What’s New in Google SecOps for the interval August 17th through August 24th 2026.
What’s New in Google SecOps, August 23rd 2026
Highlights
This week there was simply too much content for me to read and watch all of it before the F1 started 😅
-
🤖 The SecOps Detection Engineering Agent (DEA) is now in private preview
-
🪵 Bindplane have released beneficial updates for Google SecOps, like CEF parsing and SecOps pipeline templates
-
✍️ Tons of great SecOps Community Content such as How to investigate SecOps SIEM Audit Logs, Exploring Agent Graphs for SecOps AI Runbooks, as well as several webinar recordings
Product Updates & New Features
Google SecOps
🚀 SecOps Release Notes from Google Cloud Docs
-
Google SecOps has introduced a new public preview feature allowing more precise relative time filtering with ‘Past’, ‘Previous’, and ‘Current’ operators, eliminating ambiguity in data range calculations. [Read More]
-
Google Cloud Chronicle’s Investigation Management now includes a new ‘Side-by-side view’ feature, currently in public preview, on the Alerts & Detections tab to enhance the inspection of alert metadata. [Read More]
This is a good addition to the Case 2 preview which provides parity to that of Case 1, i.e., no additional mouse clicks and tabs needed anymore.
New Vertical Alerts & Detections view in Case 2
-
Google SecOps has launched the AI-powered Detection Engineering Agent in public preview, which helps evaluate threat coverage, extract intelligence, and automatically draft YARA-L detection rules to strengthen security posture. [Read More]
The latest Google SecOps Agent, the Detection Engineering Agent (DEA) is in private preview. I find this is more a Detection Coverage Agent at present, but I plan to write up a separate blog on this in the near future.
The DEA Workflow
✍️ Going with the Flow(s): Distinct Clusters Target Individuals of Interest to Russia from Google Cloud Blog
-
Google Threat Intelligence Group is tracking three distinct Russian cyber espionage clusters that abuse legitimate authentication flows to target individuals in academia, aerospace, defense, and government sectors. [Read More]
✍️ Staying Ahead of Adversarial AI Through Agentic Source Code Review from Google Cloud Blog
-
The article discusses the application of agentic source code review as a strategy to defend against and stay ahead of adversarial AI threats. [Read More]
BindPlane
✍️ August 2026 at Bindplane: Full-Pipeline Blueprints and Scoped API keys from Bindplane.com
-
Bindplane has released Full-Pipeline Blueprints, allowing for complete end-to-end data pipeline setup, and introduced Scoped API Keys to preview. [Read More]
We also added two new parser functions to the transform processor, one for CEF and one for Extended Log Format, that turn those security formats into structured JSON. They follow the same upstream-first approach as the LEEF parser from earlier, so the transform processor’s parser family now covers most of the common security log shapes.
Bindplane August Community Call
✍️ Full-Pipeline Blueprints Are Here: Source, Processors, and Destination in One Click from Bindplane.com
-
BindPlane has launched Full-Pipeline Blueprints, which simplify data pipeline creation by providing a complete solution including source, processors, and destination in a single click, moving beyond previous processor-only bundles. [Read More]
Standardize & Route Windows Events for Google SecOps standardizes Windows Events for SecOps, then routes each channel — SYSMON, POWERSHELL, DNS, MSSQL, WINEVTLOG — through its own batch processor, so batches stay homogeneous per SecOps log type.
