What’s New in Google SecOps: 2026–10–26

What’s New in Google SecOps for the interval Oct 19th through Oct 25th, 2026.

Highlights

🔥 New to Google SecOps: Don’t Get Aggravated, It’s Just |> AGGREGATE: John Stoner introduces the new AGGREGATE SQL pipe operator in Google SecOps for statistical analysis and grouping of events.

😸 Adoption Guide: Best practices for using Gemini for Rules: Ivan Ninichuck outlines best practices for leveraging Gemini’s Detection Engineering Agent to automate and enhance threat detection.

🤖 PHP Agentic Detection: A SecOps UEBA Workflow: Greg Kushmerek details a SecOps UEBA workflow designed to detect agent-like behavior in PHP environments.

Product Updates & New Features

Google SecOps

🚀 Release Notes from Google Cloud Docs

• Google SecOps has added a new feature allowing users to configure whether closed cases are reopened when new alerts arrive with the same Source Grouping Identifier. Read More

• Updates to Google Chronicle SOAR marketplace integrations, including the addition of a new Google Threat Intelligence — GTI Alerts Connector and an improvement to Siemplify’s case loading.Read More

SecOps SIEM

📝 Updated Doc: Investigation > Outer Joins from Google Cloud Docs

• New Syntax for Detection Rules: Outer joins are now achievable in detection rules by defining join relationships using equality (=) in the events section and specifying an unbounded condition (# data_table >= 0 for left outer join, # data_table = 0 for anti-join exclusion) in the condition section.

• Comprehensive Examples: New rule examples are provided for left outer joins (enrichment) and anti-joins (exclusion), demonstrating single-column and multi-column scenarios.

• Null Handling Guidance: Includes best practices for handling null values from unmatched join fields in the outcome section using functions like strings.coalesce and conditional if expressions.

• Correction/Clarification: The previous statement that outer joins are not supported in detection rules has been clarified; explicit left join/right join keywords are not used, but the functionality is available through specific condition-based logic.

📝 Updated Doc: Detection > Ati Fusion Feed from Google Cloud Docs

• Processing Differences: A note clarifies that the ingestion and processing methods for GTI_IOC feed IoCs differ from legacy feeds, which may lead to discrepancies in IoC counts or rule matches.

• IoC Stability: It is now explained that the GTI_IOC feed includes both stable (verified, high confidence) and unreviewed (pending verification) IoCs.

• Ingestion Filtering Criteria: A new section details how Google SecOps filters GTI_IOC feed data to ensure high fidelity. IoCs are ingested if they meet at least one of the following criteria:
  - GTI confidence score of 80 or higher.
  - GTI verdict of malicious.
  - Known threat association.

• Unreviewed IoC Tagging: Unreviewed IoCs that meet the ingestion criteria are marked with metadata.threat.stable = false until they are fully reviewed and validated, at which point the tag changes to true.

📝 Updated Doc: Investigation > UDM Search from Google Cloud Docs

• Added a new permission requirement: chronicle.instances.suggestQueryFields is now needed for accessing “Historical usage ranking for UDM field auto-suggestions” in the query editor, specifically when using custom IAM roles.

📝 Updated Doc: Preview > Big Query from Google Cloud Docs

• Added a note clarifying the processing and expected latency for “future events.” These events, where metadata.event_timestamp is later than metadata.ingested_timestamp, are not processed by the real-time pipeline and appear in the events table in approximately 3–4 days.

📝 Updated Doc: Administration: Create Azure Feed from Google Cloud Docs

• The documentation now includes an important warning regarding Azure Event Hub configuration for Google SecOps feeds. Users are explicitly instructed to set the Event Hub’s Cleanup Policy to Delete and not Compact (Log Compaction). Using Compact is cautioned against as it only retains the latest value of a key, which can prevent Google SecOps from ingesting all historical events and may cause the feed to stop processing.

