What’s New in Google SecOps for the interval Oct 5th through Oct 11th, 2026.
Highlights
-
An important upgrade note if you use the SOAR GitSync integration
-
How to manage Bindplane Agents via the CLI from Simone Bruzzechesse
Product Updates & New Features
Google SecOps
🔥 🚀 Chronicle Release Notes from Google Cloud Docs
-
Google Cloud has released Terraform providers and client libraries for numerous Google SecOps features accessible via the Chronicle API, including Feeds, Parsers, Rules, and Data Export. Read More
Provision Google SecOps resources with Terraform | Google Security Operations | Google Cloud…
Learn how to provision Terraform for Google SecOps resourcesdocs.cloud.google.com
📄 New Docs: Standard SQL > Query Performance Best Practices from Google Cloud Docs
This document introduces GoogleSQL query performance best practices for Google SecOps SIEM, focusing on preventing queries from hitting resource guardrails. Key optimizations include:
-
Self-joins: Filtering out NULL or empty join keys to prevent Cartesian explosions and using primitive integer arithmetic on metadata.event_timestamp.seconds for time window calculations instead of TIMESTAMP_DIFF. Detailed unoptimized and optimized Standard/Piped SQL examples are provided.
-
Filtering and Column Selection: Applying filters early in the query, selecting only specific columns (avoiding SELECT *), and leveraging indexed UDM fields for filtering.
-
Repeated Fields (Arrays): Recommending EXISTS (SELECT 1 FROM UNNEST(…)) over ARRAY_INCLUDES or IN UNNEST for checking values within arrays, and using NET.IP_IN_NET for efficient CIDR matching within repeated IP fields.
📝 Updated Docs: Ingestion > Understand Ingestion Metrics from Google Cloud Docs
-
This update introduces a comprehensive section explaining discrepancies in reported ingestion.log_volume between raw log storage and Google SecOps dashboards. It details the reasons for these differences, including varying time ranges, lookback limits (up to 365 days for dashboards, 24 months for Cloud Monitoring), and different data collection pipelines. Read More
🔥 📄 New Docs: Reports > Response Health Monitoring And Troubleshooting Dashboard from Google Cloud Docs
-
This new document introduces the Response Health Hub within Google SecOps SOAR, a central interface for monitoring the health, performance, and automation efficiency of playbooks and integrations. Read More. Read More
The new Response Health Hub
🚀 SecOps SOAR Integrations from Google Cloud Docs
-
This article details updates for Google Chronicle (v97.0), including enhanced alert synchronization logic, and Gitsync (v53.0), which now supports the latest Chronicle API but requires existing users to migrate their repository branch. Read More
📝 ⚠️ Updated Docs: SOAR > Marketplace > Power Ups > Gitsync from Google Cloud Docs
-
This update to the GitSync documentation introduces a critical mandatory platform requirement: GitSync v53.0 and later versions exclusively use Chronicle REST APIs with automated IAM authentication, discontinuing support for legacy Google SecOps API endpoints. Users must migrate their Google SecOps instance to a Chronicle API-enabled environment before upgrading or configuring GitSync. Read More
Google Cloud
✍️ Welcome to Gemini at Work 2026: Introducing the Gemini agent from Google Cloud Blog
-
The article, adapted from a keynote at Gemini at Work 2026, introduces the new Gemini agent. It includes several announcements regarding Google’s AI developments. Read More
✍️ The Outer Loop, Insights First: An Ambient Quality Agent That Diagnoses Your Production Agent from Google Cloud Blog
-
Google is open-sourcing AQuA (Ambient Quality Agent), a tool designed to diagnose and improve the quality of AI agents in production by detecting silent regressions and identifying root causes. Read More
The last 20%
✍️ Supercharge your development with the Google Developer Knowledge API ecosystem from Google Cloud Blog
-
