Data table event enrichment (inner vs left vs outer)

There is on-going work on joins with data tables occurring and this question is timely but potentially a little early. I tested this on my internal tenant and was able to get a result but I don’t believe it has been pushed out fully. That said, we can (shortly) do a left join between the events and a data table and the search syntax would look something like this:

$e.metadata.event_type = "USER_LOGIN"
$e.target.user.userid = $user
left join $e.target.user.userid = %adhoc_users.userid
match:
    $user
outcome:
    $company = array_distinct(%adhoc_users.organization)
    $state = array_distinct(%adhoc_users.state)
    $probationary = array_distinct(%adhoc_users.probationary)

This would give you all the user login events and then show the org, state and probationary status of the users that exist in both the event and data table but still provide the users in the events even if they are not in the data table.

Again, this may not be in your tenant yet but should be getting there soon.

Hey John,

Thanks a lot for the explanation and a follow-up question:
- How can I track this functionality ?
- Should I just read the release notes or is there a way to verify this from within our Google SecOps instance ?

As I haven’t received a response from our partner team, I wanted to check whether you were able to obtain any information about that functionality ?

Just closing the loop on this but the release notes appeared a few days ago https://docs.cloud.google.com/chronicle/docs/secops/release-notes#February_12_2026