Example of Bindplane blueprint for Google SecOps
Google Cloud & AI
✍️ Cloud CISO Perspectives: Sticking to security fundamentals in the AI era from Google Cloud Blog
-
This Cloud CISO Perspectives introduces Chris Betz’s insights on why adhering to security fundamentals is more critical than ever in the age of AI. [Read More]
✍️ Build zero-trust AI agents with Google’s Agent Development Kit from Google Cloud Blog
-
Google’s Agent Development Kit (ADK) emphasizes building autonomous AI agents with a robust zero-trust architecture, implementing hardware-backed cryptographic signatures, kernel-level sandboxing, and deterministic semantic gateways to prevent prompt injections and malicious execution. [Read More]
✍️ Google is a Leader in the 2026 Gartner® Magic Quadrant™ for Cloud-Native Application Platforms from Google Cloud Blog
-
Google has been recognized as a Leader for the third consecutive year in the 2026 Gartner Magic Quadrant for Cloud-Native Application Platforms. [Read More]
✍️ How agents can delegate better from Google Cloud Blog
-
The Google Cloud article discusses the importance of effective delegation, a key leadership skill, and explores how these principles can be applied to AI agents for better task management [Read More]
✍️ Expanding Google Antigravity for enterprise customers from Google Cloud Blog
-
Google is expanding its Antigravity platform for enterprise customers, incorporating feedback to improve developer access, security controls, license management, and pooled usage. [Read More]
Adoption Guides & Deep Dives
✍🔥️ Adoption Guide: How to investigate SecOps SIEM Audit Logs from Google Cloud Security Community
-
This adoption guide explains how to investigate audit logs within Google SecOps SIEM, emphasizing the critical role of comprehensive, properly configured audit logging for complete visibility and recording system changes. [Read More]
✍🔥️ Exploring Agent Graphs for SecOps AI Runbooks from Google Cloud Security Community
-
The article from Dan Dye explores the application of Agent Graphs from the Google ADK project to create more rigorous, deterministic, and explainable AI-powered workflows for Security Operations (SecOps) runbooks. [Read More]
✍️ Building Custom Anomaly Detection Models with Google SecOps and BigQuery ML: Prediction Model (Part 1) from Google Cloud Security Community
-
This article, part one of a series, introduces building custom anomaly detection prediction models using Google SecOps and BigQuery ML, noting the need for specialized models beyond standard AI features in certain SOC environments. [Read More]
✍️ Beyond Chat: Building Multi Agent SOC Ecosystems with Claude and Google MCP from Google Cloud Security Community
-
The article discusses the shift of adversaries operationalizing AI for adaptive malware and proposes building multi-agent SOC ecosystems using Claude and Google MCP to enhance enterprise security against these advanced threats. [Read More]
Community & Events
📢 Webinar 9/30: CodeMender: AI Code Security Agent from Google Cloud Security Community
-
The article announces a webinar discussing CodeMender, an AI Code Security Agent designed to autonomously find and fix vulnerabilities in codebases, leveraging AI for defensive security. [Read More]
📢 📹 Meet SecOps: Your Agentic SOC from Google Cloud Security Community
-
This webinar discusses how Google SecOps is leveraging generative AI and autonomous agentic workflows to transform the modern Security Operations Center (SOC), enabling faster detection and response against rapidly escalating cyber threats. [Read More]
Meet SecOps: Your Agentic SOC
📢 📹 From Blocks to Bots: Scaling SecOps with Modular Playbooks and Agentic Automation from Google Cloud Security Community
-
This webinar details how to design and deploy robust, self-healing modular playbooks in Google SecOps using Foundational Blocks and the Centaur Model, addressing complexities of monolithic designs with agentic automation. [Read More]
Scaling SecOps with Modular Playbooks & Agentic Automation
✍️ Tuesday’s Tip of the Week — Data Tables: Allow-Lists, Block-Lists, and Enrichment in Your Rules from Google Cloud Security Community
-
This article introduces data tables in Google SecOps as structured lookup tables for implementing allow-lists, block-lists, and enriching security rules using YARA-L syntax. [Read More]
🔥✍️ New stats hunting skill from Google Cloud Security Community
-
A new community ‘Stats Hunter’ skill from Greg Kushmerek has been developed for the SecOps platform to simplify mathematical analytics, guiding users in statistical YARA-L searches and noise threshold management. [Read More]
