Stay Informed

We are on a mission to drive the adoption for our Google SecOps Native Dashboard feature, and we want YOU, our amazing community, to lead the charge! Let’s unlock the full potential of this together! We also want you to empower your security operations with the new Native Dashboard, create insightful visualizations and gain better visibility using our out-of-the-box dashboards created by Google SecOps internal team! This isn't just any contest; it's your chance to shine and help shape the future of SecOps visibility! Your vote matters so be sure to check out the details below on how you can help us determine a winner! Duration: March 31st - April 30th Announcement date: Winners will be announced Mid-May 2025 How to Participate

Big news! Our new white paper, "Securing Nations in the Digital Age: Google Cloud Cybershield™," is LIVE! This essential guide dives into: The Current Threat Landscape: Learn why governments and public sector entities are prime targets and the alarming trends in financially motivated attacks and state-sponsored cyber espionage. The Need for a Comprehensive Approach: Understand the challenges of siloed security tools, lack of real-time information sharing, and the persistent cybersecurity talent shortage. The Need for a Comprehensive Approach: Understand the challenge

Hey Community!  We have an upcoming webinar that you won't want to miss on May 21th 10AM EDT / 15:00 BST! This urgent webinar is focused on a critical cybersecurity threat: UNC3944, also known as Scattered Spider. As you may know, UNC3944 has resumed its ransomware and extortion operations, and they are currently targeting US retailers with the same aggressive tactics they used in the UK recently. I wanted to make sure you were aware of this immediate risk. These actors are particularly effective at circumventing mature security programs, using social engineering and third-party access to gain entry. We are hosting a webinar on May 21st at 10:00 AM EDT / 3:

The strength of our community lies in the individuals who contribute to our shared achievements. Discover more about the people who make us who we are. Dive into the dynamic world of SecOps with our latest community highlight: Vasken Houdoverdov! As a Technical Solutions Consultant, Vasken thrives on the thrill of case analysis, rule creation, and big data insights. But his impact doesn't stop there – he's a valuable content creator across our forums, driving product adoption and connecting with security pros globally. Hear what sparks his passion, the rewarding aspects of his role, and why he's excited to be part of our growing Google Cloud Security Community. Plus, you won't believe his fascinating fun fact!  

Have you considered the individuals who contribute to our collective success? We invite you to learn more about the driving forces within our community. Meet John Stoner, our Global Principal Security Strategist. He is all about making security teams more effective and does this by breaking down complex data, addressing new threats, and sharing his widely respected SecOps best practices. John is on a mission to simplify the complexities of security operations, starting with data understanding. From his love for insightful blogs to his passion for bridging the gap between business and security, John's insights are a valuable resource for our community.  

Today we are excited to announce the general availability of Google Unified Security! Google Unified Security is our new AI-powered converged security solution, designed to address the challenges of fragmented data and siloed security tools of which threat actors are increasingly taking advantage. By integrating Google's leading threat intelligence, security operations, cloud security, secure enterprise browsing, and Mandiant expertise, Google Unified Security creates a single, scalable security data fabric across the entire attack surface. Gemini AI enhances threat detection with real-time insights and streamlines security operations, empowering organizations to shift from reactive to preemptive security and stay two steps ahead of increasingly sophisticated attacke

Ensuring continuous data ingestion is critical for effective security operations. What happens when a collector stops sending logs to your Google SecOps instance? That's where Silent Host Monitoring comes in, allowing you to create alerts based on changes in ingestion rates via Google Cloud Monitoring. This way, you'll be notified if a collector stops functioning for any reason.Bindplane plays a key role in enabling this monitoring. Ensure that the SecOps Standardization Processor is active in your Bindplane workflow. The next step is to ensure the collector server's hostname is included as an attribute in your log entries. By implementing Silent Host Monitoring with Bindplane and Google Cloud Monitoring, you can proactively identify and address issues with your telemetry ingestion pipelines, ensuring you maintain complete visibility within your Google SecOps environment. This allows for quicker incident response and a more robust security post

Google Security Operations finished 2024 strong with a wave of impactful features in Q4! We're empowering security teams to visualize, analyze, and act with confidence through our new native dashboards. But that's not all. We've also supercharged threat investigation with Gemini alert summarization in Digital Threat Monitoring and accelerated threat intelligence research with a new search experience in Google Threat Intelligence. Let’s explore some of the highlights: Cut Through the Noise with Gemini Alert Summarization   Reduce alert fatigue and accelerate threat investigation with Gemini Digital Threat Monitoring alert summarization. Digital Threat Monitoring now provides concise

