Google SecOps

No entries match these filters. Clear filters

1. api-docs-25616c54bbfe Oct 26, 2026 · issue 121

   Google SecOps gains agentic case reports, action executor, AI billing settings, and search session results APIs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   API change

   Google SecOps gains agentic case reports, action executor, AI billing settings, and search session results APIs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • + PATCH /v1alpha/{aiBillingSettings.name}
   • + POST /v1alpha/{parent}/actionExecutor:fetchActionDetails
   • + GET /v1alpha/{parent}/actionExecutor:fetchActions
   • + POST /v1alpha/{parent}/agenticCaseReportTemplates
   • + GET /v1alpha/{parent}/agenticCaseReportTemplates
   • + PATCH /v1alpha/{agenticCaseReportTemplate.name}
   • + POST /v1alpha/{parent}/agenticCaseReports:generate
   • + GET /v1alpha/{parent}/agenticCaseReports
   • + PATCH /v1alpha/{agenticCaseReport.name}
   • + POST /v1alpha/{name}:publish
   • + POST /v1alpha/{parent}/nativeDashboards:manageLease
   • + POST /v1/{parent}:search
   • + GET /v1/{parent}/searchedResults
   └──▷ TRY IT
   Retrieve paginated results from an existing search session to integrate UDM search output into an external pipeline.
   copy

   $ curl -X GET 'https://chronicle.googleapis.com/v1/{parent}/searchedResults' \
     -H 'Authorization: Bearer $(gcloud auth print-access-token)'

   • Adds POST /v1alpha/{parent}/actionExecutor:fetchActionDetails and GET /v1alpha/{parent}/actionExecutor:fetchActions endpoints under v1alpha.projects.locations.instances.actionExecutor to fetch detailed descriptions and parameter schemas for specific actions on a SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. alert.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds getAiBillingSettings and PATCH /v1alpha/{aiBillingSettings.name} (updateAiBillingSettings) endpoints to read and update AI billing settings for an instance.
   • Adds full CRUDCRUDThe four basic database operations — Create, Read, Update, Delete — used as shorthand for any system that manages persistent data records, giving cyber tools a standard model for interacting with stored information. API under v1alpha.projects.locations.instances.agenticCaseReportTemplates — POST, GET, PATCH, and delete — to create, list, retrieve, update, and delete agentic case report templates.
   • Adds POST /v1alpha/{parent}/agenticCaseReports:generate, POST /v1alpha/{name}:publish, list, retrieve, update, download, and delete endpoints under v1alpha.projects.locations.instances.cases.agenticCaseReports to generate, manage, and publish agentic case reports.
   • Adds POST /v1alpha/{parent}/nativeDashboards:manageLease endpoint to manage dashboard leases for auto-refreshing charts.

   +5 more show less

   • Adds GET /v1/{parent}/searchedResults endpoint under v1.projects.locations.instances.searchSessions.searchedResults to retrieve results from a search session.
   • New endpoint documented: PATCH /v1alpha/{aiBillingSettings.name}
   • New endpoint documented: POST /v1alpha/{parent}/actionExecutor:fetchActionDetails
   • New endpoint documented: GET /v1alpha/{parent}/actionExecutor:fetchActions
   • New endpoint documented: POST /v1alpha/{parent}/agenticCaseReportTemplates

   10 details in Everything

2. changelog Oct 20, 2026 · issue 114

   Google SecOps adds 18 new log type ingestion targets and migrates ATI curated rules to the GTI_IOC feed.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢
   • Updates parsers for FORTINET_SANDBOX, PURE_STORAGE, RSA_NETWITNESS, and UPTYCS_EDR log types.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Updates Applied Threat Intelligence (ATI) curated detection rules to match against the GTI_IOC feed, replacing the legacy feeds; custom rules referencing legacy feeds must be manually migrated to GTI_IOC.
   • Updates parsers for FORTINET_SANDBOX, PURE_STORAGE, RSA_NETWITNESS, and UPTYCS_EDR log types.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !Custom YARA-LYARA-LA rule language developed by Google for Chronicle that extends YARA syntax to express multi-event, time-windowed detections over log data rather than single-file pattern matching. rules that still reference the legacy ATI feeds must be updated to use the GTI_IOC feed, or they will no longer match on the curated indicator data.
3. docs update Oct 15, 2026 · issue 109
   • Updated integration Updated default parsers
   • New integration New log types added without a default parser
4. October 12, 2026 (2026-10-12) Oct 12, 2026 · issue 110
   • Updated detection Applied Threat Intelligence curated rules migrated to GTI_IOC feed
   └──▷ BREAKING ON UPGRADE

   • !Custom rules referencing MANDIANT_ACTIVE_BREACH_IOC, MANDIANT_FUSION_IOC, or OPEN_SOURCE_INTEL_IOC must be updated to use GTI_IOC.
5. docs update Oct 11, 2026 · issue 102

   Google SecOps SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. Search gains SQL/GoogleSQLGoogleSQLGoogle's SQL dialect used in BigQuery and Spanner, offering standard SQL with extensions for nested data and analytic functions; tools build on it to query large datasets without a custom query language. dialect, natural-language query generation via Gemini, UDM Lookup, and data RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. scope enforcement.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢ ⤢
   └──▷ HOW TO FIND IT
   Run a BigQueryBigQueryA serverless, cloud-hosted analytical database from Google that runs SQL queries across massive datasets without managing infrastructure, giving cyber tools scalable storage and fast querying over large volumes of log or event data.-compatible multi-table join across UDM and Entity Context Graph when YARA-L 2.0YARA-L 2.0A rule language developed by Google for writing detection logic in Chronicle SIEM, extending YARA syntax to match sequences of log events over time rather than static file patterns. alone is insufficient for complex aggregations.
   📍In SIEM Search, click the query editor, select the SQL dialect tab, then enter your GoogleSQL query referencing UDM and ECG tables and click Run.
   Kick off a threat hunt from plain English without knowing YARA-LYARA-LA rule language developed by Google for Chronicle that extends YARA syntax to express multi-event, time-windowed detections over log data rather than single-file pattern matching. 2.0 syntax — ideal for fast triage or onboarding new analysts.
   📍In the SIEM Search natural language query bar, type: 'failed user logins over the last 3 days', then click Generate Query to have Gemini produce the YARA-L 2.0 equivalent in the query editor.
   Discover the exact UDM field that stores a suspicious hash value before writing a hunt query, avoiding trial-and-error field guessing.
   📍In SIEM Search, open UDM Lookup, set Match On to Values, enter 44d88612fea8a8f36de82e1278abb02f, select the returned field, then click Append to query.
   • Adds SQL (GoogleSQL) dialect to the query editor enabling BigQuery-compatible queries, multi-table joins across UDM and Entity Context Graph (ECG), and advanced aggregations; natural-language query generation via Gemini in the SIEM Search bar that converts English statements into YARA-L 2.0 queries with automatic time-range parameter adjustment; and UDM Lookup, letting analysts find UDM field names or stored string values and append results directly to a search query or copy them to the clipboard.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds chronicle.events.fetchEnrichedEvent, chronicle.savedSearches.update, chronicle.searchViews.update, chronicle.parsers.list, chronicle.parsers.get, chronicle.cases.get, and chronicle.cases.list as granular IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. permissions gating advanced search features.
   • Enforces data RBAC scope filtering across all SIEM Search tabs, restricting UDM events, raw logs, alerts, detections, and cases to the scopes assigned to the user role.
   • Adds configurable maximum search-result limits with a custom option (values between user-defined bounds) and a default value, settable per user in SIEM Search general settings, and documents maximum time ranges per search type: UDM/RAW 365 days; STATS 90 days; JOIN inner 90 days, inner without match 14 days, outer 14 days; CASE/CASE HISTORY 90 days.
   • Adds configurable query-editor auto-collapse after search execution to maximize results screen space, and syntax-error highlighting in the query editor that displays a red squiggly line under problematic text with hover-to-view error descriptions.

   +1 more show less

   • Adds Cases and Case History as searchable data streams in SIEM Search, correlating security cases and historical case audit logs with other security data.
   • Adds SQL (GoogleSQL) dialect to the query editor enabling BigQuery-compatible queries, multi-table joins across UDM and Entity Context Graph (ECG), and advanced aggregations; natural-language query generation via Gemini in the SIEM Search bar that converts English statements into YARA-L 2.0 queries with automatic time-range parameter adjustment; and UDM Lookup, letting analysts find UDM field names or stored string values and append results directly to a search query or copy them to the clipboard.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds chronicle.events.fetchEnrichedEvent, chronicle.savedSearches.update, chronicle.searchViews.update, chronicle.parsers.list, chronicle.parsers.get, chronicle.cases.get, and chronicle.cases.list as granular IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. permissions gating advanced search features.
   • Enforces data RBAC scope filtering across all SIEM Search tabs, restricting UDM events, raw logs, alerts, detections, and cases to the scopes assigned to the user role.
   • Adds Cases and Case History as searchable data streams in SIEM Search, correlating security cases and historical case audit logs with other security data.

   2 more in Everything

6. docs update Oct 11, 2026 · issue 102

   Google SecOps adds Terraform providers and client libraries for 14 Chronicle API resource types, and expands the roles/chronicle.restrictedDataAccessViewer IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. role.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ▶ ⤢
   • Adds Terraform providers and Google Cloud client libraries for 14 Chronicle API resource types: Feeds, Parsers, Rules, Findings Refinements, Retrohunts, Dashboards, Data Tables, Watchlists, Custom Lists, Environments, Environment Groups, Data Export, SOARSOARSecurity orchestration, automation and response, coordinating incident workflows across tools. Playbooks can gather evidence, assign work or carry out approved response actions. Domains, and SOAR Networks — enabling infrastructure-as-code provisioning and custom workflow automation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Expands the roles/chronicle.restrictedDataAccessViewer IAM role to include all read-only permissions from roles/chronicle.viewer, except chronicle.globalDataAccessScopes.permit, covering SOAR cases and playbooks, investigations, threat collections, findings, security validation, and ingestion resources within assigned data access scopes.
   • Adds Terraform providers and Google Cloud client libraries for 14 Chronicle API resource types: Feeds, Parsers, Rules, Findings Refinements, Retrohunts, Dashboards, Data Tables, Watchlists, Custom Lists, Environments, Environment Groups, Data Export, SOARSOARSecurity orchestration, automation and response, coordinating incident workflows across tools. Playbooks can gather evidence, assign work or carry out approved response actions. Domains, and SOAR Networks — enabling infrastructure-as-code provisioning and custom workflow automation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 more in Everything

7. October 08, 2026 (2026-10-08) Oct 8, 2026 · issue 109
   • Updated integration Updated supported default parsers
   • New integration New log types added without a default parser
8. api-docs-fae944499cee Oct 6, 2026 · issue 096

   Google SecOps adds AI-driven parser generation, Object RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. fetching, parser diagnostics, and ownership transfer endpoints.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   API change

   Google SecOps adds AI-driven parser generation, Object RBAC fetching, parser diagnostics, and ownership transfer endpoints.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • + GET /v1alpha/{parent}:fetchShareableObjects
   • + POST /v1alpha/{parent}/actions:aiGenerate
   • + GET /v1alpha/{parent}/parserRuntimeErrors
   • + POST /v1alpha/{parent}/parsers:generateAiCustomParser
   • + POST /v1alpha/{name}:refineAiCustomParser
   • + POST /v1alpha/{name}:transferOwnership
   • + POST /v1alpha/{name}:transferOwnership
   └──▷ TRY IT
   Diagnose why logs are failing to parse by pulling recent runtime errors for a specific log type.
   copy

   $ curl -X GET 'https://chronicle.googleapis.com/v1alpha/projects/<project>/locations/<location>/instances/<instance>/logTypes/<logType>/parserRuntimeErrors' -H 'Authorization: Bearer $(gcloud auth print-access-token)'

   Bootstrap a custom log parser from scratch without writing UDM mapping logic by hand — let the multi-agent pipeline draft it.
   copy

   $ curl -X POST 'https://chronicle.googleapis.com/v1alpha/projects/<project>/locations/<location>/instances/<instance>/logTypes/<logType>/parsers:generateAiCustomParser' -H 'Authorization: Bearer $(gcloud auth print-access-token)' -H 'Content-Type: application/json' -d '{}'

   • Adds GET /v1alpha/{parent}:fetchShareableObjects endpoint to list all Object RBAC-enabled objects within an instance.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds GET /v1alpha/{parent}/parserRuntimeErrors endpoint to list parser runtime errors and diagnostics for a given log type and time window.
   • Adds POST /v1alpha/{parent}/actions:aiGenerate endpoint to generate a new integration action definition using Gemini AI.
   • Adds POST /v1alpha/{parent}/parsers:generateAiCustomParser endpoint to generate a full custom parser using an autonomous multi-agent pipeline.
   • Adds POST /v1alpha/{name}:refineAiCustomParser endpoint to refine an existing custom parser or generation session based on user feedback.

   +7 more show less

   • Adds POST /v1alpha/{name}:transferOwnership endpoint to transfer ownership of a specified resource to a new principal.
   • New endpoint documented: GET /v1alpha/{parent}:fetchShareableObjects
   • New endpoint documented: POST /v1alpha/{parent}/actions:aiGenerate
   • New endpoint documented: GET /v1alpha/{parent}/parserRuntimeErrors
   • New endpoint documented: POST /v1alpha/{parent}/parsers:generateAiCustomParser
   • New endpoint documented: POST /v1alpha/{name}:refineAiCustomParser
   • New endpoint documented: POST /v1alpha/{name}:transferOwnership

   12 details in Everything

9. docs update Oct 6, 2026 · issue 096

   Google SecOps SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. Search adds SQL/GoogleSQLGoogleSQLGoogle's SQL dialect used in BigQuery and Spanner, offering standard SQL with extensions for nested data and analytic functions; tools build on it to query large datasets without a custom query language. query mode, natural-language query bar, UDM Lookup, and data RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. scope enforcement across all search tabs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢ ⤢
   └──▷ HOW TO FIND IT
   Quickly hunt for lateral movementlateral movementMoving from an initially compromised system or identity to other resources in a network. Attackers often use stolen credentials or trusted connections to expand their access. by asking in plain English — useful when you do not know the exact YARA-L 2.0YARA-L 2.0A rule language developed by Google for writing detection logic in Chronicle SIEM, extending YARA syntax to match sequences of log events over time rather than static file patterns. field syntax.
   📍In the SIEM Search page, click the natural language query bar and enter: 'failed user logins over the last 3 days', then click Generate Query to produce a YARA-L 2.0 query and click Run.
   Discover the correct UDM field name to use in a query when you only know part of the field name or a sample value stored in logs.
   📍In the SIEM Search page, open UDM Lookup, set Match On to values, enter a sample string (for example, winword.exe), review full-value and possible-value matches, select the relevant field, and click Append to add it to your query.
   • Adds chronicle.events.fetchEnrichedEvent, chronicle.savedSearches.update, chronicle.searchViews.update, chronicle.parsers.list, chronicle.parsers.get, chronicle.cases.get, and chronicle.cases.list as granular IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. permissions gating advanced search features.
   • Adds UDM Lookup — a field-discovery tool that searches schema field names or stored log values and lets you append results directly to a query in the editor.
   • Supports configurable maximum search result limits with a custom option accepting values in a defined range, and a configurable auto-collapse behavior for the query editor.
   • Adds chronicle.events.fetchEnrichedEvent, chronicle.savedSearches.update, chronicle.searchViews.update, chronicle.parsers.list, chronicle.parsers.get, chronicle.cases.get, and chronicle.cases.list as granular IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. permissions gating advanced search features.
   • Adds UDM Lookup — a field-discovery tool that searches schema field names or stored log values and lets you append results directly to a query in the editor.

