What’s New in Google SecOps for the interval August 10th through August 17th, 2026.
What’s New in Google SecOps, August 17th 2026
Highlights
- 🚀 Google TI has released into preview Agentic Flows including API Support
- ✍ A new post from John Stoner on creating Drill Downs in SecOps Native Dashboards
- 🚧 A scheduled maintenance window for SOAR on August 16, 2026
- ✍️ Two great blogs from Anton Chuvakin on why 2003 Problems Look So Familiar in 2026 and why Triage Must Die (Part 2)
Product Updates & New Features
🚀 SecOps Release Notes from Google Cloud Docs
- Google Cloud Chronicle’s Health Hub now includes new tables and a Data Health Deep Dive page for monitoring data ingestion latency at both source and log-type levels. [Read More]
Native Log Source Latency Analysis in the Health Hub Dashboards
This is a topic I’ve written on and created solutions for in the past, and so it’s great to see it part of the product proper now.
Monitor health of data sources | Google Security Operations | Google Cloud Documentation
- Google SecOps has launched a new public preview feature, ‘Analyze feed activity with Cloud Logging,’ enabling users to monitor, debug, and troubleshoot ingestion pipelines and feeds to diagnose log delivery issues. [Read More]
Debug Feed Management with Cloud Logging
Note, this feature requires Google Cloud Platform access. If you use WIF as your primary auth mechanism it will likely need a secondary WIF auth setup for GCP console access, or you’ll need to enable Google Auth to the GCP Project.
Analyze feed activity with Cloud Logging | Google Security Operations | Google Cloud Documentation
-
🚧 Scheduled maintenance for the SOAR database and infrastructure is planned for August 16, 2026, which will cause a brief period of system downtime. [Read More]
Google SecOps
📝 Updated Docs :Agentic SOC > Security Tokens from Google Cloud Docs
-
The key change is a delay in the start date for the consumption of purchased Google SecOps Security Tokens. Previously, the consumption was set to begin on July 1, 2026. This has been changed to September 1, 2026.
SecOps SIEM
📝 Updated Docs: Ingestion > Analyze Feed Activity With Cloud Logging from Google Cloud Docs
-
Bring Your Own Project (BYOP) Requirement: An “Important” note has been added stating that analyzing feed activity with Cloud Logging is only supported for Google SecOps instances configured with a Bring Your Own Project (BYOP) Google Cloud project. If not configured with BYOP, this feature is unavailable.
-
Log Router Exclusion Filters: A new section titled “Exclude specific logs using Log Router” has been introduced. This section provides instructions on how to configure exclusion filters in a Google Cloud project’s Log Router to stop receiving specific feed activity logs (e.g., for a particular feed ID or all Storage Transfer Service (STS) logs).
-
Clarification on STS Log Disablement: The new “Exclude specific logs” section clarifies that while Google SecOps can disable all feed activity logging via a support case, Storage Transfer Service (STS) logs are a special case and cannot be disabled by Google SecOps; they must be excluded using the Log Router exclusion filter method.
📝 Updated Docs: Investigation > Statistics Aggregations In UDM Search from Google Cloud Search
-
The maximum number of results returned by statistical queries has been increased from 10,000 to 100,000.
-
This updated limitation now explicitly states it applies to UI and long-running operation API only.
The recent Asynchronous API update also will provide quota updates to 1,000 QPH for the Web UI and 2,000 QPH for programmatic API access. Additionally, concurrency limits now allow up to 360 concurrent queries per tenant.
Google Threat Intelligence
🔥 🚀 Agentic Flows & API, and Threat Actor Naming Updates from gtidocs.readme.io
-
Google TI Flows is a scheduled orchestration engine that automates recurring investigations by executing natural language prompts (with optional email delivery) and advanced saved searches (delivered to your IoC Stream) on a schedule.[Read More]
Create scheduled investigations with Natural Language with Google TI Flows
-
The Agentic API is now live in Public Preview for Enterprise, Enterprise Plus, and Integration Advanced users. It provides programmatic REST API access to specialized AI threat intelligence agents, shifting threat intelligence from manual lookups to continuous, autonomous AI-driven defense. [Read More]
-
We are rolling out a new, unified threat actor naming schema to standardize tracking across all systems and make our threat intelligence more intuitive and actionable. As the threat landscape expands, relying on sequential numbers (e.g., APT44, FIN11) has become an exercise in memorization rather than intuition. [Read More]
Updated Threat Actor naming in Google TI
BindPlane
⚙️ v1.106.0 from GitHub
-
This article announces version 1.106.0 of the bindplane-otel-collector, introducing a new feature to check for RetryAfterNanoseconds in opamp error responses. [Read More]
Google Cloud & AI
🔥✍️📊 Bring your spreadsheet data to life with Sheets canvas from Google Cloud Blog
-
Google has introduced Sheets canvas, a new feature built with Gemini that allows users to transform their spreadsheet data into interactive mini-apps using simple natural language prompts. This dynamic layer requires no coding and stays perfectly in sync with your original spreadsheet data in real time. It makes it easy to build custom visual layouts — like study trackers or seating charts — that can be shared with collaborators just like a regular sheet. [Read More]
✍️ PQC in Plaintext: Google Cloud’s post-quantum cryptography roadmap from Google Cloud Blog
-
Google Cloud outlines its decade-long commitment and roadmap for post-quantum cryptography (PQC), detailing its internal rollout across infrastructure and contributions to advancing open standards for future security. [Read More]
✍️ 🎉 Google named a Leader in The Forrester Wave™: AI Platforms, Q3 2026 from Google Cloud Blog
-
Google Cloud has been recognized as a Leader in The Forrester Wave™: AI Platforms, Q3 2026, for its comprehensive and integrated AI platform, including Gemini Enterprise, which helps organizations build and operationalize complex AI workflows. [Read More]
✍️ 🤖 Mastering Edge AI on Raspberry Pi with LiteRT and Gemma from Google Developer Blog
-
The article details how LiteRT and lightweight Gemma open models simplify deploying secure, real-time Edge AI on Raspberry Pi, optimizing CPU/GPU performance for fast token speeds and enabling local reasoning for robotics. [Read More]
Adoption Guides & Deep Dives
🔥 ✍️ New to Google SecOps: Drilling Down the House from Google Cloud Security Community
-
The article demonstrates how to build dashboards and metrics using case datasets and drilldowns in Google Security Operations (SecOps), providing a practical guide and a shareable JSON dashboard configuration. [Read More]
Community & Events
✍️ Announcing Public Preview of the Google Security Operations Threat Hunt Agent from Google Cloud Security Community
-
Google has announced the public preview of its Security Operations Threat Hunt Agent, designed to simplify and automate proactive threat hunting for SOCs, which is typically a complex and manual task. [Read More]
✍️ Exabeam + Google SecOps from Google Cloud Security Community
-
Exabeam has extended its behavioral analytics and workflow automation to Google Security Operations, providing security teams with deeper visibility into insider threats across human and AI identities, while reducing cost and complexity. [Read More]
Note, this appears to be a SOAR Integration from what I can tell.
