What’s New in Google SecOps for the interval Oct 12th through Oct 18th, 2026.
Highlights
🤖 The highlight of the week would be Gemini 4 Argon being released
🚀 There are also several great new features in Google TI, including a macOS Mirage Sandbox.
🛠 And last, after 10 Years, a new SRE book from Google
Product Updates & New Features
Google SecOps
🚀 Release Notes from Google Cloud Docs
-
Applied Threat Intelligence curated detection rules are now updated to utilize the new GTI_IOC feed, following the deprecation of several legacy feeds, requiring no user action. Read More
If you have custom rules that still reference the legacy feeds, update them to use the GTI_IOC feed. For more information, see Migrate to GTI_IOC.
-
The deadline for migrating SOAR APIs to the Chronicle API has been extended from November 30, 2026, to March 31, 2027. Read More
SecOps SIEM
📝 New Docs: Dashboard data sources and field prefixes from Google Cloud Docs
-
The article describes how to use data sources and field prefixes within Google Security Operations (Chronicle) to create custom dashboard charts for tracking SOAR cases, playbook execution, and rule detections. Read More
📝 New Docs: Reference > Parity > Partner > Generate Forwarder Files from Google Cloud Docs
This document outlines the migration from the Legacy Backstory Partner API (GetForwarderConfigs) to the modern Chronicle API (GenerateForwarderFiles). Read More
Note: For MSSPs or global enterprises using the legacy Partner API, this functionality is now being made available via the chronicle.googleapis.com and there are several new Parity documents with the updated API endpoint.
GetInstance APIs request and response mapping | Google Security Operations | Google Cloud…
ListTenants APIs request and response mapping | Google Security Operations | Google Cloud…
📝 Updated Doc: Ingestion: Ingestion Notifications For Health Metrics from Google Cloud Docs
-
Added a new note clarifying which metric to use (Total ingested log size) for monitoring daily ingestion volume against contractual limits, explicitly recommending against the quota_limit metric due to its dynamic nature and potential for false alarms. Also, a new section, "Set up a sample policy to monitor daily ingestion volume", was added, providing step-by-step instructions to configure an alerting policy for daily contractual ingestion limits. Read More
📝 Updated Doc: Ingestion: Understand Ingestion Metrics from Google Cloud Docs
-
Guidance on monitoring contractual limits: Users are now explicitly directed to use the chronicle.googleapis.com/ingestion/log/bytes_count metric for monitoring daily ingestion volume against contractual limits.
-
Warning against quota_limit metric: The documentation now strongly advises against using the chronicle.googleapis.com/ingestion/quota_limit metric for daily volume alerts, clarifying that it measures dynamic backend limits and can lead to false alarms.
-
New reference: A link to steps for setting up a daily volume alert policy (Set up a sample policy to monitor daily ingestion volume) has been added.
Ingestion metrics overview | Google Security Operations | Google Cloud Documentation
📝 Updated Doc: Ingestion > View Billed Ingestion Volume from Google Cloud Docs
-
Recommended Metric: Users should now use chronicle.googleapis.com/ingestion/log/bytes_count to monitor daily ingestion volume against contractual limits.
-
Avoid Metric: A strong warning is included against using chronicle.googleapis.com/ingestion/quota_limit for tracking daily contractual ingestion volume. This metric measures dynamic backend limits, not actual ingested data, and can lead to false alarms.
-
Updated Guidance Link: The configuration steps now point to a new resource: Set up a sample policy to monitor daily ingestion volume.
Ingestion metrics overview | Google Security Operations | Google Cloud Documentation
SecOps SOAR
📝 New Docs: Manage SOAR Statistics from Google Cloud Docs
-
The article details how to manage statistics within Google Security Operations’ Chronicle SOAR platform to optimize Security Operations Center (SOC) activities and identify operational trends. Read More
Google Threat Intelligence
🚀 🔥 Release Notes from gtidocs.readme.io
-
This changelog details new features and updates, including internet scanning, a macOS Mirage Sandbox, an Agentic API Guide, and detection highlights for advanced infrastructure hunting. Read More
📝 New Docs: Mail Hub from gtidocs.virustotal.com
This document introduces the Mail Hub, a new, centralized interface for managing all Google Threat Intelligence email notifications. It consolidates email settings previously located in user settings into a dedicated tab with three sub-tabs:
-
Threat Intelligence digests: Allows users to create and manage scheduled daily or weekly email summaries of Intelligence Reports, Vulnerability Intelligence, and Threat Profile updates with granular filtering options.
