the public preview of the Alert Triage and Investigation agent, a purpose-built AI agent natively embedded into Google Security Operations.

Hey Community! Come elevate your career with the new Google Cloud Professional Security Operations Engineer Certification. Registration is now open! The new Google Cloud Professional Security Operations Engineer (PSOE) certification highlights the continuous and vigilant defense against ever-present threats that cloud security operations engineers and organizations face every day.If the Professional Cloud Security Engineer (PCSE) certification equips you to build a secure cloud fortress, the PSOE certification demonstrates that you are able to use the Google Cloud security tools such as Google Security Operations (SecOps), Security Command Center (SCC), and Google Threat Intelligence (GTI) to continuously defend it. This is critical because robust security isn't just about configuration; it's about the ongoing battle against evolving threats.The exam assesses your expertise across six core domains:Platform operations (~14%) Data manag

Google Security Operations (SecOps) continues to push the boundaries of innovation, focusing on deep integration and intelligent automation. Our recently released features are designed to reduce noise, accelerate investigations, and ensure your security operations remain resilient and scalable. Agentic SOC Emerging Threat Center: (Public Preview)The Emerging Threat Center in SecOps helps customers immediately determine if their environment is impacted by new critical intelligence published by GTI, enabling them to quickly understand “Are we impacted?” and “Are we prepared?”, transforming the starting point for threat hunting workflows into a proactive, curated journey. As new Campaigns are published, Gemini processes the reports, determines detection coverage, and suggests new rules to add to Curated Detections.

 For 16 years, the M-Trends report has served as a bellwether for the cybersecurity industry, providing an unvarnished look at the attackers, tactics, and techniques defining the modern threat landscape. We are proud to share the 2025 M-Trends Report, which distills observations and analysis from our latest incident response investigations into actionable guidance. This year's edition moves beyond standard metrics to explore how threat actors are adapting to cloud environments, exploiting decentralized finance, and leveraging human vectors in new ways. What You Will Learn: This comprehensive report offers a deep dive into the most critical trends of the past year, including:The Rise of Infostealers: Analysis of the growing risk posed by information-stealing malware and its role in precursor attacks. Nation-State Evolution: A detailed look at the Iranian threat landscape in 2024 and the persis

Google Security Operations introduced a wave of significant features in Q2 2025, enhancing capabilities in data visualization, search, and case management. SecOps Dashboard and Reporting Platform: Now Offering Enhanced Visualization, Analysis, and MonitoringNow generally available, this release has added some exciting new capabilities to improve your visualization experience further.  Learn moreKey Enhancements Include: SOAR Data Integration: Dashboards now natively integrate SOAR data, enabling powerful visualizations and monitoring of SOAR operations. This includes access to cases, case history, and playbook data, all queryable using YARA-L. Additionally, 30 days of historical SOAR data have been backfilled for all customers. Dashboard

Google SCC introduced significant innovations focused on helping customers prioritize risk, identify vulnerabilities, and protect AI workloads within their cloud environment. Below are the key features that achieved General Availability (GA) along with exciting Public Previews (PP). SCC comes in Premium (SCC-P) and Enterprise (SCC-E) editions. Premium provides the strongest security for Google Cloud, while Enterprise extends protection across multiple clouds and includes more robust automated responses. Risk Prioritization:Security Graph “Issues” (GA) - surfaces the most critical security risks in a customer’s environment, grouping them by severity and showing how assets, identities, and exposures are connected through an intuitive visual map. This helps customers quickly understand attack paths and the potential blast radius of each issu

Hello, Security Community!We have introduced the Emerging Threats Center in Google Security Operations to address a specific friction point in the SOC: the lag between a high-profile threat hitting the news and the ability to detect it in your environment.When a "headline" vulnerability drops, analysts often lose hours or days to manual research and writing custom rules. The Emerging Threats Center is designed to streamline this workflow by leveraging Gemini to automate the heavy lifting of detection engineering.Here is the practical outcome for your team: Immediate Visibility: Rapidly answer "Are we impacted?" and "Are we prepared?" without manual query construction. Automated Research: The system analyzes threat intelligence articles and automatically converts them into valid detection rules.

Hello Community! I can't believe 2025 is almost over and 2026 is right around the corner. I don't know about you, but this year flew by! It has been a milestone year for us; we launched new programs, migrated to a new platform, and saw incredible growth in our membership and engagement. And I have all of you to thank for this success! This community is a massive puzzle, and every one of you is an essential piece. Whether you just registered your account, visited for the first time today, or browse our content to stay informed… THANK YOU for being here! To those who step up to ask questions, share solutions, and offer ideas: THANK YOU for making this a safe space for us to learn from one another and create connections. Your contributions are what allow us to build this powerful network of security practitioners. I am deeply grateful for your efforts. Lets continue this growth and momentum next ye

Welcome to the December edition of our Spotlight Series! For Darren Davis, Senior Security Consultant at Google SecOps, cybersecurity isn't just about prevention—it's about being ready to respond. In this month's feature, Darren opens up about the never-ending learning curve of the industry and why he loves seeing that "aha" moment when customers realize the true power of SecOps.From his top podcast recommendations (shoutout to Darknet Diaries!) to the Adoption Guides he swears by, get to know the expert behind the strategy.Join Darren for an exclusive webinar on December 10th, where he’ll share his expertise on Parsers and best practices. Register here: Parse Anything in Google SecOps: Parser Development Best Practices 

