Skip to main content

What’s New in Google SecOps: 2026–09–14

  • September 15, 2026
  • 0 replies
  • 6 views
Staff
Forum|alt.badge.img+15

What’s New in Google SecOps for the interval Sep 07 through Sep 13 2026.

 

What’s New in Google SecOps, Sep 13 2026

 

Highlights

 

Product Updates & New Features

 

Google SecOps

 

📰 New Doc: Reference > Parity > Bigquery > Provide Bigquery Access from cloud.google.com

  • This document outlines the migration from the Legacy UpdateBigQueryAccess API to the Modern ProvideBigQueryAccess API for Google SecOps SIEM. Read More.

📰 New Doc: Reference: Parity: CuratedRule: List Curated Rules from cloud.google.com

  • This document outlines the migration from the legacy Backstory Rules Engine API to the modern Chronicle API for ListCuratedRules Read more.

📰 New Doc: Reference: Parity: CuratedRule: Legacy Search Curated Detections from cloud.google.com

  • This document outlines the migration from the ListCuratedRuleDetections API to the LegacySearchCuratedDetections API, detailing request and response mapping specifications and property parity analysis. Read More.

📝 Updated Docs: Log In To Ui from cloud.google.com

Added a new comprehensive section outlining network access and domain allowlist requirements for Google SecOps and Google SecOps SOAR. This includes:

  • Mandatory core domains for UI functionality, API calls, and workspace navigation.

  • Mandatory Google infrastructure and Cloud API domains for identity, permissions, and platform services.

  • Optional and non-blocking domains for usage telemetry, reporting, and surveys, clarifying their impact if blocked. Read More.

📝 Updated Doc: Reference: Ingestion Metrics Schema from cloud.google.com

  • Added a new section detailing the “Data Pipeline Management (DPM) external metrics schema.” This section introduces several new metrics for log processing pipelines, including /ingested_bytes_count, /emitted_bytes_count, /ingested_log_count, /emitted_log_count, and /processing_latencies. Each new metric is described with its type and a pipeline_id field, while /processing_latencies also includes a processor_id field. Read More.

 

SecOps SIEM

 

🚀 Release Notes from docs.google.com

  • ⚠️ Google Cloud Chronicle is deprecating write permissions from the chronicle.readonly OAuth scope, effective January 25, 2027, requiring users to update any affected workflows. Read More

I guess it wasn’t that read only after all…

📝 Updated Doc: Reference > Feed Management Api from cloud.google.com

  • Added comprehensive documentation for the WORKDAY log type, including specific request fields for API authentication (OAuth 2.0 client ID, client secret, refresh token, token endpoint, access token), hostname, and tenant ID. Also included instructions on how to test the API endpoint before creating a feed. Read More.

📝 Updated Doc: Reference: Chronicle Api Feeds from cloud.google.com

  • Okta System Log: Added a note indicating that Google SecOps limits batch requests to a maximum of 30 consecutive requests per cycle to maintain stable ingestion and comply with Okta’s rate limits.

  • Okta User: Added a note detailing Google SecOps’s rate limiting strategy for user ingestion:
    - A maximum of 10 consecutive requests for initial user listings.
    - A maximum of 420 requests per minute for follow-up fetches to obtain manager details, which is 70% of Okta’s 600 requests per minute limit. Read More.

Note, this was also updated in Reference: Feed Management Api too.
 

📝 Updated Doc: Ingestion: Ingestion Entities: Configure Multiple Feeds from cloud.google.com

This update introduces and thoroughly explains the concept of backfillability for re-enabled data feeds.

  • Feed State Clarity: Clarified that “enable” means “resume” and “disable” means “pause” for feeds.

  • Backfillability Details: Added a new, comprehensive section on “Data recovery when you re-enable feeds (backfillability)” which:
    - Explains that Google SecOps can retrieve missed data for pull-based feeds (e.g., S3, GCS, SFTP, 3rd-party APIs) when re-enabled
    - States that push-based feeds (e.g., webhooks, Pub/Sub, Kinesis, Direct API/agents) do not support automatic backfill, and data can be lost if not buffered and retried by the source system
    - Provides “Backfill considerations” covering limitations like source system data retention, Google SecOps’ internal buffer (up to 90 days), tenant restrictions, ingestion quotas (lower priority, rate-limited), dynamic rate limiting, cloud storage controls, and options for clearing large backlogs.

  • Delete Custom API Feeds: Introduced a new option to explicitly delete pending backlog data when deleting Custom API feeds, offering more control over data retention during deletion. Read More.

Note, the Backfillability updates are also included in Administration: Feed Management.
 

📝 Updated Doc: Reference: Chronicle Api Feeds from cloud.google.com

Added a new section providing critical instructions for enabling access to Azure Blob Storage for ingestion. This section details how to configure the Azure firewall to allow incoming connections from Google’s ingestion infrastructure. It offers two methods:

  • Allowlisting the full Google IP address range (recommended): Provides guidance on retrieving the goog.json file for the complete list and automating firewall configuration.