   1 more in Everything

10. docs update Oct 6, 2026 · issue 096
    ▶ ⤢
    └──▷ TRY IT
    Grant a scoped analyst read-only access across all Google SecOps features within their data access scope, without permitting global data access.
    copy

    $ gcloud projects add-iam-policy-binding <project-id> \
      --member='user:<analyst@example.com>' \
      --role='roles/chronicle.restrictedDataAccessViewer'

11. October 05, 2026 (2026-10-05) Oct 5, 2026 · issue 095

    Terraform providers and Google Cloud client libraries now available for 14 Google SecOps Chronicle API resource types.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢
    • Adds Terraform provider support for managing Google SecOps resources as code across Feeds, Parsers, Rules, Findings Refinements, Retrohunts, Dashboards, Data Tables, Watchlists, Custom Lists, Environments, Environment Groups, Data Export, SOARSOARSecurity orchestration, automation and response, coordinating incident workflows across tools. Playbooks can gather evidence, assign work or carry out approved response actions. Domains, and SOAR Networks via the Chronicle API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds Google Cloud client library support for building custom integrations and automating Google SecOps workflows programmatically across the same Chronicle API resource types: Feeds, Parsers, Rules, Findings Refinements, Retrohunts, Dashboards, Data Tables, Watchlists, Custom Lists, Environments, Environment Groups, Data Export, SOAR Domains, and SOAR Networks.

    2 details in Everything

12. docs update Oct 4, 2026 · issue 094

    Google SecOps SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. Search gains SQL/GoogleSQLGoogleSQLGoogle's SQL dialect used in BigQuery and Spanner, offering standard SQL with extensions for nested data and analytic functions; tools build on it to query large datasets without a custom query language. dialect, natural-language query generation via Gemini, UDM Lookup, and granular IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. permissions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Run a BigQueryBigQueryA serverless, cloud-hosted analytical database from Google that runs SQL queries across massive datasets without managing infrastructure, giving cyber tools scalable storage and fast querying over large volumes of log or event data.-compatible multi-table join across UDM and Entity Context Graph directly in the SIEM Search console when YARA-L 2.0YARA-L 2.0A rule language developed by Google for writing detection logic in Chronicle SIEM, extending YARA syntax to match sequences of log events over time rather than static file patterns. is insufficient for your aggregation needs.
    📍In the SIEM Search query editor, click the dialect selector and choose SQL, then enter your GoogleSQL query joining UDM and ECG tables and click Run.
    Quickly kick off an investigation in plain English when you do not know the exact YARA-LYARA-LA rule language developed by Google for Chronicle that extends YARA syntax to express multi-event, time-windowed detections over log data rather than single-file pattern matching. syntax — Gemini translates the natural-language statement into a ready-to-run query.
    📍In the SIEM Search natural language query bar, type: failed user logins over the last 3 days — then click Generate Query to have Gemini produce the YARA-L 2.0 query automatically.
    • Adds SQL (GoogleSQL) dialect to the query editor, enabling BigQuery-compatible queries, complex multi-table joins across UDM and Entity Context Graph (ECG), and advanced aggregations directly in the console.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds chronicle.events.fetchEnrichedEvent IAM permission to gate access to enriched or extended event details in search results.
    • Adds chronicle.savedSearches.update and chronicle.searchViews.update IAM permissions to gate saving searches and editing search views.
    • Adds chronicle.parsers.list and chronicle.parsers.get IAM permissions to gate viewing log parsers and schema.
    • Adds chronicle.cases.get and chronicle.cases.list IAM permissions to gate searching Case History.

    +7 more show less

    • Adds natural-language query bar to the SIEM Search page, where analysts enter English-language statements and Gemini generates a valid YARA-L 2.0 query automatically, including auto-adjusting time range parameters from natural-language time terms.
    • Adds UDM Lookup feature to help analysts find UDM field names or stored log values while writing queries, with results usable as a query starting point, appended to an existing query, or copied to the clipboard.
    • Adds CASE and CASE HISTORY as searchable data streams on the SIEM Search page, enabling correlation of security cases and historical case audit logs with other security data (max 90-day range).
    • Enforces data RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. scope filtering across all SIEM Search tabs — UDM events, raw logs, alerts, detections, and cases are restricted to the scopes assigned to the user's role.
    • Adds configurable maximum search result count, accepting a custom value, with a default set by the platform.
    • Adds configurable query editor auto-collapse behavior after running a search, to maximize screen space for results.
    • Defines explicit maximum time ranges per search type: UDM/RAW — 365 days; STATS — 90 days; JOIN inner joins — 90 days; JOIN inner joins without match condition and outer joins — 14 days; CASE/CASE HISTORY — 90 days.

    12 details in Everything

13. docs update Oct 4, 2026 · issue 094

    The roles/chronicle.restrictedDataAccessViewer IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. role now includes all read-only permissions from roles/chronicle.viewer, except global data access.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ▶ ⤢
    • Expands roles/chronicle.restrictedDataAccessViewer to include all read-only permissions from roles/chronicle.viewer — covering SOARSOARSecurity orchestration, automation and response, coordinating incident workflows across tools. Playbooks can gather evidence, assign work or carry out approved response actions. cases and playbooks, investigations, threat collections, findings, security validation, and ingestion resources — while still excluding chronicle.globalDataAccessScopes.permit.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 detail in Everything

14. api-docs-c62f0d21376d Sep 26, 2026 · issue 086

    Google SecOps: Adds POST /v1beta/{parent}:search to execute searches and GET /v1beta/{parent}/searchedResults to retrieve results from a search session via the new v1beta.projects.locations.instances.searchSessions.searchedResults resource.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    API change

    Google SecOps: Adds `POST /v1beta/{parent}:search` to execute searches and `GET /v1beta/{parent}/searchedResults` to retrieve results from a search session via the new `v1beta.projects.locations.instances.searchSessions.searchedResults` resource.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • + POST /v1beta/{parent}:search
    • + POST /v1beta/{parent}/dataTableRows:bulkDelete
    • + POST /v1beta/{parent}/dataTableRows:bulkDeleteAsync
    • + GET /v1beta/{parent}/searchedResults
    • + GET /v1alpha/{name}:suggestQueryFields
    • + GET /v1alpha/{name}:fetchWizRelatedIssues
    • + GET /v1alpha/{name}:queryCaseViews
    • + POST /v1alpha/{name}:addCaseWallRecordTags
    • + GET /v1alpha/{parent}/caseWallRecords:queryAvailableCaseWallRecordTags
    • + POST /v1alpha/{name}:removeCaseWallRecordTags
    • + GET /v1alpha/{name}:fetchParserAuditEvents
    • + POST /v1alpha/{name}:execute
    • + POST /v1alpha/{parent}/remediationPlans:generate
    • + GET /v1alpha/{parent}/remediationPlans
    • + PATCH /v1alpha/{remediationPlan.name}
    • + POST /v1alpha/{parent}/remediationActions
    • + GET /v1alpha/{parent}/remediationActions
    • + GET /v1alpha/{parent}/remediationActionExecutions
    └──▷ TRY IT
    Pull Wiz-related security issues into a SecOps case to correlate cloud context with an active investigation.
    copy

    $ curl -X GET \
      'https://chronicle.googleapis.com/v1alpha/projects/<project>/locations/<location>/instances/<instance>/cases/<case_id>:fetchWizRelatedIssues' \
      -H 'Authorization: Bearer $(gcloud auth print-access-token)'

    • Adds GET /v1alpha/{name}:fetchWizRelatedIssues to fetch Wiz-related security issues for a specific case, enabling Wiz integration within SecOps case management.
    • Adds a full remediation-plan lifecycle API under v1alpha.projects.locations.instances.remediationPlans: POST /v1alpha/{parent}/remediationPlans:generate to trigger the remediation agent, POST /v1alpha/{name}:execute to execute a plan, GET /v1alpha/{parent}/remediationPlans to list plans, and PATCH /v1alpha/{remediationPlan.name} to update a plan.
    • Adds GET /v1alpha/{name}:suggestQueryFields to retrieve query field autosuggestions based on user and tenant-level usage.

    3 details in Everything

15. changelog Sep 26, 2026 · issue 086
    ⤢ ⤢
    └──▷ HOW TO FIND IT
    Scope a UDM search to events from a specific Google Cloud organization in a multi-org environment — no extra sink configuration needed.
    📍metadata.base_labels.ingestion_kv_labels["gcp_organization_id"] = <YOUR_GCP_ORGANIZATION_ID>
16. api-docs-c62f0d21376d Sep 25, 2026 · issue 085

    Google SecOps: Adds GET /v1alpha/{name}:fetchWizRelatedIssues to fetch Wiz-related security issues for a specific case.

    API change

    Google SecOps: Adds `GET /v1alpha/{name}:fetchWizRelatedIssues` to fetch Wiz-related security issues for a specific case.

    • + POST /v1beta/{parent}:search
    • + POST /v1beta/{parent}/dataTableRows:bulkDelete
    • + POST /v1beta/{parent}/dataTableRows:bulkDeleteAsync
    • + GET /v1beta/{parent}/searchedResults
    • + GET /v1alpha/{name}:suggestQueryFields
    • + GET /v1alpha/{name}:fetchWizRelatedIssues
    • + GET /v1alpha/{name}:queryCaseViews
    • + POST /v1alpha/{name}:addCaseWallRecordTags
    • + GET /v1alpha/{parent}/caseWallRecords:queryAvailableCaseWallRecordTags
    • + POST /v1alpha/{name}:removeCaseWallRecordTags
    • + GET /v1alpha/{name}:fetchParserAuditEvents
    • + POST /v1alpha/{name}:execute
    • + POST /v1alpha/{parent}/remediationPlans:generate
    • + GET /v1alpha/{parent}/remediationPlans
    • + PATCH /v1alpha/{remediationPlan.name}
    • + POST /v1alpha/{parent}/remediationActions
    • + GET /v1alpha/{parent}/remediationActions
    • + GET /v1alpha/{parent}/remediationActionExecutions
    └──▷ TRY IT
    Trigger the Remediation agent on a case and store the resulting plan — the first step toward automated response in SecOps.
    copy

    $ curl -X POST \
      'https://chronicle.googleapis.com/v1alpha/projects/<project>/locations/<location>/instances/<instance>/remediationPlans:generate' \
      -H 'Authorization: Bearer $(gcloud auth print-access-token)' \
      -H 'Content-Type: application/json' \
      -d '{"parent": "projects/<project>/locations/<location>/instances/<instance>"}'

    Pull all Wiz security issues linked to a SecOps case to correlate cloud posture findings with SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. alerts without leaving the platform.
    copy

    $ curl -X GET \
      'https://chronicle.googleapis.com/v1alpha/projects/<project>/locations/<location>/instances/<instance>/cases/<case>:fetchWizRelatedIssues' \
      -H 'Authorization: Bearer $(gcloud auth print-access-token)'

    Clean up stale rows from a data table at scale without blocking — then poll the returned operation for completion.
    copy

    $ curl -X POST \
      'https://chronicle.googleapis.com/v1beta/projects/<project>/locations/<location>/instances/<instance>/dataTables/<table>/dataTableRows:bulkDeleteAsync' \
      -H 'Authorization: Bearer $(gcloud auth print-access-token)' \
      -H 'Content-Type: application/json' \
      -d '{"filter": "create_time < \"2025-01-01T00:00:00Z\""}'

    • Adds the v1alpha.projects.locations.instances.remediationPlans resource with POST /v1alpha/{parent}/remediationPlans:generate to trigger the Remediation agent and save its output as a Remediation Plan.
    • Adds POST /v1alpha/{parent}/remediationActions to create a manual Remediation Action under a plan, and GET /v1alpha/{parent}/remediationActions to list actions under a plan, via the new v1alpha.projects.locations.instances.remediationPlans.remediationActions resource.

    2 details in Everything

17. changelog Sep 25, 2026 · issue 085

    Google SecOps auto-enriches direct-ingestion logs with the source GCP organization ID under metadata.base_labels.ingestion_kv_labels.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢
    └──▷ HOW TO FIND IT
    Filter UDM Search to a specific GCP organization in a multi-org environment, scoping investigation or detection results to only that org's logs.
    📍metadata.base_labels.ingestion_kv_labels["gcp_organization_id"] = <YOUR_GCP_ORGANIZATION_ID>
18. docs update Sep 25, 2026 · issue 085

    Google SecOps adds a User Preferences dialog for time zone, date/time format, notifications, and accessibility settings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Tune notification delivery so alerts reach you by email and set your local time zone to avoid timestamp confusion in investigations.
    📍1. Click your user avatar (top-right). 2. Select User preferences. 3. Under Localization, set Time Zone and Date/Time Format to match your region. 4. Under Notifications, click the User Notifications toggle to ON, select the desired notification types, and choose email or both for delivery. 5. Under Accessibility, set the feedback message duration to your preference.
19. docs update Sep 25, 2026 · issue 085

    Google SecOps adds a Gemini pane for in-product documentation Q&A with Google Search grounding and citations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Ask the Gemini pane how to investigate user logins without leaving the SecOps console.
    📍1. In Google SecOps, open the Gemini pane. 2. Enter the prompt: How do I investigate user logins 3. Review the generated summary and follow any linked documentation pages for deeper context.
    • Adds an in-product Gemini pane that answers natural-language questions about Google SecOps by summarizing relevant documentation and linking to related pages.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Gemini responses are grounded via Google Search, surfacing a Google G icon, search query chips, and citations so practitioners can verify sources used during an investigation.
    • Enables deletion of individual or all Gemini chat sessions via Delete chat and Delete all chat sessions controls in the Gemini pane.

