What’s New in Google SecOps for the interval Sep 30th through Sep 7th, 2026.
What’s new in Google SecOps, 6th Sept 2026
Highlights
🚀 New SecOps features: Case level playbooks, Reaction Triggers, and Scheduled YARA-L Rules
🤖 A great blog from Greg Kushmerek on Building AI-driven UEBA for Google SecOps
Product Updates & New Features
Google SecOps
🚀 Release Notes from Google Cloud Docs
-
🔥 SOAR: New Feature > Case playbooks. This feature is in preview. Google SecOps now supports case playbooks. You can run playbooks or execute manual actions across an entire case container rather than individual alerts, consolidating response tasks and reducing redundant operations during investigations. [Read More]
Case playbooks overview | Google Security Operations | Google Cloud Documentation
-
🔥 SOAR: New Feature > Reaction triggers. This feature is in preview. Google SecOps now supports reaction triggers. As post-ingestion triggers, they allow playbooks to automatically fire in response to real-time case or alert updates during active investigations, such as changes to the case assignee, case tags, alert priority, or newly added entities. [Read More]
Use reaction triggers in playbooks | Google Security Operations | Google Cloud Documentation
-
SIEM: New Feature > Self-service Bindplane Enterprise license download. This feature is currently in Preview for Google Security Operations tenants in the US and EU regions. Google Security Operations Enterprise Plus and Google Unified Security (GUS) customers can now download their Bindplane Enterprise (Google Edition) license key directly from the platform console under SIEM Settings > Collection Agents. [Read More]
Deploy the Bindplane agent for collection | Google Security Operations | Google Cloud Documentation
-
🔥 SIEM: New Feature > Customizable schedules for multi-event rules general availability
-
The customizable schedules for multi-event rules feature is now in General Availability (GA). Customizable schedules give security teams granular control and transparency over how multi-event rules execute in Google SecOps, and provide the following capabilities:
- Configure settlement delays: Set first-run delay offsets (from 1 minute up to 48 hours) to account for log ingestion latency and reduce false negatives.
- Leverage automated true-up runs: Automatically re-evaluate time windows at 4 hours (and optionally 30 hours for full context enrichment) to capture late-arriving logs.
- Migrate legacy rules: Upgrade existing custom multi-event rules to customizable schedules directly from the Rules Dashboard. -
To manage rule schedules with custom IAM roles, make sure your roles include chronicle.rules.modifyRules and chronicle.ruleDeployments.update. Predefined IAM roles include these permissions automatically. [Read More]
Note, this is dated August 31st but often the Release Notes are back-dated.
Configure customized schedules for rules | Google Security Operations | Google Cloud Documentation
The legacy YARA-L rule scheduler, and….
The new YARA-L Rule Scheduler
📝 New Docs: Secops > Secops Architecture from Google Cloud Docs
-
This document describes the Google SecOps architecture and data flows, covering ingestion, UDM normalization, YARA-L threat detection, and automated response. [Read More]
📝 New Docs: Secops > Compliance from Google Cloud Docs
-
This document outlines the supported compliance standards, data residency, and security controls for Google SecOps. Key additions include Data Residency and Boundaries (DRZ), US Public Sector and Government Compliance, Industry and Healthcare Regulations, and Security and Data Protection Controls. [Read More]
SecOps SIEM
📝 ⚠️ New Docs: Administration > Upgrade Data Feeds V2 from Google Cloud Docs
-
Cloud storage data feeds are upgrading to a new v2 connector framework, leveraging Google Cloud Storage Transfer Service (STS) for enhanced reliability, scalability, performance, and security. The legacy v1 connectors (Cloud Storage, Amazon S3, Amazon SQS, Azure Blob Storage) are being discontinued.
Key Migration Timelines:
-
October 1, 2026: End of support for v1 feeds; only best-effort support will be available.
-
March 15, 2027: Permanent deactivation of v1 connectors; feeds will cease to function.
Automatic migration services are provided, but users must take specific actions before migration to ensure success:
-
Cloud Storage: Grant new service account permissions.
-
Amazon S3: Add STS IP ranges to bucket policy if using IP allowlisting.