-
Alerts: Enables users to configure immediate email notifications for My Landscape alerts based on criteria such as Threat Scenario, Severity, and Minimum Relevance Score.
-
Comms subscriptions: Provides a dedicated section for managing general account, product, research, and event communication preferences.
✍️ ARMORY CASTLE Exploits BeyondTrust from Google Cloud Blog
-
The article discusses the ‘ARMORY CASTLE’ exploit targeting BeyondTrust, involving the disclosure of vulnerability CVE-2026–102764. Read More
Google SecOps customers have access to these broad category rules and more under the Mandiant Hunting, Mandiant Frontline Threats, and Mandiant Intel Emerging Threats rule packs. The activity discussed in the blog post is detected in Google SecOps under the rule names:
* Echo Pipes Base64 To Shell
* Base64 Encoded Shell Command Execution
* Low Severity Endpoint Detection Cluster on Host
* Suspicious Curl Download to tmp
* Suspicious Curl Network Connection to Staging Directory
✍️ Investigating Ephemeral Supply Chain Tampering from Google Cloud Blog
-
Google Threat Intelligence Group (GTIG) and Mandiant investigated a software supply chain compromise campaign that targeted AOMEI Technology’s update infrastructure between April and July 2026. Read More
Google Security Operations customers have access to these broad category rules and more under the “Mandiant Frontline Threats”, “Mandiant Hunting Rules”, and “Applied Threat Intelligence — Curated Prioritization” rule packs. The activity discussed in the blog post is detected in Google Security Operations under the rule names:
* Explorer Launching Cmd With Powershell Start Process Command
*Suspicious Process Invoking Dllhost Clsid Invocation
*ATI Active Breach Rule Match for File IoCs
*ATI High Priority Rule Match for Ip Address IoCs
*ATI Medium Priority Rule Match for Ip Address IoCs
*Copy System Binary
*System32 Binary Copied to Non-Standard Directory
Google Cloud
✍️ Four evaluation engineering lessons learned from building agent plugins from Google Cloud Blog
-
The article discusses the critical role of evaluation engineering in building reliable AI agentic systems, emphasizing that measurement is the real challenge, and shares lessons learned. Read More
✍️ Modernizing perimeter security: Scalable perimeters with VPC Service Controls from Google Cloud Blog
-
The article discusses the modernization of cloud perimeter security, particularly for autonomous agents (non-human identities), by introducing scalable perimeters using VPC Service Controls to provide secure-by-default guardrails. Read More
Note: Google SecOps supports VPC Service Controls.
Configure VPC Service Controls | Google Security Operations | Google Cloud Documentation
✍️ 🚀 🔥 Gemini 4 Argon available on Google Cloud, built to help solve your business’ hardest problems from Google Cloud Blog
-
Google Cloud has made Gemini 4 Argon available, evolving Gemini Enterprise and introducing the Gemini agent as a universal tool to help businesses solve complex problems. Read More
✍️ Gemini 4 Argon for Robotics from Google Developer Blog
-
Gemini 4 Argon is a new general-purpose AI model for robotics designed to enhance workflows with advanced physical understanding, code generation, and visual-semantic reasoning, accessible to developers across Google’s platforms. Read More
✍️ Optimizing a 200,000-line Python codebase overnight with Gemini 4 Argon from Google Developer Blog
-
Google’s engineering team successfully optimized a 200,000-line Python codebase overnight using Gemini 4 Argon, achieving a 40% reduction in memory overhead and a 21% speedup in cold imports for their open-source Python Agent Development Kit. Read More
✍️ 🔥 10 Years of the SRE book: Announcing the second edition of “Site Reliability Engineering” from Google Cloud Blog
-
Google is celebrating the 10-year anniversary of its bestselling “Site Reliability Engineering” book by announcing a second edition, which originally shared their practices for managing large-scale infrastructure. Read More
Site Reliability Engineering, 2nd Edition
✍️ Announcing DPoP Support for Google OAuth: Securing Refresh Tokens from Google Developers Blog
-
Google OAuth Platform now supports DPoP to cryptographically bind and secure refresh tokens, enhancing credential security against infostealer malware and MITM attacks without impacting API performance. Read More
✍️ One Agent Development Kit, five languages from Google Cloud Blog
-
The article introduces an Agent Development Kit (ADK) that supports five different programming languages, emphasizing its versatility beyond Python to include languages like Go and JavaScript for various agent implementations. Read More
✍️ Three layers, one repo: a tour of google/adk-recipes from Google Developers Blog
-
The google/adk-recipes repository unifies Agent Development Kit (ADK) resources into three structured layers, serving as a single source of truth for building AI agents and streamlining development workflows. Read More
✍️ Evaluating AI agents: moving past the vibe check from Google Developers Blog
-
The article presents a practical engineering guide and reference architecture for establishing continuous evaluation pipelines for multi-turn AI agents, utilizing Google’s Gemini Enterprise Agent Platform, ADK, and OpenInference standards. Read More
Adoption Guides & Deep Dives
✍️ Governing Privileged AI Agent Actions with Google Cloud Privileged Access Manager from Google Cloud Security Community
-
The article explains how Google Cloud Privileged Access Manager (PAM) can be utilized to govern and secure the actions of autonomous AI agents, enabling enterprises to leverage AI agility without compromising security. Read More
✍️ Adoption Guide: The GTI API Handbook for Attack Surface Management from Google Cloud Security Community
-
This article is an adoption guide for the Google Threat Intelligence (GTI) API, detailing its use for automated enterprise-scale attack surface management to continuously monitor exposed assets and infrastructure vulnerabilities. Read More
Note: The legacy Google Threat Intelligence (GTI) Attack Surface Management (ASM) scanning engine and backend API endpoints are currently in their deprecation window as of September 28, 2026.
