What’s New in Google SecOps for the interval Oct 26th through Nov 1st, 2026.
Highlights
In Google SecOps news:
-
Agentic Chat into public preview, providing in-platform MCP access to SecOps
-
Basic mode search for UDM, enabling more efficient payload responses, making for a quicker search experience.
-
The SOAR Google TI Integration now includes a query Google TI Agent Action
There are also several important new and updated Google SecOps documentation releases this week, new OTEL collector version releases, as well as several interesting blogs from Google Cloud on AI Skills and Agent building.
I released a blog post on using Skills with Google SQL and OTTL to filter out low value data in Google SecOps that I delivered at the SecOps SIEMPosium a few weeks back.
Wiz posted several really interesting blog posts with thoughts and analysis the recent PHP2Shell exploitation and insights on where this is all going.
Product Updates & New Features
Google SecOps
🚀 Release Notes from Google Cloud Docs
-
The Operations feature in the Emerging Threats Center feed has reached General Availability (GA). Read More
-
⚰️ Google SecOps is completing the final shutdown of legacy Google-managed BigQuery export datasets (chronicle-tla) and associated API keys for non-Enterprise+ customers, following a deprecation announcement from March 2025. Read More
-
You can now resize inline images directly in rich-text comments on the Case Wall. Read More
️ 🔥 🚀 Now in Public Preview: The New Agentic Chat in Google Security Operations from Google Cloud Security Community
-
Google SecOps Agentic Chat has launched in Public Preview, offering a re-architected multi-turn conversational experience built on ADK 2.0 and MCP for enhanced security incident investigations. Read More
SecOps Chat Overview | Google Security Operations | Google Cloud Documentation
🔥 🚀 Speed Up Your Investigations: Basic Mode Now Available in Google SecOps SIEM Search (Public Preview) from Google Cloud Security Community
-
Google SecOps has introduced a new “Basic Mode” for its SIEM Search, now in Public Preview, enabling faster investigations by quickly displaying matching events and field counts without waiting for extra charts to load. Read More
Understand search | Google Security Operations | Google Cloud Documentation
SecOps SIEM
📄 New Docs: Reference > Verify Firewall Configuration from Google Cloud Docs
-
This new document provides comprehensive guidance for configuring firewalls and proxies to enable communication with the Google Security Operations Chronicle API. Read More
📝 Updated Docs: YARA-L: Outcome Syntax from Google Cloud Docs
-
Added a critical warning regarding potential runtime errors when performing arithmetic or modulo operations between standard signed 64-bit integer literals and unsigned 64-bit UDM fields (e.g., network.received_bytes, principal.file.size). Read More
📝 Updated Docs: Administration > Feed Management from Google Cloud Docs
-
A comprehensive new section details the setup and management of Custom API feeds (also known as Codeless Connectors), a new feature for ingesting telemetry from third-party REST APIs. This feature is currently in Pre-GA and Private Preview. Read More
📝 Updated Docs: Investigation: Search LRO API from Google Cloud Docs
-
This update introduces significant functional changes and clarifications for Long-Running Operation (LRO) APIs, particularly concerning search operations. Read More
📝 Updated Docs: Ingestion > Configure Multiple Feeds from Google Cloud Docs
-
This update introduces a new feature for filtering objects by prefix in Storage Transfer Service (STS) feeds. This feature, currently in Limited Preview and requiring allowlist access, enables more granular control over data ingestion from sources like Google Cloud Storage, Amazon S3/SQS, and Azure Blob Storage. The documentation details supported feed types, prefix syntax, validation rules, and configuration steps. Additionally, the availability status of Custom API feeds has been updated from ‘Pre-GA’ to ‘Private Preview’, indicating a more restrictive access. A new troubleshooting entry for the Generic::failed_precondition: include_prefixes is not enabled for this customer error has also been added. Read More
📝 Updated Docs: Detection > Mitre Dashboard from Google Cloud Docs
-
Updated the supported MITRE ATT&CK version from 17 to 19.1. Read More
SecOps SOAR
🔥 🚀 SecOps SOAR Integrations from Google Cloud Docs
-
New integrations for SAP ERP and a new action for Google Threat Intelligence, along with a fix for Microsoft Graph Mail Delegated. Read More
Note, this update adds the ability to query Google TI Agentic from SOAR Playbooks.
📄 New Docs: Respond > Ide > Creating A Custom Connector from Google Cloud Docs
-
This document provides a comprehensive guide for creating custom Google SecOps SOAR connectors for third-party tools not available in the Content Hub. It details the process from building a Manager class for API logic to implementing the connector in the IDE. Read More
📝 ⚠️ Updated Docs: Marketplace > Power Ups > Gitsync from Google Cloud Docs
-
This update introduces a critical warning and reversal regarding GitSync version 53.0, which contains known synchronization issues. Read More
Google Threat Intelligence
🚀 Release Notes from GTI Docs
-
New features and updates, including the introduction of GTI Mail Hub, agentic updates, and process tree enhancements, as part of a changelog. Read More
BindPlane
⚙️ v1.111.0 from GitHub
-
This article announces the release of version 1.111.0 for the observIQ BindPlane OTel Collector, introducing a new feature to the Windows install script. Read More
⚙️ v2.0.1-beta.7 from GitHub
-
This article announces the v2.0.1-beta.7 software release, detailing refactors to the internal versioning and updates to the Makefile. Read More
Google Cloud
✍️ Innovate on your own business terms: Google Cloud spend caps now generally available from Google Cloud Docs
-
Google Cloud’s spend caps on Budgets are now generally available, providing new ways to protect workloads from runaway costs with updates inspired by user feedback. Read More
Google SecOps spend in its associated Google Cloud project is expected to be nominal depending on feature usage, but this post covers important to know about features to provide assurance on alerting and controlling potential costs.