    3 details in Everything

20. docs update Sep 25, 2026 · issue 085

    Google SecOps gains Gemini-powered natural-language search, YARA-LYARA-LA rule language developed by Google for Chronicle that extends YARA syntax to express multi-event, time-windowed detections over log data rather than single-file pattern matching. generation, AI case summaries, and an autonomous Triage and Investigation Agent⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢
    └──▷ HOW TO FIND IT
    Investigate an alert hands-free: let the Triage and Investigation Agent determine whether an alert is a true or false positive, then review its findings and explanation in the TIN dashboard.
    📍In the Google SecOps console, open an alert and select Investigate with Triage and Investigation Agent. Once the agent completes its plan, navigate to the TIN dashboard to review investigation volume, token usage, and the structured verdict.
    Refine an investigation search interactively — expand the time window and add filters — using natural language instead of editing UDM query syntax.
    📍In the Google SecOps search field or Gemini pane, enter: 'Show authentication failures for user jsmith in the last 7 days, filtered to events originating outside the US.' Use the Gemini pane to iteratively adjust scope or add additional filters.
    • Adds the Triage and Investigation Agent (TIN), which autonomously analyzes incoming security alerts, executes an investigation plan, and delivers a structured true/false-positive verdict with findings and a summarized explanation; operational data such as investigation volume and token usage is visible in the curated TIN dashboard.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds a Gemini pane and natural-language prompt support in the search field to build, edit, run, and iterate on searches — adjusting scope, time range, and filters — without writing queries manually.
    • Adds natural-language prompt-driven YARA-L rule generation so practitioners can describe detection logic in plain text and receive a ready-to-use rule.
    • Adds a Gemini case summary widget that presents an AI-generated summary of a case along with suggested remediation steps.
    • Adds Gemini-powered threat intelligence assistance for answering general security domain questions and providing summaries about threat actors, IOCsIOCsAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself., and other threat intelligence topics.

    +1 more show less

    • Adds Gemini-assisted playbook creation and editing, allowing analysts to create and modify SOARSOARSecurity orchestration, automation and response, coordinating incident workflows across tools. Playbooks can gather evidence, assign work or carry out approved response actions. playbooks using natural-language prompts.

    6 details in Everything

21. docs update Sep 25, 2026 · issue 085

    Google SecOps Content Hub centralizes discovery and deployment of detection rules, dashboards, playbooks, and SOARSOARSecurity orchestration, automation and response, coordinating incident workflows across tools. Playbooks can gather evidence, assign work or carry out approved response actions. integrations in one place.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Grant a SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. analyst read access to Content Hub search queries, dashboards, and playbooks while allowing a content admin to install them — using least-privilege IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. roles.
    📍In Google Cloud IAM, assign the chronicle.reader role to grant chronicle.googleapis.com/featuredContentSearchQueries.list, chronicle.googleapis.com/featuredContentNativeDashboards.list, and chronicle.googleapis.com/featuredContentPlaybooks.list permissions. Assign the chronicle.writer role to grant the corresponding .install permissions (featuredContentSearchQueries.install, featuredContentNativeDashboards.install, featuredContentPlaybooks.install) to content administrators only.
    Quickly onboard CrowdStrike Falcon coverage — finding and deploying its Content Pack, detections, and response integrations from a single search.
    📍In Content Hub, go to Home › Search and type Crowdstrike. Review the returned Content Packs (1), Curated Detections (42), Response Integrations (2), and Dashboards (3). Click the CrowdStrike Falcon Comprehensive Pack, configure the feed for your log type, then click Configure Integrations to set up the playbook integration instance.
    • Adds chronicle.googleapis.com/featuredContentSearchQueries.get, .list, and .install IAM permissions to control access to saved search query content in Content Hub.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds chronicle.googleapis.com/featuredContentRules.list IAM permission to control access to featured curated detection rules in Content Hub.
    • Adds chronicle.googleapis.com/featuredContentNativeDashboards.get, .list, and .install IAM permissions to control access to dashboard content in Content Hub.
    • Adds chronicle.googleapis.com/feedPacks.get and .list IAM permissions to control access to feed packs in Content Hub.
    • Adds chronicle.googleapis.com/featuredContentPlaybooks.get, .list, and .install IAM permissions to control access to featured playbook content in Content Hub.

    +6 more show less

    • New Content Hub centralizes discovery, deployment, and management of Content Packs, curated detections, dashboards, saved search queries, playbooks, playbook blocks, Power Ups, and SOAR response integrations.
    • Cross-type search on the Content Hub Home page lets practitioners search Content Packs, Detections, Response Integrations, and Dashboards simultaneously and see match counts per type.
    • Response Integrations page supports rolling back an integration to a previous version when an update causes issues or custom code changes need reverting.
    • Playbooks and Blocks page allows filtering playbooks by installed integrations or by specific integrations before installing.
    • Power Ups page enables discovery, installation, and configuration of Google SecOps Power Ups for use in playbooks.
    • Search Queries page allows adding saved SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. search queries that are immediately shared across the instance.

    11 details in Everything

22. docs update Sep 25, 2026 · issue 085

    Google SecOps adds Agentic Automation to embed AI agents directly into SOARSOARSecurity orchestration, automation and response, coordinating incident workflows across tools. Playbooks can gather evidence, assign work or carry out approved response actions. playbooks for adaptive triage and investigation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Add a TIN agent step to a phishing-alert playbook and branch automatically on verdict — routing confirmed threats to isolation and high-confidence false positives to auto-close, to reduce analyst noise.
    📍1. Go to Response › Playbooks and open your phishing alert playbook. 2. In the Step Selection panel, expand the AI Agents category and drag the TIN agent step onto the canvas. 3. In the configuration panel, set Action type to Automatic and enable Retry on failure. 4. Under Error Handling (If step fails), select Skip to the next step so the workflow continues even if the alert type is unsupported. 5. Drag a Flow block (Conditional) after the AI Agent step, open the Placeholder menu, select the AI Agent step results, and use the Expression Builder to evaluate the verdict field. 6. Wire the True Positive branch to an Isolate Host action and the False Positive (High Confidence) branch (confidence_level = high) to a Close Alert action.
    Opt in the TIN agent for your tenant so automatic investigations trigger on supported SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. detection engine alerts without manual intervention.
    📍1. Open any case in Case Overview. 2. Open the Gemini Investigations side drawer. 3. Navigate to the settings of the Gemini investigation side menu. 4. Locate the Triage and Investigation Agent (TIN) integration and toggle it on for your tenant.
    • Adds Agentic Automation to Google SecOps playbooks, enabling AI agents to be embedded as discrete steps alongside deterministic automation — pausing the playbook asynchronously while the agent works without occupying the execution queue.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Integrates the Triage and Investigation Agent (TIN) as the first supported agent, delivering autonomous alert analysis with first-party enrichment, a True Positive / False Positive verdict, and a confidence_level score usable in downstream playbook logic.
    • Exposes verdict and confidence_level fields from AI Agent step results in the Expression Builder, enabling conditional branching (remediation, auto-close, or manual review) driven by the agent's structured JSON output.
    • Surfaces agent triage findings in the Gemini Investigations side drawer and in the AI Agent step results within Case Overview, with three tracked states: Not Run, Running, and Completed.

    4 details in Everything

23. docs update Sep 25, 2026 · issue 085

    Google Unified Security launches with Chrome Enterprise Premium integration, multi-cloud CDIR, and AI Protection for securing AI workloads⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢
    └──▷ HOW TO FIND IT
    Enable Chrome Enterprise Premium threat detections and browser telemetry ingestion into Google SecOps to catch malicious extensions, phishing, and credential theft originating from the browser.
    📍1. Configure the Chrome Enterprise Premium Reporting Connector to send data to Google SecOps. 2. Connect Chrome Enterprise Premium to Google SecOps. 3. Enable Chrome Enterprise Threats Curated Detections.
    Activate multi-cloud CDIR so SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. analysts can investigate privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources. and lateral movementlateral movementMoving from an initially compromised system or identity to other resources in a network. Attackers often use stolen credentials or trusted connections to expand their access. across Google Cloud, AWS, and Azure within a single Google SecOps instance.
    📍1. Activate the Enterprise Tier of SCC-E using your existing Google SecOps instance. 2. Validate Security Command Center Detection Services are enabled. 3. Connect Security Command Center to AWS (and optionally Azure, currently in Preview). 4. Ingest Google Cloud logs, AWS logs, and Azure logs into Google SecOps. 5. Enable the CDIR Curated Detections.
    • Adds Chrome Enterprise Premium (CEP) integration with Google SecOps, enabling browser-sourced threat visibility with curated detections enriched by Safe Browsing and Google Threat Intelligence (GTI).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds dedicated Google SecOps dashboards for Chrome security events and anomalies to support investigation of browser-based threats.
    • Adds native playbook orchestration for automated Chrome Enterprise response actions — including blocking malicious URLs, blocking extensions, and quarantining devices — directly from Google SecOps.
    • Adds Cloud Detection, Investigation, and Response (CDIR) capability integrating Security Command Center Enterprise with Google SecOps for unified case management, SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. log searching, and SOARSOARSecurity orchestration, automation and response, coordinating incident workflows across tools. Playbooks can gather evidence, assign work or carry out approved response actions. workflows across Google Cloud, AWS, and Azure.
    • Adds Cloud Asset Inventory collection from multi-cloud environments (Google Cloud, AWS, Azure) flowing into the Google SecOps Entity Graph to enrich alerts with asset context such as region, owner, and metadata tags.

    +6 more show less

    • Adds CDIR Curated Detections driven by Cloud Threat intelligence, including detection types such as SCC Enhanced Privilege Escalation, automatically mapped to Google SecOps cases.
    • Adds Security Command Center connection to AWS for configuration and resource data feeding the Entity Graph.
    • Adds preview support for connecting Security Command Center to Azure for configuration and resource data feeding the Entity Graph.
    • Adds AI Protection within Security Command Center Enterprise (SCC-E), providing discovery of AI inventory (models, datasets, applications), virtual red teaming for attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. analysis, and detection and response for AI-specific threats including LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. hijacking, data poisoning, and exfiltration.
    • Adds Model Armor, a model-agnostic prompt and response screening capability protecting against data loss and offensive content across Google and third-party AI models on multiple clouds.
    • Supports SIEM log searching using natural language syntax, Yara-L syntax, or raw log search against ingested cloud infrastructure logs including Google Cloud audit logs, AWS CloudTrailCloudTrailAWS service that records API calls and account activity across an AWS environment, giving cyber tools an audit log to detect anomalous or malicious actions., GuardDuty events, and Azure AD activity logs.

    11 details in Everything

24. docs update Sep 25, 2026 · issue 085

    Google SecOps Ingestion API docs detail batch deduplication, regional endpoints, and UDM vs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ unstructured log ingestion paths

    └──▷ TRY IT
    Send a batch of pre-parsed UDM events directly to Google SecOps, bypassing server-side parsing to reduce ingestion latency.
    copy

    $ curl -X POST 'https://malachiteingestion-pa.googleapis.com/v2/udmevents:batchCreate' \
      -H 'Authorization: Bearer $(gcloud auth print-access-token)' \
      -H 'Content-Type: application/json' \
      -d '{
        "customer_id": "c8c65bfa-5f2c-42d4-9189-64bb7b939f2c",
        "events": [
          {
            "metadata": {
              "event_timestamp": "2024-06-01T12:00:00.000Z",
              "event_type": "USER_LOGIN",
              "product_name": "Acme SSO",
              "vendor_name": "Acme"
            },
            "principal": {"ip": ["10.1.2.3"]},
            "target": {"user": {"userid": "mary@example.com"}}
          }
        ]
      }'

    Route log ingestion to the European multi-region endpoint to satisfy data residency requirements.
    copy

    $ curl -X POST 'https://europe-malachiteingestion-pa.googleapis.com/v2/udmevents:batchCreate' \
      -H 'Authorization: Bearer $(gcloud auth print-access-token)' \
      -H 'Content-Type: application/json' \
      -d '{
        "customer_id": "c8c65bfa-5f2c-42d4-9189-64bb7b939f2c",
        "events": [...]
      }'

    • Supports POST https://malachiteingestion-pa.googleapis.com/v2/udmevents:batchCreate to ingest pre-parsed UDM events that bypass the CBN parsing layer and go directly to indexing and the rules engine, reducing end-to-end latency.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Implements batch-level deduplication: a batch ID is hashed from customer_id and log entry content (excluding log type, namespace, labels, and feed ID); duplicate batches for the same customer and log type are rejected entirely.
    • Supports ingesting unstructured logs via a separate endpoint, with normalization handled inside Google SecOps infrastructure and data surfaced through the UI or Raw Log Scan.
    • Requires allowlisting oauth2.googleapis.com, www.googleapis.com, and <region>-chronicle.googleapis.com for egress proxy configurations.
    • Supports automating IP-range allowlist updates by periodically fetching Google Services IP ranges from https://www.gstatic.com/ipranges/goog.json and https://www.gstatic.com/ipranges/cloud.json.

    5 details in Everything

25. docs update Sep 25, 2026 · issue 085

    Google SecOps Detection Engine API adds full programmatic rule management via YARA-L 2.0YARA-L 2.0A rule language developed by Google for writing detection logic in Chronicle SIEM, extending YARA syntax to match sequences of log events over time rather than static file patterns. endpoints across 19 regional endpoints⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢
    └──▷ TRY IT
    Push a new YARA-LYARA-LA rule language developed by Google for Chronicle that extends YARA syntax to express multi-event, time-windowed detections over log data rather than single-file pattern matching. 2.0 detection rule into Google SecOps without activating it yet, so you can review it before going live.
    copy

    $ curl -s -X POST 'https://backstory.googleapis.com/v2/detect/rules' \
      -H 'Authorization: Bearer $(gcloud auth print-access-token)' \
      -H 'Content-Type: application/json' \
      -d '{"ruleText": "rule detect_dns_exfil {\nmeta:\n  author = \"analyst\"\n  description = \"Detect high-volume DNS queries\"\nevents:\n  $e.metadata.event_type = \"NETWORK_DNS\"\ncondition:\n  $e\n}"}'

    Cancel a running retrohunt against a specific versioned rule when you realize the rule logic needs adjustment mid-hunt.
    copy

    $ curl -s -X POST 'https://backstory.googleapis.com/v2/detect/rules/ru_30979d84-aa89-47d6-bf4d-b4bb0eacb497@v_1612472807_179679000/retrohunts/oh_8d424a95-5b74-4330-ab6e-5b1096d13d94:cancelRetrohunt' \
      -H 'Authorization: Bearer $(gcloud auth print-access-token)'

    Route Detection Engine API calls to the Frankfurt regional endpoint to satisfy EU data-residency requirements.
    copy

    $ curl -s -X POST 'https://europe-west3-backstory.googleapis.com/v2/detect/rules/ru_e6abfcb5-1b85-41b0-b64c-695b3250436f:enableLiveRule' \
      -H 'Authorization: Bearer $(gcloud auth print-access-token)'

    • Adds POST https://backstory.googleapis.com/v2/detect/rules (CreateRule) to create a new YARA-L 2.0 detection rule without immediately setting it live.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds POST https://backstory.googleapis.com/v2/detect/rules/{ruleId}:createVersion (CreateRuleVersion) to create a new version of an existing rule, including from non-latest versions.
    • Adds DELETE https://backstory.googleapis.com/v2/detect/rules/{ruleId} (DeleteRule) to programmatically delete a specified rule.
    • Adds POST https://backstory.googleapis.com/v2/detect/rules/{ruleId}:archive (ArchiveRule) to archive a specified rule.
    • Adds POST https://backstory.googleapis.com/v2/detect/rules/{ruleId}/retrohunts/{retrohuntId}:cancelRetrohunt (CancelRetrohunt) to cancel an in-progress retrohunt, targeting either the latest or a specific rule version.