Community & Events
✍️ Migrating from Legacy Google SecOps SOAR APIs to Chronicle APIs from Google Cloud Security Community
-
A community article outlines the process and observations for migrating from legacy Google SecOps SOAR APIs to the newer Chronicle API endpoints. Read More
✍️ Full Transparency — GTI Score Explainability from Google Cloud Security Community
-
This article introduces Google Threat Intelligence (GTI) Score Explainability, a new feature providing evidence for threat scores to help justify costly incident responses and remove uncertainty. Read More
✍️ Google SecOps HTML View: Automatically Adapt to Light and Dark Themes from Google Cloud Security Community
-
The article addresses the challenge of making custom HTML views in Google SecOps dynamically adapt to light and dark themes. It proposes a JavaScript and CSS solution to improve readability and consistency. Read More
Note: I wrote a blog on this topic previously with examples and reference CSS and HTML too.
Light & Dark mode support in Google SecOps HTML Widgets with Tailwind CSS
✍️ Tuesday’s Tip of the Week — Measure What Matters: MTTD, MTTR, and MTTC in Google SecOps from Google Cloud Security Community
-
This briefing defines key security metrics — MTTD, MTTR, and MTTC — with precise start and end points, maps them to Google SecOps data sources, and provides dashboard queries for calculation to ensure consistent measurement. Read More
Note: I also wrote on this topic too, and it is good to see that native capabilities have advanced so more of the MTTx calculations can be performed native in product now.
From PRD to App: Building SecOps MTTx Reports with Gemini and the SecOps SDK
Podcasts & YouTube
🎥 Google Cloud + Wiz: Securing the Cloud at Machine Speed from YouTube
-
Google Cloud and Wiz are collaborating to enhance cloud security, aiming to provide high-speed protection for cloud environments. Read More
Wiz
✍️ 🚀 Announcing Wiz Runtime Sensor add-on for GKE: Turnkey threat detection for Kubernetes from Google Cloud Blog
-
The article announces the Wiz Runtime Sensor add-on for GKE, providing real-time, turnkey threat detection for Kubernetes environments to address rapidly evolving security threats. Read More
✍️ ASPM in the AI Era Part 1: Unified Visibility Across Your Stack from Wiz Blog
-
The article focuses on achieving unified visibility of application risk by integrating existing code scanners and security tools into Wiz, specifically for Application Security Posture Management (ASPM) in the AI era. Read More
✍️ Securing the Mission at Machine Speed: Wiz AI Agents Arrive in Wiz for Gov from Wiz Blog
-
Wiz is launching AI Agents for its ‘Wiz for Gov’ platform, aimed at enhancing CNAPP capabilities and empowering public sector security teams to accelerate security and innovation. Read More
Platform Issues
✅ RESOLVED: Elevated Indexing Latency and Errors for Google Security Operations (SecOps) SIEM in us-central1, us-east1 from Google Cloud Status
-
Google SecOps SIEM is experiencing an incident causing elevated indexing latency and errors in us-central1 and us-east1 regions, which Google’s engineering team is actively investigating. Read More
✅ RESOLVED: Investigating elevated latency and errors with Google Secops from Google Cloud Status
-
Google is currently investigating an incident affecting Google Secops, causing elevated latency and errors for customers, with mitigation efforts underway. Read More
