What’s New in Google SecOps: 2026–11–09

What’s New in Google SecOps for the interval Nov 2nd through Nov 8th, 2026.

Highlights

In Google SecOps news:

• Case activity tagging is now available, allowing analysts to categorize and filter activities, comments, and tasks on the Case Wall.

• Consolidated Settings and Navigation has entered public preview, unifying SIEM and SOAR settings into a single menu alongside an updated left navigation.

• Several new Pre-GA and Private Preview Gemini capabilities were documented this week, including AI Parsing (for generating custom JavaScript parsers and extensions), the 3P Context Agent (for read-only third-party alert enrichment with TIN), and creating custom SOAR IDE response actions with Gemini.

In community and cloud security news, the Google Cloud Security Community shared updates on Fall rule observability improvements, 23 new curated detections for PHP2SHELL, RBAC best practices, and John Stoner’s guide to the |> EXTEND SQL pipe operator, while Mandiant detailed the rise of LLMJacking.

Product Updates & New Features

Google SecOps

🚀 Release Notes from Google Cloud Docs

• Google SecOps has released a new ‘Case activity tagging’ feature, allowing users to categorize and filter activities, comments, and tasks on the Case Wall for improved investigation management. Read More

• Google SecOps has released a new Consolidated Settings and Navigation feature in public preview, unifying SIEM and SOAR settings into a single menu and updating the left navigation. Read More

Note: I checked my tenants and I don’t see this setting under Public Preview settings or in the SecOps UI yet, so I suspect it is still rolling out.

• ☠️ Google SecOps deprecated the ListCaseEvents API endpoint on November 2, 2026, instructing users to migrate to the ListCaseEvidenceData API endpoint. Read More

📄 New Docs: Event Processing > Parsers Using AI from Google Cloud Docs

• This document introduces AI Parsing in Google SecOps, a new feature supported by Gemini, currently in Pre-GA and Private Preview.

• Create Parser with AI: Generates complete custom parsers from scratch for new or unsupported log sources. Users provide log type, ingested raw logs, and optional vendor documentation links. The AI samples logs, researches schema, plans UDM mapping, and writes JavaScript parser code, which can then be refined via natural language prompts.

• Write Extension with AI: Allows users to augment existing parsers by extracting additional fields, applying conditional logic, and transforming values. Users provide log type, a sample raw log, and prompts to describe desired mappings.

• The document details prerequisites, step-by-step workflows for both custom parser generation and extension creation, guidelines for crafting effective prompts, troubleshooting common issues, and usage quotas (10 extension sessions/24h, 5 messages/session).

• Read More

📄 New Docs: Investigation > Context Agent Investigation from Google Cloud Docs

• This document introduces the 3P Context Agent within Google SecOps, currently in Pre-GA and Private Preview.

• Purpose: An AI-powered agent designed to automatically enrich security alerts and entities with crucial external contextual data from third-party tools, thereby augmenting the verdicts of the Triage and Investigation Agent (TIN).

• Benefits: Reduces manual data gathering, accelerates the triage process, leads to faster Mean Time To Respond (MTTR), and improves decision-making during investigations.

• Functionality: Primarily triggers as a sub-agent to TIN, dynamically selects appropriate third-party tools (excluding some Google SecOps first-party tools), and enriches alert entities with findings, which are viewable in the alert details page, Gemini Investigations timeline, and Case Wall.

• Guardrails: Operates strictly with read-only enrichment actions; cannot modify data or states in third-party systems.

• Configuration: Managed under SIEM Settings > Gemini Investigations > 3P Context Agent, allowing users to enable/disable, manage included or excluded third-party tools, and configure specific integration instances per environment.

• Quota during Private Preview: The 3P Context Agent itself doesn’t consume AI quota, but TIN might consume an average of 5% additional AI quota when triggering it. Standard integration fees may apply.

• Read More

📄 New Docs: SOAR > Respond > IDE > Create IDE Actions Gemini from Google Cloud Docs

• This document introduces a new feature allowing users to create custom Python code for response actions using Gemini within the Google SecOps SOAR Integrated Development Environment (IDE).

• Functionality: Users provide natural language descriptions to generate action code for existing integrations.

• Availability: The feature is currently in Pre-GA and Private Preview.

• Process: Detailed steps cover generating code from a prompt, reviewing the output, modifying if needed, and saving the action.

• Best Practices: Guidelines are provided for effective prompting, such as suggesting specific names and parameters, focusing on single API endpoints, defining JSON output structures, keeping code in a single module, and including documentation references.

• Read More

Google Cloud

✍️ New capabilities to power agents at scale with Google’s Agentic Data Cloud from Google Cloud Blog

• Google is announcing new capabilities for its Agentic Data Cloud, empowering organizations to deploy and scale AI agents in production to generate revenue, enhance efficiency, and mitigate risks. Read More

✍️ The Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model Resources from Google Cloud Blog

• The article introduces LLMJacking, a new method where threat actors hijack enterprise cloud and AI model resources for monetization, based on incidents Mandiant responded to. Read More

Adoption Guides & Deep Dives

✍️ New to Google SecOps: Same as It Ever Was? Not When You Use |> EXTEND from Google Cloud Security Community

• This article from John Stoner introduces the EXTEND pipe operator in Google Security Operations (SecOps) SQL syntax, explaining how it adds computed columns to query results and builds on foundational query skills. Read More

Community & Events

✍️ SecOps Rule Observability Improvements — Fall Edition from Google Cloud Security Community

• Google SecOps has announced new improvements to rule observability, building on earlier successful enhancements that have been widely adopted by customers. Read More

✍️ Curated Content — Quick Update For PHP2SHELL Content from Google Cloud Security Community

• Google Security Operations has released new curated content and detections related to the PHP2SHELL disclosures, including a detailed writeup and 23 new detections for the SecOps community. Read More

✍️ Tuesday’s Tip of the Week — RBAC in Google SecOps: IAM Roles, Data Scopes, and Least Privilege from Google Cloud Security Community

• This article provides a guide on implementing Role-Based Access Control (RBAC) in Google SecOps using Google Cloud IAM, covering IAM roles, data scopes, and the principle of least privilege for SecOps administrators. Read More

Wiz

✍️ The ROI of Agentic Remediation: Real-World Results with Wiz Green Agent from Wiz Blog

• The article explores the return on investment of Wiz Green Agent, detailing how client companies like Fireblocks utilized its ‘agentic remediation’ to eliminate cross-team blockers and accelerate critical risk resolution. Read More

✍️ From Reactive to Proactive: Empowering SOC Teams with the Wiz Red and Blue Agents from Wiz Blog

• The article introduces Wiz’s Red and Blue Agents, designed to empower SOC teams with proactive pre-breach alerts and automated threat investigation to stay ahead of AI-era threats. Read More

Platform Issues

✅ RESOLVED: Google SecOps is experiencing elevated error rates and high Search query latency in the US region from Google Cloud Status

• Google SecOps experienced elevated error rates and high query latency in the US region; the issue has been resolved. Read More

✅ RESOLVED: Google SecOps is experiencing elevated search error rates in the asia-southeast1 (Singapore) region from Google Cloud Status

• Google SecOps experienced elevated search error rates affecting log search and query capabilities in the asia-southeast1 (Singapore) region; the issue has been resolved. Read More