    +3 more show less

    • Adds POST https://backstory.googleapis.com/v2/detect/rules/{ruleId}:enableLiveRule and POST https://backstory.googleapis.com/v2/detect/rules/{ruleId}:disableLiveRule to activate or deactivate live rule execution.
    • Supports 19 regional API endpoints for the Detection Engine API, including https://europe-backstory.googleapis.com (Europe Multi-Region), https://backstory.googleapis.com (US Multi-Region), and region-specific endpoints for São Paulo, Canada, Dammam, Doha, Frankfurt, Jakarta, Johannesburg, London, Mumbai, Paris, Warsaw, Singapore, Sydney, Tel Aviv, Tokyo, Turin, and Zurich.
    • Authenticates Detection Engine API calls via Google Developer Service Account credentials scoped to https://www.googleapis.com/auth/chronicle-backstory using google.oauth2 and googleapiclient.

    8 details in Everything

26. docs update Sep 25, 2026 · issue 085

    Google SecOps Backstory Search API reference published, covering endpoints for events, assets, IOCsIOCsAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself., and alerts with regional endpoint support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Retrieve all assets that contacted a known-malicious domain over a two-day window to scope lateral exposure during an incident.
    copy

    $ curl -H 'Authorization: Bearer $(gcloud auth print-access-token)' 'https://backstory.googleapis.com/v1/artifact/listassets?artifact.domain_name=www.altostrat.com&start_time=2024-06-01T00:00:00Z&end_time=2024-06-03T00:00:00Z&page_size=100'

    Fetch the full parsed UDM event for a specific event ID surfaced in the Google SecOps UI Event Viewer to enrich an alert programmatically.
    copy

    $ curl -H 'Authorization: Bearer $(gcloud auth print-access-token)' 'https://backstory.googleapis.com/v1/event:get?name=ABCDEF1ghiJKlmnOpqrs2tuv3wXYYYYYZZABCD4ABCD='

    Authenticate a Python script to the Backstory API using a service account credential so all subsequent API calls are OAuth-authorized.
    python copy

    from google.auth.transport import requests
    from google.oauth2 import service_account
    
    SCOPES = ['https://www.googleapis.com/auth/chronicle-backstory']
    SERVICE_ACCOUNT_FILE = '/customer-keys/apikeys-demo.json'
    
    credentials = service_account.Credentials.from_service_account_file(
        SERVICE_ACCOUNT_FILE, scopes=SCOPES)
    http_session = requests.AuthorizedSession(credentials)
    
    response = http_session.request('GET',
        'https://backstory.googleapis.com/v1/event:get?name=ABCDEF1ghiJKlmnOpqrs2tuv3wXYYYYYZZABCD4ABCD=')
    print(response.json())

    • Adds GET https://backstory.googleapis.com/v1/events/log:get/?name={UID} endpoint to retrieve a single raw log by UDM event metadata.id.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds GET https://backstory.googleapis.com/v1/event:get?name={UID} endpoint to retrieve a single parsed UDM event by metadata.id.
    • Adds GET https://backstory.googleapis.com/v1/artifact/listassets endpoint to list all assets that accessed a given artifact (domain, destination IP, MD5/SHA1/SHA256SHA256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. hash) within a time range, with artifact.domain_name, artifact.destination_ip_address, artifact.hash_md5, artifact.hash_sha1, artifact.hash_sha256, start_time, end_time, and page_size parameters; returns up to 100 assets per request.
    • Exposes regional Backstory API endpoints across 19 regions including https://europe-backstory.googleapis.com, https://southamerica-east1-backstory.googleapis.com, https://me-central2-backstory.googleapis.com, and others, enabling data-residency-aware API access.
    • Enforces per-method query submission rate limits on the Search API: ListAlerts, ListEvents, ListIocs, ListIocDetails, ListAssetAliases, ListUserAliases at 1 QPS; ListAssets at 5 QPS; GetLog and GetEvent at 60 QPS; returns HTTP 429 (RESOURCE_EXHAUSTED) when exceeded.

    +1 more show less

    • Documents a 10-minute UDM search timeout for API-submitted queries (versus 1-hour timeout for UI-submitted queries), with page_size parameter available to limit result volume.

    6 details in Everything

27. docs update Sep 25, 2026 · issue 085

    Google SecOps adds GoogleSQLGoogleSQLGoogle's SQL dialect used in BigQuery and Spanner, offering standard SQL with extensions for nested data and analytic functions; tools build on it to query large datasets without a custom query language. search, case playbooks, reaction triggers, Detection Engineering Agent, and GA customizable rule schedules⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ▶ ⤢
    └──▷ TRY IT
    Filter UDM search results to events from a specific Google Cloud organization when multiple orgs feed into the same SecOps instance.
    copy

    $ metadata.base_labels.ingestion_kv_labels.key = 'gcp_organization_id' AND metadata.base_labels.ingestion_kv_labels.value = '123456789012'

    • Adds match_all option to the Grok filter in parser syntax, extracting all non-overlapping pattern occurrences in a field instead of only the first match.
    • Adds GoogleSQL query support (public preview) in Search, supporting both declarative SQL and Piped SQL syntax to query UDM events, entity graphs, detection rules, and case management telemetry tables.
    • Adds case playbooks (preview) enabling playbooks and manual actions to run across an entire case container rather than individual alerts.
    • Adds reaction triggers (preview) so playbooks automatically fire in response to real-time case or alert updates such as changes to assignee, tags, alert priority, or newly added entities.
    • Adds self-service Bindplane Enterprise license download (preview) for Enterprise Plus and Google Unified Security customers under SIEM Settings > Collection Agents.

    +9 more show less

    • Adds Unroll processor to Data Processing Pipelines, splitting log entries containing arrays or slices into multiple discrete log events before parsing and ingestion.
    • Adds Operations in the Emerging Threats Center feed, providing granular threat intelligence from frontline investigations scoped to individual organizations alongside global Campaigns.
    • Adds three distinct relative time filter operators — Past, Previous, and Current (public preview) — eliminating ambiguity between rolling windows and calendar-aligned periods across dashboards and Search.
    • Adds Side-by-side view layout (public preview) to the Alerts & Detections tab in the revamped Investigation Management experience, showing alert metadata and Gemini insights in an adjacent pane.
    • Adds Detection Engineering Agent (public preview), an AI assistant accessible via Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. (MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface.) tools that extracts threat intelligence and drafts YARA-LYARA-LA rule language developed by Google for Chronicle that extends YARA syntax to express multi-event, time-windowed detections over log data rather than single-file pattern matching. detection rules.
    • Adds event simulation (public preview) to programmatically deliver threat sequences into the live ingestion pipeline for full-funnel detection coverage evaluation from UDM normalization through multi-event correlation.
    • Promotes customizable schedules for multi-event rules to General Availability, with configurable first-run delay offsets (1 minute to 48 hours), automated true-up runs at 4 hours and optionally 30 hours, and migration of legacy rules from the Rules Dashboard; requires chronicle.rules.modifyRules and chronicle.ruleDeployments.update IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. permissions for custom roles.
    • Adds Mandiant Frontline Threats rule packs to Curated Detections in Content Hub: Mandiant Frontline Threats for Linux, Mandiant Frontline Threats for MacOS, and Mandiant Frontline Threats for Google Cloud.
    • Adds resizable Case preview and Alert and detection preview side panels in the Investigation Management experience, adjustable via mouse or keyboard shortcuts.
    • Adds GoogleSQL query support (public preview) in Search, supporting both declarative SQL and Piped SQL syntax to query UDM events, entity graphs, detection rules, and case management telemetry tables.
    • Adds case playbooks (preview) enabling playbooks and manual actions to run across an entire case container rather than individual alerts.
    • Adds reaction triggers (preview) so playbooks automatically fire in response to real-time case or alert updates such as changes to assignee, tags, alert priority, or newly added entities.
    • Adds self-service Bindplane Enterprise license download (preview) for Enterprise Plus and Google Unified Security customers under SIEM Settings > Collection Agents.
    • Adds Unroll processor to Data Processing Pipelines, splitting log entries containing arrays or slices into multiple discrete log events before parsing and ingestion.

    +4 more show less

    • Adds Operations in the Emerging Threats Center feed, providing granular threat intelligence from frontline investigations scoped to individual organizations alongside global Campaigns.
    • Adds Detection Engineering Agent (public preview), an AI assistant accessible via Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. (MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface.) tools that extracts threat intelligence and drafts YARA-LYARA-LA rule language developed by Google for Chronicle that extends YARA syntax to express multi-event, time-windowed detections over log data rather than single-file pattern matching. detection rules.
    • Adds event simulation (public preview) to programmatically deliver threat sequences into the live ingestion pipeline for full-funnel detection coverage evaluation from UDM normalization through multi-event correlation.
    • Adds Mandiant Frontline Threats rule packs to Curated Detections in Content Hub: Mandiant Frontline Threats for Linux, Mandiant Frontline Threats for MacOS, and Mandiant Frontline Threats for Google Cloud.

    5 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !Effective January 25, 2027, write permissions will be removed from the chronicle.readonly OAuth scope; any workflow using chronicle.readonly for write operations must be updated to use the chronicle OAuth scope.
    • !After March 18, 2027, the MANDIANT_ACTIVE_BREACH_IOC, MANDIANT_FUSION_IOC, and OPEN_SOURCE_INTEL_IOC feeds will be removed; migrate to the GTI_IOC feed before that date.
28. api-docs-c62f0d21376d Sep 24, 2026 · issue 084

    Google SecOps adds remediation plans, Wiz integration, bulk data-table ops, and search-session result retrieval via new REST APIsREST APIsA convention for building HTTP-based interfaces where resources are addressed by URL and manipulated with standard verbs like GET, POST, and DELETE, giving cyber tools a predictable way to integrate with external services..⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    API change

    Google SecOps adds remediation plans, Wiz integration, bulk data-table ops, and search-session result retrieval via new REST APIs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • + POST /v1beta/{parent}:search
    • + POST /v1beta/{parent}/dataTableRows:bulkDelete
    • + POST /v1beta/{parent}/dataTableRows:bulkDeleteAsync
    • + GET /v1beta/{parent}/searchedResults
    • + GET /v1alpha/{name}:suggestQueryFields
    • + GET /v1alpha/{name}:fetchWizRelatedIssues
    • + GET /v1alpha/{name}:queryCaseViews
    • + POST /v1alpha/{name}:addCaseWallRecordTags
    • + GET /v1alpha/{parent}/caseWallRecords:queryAvailableCaseWallRecordTags
    • + POST /v1alpha/{name}:removeCaseWallRecordTags
    • + GET /v1alpha/{name}:fetchParserAuditEvents
    • + POST /v1alpha/{name}:execute
    • + POST /v1alpha/{parent}/remediationPlans:generate
    • + GET /v1alpha/{parent}/remediationPlans
    • + PATCH /v1alpha/{remediationPlan.name}
    • + POST /v1alpha/{parent}/remediationActions
    • + GET /v1alpha/{parent}/remediationActions
    • + GET /v1alpha/{parent}/remediationActionExecutions
    └──▷ TRY IT
    Trigger an AI-generated remediation plan for a case, then execute it — useful when responding to a confirmed incident and you want automated remediation steps applied immediately.
    copy

    $ # Step 1: generate a remediation plan
    curl -X POST \
      'https://chronicle.googleapis.com/v1alpha/projects/<project>/locations/<location>/instances/<instance>/remediationPlans:generate' \
      -H 'Authorization: Bearer $(gcloud auth print-access-token)' \
      -H 'Content-Type: application/json' \
      -d '{"parent": "projects/<project>/locations/<location>/instances/<instance>"}'
    
    # Step 2: execute the returned plan
    curl -X POST \
      'https://chronicle.googleapis.com/v1alpha/<remediationPlan.name>:execute' \
      -H 'Authorization: Bearer $(gcloud auth print-access-token)' \
      -H 'Content-Type: application/json' \
      -d '{}'

    Pull Wiz-related security issues into a SecOps case to correlate cloud posture findings with SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. alerts without leaving the platform.
    copy

    $ curl -X GET \
      'https://chronicle.googleapis.com/v1alpha/<name>:fetchWizRelatedIssues' \
      -H 'Authorization: Bearer $(gcloud auth print-access-token)'

    • Adds POST /v1beta/{parent}:search to initiate search sessions, plus GET /v1beta/{parent}/searchedResults under the new v1beta.projects.locations.instances.searchSessions.searchedResults resource to page through results.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds POST /v1beta/{parent}/dataTableRows:bulkDelete and POST /v1beta/{parent}/dataTableRows:bulkDeleteAsync for synchronous and asynchronous bulk deletion of data table rows.
    • Adds GET /v1alpha/{name}:queryCaseViews to query available views for a case.
    • Adds POST /v1alpha/{name}:addCaseWallRecordTags and POST /v1alpha/{name}:removeCaseWallRecordTags to add or remove tags on a CaseWallRecord.
    • Adds GET /v1alpha/{parent}/caseWallRecords:queryAvailableCaseWallRecordTags to list all available CaseActivityTags.

