News & Announcements

Ensuring continuous data ingestion is critical for effective security operations. What happens when a collector stops sending logs to your Google SecOps instance? That's where Silent Host Monitoring comes in, allowing you to create alerts based on changes in ingestion rates via Google Cloud Monitoring. This way, you'll be notified if a collector stops functioning for any reason.Bindplane plays a key role in enabling this monitoring. Ensure that the SecOps Standardization Processor is active in your Bindplane workflow. The next step is to ensure the collector server's hostname is included as an attribute in your log entries. By implementing Silent Host Monitoring with Bindplane and Google Cloud Monitoring, you can proactively identify and address issues with your telemetry ingestion pipelines, ensuring you maintain complete visibility within your Google SecOps environment. This allows for quicker incident response and a more robust security posture Please review the following how-to gui

Google Security Operations finished 2024 strong with a wave of impactful features in Q4! We're empowering security teams to visualize, analyze, and act with confidence through our new native dashboards. But that's not all. We've also supercharged threat investigation with Gemini alert summarization in Digital Threat Monitoring and accelerated threat intelligence research with a new search experience in Google Threat Intelligence. Let’s explore some of the highlights: Cut Through the Noise with Gemini Alert Summarization   Reduce alert fatigue and accelerate threat investigation with Gemini Digital Threat Monitoring alert summarization. Digital Threat Monitoring now provides concise summaries of all alerts from the open, deep, and dark web, enabling your security team to efficiently prioritize and assess potential threats. Quickly identify critical issues, even across multiple languages, and streamline your incident response workflow. Learn more in our documentation. Automatically

Hey Community! I have some new updates for you! Get ready for an action-packed Google Cloud Next '25, April 9-11! We're thrilled to announce two hands-on Security Operations workshops sponsored by the Google Cloud Security Community. Check out the details and RSVP! These are in-person workshops at the event, so you'll need a Next '25 pass to attend. (Don't have one yet? Register for NEXT 25) But that's not all! We've also got a Google Threat Intelligence Capture the Flag and a hands-on Security Command Center workshop lined up. Check out all the exciting details below and RSVP to secure your spot! 👇 Here's the line up... Security Operations Workshops: The Visualizing Alerts will enhance your team's Google SecOps proficiency with our hands-on workshop. Learn to leverage the alert graph for streamlined triage, in-depth investigations, and optimized YARA-L rule modification. This hands-on session equips analysts with skills to efficiently manage alerts, improve detection accuracy,

Ever wondered who's behind the scenes? Curious to know who makes our community tick? We're about to show you! From API roadblocks to the satisfaction of conquering a mountain of tasks, Andy Shepherd's journey in SecOps is anything but ordinary. He believes cybersecurity is born from constant change and tech evolution, and he's always looking for the next big challenge. Join us as we shine a light on Andy, our Global Architect, and his passion for solving "interesting problems for interesting people."   Andy Shepherd Global Architect in SecOps “I wonder if cybersecurity's existence stems from the combination of constant business change and deployment of fresh technologies? Though without these, would we still be using standalone 1950s servers in basements?” Questions and Answers Q: What makes you excited about going to work every day? A: Using interesting technology to fix interesting problems for interesting people Q: If you could change one thing about security operati

We're excited to announce a Vertex AI integration is now available in the Google SecOps Marketplace! ✨  Combine the power of Google’s AI Platform, Vertex AI and models, to rapidly create custom response actions and meet enrichment needs. Gain deeper insights from your data and boost your team's efficiency and effectiveness, whether you're using Gemini in SecOps, built-in features, or creating custom solutions with Vertex AI. Here are the use cases you can address with this Vertex AI integration: Execute a Playbook Prompt (Generally Available): The sky's the limit! Use custom prompts to automate case management activities, summarize action responses, build curated emails and ITSM tickets with context from alerts, and streamline your workflows. Analyze EML (Preview): Automatically analyze suspicious emails for malicious behavior with an out-of-the-box (OOTB) widget. Generative AI provides an email threat level rating, recommended next steps, and a clear explanation of the id

