[Fixed] Left Outer Join - Rules and Datatables

Hello Google Security Community - after a soak period with some of our early adopter customers, I wanted to share a fix/update to some rules + data tables behaviors that we think are valuable for a number of detection use-cases.

My colleague Bharath K and I have been working through a  bug around outer-left joins and datatables that has been fixed. I have created a Github repo with reference examples so you can think through creative ways of applying these patterns to your detections.

https://github.com/Dishwishy/secops-rules-left-join-examples-2026/tree/main

In particular ​@hliu (aka Average Splunk |lookup enjoyer) has had a lot of great content and details in this area, so a major thank you to putting us on the trail of this problem and helping us resolve it.
 

• Data table event enrichment (inner vs left vs outer)

And I would be remiss for not also thanking ​@jstoner for his help as well on this particular journey:

• New to Google SecOps: How Soon Is Null? Using IOCs with Outer Joins

Thanks for being great users and community members and I look forward to your feedback.

-Kyle​​​​​​​