    +21 more show less

    • Adds GET /v1alpha/{name}:fetchParserAuditEvents to retrieve the unified parser and augmentation audit timeline for a LogType.
    • Introduces the v1alpha.projects.locations.instances.remediationPlans resource family with endpoints to generate (POST /v1alpha/{parent}/remediationPlans:generate), execute (POST /v1alpha/{name}:execute), list (GET /v1alpha/{parent}/remediationPlans), retrieve, and update (PATCH /v1alpha/{remediationPlan.name}) AI-suggested remediation plans.
    • Adds GET /v1alpha/{parent}/remediationActionExecutions under v1alpha.projects.locations.instances.remediationPlans.remediationActions.remediationActionExecutions to list execution records for a remediation action.
    • New endpoint documented: POST /v1beta/{parent}:search
    • New endpoint documented: POST /v1beta/{parent}/dataTableRows:bulkDelete
    • New endpoint documented: POST /v1beta/{parent}/dataTableRows:bulkDeleteAsync
    • New endpoint documented: GET /v1beta/{parent}/searchedResults
    • New endpoint documented: GET /v1alpha/{name}:suggestQueryFields
    • New endpoint documented: GET /v1alpha/{name}:fetchWizRelatedIssues
    • New endpoint documented: GET /v1alpha/{name}:queryCaseViews
    • New endpoint documented: POST /v1alpha/{name}:addCaseWallRecordTags
    • New endpoint documented: GET /v1alpha/{parent}/caseWallRecords:queryAvailableCaseWallRecordTags
    • New endpoint documented: POST /v1alpha/{name}:removeCaseWallRecordTags
    • New endpoint documented: GET /v1alpha/{name}:fetchParserAuditEvents
    • New endpoint documented: POST /v1alpha/{name}:execute
    • New endpoint documented: POST /v1alpha/{parent}/remediationPlans:generate
    • New endpoint documented: GET /v1alpha/{parent}/remediationPlans
    • New endpoint documented: PATCH /v1alpha/{remediationPlan.name}
    • New endpoint documented: POST /v1alpha/{parent}/remediationActions
    • New endpoint documented: GET /v1alpha/{parent}/remediationActions
    • New endpoint documented: GET /v1alpha/{parent}/remediationActionExecutions

    26 details in Everything

29. docs update Sep 24, 2026 · issue 084

    Google SecOps: Adds metadata.base_labels.ingestion_kv_labels field (key: gcp_organization_id) to UDM events from Google Cloud direct ingestion, enabling multi-org log source identification without extra sink configuration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ▶ ⤢
    └──▷ USE IT
    Scope a YARA-LYARA-LA rule language developed by Google for Chronicle that extends YARA syntax to express multi-event, time-windowed detections over log data rather than single-file pattern matching. detection rule to a specific Google Cloud organization in a multi-org environment by filtering on the auto-enriched org ID label.
    text copy

    // In your YARA-L 2.0 rule, filter UDM events by org ID:
    events:
      $e.metadata.base_labels.ingestion_kv_labels["gcp_organization_id"] = "123456789012"

    Download the Bindplane Enterprise license key from the console to onboard a new collection agent without raising a support ticket.
    📍In the Google SecOps console, go to Settings › SIEM Settings › Collection Agents, then select 'Download Bindplane Enterprise (Google Edition) license key'.
    └──▷ BREAKING ON UPGRADE

    • !Effective January 25, 2027, write permissions will be removed from the chronicle.readonly OAuth scope; any workflow performing write operations must be updated to use the chronicle OAuth scope.
    • !After March 18, 2027, the MANDIANT_ACTIVE_BREACH_IOC, MANDIANT_FUSION_IOC, and OPEN_SOURCE_INTEL_IOC feeds will be removed; migrate to the GTI_IOC feed before that date.
30. api-docs-c62f0d21376d Sep 23, 2026 · issue 083

    Google SecOps: Adds POST /v1alpha/{parent}/remediationPlans:generate to trigger the Remediation agent and save its output as a Remediation Plan.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    API change

    Google SecOps: Adds `POST /v1alpha/{parent}/remediationPlans:generate` to trigger the Remediation agent and save its output as a Remediation Plan.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • + POST /v1beta/{parent}:search
    • + POST /v1beta/{parent}/dataTableRows:bulkDelete
    • + POST /v1beta/{parent}/dataTableRows:bulkDeleteAsync
    • + GET /v1beta/{parent}/searchedResults
    • + GET /v1alpha/{name}:suggestQueryFields
    • + GET /v1alpha/{name}:fetchWizRelatedIssues
    • + GET /v1alpha/{name}:queryCaseViews
    • + POST /v1alpha/{name}:addCaseWallRecordTags
    • + GET /v1alpha/{parent}/caseWallRecords:queryAvailableCaseWallRecordTags
    • + POST /v1alpha/{name}:removeCaseWallRecordTags
    • + GET /v1alpha/{name}:fetchParserAuditEvents
    • + POST /v1alpha/{name}:execute
    • + POST /v1alpha/{parent}/remediationPlans:generate
    • + GET /v1alpha/{parent}/remediationPlans
    • + PATCH /v1alpha/{remediationPlan.name}
    • + POST /v1alpha/{parent}/remediationActions
    • + GET /v1alpha/{parent}/remediationActions
    • + GET /v1alpha/{parent}/remediationActionExecutions
    └──▷ TRY IT
    Kick off the Remediation agent for a case and persist the resulting plan — useful immediately after triage to get AI-suggested remediation steps.
    copy

    $ curl -X POST \
      'https://chronicle.googleapis.com/v1alpha/projects/<project>/locations/<location>/instances/<instance>/remediationPlans:generate' \
      -H 'Authorization: Bearer $(gcloud auth print-access-token)' \
      -H 'Content-Type: application/json' \
      -d '{"parent": "projects/<project>/locations/<location>/instances/<instance>"}'

    Pull Wiz-linked security issues into a SecOps case so responders see cloud-side risk context without leaving the platform.
    copy

    $ curl -X GET \
      'https://chronicle.googleapis.com/v1alpha/projects/<project>/locations/<location>/instances/<instance>/cases/<case>:fetchWizRelatedIssues' \
      -H 'Authorization: Bearer $(gcloud auth print-access-token)'

    Fetch parser audit events for a log type to review the full ingestion-pipeline change history during an incident investigation.
    copy

    $ curl -X GET \
      'https://chronicle.googleapis.com/v1alpha/projects/<project>/locations/<location>/instances/<instance>/logTypes/<logType>:fetchParserAuditEvents' \
      -H 'Authorization: Bearer $(gcloud auth print-access-token)'

    • Adds POST /v1alpha/{name}:execute to execute a suggested Remediation Plan.
    • Adds GET /v1alpha/{parent}/remediationPlans to list Remediation Plans with optional filtering.
    • Adds PATCH /v1alpha/{remediationPlan.name} to update a Remediation Plan.
    • Adds GET /v1alpha/{parent}/remediationActions to list Remediation Actions under a plan.
    • Adds POST /v1beta/{parent}:search for new search session initiation.

    +3 more show less

    • Adds GET /v1beta/{parent}/searchedResults to retrieve results from an existing search session.
    • Adds GET /v1alpha/{name}:suggestQueryFields to retrieve query field autosuggestions based on user and tenant level usage.
    • Adds POST /v1alpha/{name}:addCaseWallRecordTags to add a tag to a CaseWallRecord.

    8 details in Everything

31. docs update Sep 23, 2026 · issue 083

    Google SecOps: Gemini in SecOps uses Google Search grounding to pull up-to-date internet context into responses, surfacing the exact search queries used and citations to source data.

    └──▷ HOW TO FIND IT
    Ask Gemini to walk you through rule creation without leaving the SecOps console during an investigation.
    📍In the Gemini pane, enter the prompt: How do I create a rule — Gemini returns a documentation summary, search query chips showing what it queried on Google Search, and citations linking to the source pages.
32. docs update Sep 23, 2026 · issue 083

    Google SecOps: Enables rollback of a Response Integration to a previous version from the Response Integrations page if an update causes issues or requires reverting custom code changes.

    └──▷ HOW TO FIND IT
    Roll back a Response Integration to a stable previous version after an update breaks a SOARSOARSecurity orchestration, automation and response, coordinating incident workflows across tools. Playbooks can gather evidence, assign work or carry out approved response actions. playbook, without waiting for a new release.
    📍In Content Hub, go to Response Integrations, find the affected integration, open its details panel, and select the previous version from the version history to roll back.
    Search across all content types at once to find all CrowdStrike-related assets (packs, detections, integrations, dashboards) before onboarding a new data source.
    📍In Content Hub, go to Home, type Crowdstrike in the Search field, then review the grouped results: Content Packs, Curated Detections, Response Integrations, and Dashboards — click View all on any category to drill in.
    • Provides curated detection transparency by allowing users to inspect individual rule logic and code directly in the Content Hub Curated Detections page.
    • Supports installing and running Power Ups from the Content Hub Power Ups page to extend playbook capabilities.

    2 details in Everything

33. docs update Sep 23, 2026 · issue 083

    Google SecOps: Adds the Triage and Investigation Agent (TIN) integration, which autonomously gathers evidence, performs first-party enrichment, and returns a True Positive or False Positive verdict plus a confidence_level output usable in downstream logic.

    └──▷ HOW TO FIND IT
    Add a TIN agent step to an existing playbook and branch on verdict to auto-close false positives or escalate true positives.
    📍1. Go to Response › Playbooks and open the target playbook. 2. In the Step Selection panel, open the AI Agents category and drag the TIN agent onto the canvas. 3. In the configuration panel, set Action type to Automatic, enable Retry on failure, and set Error Handling to Skip to the next step. 4. Drag a Flow block (Conditional) onto the canvas after the AI Agent step. 5. In the Placeholder menu, select the AI Agent step results, open the Expression Builder, and choose verdict. 6. Branch: verdict = True Positive → Isolate Host; verdict = False Positive AND confidence_level = High → Close Alert; verdict = False Positive AND confidence_level = Low/Medium → analyst assignment step.
    • Adds an AI Agents category in the Step Selection panel of the playbook canvas, from which agents can be dragged onto workflows and configured with Automatic or Manual action types, Retry on failure toggle, and Error Handling (stop or skip) options.
    • Exposes structured TIN result fields — verdict and confidence_level — in the Expression Builder for conditional branching via Flow block (Conditional) steps, enabling verdicts to drive remediation, alert closure, or analyst assignment paths.
    • Supports asynchronous agent execution: the playbook pauses without occupying the execution queue while the agent runs, surfacing three states — Not Run, Running, and Completed.
    • Supports manual TIN investigations on any non-SOARSOARSecurity orchestration, automation and response, coordinating incident workflows across tools. Playbooks can gather evidence, assign work or carry out approved response actions.-Connector alert, and automatic investigations for alerts from specific SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. detection engine log types defined in Default Supported Log Types.

    4 details in Everything

34. docs update Sep 23, 2026 · issue 083

    Google SecOps: Adds Model Armor, a model-agnostic prompt and response screening layer that protects against data loss and offensive content across multiple clouds and model providers.

    ⤢ ⤢
    └──▷ HOW TO FIND IT
    Onboard Chrome Enterprise Premium into Google SecOps to start receiving browser-threat detections and dashboard visibility in three steps.
    📍1. Configure the Chrome Enterprise Premium Reporting Connector to send data to Google SecOps. 2. Connect Chrome Enterprise Premium to Google SecOps. 3. Enable Chrome Enterprise Threats Curated Detections.
    Stand up multi-cloud CDIR coverage (Google Cloud, AWS, Azure) with Security Command Center Enterprise and Google SecOps to receive auto-mapped cloud threat cases.
    📍1. Activate the Enterprise Tier of SCC-E using your existing Google SecOps instance. 2. Validate Security Command Center Detection Services are enabled. 3. Connect Security Command Center to AWS for configuration and resource data. 4. (Preview) Connect Security Command Center to Azure for configuration and resource data. 5. Ingest Google Cloud logs into Google SecOps using direct ingestion and set up the Google Cloud Export Filter. 6. Ingest AWS logs into Google SecOps. 7. Ingest Azure logs into Google SecOps. 8. Enable the CDIR Curated Detections.
    • Adds Agentic AI triage and investigation capability for automatic triage and investigation of security alerts via Gemini AI.

    1 detail in Everything

35. docs update Sep 23, 2026 · issue 083

    Google SecOps: Adds POST https://backstory.googleapis.com/v2/detect/rules/{ruleId}:archive (ArchiveRule) to archive a specified rule.

    ⤢
    └──▷ TRY IT
    Deploy a new YARA-L 2.0YARA-L 2.0A rule language developed by Google for writing detection logic in Chronicle SIEM, extending YARA syntax to match sequences of log events over time rather than static file patterns. detection rule via API without enabling it live, so you can validate it before it generates alerts.
    copy

    $ curl -s -X POST 'https://backstory.googleapis.com/v2/detect/rules' \
      -H 'Authorization: Bearer $(gcloud auth print-access-token)' \
      -H 'Content-Type: application/json' \
      -d '{"ruleText": "rule detect_dns_exfil {\nmeta:\n  author = \"analyst\"\nevents:\n  $e.metadata.event_type = \"NETWORK_DNS\"\ncondition:\n  $e\n}"}'

    Cancel a long-running retrohunt against a specific rule version to free up resources mid-scan.
    copy

    $ curl -s -X POST 'https://backstory.googleapis.com/v2/detect/rules/ru_30979d84-aa89-47d6-bf4d-b4bb0eacb497@v_1612472807_179679000/retrohunts/oh_8d424a95-5b74-4330-ab6e-5b1096d13d94:cancelRetrohunt' \
      -H 'Authorization: Bearer $(gcloud auth print-access-token)'

    Enable alerting on a rule once it is validated live, so the SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. receives detections immediately.
    copy

    $ curl -s -X POST 'https://europe-backstory.googleapis.com/v2/detect/rules/ru_a17b55ed-7025-4870-85ef-3d0dd533b75b:enableAlerting' \
      -H 'Authorization: Bearer $(gcloud auth print-access-token)'

    • Adds POST https://backstory.googleapis.com/v2/detect/rules/{ruleId}:enableLiveRule (EnableLiveRule) to set the latest version of a rule to live.
    • Adds POST https://backstory.googleapis.com/v2/detect/rules/{ruleId}:disableLiveRule (DisableLiveRule) to disable the latest version of a live rule.
    • Adds POST https://backstory.googleapis.com/v2/detect/rules/{ruleId}:enableAlerting (EnableAlerting) and POST https://backstory.googleapis.com/v2/detect/rules/{ruleId}:disableAlerting (DisableAlerting) to control alerting on a per-rule basis.
    • Exposes regional API endpoints for 19 regions/multi-regions (including https://europe-backstory.googleapis.com, https://southamerica-east1-backstory.googleapis.com, and others) so practitioners can route Detection Engine API calls to their data-residency region.
    • Requires OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. scope https://www.googleapis.com/auth/chronicle-backstory and a Google Developer Service Account credential (JSON key file) to authenticate all Detection Engine API calls.

    5 details in Everything

36. docs update Sep 23, 2026 · issue 083

    Google SecOps: Supports 19 regional Backstory API endpoints including https://europe-backstory.googleapis.com, https://northamerica-northeast2-backstory.googleapis.com, https://me-central2-backstory.googleapis.com, and https://africa-south1-backstory.googleapis.com, allowing data-residency-aware API calls.