📝 Updated Doc: Reference: Chronicle API Feeds from Google Cloud Docs

• Amazon SQS v2 feeds: Details have been added regarding the supported AWS S3 event notification types. It’s explicitly stated that Google SecOps uses Google Cloud Storage Transfer Service (STS) for these feeds, which enforces a strict allowlist of event types. Supported event types now include ObjectCreated:Put, ObjectCreated:Post, ObjectCreated:Copy, ObjectCreated:CompleteMultipartUpload, and ObjectRestore:Completed. Ingestion might fail silently if non-standard event types are received.

SecOps SOAR

📝 Updated Doc: Soar > Building A Custom Integration from Google Cloud Docs

• The document has been significantly updated to introduce and prioritize a new “Local IDE & GitHub workflow” as the recommended best practice for building custom integrations. This workflow emphasizes modern GitOps practices, local development with preferred IDEs, and version control via GitHub. It introduces the Marketplace CLI tool (mp CLI) and uv package manager as core tools for this process, outlining a conceptual GitOps lifecycle.

• The previous method of building integrations directly within the built-in SOAR IDE is now positioned as an “Alternative” for legacy environments or quick prototypes. Extensive, detailed instructions for mp CLI setup and advanced dependency management using uv have been removed from this document and are now referenced as external links to the official Chronicle Content Hub GitHub Repository for up-to-date technical details.

📝 Updated Doc: Soar > My First Integration from Google Cloud Docs

• Legacy Workflow Designation: The existing method of building custom integrations using the built-in IDE is now explicitly labeled as a “legacy workflow.” While still supported for rapid prototyping, it’s no longer the recommended best practice.

• Modern GitOps Workflow: The document now strongly advocates for a modern GitOps workflow, where integrations are developed locally using a user’s own IDE and managed via GitHub. A link to new documentation detailing this approach has been added.

• Python Version Update: The default Python version used for custom integrations has been upgraded from Python 3.7 to Python 3.11.

📝 Updated Doc: Soar > Working With Remote Agents > Troubleshooting from Google Cloud Docs

• Added a new section, “Remote Agent tasks fail on hardened environments,” detailing how to diagnose and resolve issues where Remote Agent tasks fail on hardened Linux hosts (e.g., RHEL 8 with SELinux, AppArmor, or endpoint security enabled). This includes commands to check SELinux status and audit logs, and solutions like adding security options to docker run/podman run commands, configuring custom security policies for agent directories/executables, or setting SELinux to Permissive mode.

Google Cloud

✍️ Responding to core PHP vulnerabilities CVE-2026–109618 and CVE-2026–109619 from Google Cloud Blog

• Two critical vulnerabilities, CVE-2026–109618 and CVE-2026–109619, have been disclosed in the core PHP language runtime, potentially leading to unauthenticated remote code execution and memory disclosure, with Wiz Research and Gemini 4 Argon contributing to their discovery and remediation. Read More

✍️ Google Cloud expands model choice and flexibility, bringing OpenAI models to customers from Google Cloud Blog

• Google Cloud is enhancing its model choices by integrating OpenAI models into its Model Garden, providing customers greater flexibility and options for their AI workloads. Read More

✍️ Claude Opus 5.5 and Claude Sonnet 5.5 are now available in Google Antigravity from Google Cloud Blog

• Google Antigravity now offers Claude Opus 5.5 and Claude Sonnet 5.5 to Google Cloud customers, providing different AI models for various tasks. Read More

✍️ Developer’s guide to implementing MCP apps in Gemini from Google Cloud Blog

• This article is a developer’s guide explaining how to implement MCP Apps in Google’s Gemini to enhance enterprise assistants beyond text-only interactions for visual, multi-step tasks. Read More

✍️ Google named a Leader in the 2026 IDC MarketScape for Agentic AI Platforms from Google Cloud Blog

• Google has been recognized as a leader in the 2026 IDC MarketScape for Agentic AI Platforms, highlighting its role in addressing organizational challenges in deploying AI effectively. Read More

✍️ Powering the Agent Development Lifecycle with any framework, from ADK to LangChain and beyond from Google Cloud Blog

• The Agents CLI Extension System now supports various frameworks like LangChain, providing a unified deployment and evaluation workflow for AI agent development and enabling custom extensions for policy enforcement. Read More