✍️ Tuesday Tip of the Week — Chaining Events: Detect Attack Sequences, Not Isolated Actions from Google Cloud Security Community
-
This article from Google Cloud Community’s “Tuesday Tip of the Week” emphasizes the importance of using multi-event rules and YARA-L in security operations to detect attack sequences by correlating different event types, rather than focusing on isolated actions. [Read More]
3rd Party Blogs
🔥 ✍️ The Ancient Art of SIEM: Why 2003 Problems Look So Familiar in 2026 from Anton Chuvakin
-
The article critically examines the persistent challenges within Security Information and Event Management (SIEM), noting how problems from 2003 continue to be relevant in 2026. [Read More]
🔥 ✍️ Stop Building a 2003 SOC with AI: Triage Must Die (Part 2) from Anton Chuvakin
-
The article critically examines the current state of Security Operations Centers, arguing against building outdated SOCs with AI and advocating for the elimination of traditional triage methods. [Read More]
Podcasts & YouTube
-
The Power of Multi-Agent AI: Why a single model is not enough, and how specialized agents (Threat Modeling, Hunting, Triage, and Adversarial Debate) collaborate like a human team.
-
GitHub RCE & CosmosDB Cross Tenant Access: A breakdown of the record-breaking bounty for the GitHub RCE report and the Azure CosmosDB master key vulnerability discovered by Atlas.
-
Humans vs. AI: Whether vulnerability researchers are becoming “buggy whip manufacturers” or if human insight, instinct, and the smell of danger remain irreplaceable.
Wiz
✍️ Wiz on Wiz: How the Wiz FinOps Team Uses Wiz Cloud Cost from Wiz Blog
-
The article details how Wiz’s internal FinOps team utilizes Wiz Cloud Cost to power their cloud cost investigation and optimization efforts [Read More]
✍️ Securing Data in the AI era from Wiz Blog
-
The article addresses the evolving landscape of data risk due to AI, highlighting the crucial need to understand data connectivity and exposure for effective security. [Read More]
✍ ️How to Investigate GitHub PAT Compromise: Lessons From a Multi-Organization Campaign from Wiz Blog
-
The article provides a practical playbook for investigating GitHub Personal Access Token (PAT) compromises, drawing lessons from Wiz CIRT’s response to a multi-organization campaign. [Read More]
✍️ Closing the Blind Spot: Securing Personal Repositories in the Software Supply Chain from Wiz Blog
-
The article highlights the security risk posed by personal repositories in the software supply chain, where corporate secrets can escape, and introduces Wiz’s solution to identify, validate, and fix these vulnerabilities. [Read More]
SecOps Platform Issues
✅ RESOLVED: Google SecOps customers are experiencing ingestion failure with the 3P Proofpoint API in all regions from Google Cloud Status
-
Google SecOps customers are experiencing an ingestion failure with the 3P Proofpoint API across all regions, which began on August 14, 2026, at 05:04 PDT. [Read More]
✅ RESOLVED: Google SecOps customers in the us multi-region may experience delays in Legacy BigQuery Export Jobs from Google Cloud Status
-
Google SecOps customers in the US multi-region are experiencing intermittent delays and failures in Legacy BigQuery Export Jobs, which began on 2026–08–11 at 08:00 PDT. [Read More]
✅ RESOLVED: We are investigating an issue with High Search Query Response Latencies in the US Region from Google Cloud Status
-
Google is investigating an issue with high search query response latencies in the US Region, affecting Google SecOps, which began on 2026–08–12 at 12:14 US/Pacific. [Read More]
✅ RESOLVED: Some Google SecOps customers in the US multiregion may experience delays with data normalization and detections from Google Cloud Status
-
Google SecOps customers in the US multiregion are experiencing delays with data normalization and detections due to an ongoing issue. [Read More]
✅ RESOLVED: Mandiant Managed Defense customers may experience elevated errors when logging in from Google Cloud Status
-
Mandiant Managed Defense customers experienced elevated login errors, but the issue has since been fully resolved for all affected users [Read More]