    └──▷ TRY IT
    Retrieve the full parsed UDM event for a specific event ID to inspect network connection details, principal asset metadata, and security outcomes programmatically.
    copy

    $ curl -H "Authorization: Bearer $(gcloud auth print-access-token)" \
      'https://backstory.googleapis.com/v1/event:get?name=ABCDEF1ghiJKlmnOpqrs2tuv3wXYYYYYZZABCD4ABCD='

    Find all assets in your enterprise that contacted a suspicious domain during an incident window, scoped to one result to verify connectivity before broadening the query.
    copy

    $ curl -H "Authorization: Bearer $(gcloud auth print-access-token)" \
      'https://backstory.googleapis.com/v1/artifact/listassets?start_time=2024-06-01T00:00:00Z&end_time=2024-06-07T00:00:00Z&artifact.domain_name=malicious-example.com&page_size=100'

    Authenticate a Python script to the Backstory API using a service account so all subsequent API calls are OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. authorized.
    python copy

    from google.auth.transport import requests
    from google.oauth2 import service_account
    
    SCOPES = ['https://www.googleapis.com/auth/chronicle-backstory']
    SERVICE_ACCOUNT_FILE = '/customer-keys/apikeys-demo.json'
    
    credentials = service_account.Credentials.from_service_account_file(
        SERVICE_ACCOUNT_FILE, scopes=SCOPES)
    http_session = requests.AuthorizedSession(credentials)
    
    response = http_session.request(
        'GET',
        'https://europe-backstory.googleapis.com/v1/event:get?name=<UID>')
    print(response.json())

    • UDM search queries sent via API time out after 10 minutes, versus 1 hour for UI-initiated queries.

    1 detail in Everything

37. docs update Sep 23, 2026 · issue 083

    Google SecOps: Adds chronicle.rules.modifyRules and chronicle.ruleDeployments.update IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. permissions required for custom roles to manage customizable schedules for multi-event rules, now in General Availability⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ▶ ⤢
    └──▷ HOW TO FIND IT
    Download your Bindplane Enterprise license key directly from the Google SecOps console without opening a support ticket
    📍In the Google SecOps console, go to SIEM Settings › Collection Agents and click Download License Key to retrieve your Bindplane Enterprise (Google Edition) license.
    └──▷ BREAKING ON UPGRADE

    • !Effective January 25, 2027, write permissions will be removed from the chronicle.readonly OAuth scope — any workflow performing write operations using chronicle.readonly must be updated to use the chronicle OAuth scope.
    • !After March 18, 2027, the MANDIANT_ACTIVE_BREACH_IOC, MANDIANT_FUSION_IOC, and OPEN_SOURCE_INTEL_IOC feeds will be removed — migrate to the GTI_IOC feed before that date.
38. api-docs-c62f0d21376d Sep 22, 2026 · issue 082

    Google SecOps: Adds GET /v1alpha/{name}:suggestQueryFields to retrieve query field autosuggestions based on user and tenant-level usage.

    API change

    Google SecOps: Adds `GET /v1alpha/{name}:suggestQueryFields` to retrieve query field autosuggestions based on user and tenant-level usage.

    • + POST /v1beta/{parent}:search
    • + POST /v1beta/{parent}/dataTableRows:bulkDelete
    • + POST /v1beta/{parent}/dataTableRows:bulkDeleteAsync
    • + GET /v1beta/{parent}/searchedResults
    • + GET /v1alpha/{name}:suggestQueryFields
    • + GET /v1alpha/{name}:fetchWizRelatedIssues
    • + GET /v1alpha/{name}:queryCaseViews
    • + POST /v1alpha/{name}:addCaseWallRecordTags
    • + GET /v1alpha/{parent}/caseWallRecords:queryAvailableCaseWallRecordTags
    • + POST /v1alpha/{name}:removeCaseWallRecordTags
    • + GET /v1alpha/{name}:fetchParserAuditEvents
    • + POST /v1alpha/{name}:execute
    • + POST /v1alpha/{parent}/remediationPlans:generate
    • + GET /v1alpha/{parent}/remediationPlans
    • + PATCH /v1alpha/{remediationPlan.name}
    • + POST /v1alpha/{parent}/remediationActions
    • + GET /v1alpha/{parent}/remediationActions
    • + GET /v1alpha/{parent}/remediationActionExecutions
    └──▷ TRY IT
    Trigger the Remediation agent for an open case and save its suggested plan — the first step before reviewing or executing automated fixes.
    copy

    $ curl -X POST \
      'https://chronicle.googleapis.com/v1alpha/projects/<project>/locations/<location>/instances/<instance>/remediationPlans:generate' \
      -H 'Authorization: Bearer $(gcloud auth print-access-token)' \
      -H 'Content-Type: application/json' \
      -d '{"parent": "projects/<project>/locations/<location>/instances/<instance>"}'

    Execute a previously generated remediation plan to kick off its automated response actions.
    copy

    $ curl -X POST \
      'https://chronicle.googleapis.com/v1alpha/projects/<project>/locations/<location>/instances/<instance>/remediationPlans/<plan_id>:execute' \
      -H 'Authorization: Bearer $(gcloud auth print-access-token)' \
      -H 'Content-Type: application/json' \
      -d '{}'

    • Introduces the v1alpha.projects.locations.instances.remediationPlans resource with POST /v1alpha/{parent}/remediationPlans:generate to trigger the Remediation agent and save its output, POST /v1alpha/{name}:execute to execute a suggested plan, GET /v1alpha/{parent}/remediationPlans to list plans with optional filtering, and PATCH /v1alpha/{remediationPlan.name} to update a plan.
    • Introduces v1alpha.projects.locations.instances.remediationPlans.remediationActions with POST /v1alpha/{parent}/remediationActions to create a manual remediation action and GET /v1alpha/{parent}/remediationActions to list actions under a plan.
    • Introduces v1alpha.projects.locations.instances.remediationPlans.remediationActions.remediationActionExecutions with GET /v1alpha/{parent}/remediationActionExecutions to list execution records under a remediation action.

    3 details in Everything

39. docs update Sep 22, 2026 · issue 082

    Google SecOps adds in-product Gemini help pane with Google Search grounding, citations, and chat session management.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Ask the Gemini pane a natural-language question to quickly look up how a SecOps feature works without leaving the product.
    📍In the Gemini pane, type a prompt such as How do I create a rule and press Enter. Gemini returns a documentation summary with links to relevant pages and, when Google Search grounding is used, displays the Google G icon, the exact search query chips, and citations so you can verify the sources.
    • Adds a Gemini pane inside Google SecOps for answering natural-language questions about the product using documentation summaries.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Gemini responses are grounded with Google Search, surfacing the exact search queries used, a Google G icon indicating internet connectivity, and search query chips alongside citations for transparency.
    • Supports deleting individual or all chat sessions from the Gemini pane via Delete chat and Delete all chat sessions options.
    • Enables thumbs-up/thumbs-down feedback on Gemini-generated responses directly from the Gemini pane.

    4 details in Everything

40. docs update Sep 22, 2026 · issue 082

    Google SecOps Content Hub centralizes discovery and deployment of content packs, detections, dashboards, playbooks, and SOARSOARSecurity orchestration, automation and response, coordinating incident workflows across tools. Playbooks can gather evidence, assign work or carry out approved response actions. integrations⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Grant a SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. analyst read access to Content Hub content packs, detections, dashboards, and playbooks without install rights, using the least-privilege chronicle.reader role.
    📍In Google Cloud IAM, bind the chronicle.reader role to the analyst's principal. This grants: chronicle.googleapis.com/featuredContentSearchQueries.get, chronicle.googleapis.com/featuredContentSearchQueries.list, chronicle.googleapis.com/featuredContentRules.list, chronicle.googleapis.com/featuredContentNativeDashboards.get, chronicle.googleapis.com/featuredContentNativeDashboards.list, chronicle.googleapis.com/feedPacks.get, chronicle.googleapis.com/feedPacks.list, chronicle.googleapis.com/featuredContentPlaybooks.get, chronicle.googleapis.com/featuredContentPlaybooks.list.
    Grant a content engineer the ability to install search queries, dashboards, and playbooks from Content Hub, using the chronicle.writer role.
    📍In Google Cloud IAM, bind the chronicle.writer role to the engineer. This grants: chronicle.googleapis.com/featuredContentSearchQueries.install, chronicle.googleapis.com/featuredContentNativeDashboards.install, chronicle.googleapis.com/featuredContentPlaybooks.install in addition to all reader permissions.
    • Adds chronicle.googleapis.com/featuredContentSearchQueries.get, .list, and .install IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. permissions to control access to search query content in Content Hub⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds chronicle.googleapis.com/featuredContentRules.list IAM permission to control access to featured detection rules in Content Hub
    • Adds chronicle.googleapis.com/featuredContentNativeDashboards.get, .list, and .install IAM permissions to control access to dashboard content in Content Hub
    • Adds chronicle.googleapis.com/feedPacks.get and .list IAM permissions to control access to feed packs in Content Hub
    • Adds chronicle.googleapis.com/featuredContentPlaybooks.get, .list, and .install IAM permissions to control access to featured playbook content in Content Hub

    +9 more show less

    • Introduces Content Hub, a centralized platform for discovering, deploying, and managing content packs, curated detections, dashboards, saved search queries, playbooks, and SOAR integrations within Google SecOps
    • Supports four content categories in Content Hub: Google (verified by Google SecOps), Partner (third-party validated), Community (user-contributed validated), and Custom (private to your instance)
    • Enables cross-content-type unified search across Content Packs, Detections, Response Integrations, and Dashboards simultaneously from the Content Hub Home page
    • Enables deployment of end-to-end content packs including log ingestion, curated detections, and dashboards for supported products from a single Content Packs page
    • Adds a Curated Detections page that exposes full rule logic and code (detection transparency) and pivots to the Detections page via View Rule Performance
    • Adds a Response Integrations page supporting install, configure, and rollback to a previous version for individual SOAR connectors and playbook integrations
    • Adds a Playbooks and Blocks page for browsing, filtering, and installing playbooks and nested playbook blocks (playbook blocks) into selected environments
    • Adds a Search Queries page for adding saved SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. search queries shared across the instance, managed from the SIEM Search page
    • Adds a Power Ups page for viewing, installing, and configuring Google SecOps Power Ups for use in playbooks

    14 details in Everything

41. docs update Sep 22, 2026 · issue 082

    Google SecOps adds Agentic Automation to embed AI agents directly into playbooks for adaptive, AI-driven triage and investigation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Automatically close low-noise false positives and route uncertain verdicts to an analyst — all driven by TIN's structured outputstructured outputForcing a model's response to match a given format or JSON schema, so software can parse it reliably instead of hoping the text is well formed. in a single playbook.
    📍In Response › Playbooks, open or create a playbook, then: 1. From Step Selection › AI Agents, drag the TIN agent step onto the canvas and set Action type to Automatic. 2. Enable Retry on failure and set Error Handling to Skip to the next step for unsupported alert types. 3. Drag a Flow block (Conditional) after the agent step, open the Placeholder menu, select the AI Agent step results, and in the Expression Builder choose verdict and confidence_level. 4. Wire branches: verdict=True Positive → Isolate Host; verdict=False Positive + high confidence → Close Alert; verdict=False Positive + low/medium confidence → analyst assignment step.
    • Adds Agentic Automation to Google SecOps playbooks, enabling AI agents to be embedded as steps alongside deterministic automation, with asynchronous execution that pauses the playbook without occupying the execution queue.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Integrates the Triage and Investigation Agent (TIN) as the first supported agent, delivering autonomous alert analysis with a True Positive / False Positive verdict, a confidence_level score, and structured JSON outputs for downstream branching.
    • Exposes AI Agent step results in the Expression Builder so playbook conditions can branch on verdict or confidence_level rather than static inputs.
    • Surfaces agent triage findings in the Gemini Investigations side drawer and in the AI agent step results within Case Overview.
    • Adds Error Handling configuration on the AI Agent step — choose Stop the playbook or Skip to the next step when an unsupported alert type or data format prevents the agent from completing.

    +2 more show less

    • Adds Retry on failure toggle on the AI Agent step to rerun the agent on transient execution errors.
    • Supports both Automatic and Manual action types on the AI Agent step, letting analysts trigger TIN investigations on demand from within a case.

    7 details in Everything

42. docs update Sep 22, 2026 · issue 082

    Google Unified Security launches converged platform integrating SecOps, Chrome Enterprise, SCC, and AI Protection for multi-cloud threat detection and response.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢
    • Adds Chrome Enterprise Premium (CEP) integration with Google SecOps, enabling curated detections enriched with Safe Browsing and Google Threat Intelligence (GTI) for browser-based threats such as malicious extensions, credential theft, and data exfiltrationdata exfiltrationMoving data out of a system or organization without authorization. It can happen through network transfers, removable media or other channels..⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds dedicated Google SecOps dashboards for Chrome security events and anomalies to surface browser-based threat visibility for SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. analysts.
    • Adds native playbook orchestration for automated Chrome Enterprise response actions — including blocking malicious URLs, blocking extensions, and quarantining devices — directly from the Google SecOps platform.
    • Adds Cloud Detection, Investigation, and Response (CDIR) capability via unified Security Command Center Enterprise (SCC-E) integration, covering Google Cloud, AWS, and Azure with SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. log searching, case management, and SOARSOARSecurity orchestration, automation and response, coordinating incident workflows across tools. Playbooks can gather evidence, assign work or carry out approved response actions. workflows in a single platform.
    • Adds Cloud Asset Inventory collection from multi-cloud environments (Google Cloud, AWS, Azure) flowing into the Google SecOps Entity Graph for enriched alert context — including resource owner, region, and metadata tags.

    +5 more show less

    • Adds Security Command Center connection to AWS for configuration and resource data feeding into the Entity Graph.
    • Adds preview support for connecting Security Command Center to Azure for configuration and resource data feeding into the Entity Graph.
    • Adds AI Protection suite inside Security Command Center Enterprise, providing discovery and cataloging of AI assets (models, datasets, applications), virtual red teaming to surface attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately., and detection and response for LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. hijacking, data poisoning, and data exfiltration threats.
    • Adds Model Armor, a model-agnostic and cloud-agnostic capability that screens generative AI prompts and responses for data loss, offensive content, and brand risk across Google and third-party models.
    • Supports natural language syntax, Yara-L syntax, and raw log searching within Google SecOps for CDIR investigations across Google Cloud audit logs, AWS CloudTrailCloudTrailAWS service that records API calls and account activity across an AWS environment, giving cyber tools an audit log to detect anomalous or malicious actions., GuardDuty events, and Azure AD activity logs.