-
Amazon SQS: Ensure queues receive messages from a single S3 bucket and verify identical credentials.
-
Microsoft Azure: Allow STS IP ranges if using firewalls/virtual networks
-
Fix any currently failing feeds due to incorrect credentials.
📑 🤔 Updated Docs: Administration > Feed Management from Google Cloud Docs
-
A new Custom API feed source type, enabling users to ingest telemetry from third-party REST APIs using a configuration-based model. This includes comprehensive documentation on setting up Custom API feeds, defining API endpoints, authentication (Basic, OAuth 2.0, API Key), pagination, and checkpointing strategies. Two connector models are detailed: Standard API (Sequential) and List & Detail (Parent-Child). The documentation also covers key benefits, prerequisites, best practices, rate limiting guardrails, limitations, and troubleshooting guidance. Additionally, a new option to delete pending backlog data when deleting Custom API feeds was added.
Note, this is likely the public docs being updated before the feature is announced, but you will soon be able to add REST APIs natively in Feed Management.
📑 Updated Docs: Yara L > Composite Detection Rules from Google Cloud Docs
-
The method for accessing outcome variables within composite rules has been updated. Previously, outcome variables were accessed using detection.detection.outcomes["variable_name"]. The updated path requires using detection.detection.variables["variable_name"].string_val to explicitly retrieve the string value of the variable. [Read More]
📑 ⚠️ Updated Docs: Reference: Feed Management Api from Google Cloud Docs
-
The tokenEndpoint configuration for authentication has been updated. Previously, it required a full absolute URL (e.g., https://api.us-2.crowdstrike.com/oauth2/token). It now expects a relative path (e.g., oauth2/token), with the base URL being derived from the hostname configuration. Users must update existing configurations to reflect this change. [Read More]
📑 ⚠️ Updated Docs: Administration: Siem Endpoint Mapping Table from Google Cloud Docs
-
New Ingestion API Mappings: A comprehensive set of mappings for Ingestion API endpoints has been added. These new entries detail how various legacy ingestion methods (BatchCreateEntities, BatchCreateEvents, BatchCreateLogs, BatchCreateUDMEvents, BatchCreateUnstructuredLogEntries, CreateEntities, CreateUDMEvents, CreateUnstructuredLogEntries, ListLogTypes, ListSupportedLogTypes, PutLog) correspond to modern Chronicle API endpoints (e.g., entities.import, forwarders.importStatsEvents, logs.import, events.import, logTypes.list, logTypeSettings.list, logTypes.update).
-
Clarified Endpoint Removal: The Uppercase Alerts CreateCorrespondence API, previously listed in the main mapping with a N/A status, has been explicitly moved to and is now solely listed under the 'Unmapped and removed endpoints' section, reaffirming its deprecated and removed status. [Read More]
📑 Updated Docs: Detection > Ati Fusion Feed from Google Cloud Docs
-
Updated the recommended YARA-L migration syntax for transitioning from MANDIANT_FUSION_IOC to GTI_IOC. The revised syntax removes the explicit OR MANDIANT_FUSION_IOC condition and introduces a new required condition: $mandiant.graph.metadata.threat_intel.stable = true. This modification impacts how users should update their YARA-L rules to maintain accurate and uninterrupted coverage with the new GTI product name. [Read More]
📑 Updated Docs: Detection > Detection Delays from Google Cloud Docs
-
Expanded Engine Capabilities: The Streaming Engine is now explicitly stated to support windowed single-event rules and to continuously evaluate late-arriving data and retroactive enrichments.
-
Revised True-Up Timings: The expected re-evaluation time for late-arriving data has been updated from “5 to 8 hours” to “approximately 4 hours (and optionally 30 hours with enrichment completeness)”.
-
New Run Frequency: A new match_window / 10 run frequency has been introduced for multi-event rules with match windows greater than 48 hours.
-
Clarified Delay Factors: Detailed explanations for various delay factors, including specific examples for time zone discrepancies and updated Entity Context Graph (ECG) processing times.
-
Enhanced Guidance: Improved troubleshooting approaches and more specific techniques to reduce detection latency are provided. [Read More]
Note, in a similar way, Rule Execution Frequency and Run Frequency docs have been updated.