  • Allowlisting a specific IP address subset (alternative): Lists specific IPv4 and IPv6 ranges, with a caution about the need for proactive monitoring and updates due to potential changes in Google’s infrastructure. Read More.

Note, this was also added in Reference: Feed Management Api too.
 

📝 🔥 Updated Doc: Reference: Udm Field List from cloud.google.com

This document has undergone a significant restructuring and content update. Key changes include:

  • Documentation Scope Reduction: The most substantial change is the removal of detailed field definitions and all enumerated types for most UDM subtypes (e.g., Authentication, Browser, File, Network, etc.) from this document. This likely indicates a re-organization of the UDM reference documentation, with these details now covered elsewhere.

  • New Entity Risk Features: Introduces new data structures EntityRisk and RiskDelta to provide comprehensive entity risk scoring. EntityRisk gains new fields like risk_score, normalized_risk_score, risk_window_size, raw_risk_delta, last_reset_time, and detail_uri, and now includes a DEPRECATED_risk_score.

  • Entity Field Updates: The top-level Entity structure now includes an optional risk_score field referencing the new EntityRisk structure.

  • Threat Intelligence Deprecation and Enhancement: In EntityMetadata, the threat and ati_prioritization fields are deprecated. A new, preferred threat_intel field is introduced for managing threat intelligence metadata.

  • Enhanced Metric Capabilities: The Metric data structure is updated with new fields such as display_name, outcome_variables, match_variables, and time_range. A new MetricVariable structure is introduced to support these new metric fields.

  • Minor Updates: General wording and formatting improvements, including a corrected spelling of “data type” and updated example syntax. The IP_ADDRESS description in EntityMetadata.EntityType also received a clarification about including IOC intel threat metadata. Read More.

 

UDM Schema Updates

 

SecOps SOAR

 

🚀 Release Notes from docs.cloud.com

  • These release notes detail a new ‘Is Value In Data Table Async’ action for Google Chronicle and significant improvements to the Microsoft 365 Defender incidents connector, including updated alert tracking and better pagination. Read More

📝 ⚠️️ Updated Doc: Soar: Admin Tasks: User Secops: Map Users In The Secops Platform First Party from cloud.google.com

  • Added a new Important note warning that permission groups must have at least one default landing module (e.g., Homepage, Dashboards, Cases) enabled to prevent backend errors and an infinite login redirect loop. A new Troubleshooting section was also added, detailing how to resolve an infinite login redirect loop caused by disabled default landing modules by enabling one in SOAR Settings > Permissions. Read More.

This is useful to know, if you’ve ever encountered an infinite loop issue on login, this may be the issue.

 

Google Threat Intelligence

 

🚀 Release Notes from gtidocs.readme.io

  • The article announces multiple product updates and new features, including the general availability of Single Target Operations, enhancements to Google Insights, and agentic updates. Read More

✍️ 🔥 GTIG AI Threat Tracker: From Prompting to Autonomy — The Evolution of Adversarial AI from Google Cloud Blog

  • The article from Google’s GTIG AI Threat Tracker examines the evolution of adversarial AI, focusing on AI vulnerability exploitation and initial access from prompting to autonomy. Read More

 

Community & Events

 

✍️ Tuesday’s Tip of the Week — Designing Playbooks: Automation Without Chaos from Google Cloud Security Community

  • This article, part of Google Cloud’s ‘Tip of the Week’, focuses on designing SOAR playbooks in Google SecOps to effectively automate security incident responses, aiming to reduce manual tasks while ensuring human oversight. Read More

✍️ 🔥 Stop Writing Regex: How to Create Parser Extensions using AI from Google Cloud Security Community

  • The article introduces AI-powered parser extensions to eliminate the need for writing regular expressions, aiming to reduce the burden of log parser maintenance for detection engineers and SOC analysts dealing with diverse telemetry streams. Read More

 

Wiz

 

✍️ Wiz achieves GovRAMP High Authorization from wiz.io

  • Wiz has achieved GovRAMP High Authorization, enabling it to deliver unified cloud security to protect citizen data and critical infrastructure. Read More

✍️ Off Guard: Breaking LiteLLM from authentication bypass to cloud compromise from wiz.io

  • Researchers uncovered a critical vulnerability chain in LiteLLM, stemming from default keys and unauthenticated sessions, that allows for authentication bypass and leads to root-level remote code execution and IAM theft on cloud AI infrastructure. Read More

 

Platform Issues

 

✅ RESOLVED: Google SecOps customers may experience an issue where some of the logs chunks are stuck in the queue and are not processed from status.cloud.google.com

  • Google SecOps customers are experiencing an issue where log chunks are getting stuck in the queue and are not being processed. Read More

✅ RESOLVED: We are experiencing elevated error rates in multiple Asia regions for Chronicle search API , UI and Dashboards from status.cloud.google.com

Google Cloud is experiencing elevated error rates for Chronicle search API, UI, and Dashboards across multiple Asia regions, beginning 2026–09–09 9:30 PDT. Read More

 

 

Terms & ConditionsAccessibility statement
Privacy Policy Terms of Service Gen AI Policy Community Guidelines Cookie Settings

© 2025 Google. All rights reserved.