Hey Community! I have some new updates for you! Get ready for an action-packed Google Cloud Next '25, April 9-11! We're thrilled to announce two hands-on Security Operations workshops sponsored by the Google Cloud Security Community. Check out the details and RSVP! These are in-person workshops at the event, so you'll need a Next '25 pass to attend. (Don't have one yet? Register for NEXT 25) But that's not all! We've also got a Google Threat Intelligence Capture the Flag and a hands-on Security Command Center workshop lined up. Check out all the exciting details below and RSVP to secure your spot! 👇

Ever wondered who's behind the scenes? Curious to know who makes our community tick? We're about to show you! From API roadblocks to the satisfaction of conquering a mountain of tasks, Andy Shepherd's journey in SecOps is anything but ordinary. He believes cybersecurity is born from constant change and tech evolution, and he's always looking for the next big challenge. Join us as we shine a light on Andy, our Global Architect, and his passion for solving "interesting problems for interesting people."  

We're excited to announce a Vertex AI integration is now available in the Google SecOps Marketplace! ✨  Combine the power of Google’s AI Platform, Vertex AI and models, to rapidly create custom response actions and meet enrichment needs. Gain deeper insights from your data and boost your team's efficiency and effectiveness, whether you're using Gemini in SecOps, built-in features, or creating custom solutions with Vertex AI. Here are the use cases you can address with this Vertex AI integration: Execute a Playbook Prompt (Generally Available): The sky's the limit! Use custom prompts to automate case manageme

We're thrilled to announce a fresh look and feel for the Google Cloud Security Community! This redesign aims to consolidate navigation, enhance organization, and provide a more focused experience. You’ll notice some older forums have been sunsetted to create a more streamlined space for discussion. Also, we’ve merged a few sections so you can access important updates and information all in one place. We advise that you resubscribe to these forum boards and the labels that excite you the most.   What's New? Simplified Navigation: The new navigation bar makes it easier to find what you need. Security Forums: Your go-to place for discussions on

Are you new to Chronicle or SecOps or SIEM? If you answered yes to any of those, this series is for you! When I started at Google in May, I had spent a good portion of my career working with SIEMs and MSSPs like Symantec, ArcSight and Splunk. However, I know from experience that different platforms have different capabilities and different ways to do build content, conduct investigations and hunt. So, this series is designed to provide some insight into how you can use Chronicle to effectively build rules, conduct searches and much much more. You can find the series at https://chronicle.security/blog/?filters=new-to-chronicle-series, we are at eight posts and growing. In fact, today we released a new blog around the improved search capabilities around UDM data. You can find the blog at 

Wow! What an amazing year it has been for the Google Cloud Security Community. And thanks to all of you who have participated in helping us build this incredible network of security practitioners coming together all for the common cause of supporting each other! I just wanted to highlight few simple rules to continue to keep things friendly and productive: Be Respectful: Let's keep the vibes positive. Respectful and polite interactions make for a better community. Be Relevant: Keep your comments relevant to the thread. If you have a new question, start a new thread. Share the Love: Got a tip or trick? Share it! Help others and level up the community together. Be Responsible: Use common sense and good judgment in your interactions. Avoid sharing confidential information or breaking any rules. Protect Privacy:

Hello Community Members, We are excited to announce a small refresh of the Community structure, navigation and design coming early Thursday morning Dec 12th US Pacific time zone. You'll notice some basic changes to the layout. We are simplifying and consolidating the nav bar so it's easier for you to access the information you need. We are structuring the content in a much more organized way. There will be a Security Forums section where all our forums will live. Tips & Resources will include product Onboarding Guides, product Best Practices, Learning, and a Cloud Support page. Articles & Information will include the Community Blog, News & Announcements, Security Podcast and Community Resources. The Community Blog will have a slightly new look with 3 tiles at the top of the page. Events and User Groups will remain the same.   Once we launch, we welcome any and all feedback. We look forward to hearing what you think of the new updates. And, thanks

This third quarter of 2024, Google Security Operations focused on fueling efficiency and collaboration for our customers. We’ve rolled out a host of key enhancements including: Threat profile sharing Private collection sharing New curated detections IDE staging A single YL2 language 34 new YARA-L2.0 functions (Preview) Data export from Google SecOps to BigQuery

With a busy end of September you may have missed this exciting announcement - Google named a Leader in the IDC MarketScape: Worldwide SIEM for Enterprise 2024 Vendor Assessment! We believe this recognition is a reflection of our significant investments in Google Security Operations over the past three years. Our efforts include the acquisition and integration of Mandiant, the world’s leading threat intelligence and incident response provider, and Siemplify, a leading security

What’s New in Google SecOps today? Introducing the SecOps product release digest, designed to keep you informed about the latest advancements in Google Security Operations (formerly Chronicle). Discover the latest SecOps product features and how they can empower your team.______________________________________________________________________________________________________________ Gemini AI Playbook Assistant (Public Preview)Gemini AI Playbook Assistant can help you streamline the process of creating playbooks by turning your prompts into a functional playbook that helps resolve security issues. Users can leverage Gemini to build and configure playbooks, or ask Gemini to suggest flows to cover specific use cases leveraging industry standard approaches.

