What’s New in Google SecOps for the interval August 24th through August 31st, 2026.
Highlights
🤖 Your chance to start building AI agents from the absolute basics
-
A 5-week live series called “Agent Valley” designed to teach anyone how to build production agent systems.
✈️ Ingesting Flight Data into Google SecOps with Bindplane’s REST API Source
-
Leveraging the native Bindplane REST API and processors instead of a Cloud Function to ingest flight data (from Mike)
🚀 Bringing Your Own Agents into SecOps SOAR Playbooks with Google ADK
-
Using the Google Agent Development Kit (ADK) to integrate non-deterministic agents with Gemini Enterprise (from Chris Martin (@thatsiemguy))
🤔 SIEM: Centralize Like You Mean It, Federate Like You Have To
-
Excellent architectural advice on treating centralization as the default for critical detections and knowing when to federate (from Anton Chuvakin)
🧙 Inside 90 days of attacks on AI infrastructure
-
An analysis of active honeypots showcasing active threat campaigns targeting AI infrastructure via RCE, prompt injection, and credential theft from the Wiz Blog
Product Updates & New Features
Google SecOps
🚀 Release Notes from Google Cloud Docs
-
Google Cloud’s Chronicle has released new Mandiant Frontline Threats rule packs for Curated Detections, enhancing threat detection across Linux, MacOS, and Google Cloud environments. [Read More]
Note, Curated Detections does not provide proactive notifications of new content, and you will have to go and explicitly enable new Rule Sets.
New Mandiant Frontline Threats Curated Rules
-
Google SecOps has launched a new ‘Operations’ feature in its Emerging Threats Center, offering granular, single-organization threat intelligence derived from frontline investigations. [Read More]
Afaik, this is like a smaller version of a Campaign
What is an Operation?
-
Google Cloud Chronicle’s SOAR database and infrastructure are scheduled for maintenance on August 30, causing a brief system downtime but requiring no user action. [Read More]
-
Google SecOps has released the Unroll processor, a new feature for data processing pipelines that enhances log ingestion by automatically splitting log arrays into discrete log events. [Read More]
If you’ve had log sources sending data as a List of Dictionaries (e.g., like some Palo Alto log sources do), this processor is what you need; it allows you to split each JSON log into a unique log prior to the CBN processor running.
Google Threat Intelligence
🚀 Release Notes from gtidocs.readme.io
-
The August 26th release introduces Google Insights, a new feature that provides security teams with real-world telemetry and global prevalence data to better assess active threats. It also delivers powerful Agentic AI upgrades to streamline workflows, including automated Sigma rule translation and interactive URL screenshot analysis . Finally, the update bolsters defenses with expanded configuration extractors and new YARA rules covering over 25 newly tracked malware families. [Read More]
Google Cloud & AI
✍️ Using OKF with Knowledge Catalog to serve context for agents from Google Cloud Blog
-
The article discusses the ongoing development of the Open Knowledge Format (OKF), an open specification used with Knowledge Catalog to provide context for agents and improve data sharing. [Read More]
🔥✍️ Your chance to start building AI agents from the absolute basics from Google Cloud Blog
-
The article introduces “Agent Valley,” a new resource designed to help anyone, regardless of their technical background, learn how to build AI agents through hands-on experience. [Read More]
Learn to build agents in a 5 day course from Google DevRel Engineers
👾✍️ Decoding cosmic signals with deep learning and Keras from Google Developer Blog
-
The article discusses the application of deep learning and Keras to decode cosmic signals, specifically within the exciting field of astroparticle physics. [Read More]
This isn’t related to Google SecOps, but if you’re interested in Astronomy and some non-generative-AI machine learning, then this read on keras is very interesting.
Adoption Guides & Deep Dives
✍️ Enriched URL Reports: Powered by Full Browser Execution from Google Cloud Security Community
-
The article introduces Enriched URL Reports, powered by full browser execution, as a new feature within Google Threat Intelligence. This development is part of a broader shift towards intelligent, proactive cybersecurity defense leveraging Agentic AI workflows, which has recently launched in General Availability. [Read More]
Community & Events
✍️ Lifecycle of a SOAR Automation from Google Cloud Security Community
-
The article from Dmitry Kosarev (Admiral Group) covers the lifecycle of SOAR automation, detailing how to identify, build, and maintain automations to streamline repetitive and laborious IT security tasks. [Read More]
This is a good read on the process needed for life cycle of managing SOAR Playbooks in an Enterprise.