    10 details in Everything

43. docs update Sep 22, 2026 · issue 082

    Google SecOps Ingestion API supports UDM events, unstructured logs, batch deduplication, and 19 regional endpoints⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Forward a batch of pre-parsed UDM events directly to Google SecOps from a pipeline that already normalises its own telemetry, skipping server-side parsing.
    copy

    $ curl -X POST \
      'https://malachiteingestion-pa.googleapis.com/v2/udmevents:batchCreate' \
      -H 'Authorization: Bearer $(gcloud auth print-access-token)' \
      -H 'Content-Type: application/json' \
      -d '{
        "customer_id": "c8c65bfa-5f2c-42d4-9189-64bb7b939f2c",
        "events": [
          {
            "metadata": {
              "event_timestamp": "2024-06-01T00:00:00.000Z",
              "event_type": "USER_LOGIN",
              "product_name": "Acme SSO",
              "vendor_name": "Acme"
            },
            "principal": {"ip": ["10.1.2.3"]},
            "target": {"user": {"userid": "mary@example.com"}}
          }
        ]
      }'

    Send raw BIND DNS logs as unstructured entries to a European regional endpoint to satisfy data-residency requirements.
    copy

    $ curl -X POST \
      'https://europe-malachiteingestion-pa.googleapis.com/v2/unstructuredlogentries:batchCreate' \
      -H 'Authorization: Bearer $(gcloud auth print-access-token)' \
      -H 'Content-Type: application/json' \
      -d '{
        "customer_id": "c8c65bfa-5f2c-42d4-9189-64bb7b939f2c",
        "log_type": "BIND_DNS",
        "namespace": "prod-eu",
        "entries": [
          {
            "log_text": "26-Feb-2019 13:35:02.187 client 10.120.20.32#4238: query: altostrat.com IN A + (203.0.113.102)",
            "ts_epoch_microseconds": 1551188102187000
          }
        ]
      }'

    • Adds POST https://malachiteingestion-pa.googleapis.com/v2/udmevents:batchCreate endpoint to ingest pre-parsed UDM events in batches, bypassing the CBN parsing layer for lower end-to-end latency.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds POST https://malachiteingestion-pa.googleapis.com/v2/unstructuredlogentries:batchCreate endpoint to forward raw logs in batches up to 1 MB (uncompressed), with per-entry timestamps via ts_epoch_microseconds or ts_rfc3339 fields.
    • Adds batch-level deduplication: Google SecOps hashes customer_id plus log entry content to generate a batch ID, rejecting duplicate batches per customer per log type while allowing identical content under different log types.
    • Supports 19 regional ingestion endpoints (including https://europe-malachiteingestion-pa.googleapis.com, https://northamerica-northeast2-malachiteingestion-pa.googleapis.com, https://me-central2-malachiteingestion-pa.googleapis.com, and others) so logs stay in-region without extra forwarder hardware.
    • Authenticates via a Google Developer service account using OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. scope https://www.googleapis.com/auth/malachite-ingestion, with credentials loaded from a JSON key file (e.g. apikeys.json).

    5 details in Everything

44. docs update Sep 22, 2026 · issue 082

    Google SecOps Detection Engine API adds full CRUDCRUDThe four basic database operations — Create, Read, Update, Delete — used as shorthand for any system that manages persistent data records, giving cyber tools a standard model for interacting with stored information. and lifecycle endpoints for YARA-L 2.0YARA-L 2.0A rule language developed by Google for writing detection logic in Chronicle SIEM, extending YARA syntax to match sequences of log events over time rather than static file patterns. rules plus 19 regional endpoints⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢
    └──▷ TRY IT
    Deploy a new YARA-LYARA-LA rule language developed by Google for Chronicle that extends YARA syntax to express multi-event, time-windowed detections over log data rather than single-file pattern matching. 2.0 detection rule to Google SecOps without making it live yet, so you can review it before enabling.
    copy

    $ curl -s -X POST 'https://backstory.googleapis.com/v2/detect/rules' \
      -H 'Authorization: Bearer $(gcloud auth print-access-token)' \
      -H 'Content-Type: application/json' \
      -d '{"ruleText": "rule detect_dns_beacon {\nmeta:\n  author = \"analyst\"\nevents:\n  $e.metadata.event_type = \"NETWORK_DNS\"\ncondition:\n  $e\n}"}'

    Cancel a long-running retrohunt that is tying up resources or was triggered against the wrong time window.
    copy

    $ curl -s -X POST 'https://backstory.googleapis.com/v2/detect/rules/ru_30979d84-aa89-47d6-bf4d-b4bb0eacb497/retrohunts/oh_8d424a95-5b74-4330-ab6e-5b1096d13d94:cancelRetrohunt' \
      -H 'Authorization: Bearer $(gcloud auth print-access-token)'

    Route Detection Engine API calls to the EU multi-region endpoint to satisfy data-residency requirements.
    copy

    $ curl -s -X POST 'https://europe-backstory.googleapis.com/v2/detect/rules/ru_a17b55ed-7025-4870-85ef-3d0dd533b75b:enableAlerting' \
      -H 'Authorization: Bearer $(gcloud auth print-access-token)'

    • Adds POST /v2/detect/rules (CreateRule) to create a YARA-L 2.0 detection rule without activating it.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds POST /v2/detect/rules/{ruleId}:createVersion (CreateRuleVersion) to create a new version of an existing rule, including from a non-latest version.
    • Adds DELETE /v2/detect/rules/{ruleId} (DeleteRule) to permanently delete a rule by ruleId.
    • Adds POST /v2/detect/rules/{ruleId}:archive (ArchiveRule) to archive a rule without deleting it.
    • Adds POST /v2/detect/rules/{ruleId}:enableLiveRule and POST /v2/detect/rules/{ruleId}:disableLiveRule (EnableLiveRule / DisableLiveRule) to activate or deactivate live detection for the latest rule version.

    +3 more show less

    • Adds POST /v2/detect/rules/{ruleId}:enableAlerting and POST /v2/detect/rules/{ruleId}:disableAlerting (EnableAlerting / DisableAlerting) to toggle alert generation for a rule independently of live status.
    • Adds POST /v2/detect/rules/{ruleId}/retrohunts/{retrohuntId}:cancelRetrohunt (CancelRetrohunt) to cancel an in-progress retrohunt, with a {versionId} variant for targeting a specific rule version.
    • Supports 19 regional API endpoints for data-residency control, including https://europe-backstory.googleapis.com, https://southamerica-east1-backstory.googleapis.com, https://me-central2-backstory.googleapis.com, and https://africa-south1-backstory.googleapis.com.

    8 details in Everything

45. docs update Sep 22, 2026 · issue 082

    Google SecOps Backstory Search API reference published, covering endpoints for events, assets, IOCsIOCsAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself., and alerts across 19 regional endpoints.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Retrieve the full raw log for a specific event ID to inspect the original unparsed bytes during an investigation.
    copy

    $ curl -H 'Authorization: Bearer $(gcloud auth print-access-token)' 'https://backstory.googleapis.com/v1/events/log:get/?name=AAAAAFRjuBh0IYHHdk85GXpvBBoAAAAABQAAAAEAAAA='

    Enumerate all assets in your enterprise that contacted a suspicious domain over a 48-hour window, limiting results for quick triage.
    copy

    $ curl -H 'Authorization: Bearer $(gcloud auth print-access-token)' 'https://backstory.googleapis.com/v1/artifact/listassets?start_time=2024-06-01T00:00:00Z&end_time=2024-06-03T00:00:00Z&artifact.domain_name=malicious-example.com&page_size=10'

    Authenticate a Python script to the Backstory API using a service account before calling any Search API method.
    python copy

    from google.auth.transport import requests
    from google.oauth2 import service_account
    
    SCOPES = ['https://www.googleapis.com/auth/chronicle-backstory']
    SERVICE_ACCOUNT_FILE = '/customer-keys/apikeys-demo.json'
    
    credentials = service_account.Credentials.from_service_account_file(
        SERVICE_ACCOUNT_FILE, scopes=SCOPES)
    http_session = requests.AuthorizedSession(credentials)
    
    response = http_session.request('GET',
        'https://backstory.googleapis.com/v1/event:get?name=ABCDEF1ghiJKlmnOpqrs2tuv3wXYYYYYZZABCD4ABCD=')
    print(response.json())

    • Adds GET https://backstory.googleapis.com/v1/events/log:get/?name={UID} endpoint (GetLog) to retrieve a single raw log by its metadata.id.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds GET https://backstory.googleapis.com/v1/event:get?name={UID} endpoint (GetEvent) to retrieve a single parsed UDM event by its metadata.id.
    • Adds GET https://backstory.googleapis.com/v1/artifact/listassets endpoint (ListAssets) to list assets that accessed a given artifact (domain, IP, MD5/SHA1/SHA256SHA256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. hash) within a time window, returning up to 100 results per request via page_size.
    • Publishes rate limits for all Backstory Search API methods: ListAlerts, ListEvents, ListIocs, ListIocDetails, ListAssetAliases, ListUserAliases at 1 QPS; ListAssets at 5 QPS; GetLog and GetEvent at 60 QPS — with HTTP 429 (RESOURCE_EXHAUSTED) returned on breach.
    • Documents a 10-minute query timeout for UDM searches sent via API (versus 1-hour timeout for UI queries).

    5 details in Everything

46. docs update Sep 22, 2026 · issue 082

    Google SecOps adds GoogleSQLGoogleSQLGoogle's SQL dialect used in BigQuery and Spanner, offering standard SQL with extensions for nested data and analytic functions; tools build on it to query large datasets without a custom query language. search, case playbooks, reaction triggers, event simulation, and GA customizable multi-event rule schedules⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ▶ ⤢
    └──▷ HOW TO FIND IT
    Split a JSON log entry containing an array of events into individual events before parsing, using the Unroll processor in a data processing pipeline
    📍In the pipeline editor, add a Transform processor with: set(body, ParseJSON(body)) Then add an Unroll processor immediately after, pointing at the array field to expand each element into a discrete log event before ingestion.
    Download the Bindplane Enterprise license key directly from the console without opening a support ticket
    📍Navigate to SIEM Settings › Collection Agents, then select Bindplane Enterprise (Google Edition) to download the license key.
    • Adds chronicle.rules.modifyRules and chronicle.ruleDeployments.update IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. permissions requirement for managing customizable rule schedules with custom IAM roles in the Rules Dashboard⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds match_all option to the Grok filter in Google SecOps parser syntax, enabling extraction of all non-overlapping pattern occurrences within a field rather than only the first match
    • Adds Unroll processor to data processing pipelines, splitting log entries containing arrays or slices of events into multiple individual log events prior to parsing and ingestion; requires structured input, with raw payloads first processed via a Transform processor (e.g., set(body, ParseJSON(body)))
    • Adds self-service Bindplane Enterprise license download under SIEM Settings > Collection Agents for Enterprise Plus and Google Unified Security (GUS) customers in US and EU regions (Preview)
    • Introduces GoogleSQL query support in Search (public preview), offering standard declarative SQL and Piped SQL syntax to query UDM events, entity graphs, detection rules, and case management data as an alternative to YARA-L 2.0YARA-L 2.0A rule language developed by Google for writing detection logic in Chronicle SIEM, extending YARA syntax to match sequences of log events over time rather than static file patterns.

    +11 more show less

    • Introduces case playbooks (preview), enabling playbooks and manual actions to be run across an entire case container rather than individual alerts
    • Introduces reaction triggers (preview), allowing playbooks to automatically fire in response to real-time case or alert updates such as changes to assignee, tags, alert priority, or newly added entities
    • Promotes customizable schedules for multi-event rules to General Availability (GA), with configurable first-run delay offsets (1 minute to 48 hours), automated true-up runs at 4 and 30 hours, and in-place migration of legacy rules from the Rules Dashboard
    • Adds three Mandiant Frontline Threats rule packs to Content Hub: Mandiant Frontline Threats for Linux, Mandiant Frontline Threats for MacOS, and Mandiant Frontline Threats for Google Cloud
    • Adds Operations to the Emerging Threats Center feed, surfacing granular threat intelligence from frontline investigations (e.g., Managed Threat Defense engagements) targeting individual organizations
    • Introduces Detection Engineering Agent (public preview), an AI-powered assistant accessible via Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. (MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface.) tools that extracts threat intelligence and drafts YARA-LYARA-LA rule language developed by Google for Chronicle that extends YARA syntax to express multi-event, time-windowed detections over log data rather than single-file pattern matching. detection rules; compatible with AI clients such as Google Antigravity or Claude Code
    • Introduces event simulation (public preview), enabling programmatic delivery of realistic threat sequences into the live ingestion pipeline for full-funnel detection coverage evaluation covering UDM normalization, multi-event correlation, and alerting
    • Adds ingestion latency tracking tables to Health Hub (public preview) at source and log-type levels, with drill-down into a Data Health Deep Dive page for detailed latency information
    • Adds Side-by-side view layout to the Alerts & Detections tab in Cases (public preview), allowing inspection of alert metadata, status, priority, creation date, and Gemini insights in an adjacent pane
    • Adds relative time filtering with three distinct operators — Past, Previous, and Current — across dashboards and Search (public preview) for calendar-aligned and rolling-window precision
    • Adds resizable Case preview and Alert and detection preview side panels in Investigation Management, adjustable via mouse or keyboard shortcuts
    • Adds chronicle.rules.modifyRules and chronicle.ruleDeployments.update IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. permissions requirement for managing customizable rule schedules with custom IAM roles in the Rules Dashboard⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds Unroll processor to data processing pipelines, splitting log entries containing arrays or slices of events into multiple individual log events prior to parsing and ingestion; requires structured input, with raw payloads first processed via a Transform processor (e.g., set(body, ParseJSON(body)))
    • Adds self-service Bindplane Enterprise license download under SIEM Settings > Collection Agents for Enterprise Plus and Google Unified Security (GUS) customers in US and EU regions (Preview)
    • Introduces GoogleSQL query support in Search (public preview), offering standard declarative SQL and Piped SQL syntax to query UDM events, entity graphs, detection rules, and case management data as an alternative to YARA-L 2.0YARA-L 2.0A rule language developed by Google for writing detection logic in Chronicle SIEM, extending YARA syntax to match sequences of log events over time rather than static file patterns.
    • Introduces case playbooks (preview), enabling playbooks and manual actions to be run across an entire case container rather than individual alerts

    +5 more show less

    • Introduces reaction triggers (preview), allowing playbooks to automatically fire in response to real-time case or alert updates such as changes to assignee, tags, alert priority, or newly added entities
    • Adds three Mandiant Frontline Threats rule packs to Content Hub: Mandiant Frontline Threats for Linux, Mandiant Frontline Threats for MacOS, and Mandiant Frontline Threats for Google Cloud
    • Adds Operations to the Emerging Threats Center feed, surfacing granular threat intelligence from frontline investigations (e.g., Managed Threat Defense engagements) targeting individual organizations
    • Introduces Detection Engineering Agent (public preview), an AI-powered assistant accessible via Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. (MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface.) tools that extracts threat intelligence and drafts YARA-LYARA-LA rule language developed by Google for Chronicle that extends YARA syntax to express multi-event, time-windowed detections over log data rather than single-file pattern matching. detection rules; compatible with AI clients such as Google Antigravity or Claude Code
    • Introduces event simulation (public preview), enabling programmatic delivery of realistic threat sequences into the live ingestion pipeline for full-funnel detection coverage evaluation covering UDM normalization, multi-event correlation, and alerting

    6 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !Effective January 25, 2027, write permissions will be removed from the chronicle.readonly OAuth scope; workflows performing write operations must be updated to use the chronicle OAuth scope.
    • !After March 18, 2027, the MANDIANT_ACTIVE_BREACH_IOC, MANDIANT_FUSION_IOC, and OPEN_SOURCE_INTEL_IOC feeds will be removed; tenants must migrate to the GTI_IOC feed.
47. api-docs-ae690d223b15 Sep 21, 2026 · issue 081