✍️ How We Built an Agentic Purple-Team System for Detection Validation in Google SecOps from Google Cloud Security Community
-
A community developed an agentic purple-team system for automated detection validation in Google SecOps, which creates synthetic telemetry, validates it, and tracks its path through the security system. [Read More]
GitHub - GHS-SOC/PurpleTeam-Agent: This repository demonstrates how to build an Agentic Purple Team…
3rd Party Blogs
✍️ The Feynman Bet: Why You Still Won’t Vibe Code Your SIEM (Today) from Anton Chuvakin
-
The article critically examines why highly intuitive or AI-driven “vibe coding” is not yet a practical solution for managing complex Security Information and Event Management (SIEM) systems. [Read More]
✍️ So Is Your SOC AI-Ready? Part 3: API or Die Audit! from Anton Chuvakin
-
The article is the third installment in a series evaluating the AI-readiness of Security Operations Centers (SOCs), specifically highlighting the critical importance of API audits. [Read More]
✍️ What Belongs Inside the Company AI Operating System? from raffy.ch
-
The article explores what constitutes an “AI operating system layer” within a company, arguing that true AI maturity is about how AI transforms company operations rather than just the number of AI tools [Read More]
✍️ AI Maturity Is Not About Tool Count from raffy.ch
-
The article asserts that true AI maturity within a company is not measured by the number of deployed tools or users, but by its deeper integration as an operating system layer. [Read More]
Podcasts & YouTube
▶️ Governing the Autonomous SOC: Securing AI Agents End-to-End on Google’s Agent Platform from YouTube
-
The video focuses on the governance and end-to-end security of AI agents within an autonomous Security Operations Center (SOC) operating on Google’s agent platform
Securing AI Agents End-to-End on Google’s Agent Platform
▶️ Vibe Coding Google SecOps Parsers with Gemini from YouTube
-
This content features a coding session demonstrating the development of Google SecOps parsers, utilizing Google’s Gemini AI for assistance.
Vibe Coding Google SecOps Parsers with Gemini
▶️ Prompt Injection to Playbook: Detecting Compromised AI Agents in Google Cloud from YouTube
-
The article discusses methods for detecting compromised AI agents, specifically those affected by prompt injection, within Google Cloud environments.
Detecting Compromised AI Agents
▶️ Mastering the Art of Advanced IOC Searches in Google Threat Intelligence from YouTube
-
This content focuses on mastering advanced Indicator of Compromise (IOC) searches within Google Threat Intelligence.
Mastering IOC Searches in Google TI
Wiz
✍️ Rust Supply Chain Attack on arrayref: Significant Overlap with DPRK Campaigns from Wiz Blog
-
Malicious versions of the arrayref Rust crate executed a backdoor at compile time, part of a supply chain attack whose infrastructure significantly overlaps with recent DPRK-linked campaigns. [Read More]
✍️ Wiz Penetration Test Findings is now GA from Wiz Blog
-
Wiz has announced the General Availability of its “Penetration Test Findings” feature, which unifies pen-test results with real-time cloud context for continuous exposure management. [Read More]
✍️ How to Spot and Stop Rogue Device Joins from Wiz Blog
-
This article explores how adversaries are using realistic device names to abuse Entra ID device registration, making detection more challenging, and details behavioral signals to identify and stop these attacks. [Read More]
✍️ Wiz Red Agent Finds Its Way Into Snowflake’s Internal Jira Due to an AI-Generated GitHub Copilot “Autofix” from Wiz Blog
-
Wiz Red Agent independently discovered and exploited a GitHub Actions vulnerability, introduced by an AI-generated GitHub Copilot ‘Autofix,’ gaining access to sensitive data in Snowflake’s internal Jira without human intervention. [Read More]
✍️ The Closed Loop Remediation Playbook with Wiz from Wiz Blog
-
Wiz has launched new capabilities, including Workflows (GA) and Remediation and Response (public preview), to help organizations achieve a self-healing cloud through automated security remediation. [Read More]
Platform Issues
✅ RESOLVED: We are investigating a potential issue with Google SecOps in the US region from Google Cloud Status
-
Google is investigating an issue with elevated latencies on “Dashboards & Reports” within Google SecOps in the US region, affecting UDM Events dashboards. [Read More]