Google is launching the Developer Knowledge API and MCP Server in public preview, providing a machine-readable way for AI assistants to access up-to-date Google documentation across various platforms, ensuring authoritative and real-time context for AI-generated code and guidance. Read More
✍️ EmbeddingGemma 2: The Developer Guide from Google Cloud Blog
-
EmbeddingGemma 2 is a new compact, open-source multimodal embedding model that unifies text, code, and multimedia into a 768-dimensional space, offering developers modular encoders and dynamic dimension truncation for optimized memory and storage. Read More
Adoption Guides & Deep Dives
✍️ Manage the lifecycle of your IOCs in Entity Graph from Google Cloud Security Community
-
This article from Peter Solagna details how Google Cloud Security Operations allows users to manage and ingest custom Indicators of Compromise (IOCs) into its Entity Graph, enhancing threat detection capabilities. Read More
🔥 ✍️ New to Google SecOps: Please, Please, Please, Let Me |> SELECT What I Want from Google Cloud Security Community
-
This article from John Stoner introduces the SELECT pipe operator in Google SecOps, demonstrating how to use it with the WHERE operator to filter rows and reduce columns in UDM event data sets, thereby refining data analysis. Read More
Community & Events
✍️ Tuesday’s Tip of the Week — Dashboards for Detection Volume, Rule Health, and Data Quality from Google Cloud Security Community
-
This article introduces Google SecOps native dashboards designed to provide insights into detection volume, rule health, and data quality through trends and metrics, using YARA-L 2.0 queries. Read More
✍️ Cross-Project Monitoring for Google SecOps: A Cloud Monitoring Implementation Guide from Google Cloud Security Community
-
This guide provides a step-by-step implementation for cross-project monitoring in Google SecOps using Google Cloud Monitoring, ensuring data feeds to SIEMs remain active and preventing silent detection failures. Read More
3rd Party Blogs
🔥 ✍️ Mastering Bindplane CLI and Fleet Management at Scale: From Zero to Bulk Agent Migrations from Simone Bruzzechesse
-
The article is a guide on effectively utilizing Bindplane CLI for large-scale fleet management, covering everything from initial setup to bulk agent migrations. Read More
Podcasts & YouTube
🎙️ EP253 The Craft of Cloud Bug Hunting: Writing Winning Reports and Secrets from a VRP Champion from Google Cloud Security Community
-
This podcast episode features top bug bounty hunters discussing effective cloud bug hunting techniques, best practices for writing winning reports, and insights into cloud security posture and hygiene. Read More
Wiz
✍️ How the Wiz Red Agent caught a Fortune 500 firm’s data exposure (that other tools missed) from Wiz Blog
-
The article details how Wiz’s Red Agent, by simulating an attacker, quickly identified a critical data exposure at a Fortune 500 company on a public page, an issue that traditional security tools failed to detect. Read More
✍️ Introducing Wiz AI SAST: Application Security that Understands Your Code and Your Infrastructure from Wiz Blog
-
Wiz introduces AI SAST, a new AI-powered code scanner designed to find, validate, and fix complex business logic flaws within existing security programs. Read More
✍️ What’s New in Wiz Service Catalog: Smarter Discovery, Governance, and Service-Level Context from Wiz Blog
-
The article announces new updates to the Wiz Service Catalog, focusing on improved discovery, governance, and service-level context to enhance cloud risk accountability. Read More
Platform Issues
✅ RESOLVED: Some Google SecOps customers will not have received alerts for curated detection ur_A6694B54–4A6B-4620–8B64–9D02AD0A8644 from Google Cloud Status
-
Some Google SecOps customers did not receive alerts for a specific curated detection (ur_A6694B54–4A6B-4620–8B64–9D02AD0A8644) due to an issue during a rule update process. Read More
✅ RESOLVED: Some Google SecOps customers may experience delayed UDM Search and detections in the US region from Google Cloud Status
-
Some Google SecOps customers in the US region are experiencing delays with UDM Search and detections due to an ongoing incident. Read More