📑 Updated Docs: Detection > Set Customized Schedule from Google Cloud Docs
-
This document update reflects the general availability of customizable rule schedules by removing the pre-GA disclaimer. Key terminology has been standardized: “First run” is now “Primary run,” and “offset” is now “settlement delay,” with a formal definition added for the latter.
-
New content includes a “Common use cases” section providing practical examples, refined configuration steps for setting frequencies and settlement delays, and clearer guidance for optimizing Mean Time to Detection (MTTD).
-
Limitations have been further clarified regarding multi-event rules with match windows greater than 48 hours and the unavailability of near-real-time streaming for multi-event correlation. [Read More]
SecOps SOAR
📑 Updated Docs: SOAR: Respond > Working With Playbooks >Using Reaction Triggers In Playbooks from Google Cloud Docs
-
New Feature: Reaction Chain Limit — A new mechanism is added to configure and enforce a maximum execution depth for reaction playbooks, preventing infinite loops. This replaces previous manual advice on infinite loop prevention.
-
New Feature: Playbook Simulator for Reaction Triggers — Playbooks containing reaction triggers can now be tested and validated using a simulator, allowing users to configure simulated event parameters and observe trigger behavior (matching/non-matching events). [Read More]
📑 ⚠️ Updated Docs: Secops > Enable Soar Access from Google Cloud Docs
-
The list of minimum required permissions for a custom role has been significantly expanded. New permissions include chronicle.instances.generateSoarAuthJwt, chronicle.socRoles.get, chronicle.userNotifications.get, chronicle.userLocalizations.get, chronicle.moduleSettings.rebranding, chronicle.integrations.get, chronicle.legacySoarAdvancedReports.get, chronicle.environmentGroups.get, chronicle.moduleSettingsProperties.get, and chronicle.legacySoarUsers.get [Read More]
If you’re creating custom IAM roles these are useful IAM permissions to be aware of.
Google Cloud & AI
✍️ 🦗 Getting started with Mantis, our open-source bug finding-and-fixing harness from Google Cloud Blog
-
Google has open-sourced Mantis, an AI-powered bug finding-and-fixing harness designed to automate the discovery, triage, reproduction, and patching of software vulnerabilities, helping defenders gain an advantage against AI-discovered exploits. [Read More]
If you’re thinking, how is this different from Codemender, my understanding is this is an open source solution, whereas Codemender is the paid for commercial supported offering.
✍️ BigQuery Graph is now GA: the knowledge foundation for the agentic era from Google Cloud Blog
-
Google Cloud has announced the General Availability of BigQuery Graph, a new feature designed to connect enterprise data for complex insights and provide foundational knowledge for AI agents. This tool aims to overcome the limitations of traditional, siloed graph databases. [Read More]
✍️ 4 engineering patterns behind the strongest AI Agents Challenge submissions from Google Cloud Blog
-
The Google for Startups AI Agents Challenge revealed that the most successful multi-agent AI systems utilize foundational software engineering patterns like bidirectional MCP and async event buses, rather than relying solely on raw model power. Read More
Adoption Guides
✍️ Adoption Guide: Reliable SOC metrics, measuring the efficacy of your SOC using SECOPS from Google Cloud Security Community
-
This adoption guide from Ivan Ninichuck aims to help Security Operations Centers (SOCs) move beyond misleading vanity metrics to implement reliable measurements that accurately reflect risk reduction and SOC efficacy. [Read More]
✍️ Adoption Guide: Customizing Security and Compliance with Custom Cloud Controls from Google Cloud Security Community
-
This adoption guide from Shreja Rangarajan explains how Google Cloud’s Custom Cloud Controls within Security Command Center (SCC) allow organizations to tailor security and compliance monitoring to their unique internal policies and requirements, beyond standard built-in checks. [Read More]
Community & Events
✍️ Bindplane Integration for Google SecOps — routing, filtering and automated rehydration for IR from Google Cloud Security Community