AI
✍️ Behind the scenes, two months later: How we ship Google Agent Skills like products from Google Cloud Docs
-
This article is a follow-up piece detailing Google’s internal processes for shipping Agent Skills as complete products, covering their development, quality maintenance, and scaling efforts. Read More
✍️ Scale agents securely with IAM Helper Agent Skills and MCP Tools from Google Cloud Docs
-
The article explains how organizations can securely scale autonomous agents using IAM Helper Agent Skills and MCP Tools to manage identities and access, thereby reducing security friction in CI/CD pipelines. Read More
✍️ Hill-Climbing Agent Quality with Agents CLI Evaluation from Google Cloud Docs
-
This post details using the Agents CLI evaluation loop to systematically improve agent performance, covering prompt regression detection, model backend swaps, automated evaluation, and quality tracking with alerts. Read More
✍️ Fast, reliable A2UI, with swappable inference formats from Google Cloud Docs
-
A2UI now supports swappable inference formats including A2UI Express, significantly reducing token usage and latency while improving screen rendering times for generative UIs without requiring frontend changes. Read More
✍️ Preview, edit, and collaborate on markdown (.md) files natively in Google Docs and Drive from Google Cloud Docs
-
Google Workspace now provides native support for Markdown (.md) files, enabling seamless editing and collaboration directly within Google Docs and Drive while preserving file fidelity for developer tools. Read More
Community & Events
✍️ Tuesday’s Tip of the Week — Retrohunt: Test Your Rules Against the Past from Google Cloud Security Community from Google Cloud Security Community
-
Retrohunt allows security professionals to test YARA-L rules against previously ingested UDM data, enabling quick validation of new rules, indicator sweeps, and incident scoping without waiting for live detections. Read More
3rd Party Blogs
🔥 ✍️ Data filtering 101: What’s new(ish) in Google SecOps from Chris Martin (@thatsiemguy)
-
The article introduces data filtering techniques and highlights new features within Google SecOps, providing an educational overview. Read More
🔥 Wiz
I’m marking the entirety of Wiz’ blogs this week as 🔥, highly recommended reading.
✍️ “Black October” for AI Developer Platforms from Wiz Blog
-
A series of agentic attacks, termed “Black October,” are targeting AI developer platforms, resulting in widespread LLMJacking incidents. Read More
✍️ Key Takeaways: AI Threat Readiness Survey Report 2026 from Wiz Blog
-
The article provides key findings from a survey on AI threat readiness, highlighting risks such as shadow AI and the need for AI-against-AI defensive models. Read More
✍️ The Rise of Agentic Attacks: What They Look Like, and Where They’re Headed from Wiz Blog
-
The article explores the evolving landscape of cyberattacks due to AI agents, examining real-world examples, identifying their characteristics, and discussing their future impact on cybersecurity. Read More
✍️ PHP2Shell: Exploitation Attempts and Remediation Trends from Wiz Blog
-
Wiz research has been monitoring PHP2Shell exploitation attempts, finding that none have succeeded so far, and analyzing the techniques used, prevention factors, and changes in exposure since disclosure. Read More
✍️ The Pwn Request Reckoning: What Still Works Against GitHub Actions from Wiz Blog
-
The article discusses how ‘pull_request_target’ attacks still pose a threat to GitHub Actions despite recent security enhancements, outlining the remaining attack surface and how to audit for it. Read More
Platform Issues
✅ RESOLVED: Google Security Operations (SIEM) customers using Customer-Managed Encryption Keys (CMEK) in all US regions are experiencing indexing delays on newly ingested events from Google Cloud Status
-
Google Security Operations (SIEM) customers utilizing Customer-Managed Encryption Keys (CMEK) across all US regions are experiencing delays in indexing newly ingested events. Read More
✅ RESOLVED: Google SecOps SIEM: Log ingestion failures for HTTPS Push feeds using custom log types from Google Cloud Status
-
Google SecOps SIEM is experiencing log ingestion failures for HTTPS Push feeds utilizing custom log types, with the engineering team actively investigating the issue. Read More
✅ RESOLVED: Google SecOps customers across multiple regions may not be able to create or edit data feeds from Google Cloud Status
-
Google SecOps customers in multiple regions are currently unable to create or edit data feeds due to an ongoing incident, which Google’s engineering team is actively investigating. Read More
✅ RESOLVED: Google SecOps customers in the EU multi-region may experience delays with data normalization, search and detections from Google Cloud Status
-
Google SecOps customers in the EU multi-region are experiencing delays with data normalization, search, and detections due to an ongoing incident. Read More