Adoption Guides & Deep Dives

✍ 🔥️ New to Google SecOps: Don’t Get Aggravated, It’s Just |> AGGREGATE from Google Cloud Security Community

• The article from John Stoner introduces the new AGGREGATE SQL pipe operator in Google Security Operations (SecOps), which facilitates statistical analysis and grouping of events within datasets. Read More

Community & Events

✍️ Tuesday’s Tip of the Week — Who Watches the Watchmen? Detecting When Your Detections Break from Google Cloud Security Community

• This article addresses the silent failure of security detection pipelines, such as disabled rules or stopped log sources, and outlines methods for detection, relevant SecOps features, and setup procedures for alerts and dashboards. Read More

✍️ 🔥 Adoption Guide: Best practices for using Gemini for Rules from Google Cloud Security Community

• This adoption guide outlines best practices for using Gemini for Rules within Google SecOps, emphasizing how its Detection Engineering Agent automates and systematically enhances threat detection through an end-to-end framework. Read More

3rd Party Blogs

✍️ 🔥 PHP Agentic Detection: A SecOps UEBA Workflow from Greg Kushmerek

• The article from Greg Kushmerek outlines a SecOps UEBA workflow specifically designed for detecting agent-like behavior within PHP environments. Read More

Wiz
 

✍️ ASPM in the AI Era Part 2: Prioritize Exploitable Risks with Code-to-Cloud Context from Wiz Blog

• This article, part of a series, focuses on enhancing Application Security Posture Management (ASPM) in the AI era by prioritizing exploitable risks using comprehensive code-to-cloud context to reduce triage times. Read More

✍️ ARTEX in the Wild: Storm-0940 Expands Targeting of IT and Software Vendors from Wiz Blog

• Wiz Research is tracking the ARTEX-using actor, Storm-0940, which is expanding its targeting of IT and software vendors, including attacks on Okta, Entra, and Cognito. Read More

✍️ LiteLLM Compromised, Steals Credentials from Wiz Blog

• A malicious version (1.107.0) of the LiteLLM package was uploaded to PyPI and Docker, actively stealing browser, cloud, and AI credentials. Read More

✍️ PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet from Wiz Blog

• AI has uncovered critical Remote Code Execution (RCE) vulnerabilities in the core PHP engine, impacting 70% of the internet and allowing for Heartbleed-style memory disclosure. Read More

✍️ Wiz Sensor on GKE. 1-Click Runtime Protection, Now Native from Wiz Blog

• Wiz has launched a new native, one-click runtime protection add-on for Google Kubernetes Engine (GKE), automating deployment and providing kernel-level eBPF threat detection. Read More

✍️ From Phishing to LLMjacking: Threat Actors Targeting Cloud Billing Accounts for LLM Usage from Wiz Blog

• Threat actors are employing sophisticated phishing techniques, starting with malicious Google Search ads, to steal credentials and hijack cloud billing accounts. This allows them to incur hundreds of thousands of dollars in unauthorized Large Language Model (LLM) API usage. Read More

✍️ Supply Chain Zero Days: Closing the Gap Between Publication and Detection from Wiz Blog

• The article describes how Wiz’s supply chain pipeline can detect zero-day compromises in trusted software packages at the point of publication, enabling early detection before CVEs are issued. Read More

✍️ Loud, Fast, and Everywhere: Anatomy of a Real AI-Driven Cloud Attack from Wiz Blog

• The article analyzes real AI-driven cloud attacks impacting various cloud components like Kubernetes and CI/CD, and offers insights into their behavior and detection. Read More

Platform Issues
 

✅ RESOLVED: Google SecOps (SIEM and SOAR) customers are experiencing issues in the europe-west2 region from Google Cloud Status

• Google Security Operations (SIEM and SOAR) customers in the europe-west2 region are experiencing an incident, which began on Monday, 2026–10–19 23:08 PDT. Read More

✅ RESOLVED: Google Security Operations (SIEM) customers may experience brief, intermittent delays or errors when running searches from Google Cloud Status

• Google Security Operations (SIEM) customers are experiencing brief, intermittent delays and errors when running searches, an incident that began on October 18, 2026. Read More