Our Spotlight for November is Jay Aware, our brilliant Customer Engineer in Security! Jay is passionate about tackling complex security challenges at a global scale and loves diving into nerdy topics like attacker methodology. He reminds us that "Security is a journey, not an end-state," and that continuous effort is key in the fight against bad actors. Want to learn more from Jay? He'll be hosting an exclusive webinar on November 11th where he'll share his insights and expertise. Don't miss this opportunity to hear from a pro.Register here: Community Webinar: Terraform-all-the-things: Google SecOps Authentication with 3rd party identity providers 

We're delighted to announce the expansion of Google Security Operations' regional support for data residency in two new locations: Brazil and France! This launch marks two significant milestones: A South American Debut: Brazil becomes our first data region in South America, extending our advanced security capabilities to this dynamic market. EMEA Expansion: France joins our growing network of data regions in EMEA, now totaling 11, underscoring our dedication to data privacy and security across the region. This expansion allows even more organizations to experience the benefits of Google Security Operations. In a recent IDC interview, a

Hello Google Cloud Security Community!I'm thrilled to announce the launch of a new, dedicated space in our community: the CISO's Corner.This new section is a resource hub designed for CISOs, C-suite executives, and security leaders. It's a place to cut through the noise and find high-level, strategic guidance. What You'll Find Inside The Cloud Security Podcast: Join hosts Anton Chuvakin and Timothy Peacock 

Block out your calendar and stock up on instant ramen, because the FLARE-On 12 challenge is launching soon. This is the FLARE team’s CTF-style game for reverse engineers, aspiring reverse engineers, and anyone who likes to solve fun challenges for a meager amount of internet fame. This challenge will have 9 stages of increasingly difficult challenges for single players to solve in sequence. If you solve all stages, you may be eligible to receive a prize and have your name or handle etched into the fabled FLARE-On hall of fame for all to bask in the glory of your accomplishment. The contest starts at 8:00pm ET on Sept. 26th, 2025 and ends at 8:00pm ET on Oct. 24th, 2025. A live countdown timer is running at flare-on.com. Also check out the FLARE-On website for previous year’s challenges and official solutions to hone your skills at your leisure. As always, the FLARE-On contes

This past quarter, Google Security Operations introduced significant innovations focused on AI-powered automation, next-generation detection, and enhanced operational efficiency for your Security Operations Center. Below are the key features that achieved General Availability (GA) in Q3, along with exciting public previews. Analyst ExperienceLegacy Stack (Non-BYOP, Federated Auth, Legacy RBAC) EoS: All new customers & partner tenants will no longer be onboarded into Non-BYOP project, Federated Auth and Legacy RBAC. So, every new customer instance needs to be set up in customer / partner’s GCP Project, configure Auth using Cloud Identity / BYOID, Feature RBAC to manage user roles and Data RBAC (optional) to manage Data access. Data Tables in Search: Introduces key new capabilities like Data Table Join & Filter support in Search, the abilit

Hey Community,We have an exciting opportunity for you to uplevel your AI skills and strengthen your security defenses without adding more to your plate. If you live in or are near Los Angeles, Chicago, New York, or Toronto, you're invited to an exclusive, free half-day training event designed for security practitioners. Our theme is building the next class of security experts empowered by AI.Join us to explore how AI will transform security operations from a manual grind to more autonomous functions. We'll share our vision for the Agentic SOC—a future where AI, powered by Gemini, acts as your virtual security assistant, anticipating threats and guiding you to respond faster and more effectively.In this workshop, you will:Translate Vision into Action: Go beyond theory and learn how to transform security operations from a manual grind to autonomous functions. Get Hands-On with Gemini: Discover

It's time for our October Community Spotlight! This month, we are featuring Robert Parker, a Technical Solutions Consultant who is passionate about helping organizations build their security defenses.A true believer in the power of community, Robert shares some great advice on staying up-to-date with industry trends, networking with local cybersecurity groups, and the best career advice he ever received—from a soda koozie! Check out his story in this month's spotlight.   Robert ParkerTechnical Solutions Consultant“Kindness and gratitude are free, so how about we sprinkle some of it everywhere we go?”    Q: What sparked your interest in Security Operations? 

CrowdStrike deprecated the Detects API on October 1, 2024 and this API will be decommissioned on September 30, 2025. This API has been superseded by the CrowdStrike Alerts API.Please continue reading if…You have active SIEM data feeds on Google SecOps using the CrowdStrike Detection Monitoring (“CS Detects”) API connector (mapped to the CS_DETECTS logtype), and Your CrowdStrike API Client mapped to this feed does not have permission to read ‘Alerts’.What action do I need to take?You are advised to take one of the following actions:

We're bringing to you another Community challenge and this time it's about Model Context Protocol. MCP is a hot topic in the security world right now. For those just hearing about MCP, it allows AI models to communicate with and leverage the capabilities of diverse security tools.  This helps enhance security workflows by ensuring models are contextually aware across multiple downstream services. With the ability to interact with security data in natural language, security teams can produce insights faster and scale their security operations. If you’re just getting started with the SecOps MCP server, check out our SecOps MCPserver content to learn more.We're excited to launch this new challenge and can't wait to see a