-
This article from darrenswift details an OpenTelemetry-based Bindplane OP integration for Google SecOps, enabling optimized log routing to SecOps and Google Cloud Storage, alongside automated incident rehydration capabilities. [Read More]
✍️ Tuesday’s Tip of the Week — Signal, Not Noise: Tuning Detection Rules with Exclusions and Data Tables from Google Cloud Security Community
-
This article from dnehoda discusses the problem of overly noisy security detection rules, which generate excessive false positives and hinder threat investigation. It recommends ongoing detection tuning, utilizing exclusions and data tables, to reduce noise and improve the relevance of alerts. [Read More]
✍️ [Part#3] 📊 Google SecOps Data in BigQuery: Demystifying Advanced BigQuery Export (SIEM) vs. Legacy BigQuery (SOAR) from Google Cloud Security Community
-
This article from hzmndt, part three of a series, demystifies Google SecOps data in BigQuery by comparing Advanced BigQuery Export (SIEM) with Legacy BigQuery (SOAR), detailing the SOAR BigQuery schema for incident management and automation data. [Read More]
✍️ [Part#2] 📊 Google SecOps Data in BigQuery: Demystifying Advanced BigQuery Export (SIEM) vs. Legacy BigQuery (SOAR) from Google Cloud Security Community
-
This article from hzmndt, part of a series, explains how Google SecOps data, specifically SOAR data, is handled in BigQuery, clarifying that it’s not supported by Advanced BigQuery Export and requires access via the legacy BigQuery pipeline. [Read More]
✍️ [Part#1] 📊 Google SecOps Data in BigQuery: Demystifying Advanced BigQuery Export (SIEM) vs. Legacy BigQuery (SOAR) from Google Cloud Security Community
-
This article from hzmndt, part one of a series, demystifies the architectural distinctions between Advanced BigQuery Export (SIEM) and Legacy BigQuery (SOAR) for accessing Google Security Operations data, crucial for maturing SOC teams. [Read More]
✍️ Demystifying Google SecOps SOAR Connector Routing: How Environments, Aliases, and the “Default Environment” Actually Work from Google Cloud Security Community
-
This article from hzmndt clarifies the functionality of Google SecOps SOAR connector routing, explaining that the ‘Default Environment’ serves as a permanent fallback container rather than a temporary staging queue for multi-tenant setups. [Read More]
3rd Party Blogs
🔥✍️ Building AI-driven UEBA for Google SecOps from Greg Kushmerek
-
The article focuses on the development of AI-driven User and Entity Behavior Analytics (UEBA) specifically for Google’s Security Operations (SecOps). [Read More]
Podcasts & YouTube
🎙️ If you had not seen, Anton Chuvakin has left Google Cloud for a new adventure, and the Cloud Security Podcast had their farewell episode 😢
Farewell to the Cloud Security Podcast
Wiz
✍️ Introducing Continuous Vulnerability Assessment: Real-Time Defense for the AI Threat Era from Wiz Blog
-
Wiz introduces Continuous Vulnerability Assessment (CVA), a real-time defense system designed to detect new vulnerabilities immediately upon publication, thereby enhancing security in the AI threat era. [Read More]
Platform Issues
✅ RESOLVED: Google SecOps customers are experiencing ingestion failure with one of the 3P APIs in all regions from Google Cloud Status
-
Google SecOps customers are experiencing data ingestion failures across all regions, attributed to an upstream service outage with the Proofpoint Mail API. [Read More]
✅ RESOLVED: Google SecOps APIs and UI may not be available for some customers in central-us1 from Google Cloud Status
-
Google SecOps APIs and UI experienced an availability issue for some customers in us-central1 due to a networking problem, beginning around 2026–09–01 08:00 US/Pacific. [Read More]
-
Customers using BigQuery BYOP or legacy data export to TLA projects may experience delays in UDM Events appearing in their BigQuery datasets, while BigQuery Advanced export for SecOps Enterprise+ customers remains unaffected. [Read More]
✅ RESOLVED: Some Google SecOps customers in the US multiregion may experience delays with data normalization and detections from Google Cloud Status
-
Some Google SecOps customers in the US multi-region are experiencing delays with data normalization and detections due to an ongoing issue. [Read More]