We're thrilled to announce a fresh look and feel for the Google Cloud Security Community! This redesign aims to consolidate navigation, enhance organization, and provide a more focused experience. You’ll notice some older forums have been sunsetted to create a more streamlined space for discussion. Also, we’ve merged a few sections so you can access important updates and information all in one place. We advise that you resubscribe to these forum boards and the labels that excite you the most.   What's New? Simplified Navigation: The new navigation bar makes it easier to find what you need. Security Forums: Your go-to place for discussions on SecOps SIEM, SOAR, Google Threat Intelligence, Attack Surface Management, Managed Defense, Security Validation, Security Command Center, and reCAPTCHA. Come ask questions, share your expertise, connect, network, help each other out, have fun and remember, please be respectful! Tips & Resources: Discover product onboarding guides, le

Are you new to Chronicle or SecOps or SIEM? If you answered yes to any of those, this series is for you! When I started at Google in May, I had spent a good portion of my career working with SIEMs and MSSPs like Symantec, ArcSight and Splunk. However, I know from experience that different platforms have different capabilities and different ways to do build content, conduct investigations and hunt. So, this series is designed to provide some insight into how you can use Chronicle to effectively build rules, conduct searches and much much more. You can find the series at https://chronicle.security/blog/?filters=new-to-chronicle-series, we are at eight posts and growing. In fact, today we released a new blog around the improved search capabilities around UDM data. You can find the blog at https://chronicle.security/blog/posts/new-to-chronicle-a-new-view-for-search/ Stay tuned, there is more to come!

Wow! What an amazing year it has been for the Google Cloud Security Community. And thanks to all of you who have participated in helping us build this incredible network of security practitioners coming together all for the common cause of supporting each other! I just wanted to highlight few simple rules to continue to keep things friendly and productive: Be Respectful: Let's keep the vibes positive. Respectful and polite interactions make for a better community. Be Relevant: Keep your comments relevant to the thread. If you have a new question, start a new thread. Share the Love: Got a tip or trick? Share it! Help others and level up the community together. Be Responsible: Use common sense and good judgment in your interactions. Avoid sharing confidential information or breaking any rules. Protect Privacy: Let's keep personal information private. Don't share anything you wouldn't want publicly available. Remember, this is a user-generated community. You'll find plenty of good advice

Hello Community Members, We are excited to announce a small refresh of the Community structure, navigation and design coming early Thursday morning Dec 12th US Pacific time zone. You'll notice some basic changes to the layout. We are simplifying and consolidating the nav bar so it's easier for you to access the information you need. We are structuring the content in a much more organized way. There will be a Security Forums section where all our forums will live. Tips & Resources will include product Onboarding Guides, product Best Practices, Learning, and a Cloud Support page. Articles & Information will include the Community Blog, News & Announcements, Security Podcast and Community Resources. The Community Blog will have a slightly new look with 3 tiles at the top of the page. Events and User Groups will remain the same.   Once we launch, we welcome any and all feedback. We look forward to hearing what you think of the new updates. And, thanks for continuing to

We're delighted to announce the expansion of Google Security Operations' regional support for data residency in two new locations: Brazil and France! This launch marks two significant milestones: A South American Debut: Brazil becomes our first data region in South America, extending our advanced security capabilities to this dynamic market. EMEA Expansion: France joins our growing network of data regions in EMEA, now totaling 11, underscoring our dedication to data privacy and security across the region. This expansion allows even more organizations to experience the benefits of Google Security Operations. In a recent IDC interview, a CISO at a European insurance agency shared how our platform helped them achieve a "pre-attack-based defensive posture," saving their team significant effort and allowing them to focus on higher-value tasks. They highlighted how Google Security Operations automated many of their manual SIEM tasks, freeing up their team to "work out how to get more busine

This third quarter of 2024, Google Security Operations focused on fueling efficiency and collaboration for our customers. We’ve rolled out a host of key enhancements including: Threat profile sharing Private collection sharing New curated detections IDE staging A single YL2 language 34 new YARA-L2.0 functions (Preview) Data export from Google SecOps to BigQuery Mandiant Managed Defense for Google SecOps To access the details of our Q3 additions to Google Security Operations, visit this blog. To find a comprehensive list of recent Google Security Operations Release Notes/Changes, go here.