Mandiant Managed Defense, our 24/7 managed detection and response (MDR) service, is now generally available for Google Security Operations (SecOps) customers in the US. Managed Defense now uses built-in curated detections and risk scores from Google Security Operations for comprehensive, up-to-the-minute threat coverage, automated threat identification, and faster threat identification. These capabilities allow our experts to prioritize rapid investigation and incident remediation. Our proactive approach is continuously enriched with insights from Managed Defense's own threat hunts, protecting our customers against the latest attack techniques. Managed Defense supports native Google SecOps features designed to identify potential compromise and seamlessly integrates with your existing security tools, offering flexibility and choice. Managed Defense for Google SecOps supports Crowdstrike Falcon Insight XDR, Microsoft Defender for Endpoint, and SentinelOne Singu

Hi community members,Are you a Google Security Operations customer? If so, we would sincerely appreciate it if you took a few minutes to share your positive experiences with the platform on Gartner Peer Insights. By leaving us a review, you can help other security technology buyers make informed decisions, and as a thank you, Gartner will send you a $25 gift card. Anyone on your team can complete the review as it is not limited to 1 person per company, so please invite your team to participate! All reviews are verified and posted anonymously.Write a review for Google SecOps SIEM: goo.gle/GoogleSecOpsSIEM Write a review for Google SecOps SOAR: goo.gle/GoogleSecOpsSOARThank you for your support!Ahnna

Building on the strong product momentum of Google Security Operations in the first quarter of 2024, our second quarter brought a host of significant enhancements focused on providing customers with an advanced AI and intel-driven experience. But we didn’t stop there. We also introduced a number of improvements to everyday processes, prioritizing the ease of use and efficiency of Google SecOps. To access a list of our Q2 additions to Google Security Operations, visit this blog. To find a comprehensive list of recent Google Security Operations Release Notes/Changes, go

We're excited to introduce a game-changing feature within the Google Security Operations platform: IDE Staging. 👋 Say goodbye to the fear of pushing an integration update live, only to discover it disrupted your existing playbooks and connectors. With IDE Staging, you can now thoroughly test your integrations in a safe, isolated environment before they hit production. Key Benefits of IDE Staging: Risk-Free Testing: Upgrade integrations, test them in a secure staging environment, and then confidently push them to production, replacing existing integrations without disrupting operations. Enhanced Confidence: Validate changes and gain full visibility into how updates will behave in your production environm

We are thrilled to announce the addition of two new data regions for Google Security Operations: Italy and Qatar. This brings our total number of EMEA data regions for Google SecOps to 10, demonstrating our ongoing commitment to protecting customer data and privacy. Since the start of 2024, we have added five new data regions, including Japan, Canada, India, and now Qatar and Italy. Our expansion highlights Google Cloud's dedication to delivering top-notch security solutions across the globe. One Italian customer, Telepass, is already benefiting from Google Security Operations, using it as their single point of truth for security, greatly simplifying their analysts' tasks. Another EMEA

As we forged into the first quarter of 2024, Google Security Operations (formerly Chronicle) unveiled a series of updates centered around streamlining operations for our customers. We understand the challenges faced by security operations teams dealing with time-consuming and intricate processes. That’s why we’re excited to introduce enhancements that simplify workflows and enhance efficiency. To access a list of our Q1 additions to Google Security Operations, visit this blog. To find a comprehensive list of recent Google Security Operations Release Notes/Changes, go

Today we introduced a host of new innovations in Google Security Operations (formerly known as Chronicle) designed to make everyone in the SOC more productive from security analysts, to security engineers, to managers.  You might have also noticed we announced that Chronicle is now Google Security Operations. The name may have changed, but our focus on providing a unified, AI and intelligence-driven platform that modernizes threat detection, investigation, and response (TDIR) has not! Read the blog to learn more about what's new in Google Security Operations. Or come meet us in person at our RSA Conference booth