✍️ Webinar Alert on 09/09- How to navigate the Post-Quantum Cryptography Shift from Google Cloud Security Community
-
This article announces a webinar focused on navigating the shift to post-quantum cryptography, highlighting its current status as a strict regulatory and procurement requirement due to recent executive orders and CISA standardization. [Read More]
✍️ Unwrapping Kubernetes Logs in Google SecOps: A Jenkins Case Study from Google Cloud Security Community
-
The article discusses the challenge of ‘log wrapping’ in Kubernetes when ingesting application logs into Google SecOps, and how this architectural shift impacts Security Operations, using Jenkins as a case study. [Read More]
This is a good community blog post on the end to end setup of getting Jenkins logs into SecOps.
3rd Party Blogs
🔥 ✍️ Ingesting Flight Data into Google SecOps with Bindplane’s REST API Source from Mike
-
The article details the process of ingesting flight data into Google SecOps, utilizing Bindplane’s REST API as the data source. [Read More]
This is a great read from Mike on replacing a Cloud Function with the native Bindplane REST API and Processors.
🔥✍️ Bringing Your Own Agents into SecOps SOAR Playbooks with Google ADK from Chris Martin (@thatsiemguy)
-
The article discusses the integration of custom agents into Security Operations (SecOps) SOAR playbooks using the Google Agent Development Kit (ADK). [Read More]
I’m a big fan of Google ADK, and use it frequently. This post demonstrates how to add non-deterministic Agents into SOAR Playbooks, and integration with Gemini Enterprise.
🔥️ ✍️ SIEM: Centralize Like You Mean It, Federate Like You Have To from Anton Chuvakin
-
The article discusses architectural strategies for Security Information and Event Management (SIEM) systems, emphasizing the importance of centralization while acknowledging the necessity of federation in certain contexts. [Read More]
This is a great read providing guidance on treating centralization as the default for critical detections, and the logic for when to federate.
✍️ Stop Building a 2003 SOC with AI: Local Context, Failure Modes and Your Path (Part 3) from Anton Chuvakin
-
The article critiques current Security Operations Center (SOC) practices, urging modernization with AI while emphasizing local context and understanding AI’s failure modes. [Read More]
Podcasts & YouTube
▶️ From Exploit to Code Fix in Minutes: Google SecOps + CodeMender Self-Healing Security from YouTube
-
The video describes Google SecOps and CodeMender’s rapid, self-healing security system that can fix exploits in minutes. [Watch]
Wiz
✍️🔥 Inside 90 days of attacks on AI infrastructure from Wiz Blog
-
Wiz honeypots detected a 90-day period of active attack campaigns targeting AI infrastructure, including LiteLLM, MCP servers, and other AI frameworks, through methods like RCE, blind prompt injection, and credential theft.[Read More]
✍️ From Concept to Context Engine: How Wiz Built AI-Powered Data Discovery from Wiz Blog
-
Wiz details its process of developing an AI-powered data discovery “context engine” from a “bucket scanner” using a multi-agent pipeline and feedback loops. [Read More]
✍️🔥 Version Control DFIR: a Cheatsheet to GitHub, GitLab, Bitbucket, and Azure DevOps from Wiz Blog
-
This article provides a practitioner’s guide and cheatsheet for Digital Forensics and Incident Response (DFIR) across major version control services like GitHub, GitLab, Bitbucket, and Azure DevOps, focusing on log visibility, incident readiness, and threat hunting. [Read More]
✍ The State of Cloud Risk 2026: Most Security Findings Aren’t Real Attacker Opportunities from Wiz Blog
-
A Wiz Research report on cloud risk for 2026 reveals that the majority of high-severity cloud security findings do not represent genuine attacker opportunities or a path to compromise. [Read More]
Platform Issues
⚠️ ONGOING: Investigating issues with saving rules in Google SecOps Unified Rules Public Preview Web UI from Google Cloud Status
-
Google SecOps is investigating an issue preventing users from saving rules in the Unified Rules Public Preview Web UI, with engineers actively working on a mitigation. [Read More]
✅ RESOLVED: We are experiencing an issue with Google SecOps Legacy Looker Based Dashboards where queries are failing in the europe-west9 region from Google Cloud Status
-
Google SecOps Legacy Looker Based Dashboards are experiencing an issue with failing queries in the europe-west9 region. [Read More]