With a busy end of September you may have missed this exciting announcement - Google named a Leader in the IDC MarketScape: Worldwide SIEM for Enterprise 2024 Vendor Assessment! We believe this recognition is a reflection of our significant investments in Google Security Operations over the past three years. Our efforts include the acquisition and integration of Mandiant, the world’s leading threat intelligence and incident response provider, and Siemplify, a leading security orchestration, automation and response (SOAR) provider.  The report noted, “Google Security Operations is a cloud-native SIEM that is integrating previous point products such as SOAR and ASM, enriching all alerts with Google Threat Intelligence, and offering a gen AI assistant to alleviate mundane security analyst tasks. It is built on the search, data visualization, and storage services of Google Cloud.”Download a complimentary excerpt of the IDC MarketScape: Worldwide SIEM

What’s New in Google SecOps today? Introducing the SecOps product release digest, designed to keep you informed about the latest advancements in Google Security Operations (formerly Chronicle). Discover the latest SecOps product features and how they can empower your team.______________________________________________________________________________________________________________ Gemini AI Playbook Assistant (Public Preview)Gemini AI Playbook Assistant can help you streamline the process of creating playbooks by turning your prompts into a functional playbook that helps resolve security issues. Users can leverage Gemini to build and configure playbooks, or ask Gemini to suggest flows to cover specific use cases leveraging industry standard approaches. Read More >> (Gemini AI Playbook Assistant) Data RBAC (Generally Available)Data RBAC enhances your data security by allowing role-based access control, customizable permissions based on UDM fields and ingestion parameters, and eff

Mandiant Managed Defense, our 24/7 managed detection and response (MDR) service, is now generally available for Google Security Operations (SecOps) customers in the US. Managed Defense now uses built-in curated detections and risk scores from Google Security Operations for comprehensive, up-to-the-minute threat coverage, automated threat identification, and faster threat identification. These capabilities allow our experts to prioritize rapid investigation and incident remediation. Our proactive approach is continuously enriched with insights from Managed Defense's own threat hunts, protecting our customers against the latest attack techniques. Managed Defense supports native Google SecOps features designed to identify potential compromise and seamlessly integrates with your existing security tools, offering flexibility and choice. Managed Defense for Google SecOps supports Crowdstrike Falcon Insight XDR, Microsoft Defender for Endpoint, and SentinelOne Singularity XDR. Additionally, w

Hi community members,Are you a Google Security Operations customer? If so, we would sincerely appreciate it if you took a few minutes to share your positive experiences with the platform on Gartner Peer Insights. By leaving us a review, you can help other security technology buyers make informed decisions, and as a thank you, Gartner will send you a $25 gift card. Anyone on your team can complete the review as it is not limited to 1 person per company, so please invite your team to participate! All reviews are verified and posted anonymously.Write a review for Google SecOps SIEM: goo.gle/GoogleSecOpsSIEM Write a review for Google SecOps SOAR: goo.gle/GoogleSecOpsSOARThank you for your support!Ahnna

Building on the strong product momentum of Google Security Operations in the first quarter of 2024, our second quarter brought a host of significant enhancements focused on providing customers with an advanced AI and intel-driven experience. But we didn’t stop there. We also introduced a number of improvements to everyday processes, prioritizing the ease of use and efficiency of Google SecOps. To access a list of our Q2 additions to Google Security Operations, visit this blog. To find a comprehensive list of recent Google Security Operations Release Notes/Changes, go here.

We're excited to introduce a game-changing feature within the Google Security Operations platform: IDE Staging. 👋 Say goodbye to the fear of pushing an integration update live, only to discover it disrupted your existing playbooks and connectors. With IDE Staging, you can now thoroughly test your integrations in a safe, isolated environment before they hit production. Key Benefits of IDE Staging: Risk-Free Testing: Upgrade integrations, test them in a secure staging environment, and then confidently push them to production, replacing existing integrations without disrupting operations. Enhanced Confidence: Validate changes and gain full visibility into how updates will behave in your production environment before deployment. Streamlined Python Upgrades: Aligned with the Python version upgrade process for easy maintenance and proactive security vulnerability management. How to Get Started: For a detailed walkthrough of how to use the IDE in staging mode, please refer to our do

We are thrilled to announce the addition of two new data regions for Google Security Operations: Italy and Qatar. This brings our total number of EMEA data regions for Google SecOps to 10, demonstrating our ongoing commitment to protecting customer data and privacy. Since the start of 2024, we have added five new data regions, including Japan, Canada, India, and now Qatar and Italy. Our expansion highlights Google Cloud's dedication to delivering top-notch security solutions across the globe. One Italian customer, Telepass, is already benefiting from Google Security Operations, using it as their single point of truth for security, greatly simplifying their analysts' tasks. Another EMEA CISO was interviewed by IDC and shared, "Our cybersecurity teams deal with issues faster with Google Security Operations, but they also identify more issues. The real question is, ‛How much safer do I feel as a CISO with Google Security Operations versus my old platform?’ and I would say 100 times safer.

As we forged into the first quarter of 2024, Google Security Operations (formerly Chronicle) unveiled a series of updates centered around streamlining operations for our customers. We understand the challenges faced by security operations teams dealing with time-consuming and intricate processes. That’s why we’re excited to introduce enhancements that simplify workflows and enhance efficiency. To access a list of our Q1 additions to Google Security Operations, visit this blog. To find a comprehensive list of recent Google Security Operations Release Notes/Changes, go here.

Today we introduced a host of new innovations in Google Security Operations (formerly known as Chronicle) designed to make everyone in the SOC more productive from security analysts, to security engineers, to managers.  You might have also noticed we announced that Chronicle is now Google Security Operations. The name may have changed, but our focus on providing a unified, AI and intelligence-driven platform that modernizes threat detection, investigation, and response (TDIR) has not! Read the blog to learn more about what's new in Google Security Operations. Or come meet us in person at our RSA Conference booth (N5644). You can also catch us at our keynotes, presentations, and meetups including our session, “Bye-Bye DIY: Frictionless Security Operations with Google,” on Tuesday, May 7, at 1:15 p.m. PDT.

Hi everyone, as shared in a previous announcement, we're excited to share the revamped community ranking system and badges are now live!  Please see our community resource article, Understanding Community Ranks and Badges and the announcement post for further details. With the new ranking system, we want to emphasize that: Badges are unlocked by completing a certain amount of an activity, whereas ranks are tied to completing a combination of activities, including giving and receiving likes, authoring posts and solutions, and engaging in the comments. Avatar icons are assigned to members to signify a unique status, role, or achievement in the broader Google Cloud ecosystem, including Google Staff, Innovators, Innovators Plus, and Champion Innovators.  Tip 👉 If you want to climb the ranks, take a look at your contributions, as shown on your profile page, to see if there are any comm

Hey everyone, get ready for an exciting evolution to our Google Cloud Community!  Based on your valuable feedback, we’re revamping and revitalizing the community’s ranking system and badges, going into effect on April 5th.  Community email notifications will be paused on April 5th between 5AM and 12PM PT as we make these updates, but you will still be able to use the Community as usual.  Why the change? We heard that you want a community ranking system that recognizes the quality of your contributions, not just the quantity. You want clearer naming conventions and visual representations of ranks so you can quickly see where someone falls in the ranking structure. You also wouldn’t mind a few more rungs to climb on the ranking ladder.  We hear you! Here’s what we’re doing about it. What’s changing?  Quality over quantity: The new ranking system will place greater emphasis on the value and impact of your contributions acr

It’s not time to put 2023 in the rearview mirror just yet, at least not until we’ve shared our last set of Chronicle Security Operations highlights. We do like to end things with a bang and we think you’ll like how we’re closing the year out.  To access a list of our Q4 additions to Chronicle Security Operations, visit this blog. To find a comprehensive list of recent Chronicle Release Notes/Changes, go here.

Uncover threats missed by traditional detection methods.  Mandiant expert hunters will proactively scour your Chronicle Security Operations data, armed with the latest knowledge of adversary tactics, techniques, and procedures (TTPs).  Mandiant Hunt is fueled by continuous intelligence from Mandiant frontline experts, VirusTotal’s intelligence community, and Google security telemetry, ensuring your hunt leverages the latest insights. Findings come with clear explanations of the hunt process and are mapped to the MITRE ATT&CK framework, empowering you with actionable context for decisive action. For more information, refer to the Mandiant Hunt documentation and explore how proactive hunting can mitigate business impact.

We’re glad that you’ve decided to explore our flourishing group of peers and industry experts who are here to network, share knowledge, and have fun together. Here, you can find support or network and find educational content, inspiration and encouragement, whether you are brand-new to the world of Google Cloud Security or you are a seasoned Google Cloud Security veteran. If you have not yet registered, please visit here to learn how to register. Now that you are a member, you can enjoy the following resources:  The Mandiant Forums  As a community member, you have the ability to post, reply and give "likes" on the Google Cloud Security community forums. If you are looking for support with any part of Mandiant, our forums are the place to go. They are titled "Mandiant Forums" and there you will find technical professionals with years of experience who are ready and eager to answer your questions. Conduct a quick search, by using keywords, before creating a new post b