    Google SecOps adds Remediation Plans, Wiz integration, case wall tagging, bulk data-table ops, and parser audit timeline APIs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    API change

    Google SecOps adds Remediation Plans, Wiz integration, case wall tagging, bulk data-table ops, and parser audit timeline APIs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • + POST /v1beta/{parent}:search
    • + POST /v1beta/{parent}/dataTableRows:bulkDelete
    • + POST /v1beta/{parent}/dataTableRows:bulkDeleteAsync
    • + GET /v1beta/{parent}/searchedResults
    • + GET /v1alpha/{name}:fetchWizRelatedIssues
    • + GET /v1alpha/{name}:queryCaseViews
    • + POST /v1alpha/{name}:addCaseWallRecordTags
    • + GET /v1alpha/{parent}/caseWallRecords:queryAvailableCaseWallRecordTags
    • + POST /v1alpha/{name}:removeCaseWallRecordTags
    • + GET /v1alpha/{name}:fetchParserAuditEvents
    • + POST /v1alpha/{name}:execute
    • + POST /v1alpha/{parent}/remediationPlans:generate
    • + GET /v1alpha/{parent}/remediationPlans
    • + PATCH /v1alpha/{remediationPlan.name}
    • + POST /v1alpha/{parent}/remediationActions
    • + GET /v1alpha/{parent}/remediationActions
    • + GET /v1alpha/{parent}/remediationActionExecutions
    └──▷ TRY IT
    Generate an AI-driven remediation plan for a case and immediately execute it — useful for automating response to high-confidence alerts.
    copy

    $ # 1. Trigger the Remediation agent and save its output as a plan
    curl -X POST \
      'https://chronicle.googleapis.com/v1alpha/projects/<project>/locations/<location>/instances/<instance>/remediationPlans:generate' \
      -H 'Authorization: Bearer $(gcloud auth print-access-token)' \
      -H 'Content-Type: application/json' \
      -d '{"parent": "projects/<project>/locations/<location>/instances/<instance>"}'
    
    # 2. Execute the returned plan by name
    curl -X POST \
      'https://chronicle.googleapis.com/v1alpha/<remediationPlan.name>:execute' \
      -H 'Authorization: Bearer $(gcloud auth print-access-token)' \
      -H 'Content-Type: application/json' \
      -d '{}'

    Pull all Wiz-linked security issues for a case during triage to correlate cloud posture findings without leaving SecOps.
    copy

    $ curl -X GET \
      'https://chronicle.googleapis.com/v1alpha/<name>:fetchWizRelatedIssues' \
      -H 'Authorization: Bearer $(gcloud auth print-access-token)'

    Asynchronously purge a large batch of stale data table rows in the background so the operation does not time out.
    copy

    $ curl -X POST \
      'https://chronicle.googleapis.com/v1beta/<parent>/dataTableRows:bulkDeleteAsync' \
      -H 'Authorization: Bearer $(gcloud auth print-access-token)' \
      -H 'Content-Type: application/json' \
      -d '{"filter": "create_time < \"2025-01-01T00:00:00Z\""}'

    • Adds POST /v1beta/{parent}:search to initiate search sessions and GET /v1beta/{parent}/searchedResults to page through results via the new v1beta.projects.locations.instances.searchSessions.searchedResults resource.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds POST /v1beta/{parent}/dataTableRows:bulkDelete and POST /v1beta/{parent}/dataTableRows:bulkDeleteAsync for synchronous and asynchronous bulk deletion of data table rows.
    • Adds GET /v1alpha/{name}:fetchWizRelatedIssues to surface Wiz security issues linked to a specific case.
    • Adds GET /v1alpha/{name}:queryCaseViews to query available views for a case.
    • Adds POST /v1alpha/{name}:addCaseWallRecordTags and POST /v1alpha/{name}:removeCaseWallRecordTags to add and remove tags on a CaseWallRecord.

    +21 more show less

    • Adds GET /v1alpha/{parent}/caseWallRecords:queryAvailableCaseWallRecordTags to enumerate all available CaseActivityTags.
    • Adds GET /v1alpha/{name}:fetchParserAuditEvents to retrieve the unified parser and augmentation audit timeline for a LogType.
    • Adds a full Remediation Plans API under v1alpha.projects.locations.instances.remediationPlans, including POST /v1alpha/{parent}/remediationPlans:generate to trigger the Remediation agent, POST /v1alpha/{name}:execute to execute a suggested plan, GET /v1alpha/{parent}/remediationPlans to list plans, and PATCH /v1alpha/{remediationPlan.name} to update a plan.
    • Adds POST /v1alpha/{parent}/remediationActions to create manual Remediation Actions, GET /v1alpha/{parent}/remediationActions to list them, and GET /v1alpha/{parent}/remediationActionExecutions to list execution records under a remediation action.
    • New endpoint documented: POST /v1beta/{parent}:search
    • New endpoint documented: POST /v1beta/{parent}/dataTableRows:bulkDelete
    • New endpoint documented: POST /v1beta/{parent}/dataTableRows:bulkDeleteAsync
    • New endpoint documented: GET /v1beta/{parent}/searchedResults
    • New endpoint documented: GET /v1alpha/{name}:fetchWizRelatedIssues
    • New endpoint documented: GET /v1alpha/{name}:queryCaseViews
    • New endpoint documented: POST /v1alpha/{name}:addCaseWallRecordTags
    • New endpoint documented: GET /v1alpha/{parent}/caseWallRecords:queryAvailableCaseWallRecordTags
    • New endpoint documented: POST /v1alpha/{name}:removeCaseWallRecordTags
    • New endpoint documented: GET /v1alpha/{name}:fetchParserAuditEvents
    • New endpoint documented: POST /v1alpha/{name}:execute
    • New endpoint documented: POST /v1alpha/{parent}/remediationPlans:generate
    • New endpoint documented: GET /v1alpha/{parent}/remediationPlans
    • New endpoint documented: PATCH /v1alpha/{remediationPlan.name}
    • New endpoint documented: POST /v1alpha/{parent}/remediationActions
    • New endpoint documented: GET /v1alpha/{parent}/remediationActions
    • New endpoint documented: GET /v1alpha/{parent}/remediationActionExecutions

    26 details in Everything

48. September 21, 2026 (2026-09-21) Sep 21, 2026 · issue 084

    Google SecOps enriches directly ingested logs with gcp_organization_id to simplify multi-org filtering and RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. scoping.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢
    • Adds gcp_organization_id under metadata.base_labels.ingestion_kv_labels in UDM events for logs ingested via Google Cloud direct ingestion, enabling multi-organization filtering, detection rule scoping, and Data RBAC without additional sink or feed configuration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 detail in Everything

49. changelog Sep 16, 2026 · issue 076

    Google SecOps parser syntax gains match_all Grok option for exhaustive pattern extraction⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ▶ ⤢

    ▶ ⤢

    ⤢ ⤢
    └──▷ BREAKING ON UPGRADE

    • !Effective January 25, 2027, write permissions will be removed from the chronicle.readonly OAuth scope; any workflow performing write operations must be updated to use the chronicle OAuth scope instead.
    • !The MANDIANT_ACTIVE_BREACH_IOC, MANDIANT_FUSION_IOC, and OPEN_SOURCE_INTEL_IOC feeds will be removed after March 18, 2027; affected feeds must be migrated to GTI before that date.
50. docs update Sep 16, 2026 · issue 076

    Google Unified Security launches with Chrome Enterprise Premium integration, multi-cloud CDIR, and AI Protection for securing AI workloads⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢

    ▶ ⤢

    ▶ ⤢
    └──▷ HOW TO FIND IT
    Onboard Chrome Enterprise Premium to Google SecOps to immediately gain browser threat visibility and enable curated detections enriched with GTI.
    📍1. Configure the Chrome Enterprise Premium Reporting Connector to send data to Google SecOps. 2. Connect Chrome Enterprise Premium to Google SecOps. 3. Enable Chrome Enterprise Threats Curated Detections.
    Activate multi-cloud CDIR in Google SecOps to surface Security Command Center threat alerts and ingest AWS and Azure logs for unified investigation.
    📍1. Activate the Enterprise Tier of SCC-E using your existing Google SecOps instance. 2. Validate Security Command Center Detection Services are enabled. 3. Connect Security Command Center to AWS for Entity Graph resource data. 4. Ingest Google Cloud logs via direct ingestion and set up the Google Cloud Export Filter. 5. Ingest AWS logs into Google SecOps. 6. Ingest Azure logs into Google SecOps. 7. Enable the CDIR Curated Detections.
    • Adds Chrome Enterprise Premium (CEP) integration with Google SecOps, enabling curated detections enriched with Safe Browsing and Google Threat Intelligence (GTI) specifically designed for browser-based threats such as malicious extensions, credential theft, and data exfiltrationdata exfiltrationMoving data out of a system or organization without authorization. It can happen through network transfers, removable media or other channels..⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds dedicated Google SecOps dashboards for Chrome security events, providing visibility into browser anomalies and facilitating investigation of threats on managed and BYODBYODBring Your Own Device: a policy allowing employees to use personal phones, laptops, or tablets for work, creating a network of unmanaged endpoints that cyber tools must monitor or enforce policy on. devices.
    • Enables automated response playbooks for Chrome Enterprise actions — including blocking malicious URLs, blocking extensions, and quarantining devices — directly from the Google SecOps platform.
    • Adds Cloud Detection, Investigation, and Response (CDIR) capability via Security Command Center Enterprise (SCC-E) integration, covering Google Cloud, AWS, and Azure environments within a single converged platform.
    • Adds Cloud Asset Inventory collection flowing into the Google SecOps Entity Graph, enriching alerts with multi-cloud asset context (region, owner, metadata tags) for AWS, Azure, and Google Cloud resources.

    +4 more show less

    • Supports ingestion of AWS CloudTrailCloudTrailAWS service that records API calls and account activity across an AWS environment, giving cyber tools an audit log to detect anomalous or malicious actions. and GuardDuty events and Azure AD activity logs into Google SecOps for multi-cloud SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. log searching using natural language, Yara-L, or raw log syntax.
    • Adds AI Protection within Security Command Center Enterprise, providing discovery and cataloging of AI assets (models, datasets, applications), virtual red-teaming to surface toxic attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately., and detection and response for LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. hijacking, data poisoning, and AI-targeted threats — with response workflows integrated into Google SecOps.
    • Adds Model Armor to protect AI workloads against data loss, brand damage, and offensive content across models and cloud environments.
    • Adds CDIR Curated Detections for Cloud Threat scenarios, including enhanced privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources. alerts that automatically map to Google SecOps cases.

    9 details in Everything

51. docs update Sep 16, 2026 · issue 076

    Google SecOps: Adds match_all option to the Grok filter in Google SecOps parser syntax, enabling extraction of all non-overlapping pattern occurrences within a field instead of only the first match.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ▶ ⤢

    ▶ ⤢
52. docs update Sep 15, 2026 · issue 075

    Google SecOps adds GoogleSQLGoogleSQLGoogle's SQL dialect used in BigQuery and Spanner, offering standard SQL with extensions for nested data and analytic functions; tools build on it to query large datasets without a custom query language. query support in Search (public preview) for ad hoc investigations alongside YARA-L 2.0YARA-L 2.0A rule language developed by Google for writing detection logic in Chronicle SIEM, extending YARA syntax to match sequences of log events over time rather than static file patterns..⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ▶ ⤢

    ▶ ⤢
    └──▷ HOW TO FIND IT
    Run a broad statistical aggregation over UDM events for ad hoc investigation — something not previously possible without YARA-LYARA-LA rule language developed by Google for Chronicle that extends YARA syntax to express multi-event, time-windowed detections over log data rather than single-file pattern matching. 2.0.
    📍In Google SecOps, go to Search, select GoogleSQL as the query mode, then enter your SQL query against telemetry tables such as UDM events, entity graphs, detection rules, or case management data using standard SQL or Piped SQL syntax.
53. September 15, 2026 (2026-09-15) Sep 15, 2026 · issue 076

    Google SecOps parsers gain a match_all option in Grok filters to extract every non-overlapping pattern match from a field.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ▶ ⤢

    ▶ ⤢

    ⤢ ⤢
54. September 15, 2026 Sep 15, 2026 · release notes

    Grok filter now supports match_all option to extract all non-overlapping pattern occurrences

    • Adds match_all option to the Grok filter in parser syntax

    1 detail in Everything

55. docs update Sep 14, 2026 · issue 074
    ▶ ⤢

    ▶ ⤢
    └──▷ HOW TO FIND IT
    Retrieve your Bindplane Enterprise license key from the Google SecOps console to activate collection agents in your environment.
    📍In the Google SecOps console, go to SIEM Settings › Collection Agents › Bindplane Enterprise (Google Edition) and download your license key.
    └──▷ BREAKING ON UPGRADE

    • !Effective January 25, 2027, write permissions will be removed from the chronicle.readonly OAuth scope; any workflow using chronicle.readonly for write operations must be updated to use the chronicle OAuth scope.
    • !After March 18, 2027, the MANDIANT_ACTIVE_BREACH_IOC, MANDIANT_FUSION_IOC, and OPEN_SOURCE_INTEL_IOC feeds will be removed; affected feeds must be migrated to GTI.
56. docs update Sep 12, 2026 · issue 072

    Google SecOps adds case playbooks, reaction triggers, and self-service Bindplane Enterprise license download in preview⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ▶ ⤢

    ▶ ⤢
    └──▷ HOW TO FIND IT
    Download your Bindplane Enterprise license key directly from the Google SecOps console without opening a support ticket.
    📍In the Google SecOps console, go to SIEM Settings › Collection Agents › Bindplane Enterprise (Google Edition) and download the license key.
    • Enables self-service download of the Bindplane Enterprise (Google Edition) license key from SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. Settings > Collection Agents > Bindplane Enterprise (Google Edition) in the platform console, available to Enterprise Plus and Google Unified Security customers in US and EU regions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Introduces case playbooks (preview), allowing playbooks and manual actions to run across an entire case container rather than individual alerts, consolidating response tasks during investigations.
    • Introduces reaction triggers (preview), enabling playbooks to fire automatically in response to real-time case or alert updates — such as changes to case assignee, case tags, alert priority, or newly added entities.

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Effective January 25, 2027, write permissions will be removed from the chronicle.readonly OAuth scope; any workflows performing write operations must be updated to use the chronicle OAuth scope.
57. changelog Sep 8, 2026 · issue 068

    Google SecOps adds self-service Bindplane Enterprise license download and v2 feed types via Cloud Storage Transfer Service.

    ▶ ⤢

    ▶ ⤢

    ⤢ ⤢
    └──▷ HOW TO FIND IT
    Download your Bindplane Enterprise license key from the Google SecOps console to activate a self-managed Bindplane Enterprise (Google Edition) deployment.
    📍In the Google SecOps console, navigate to SIEM Settings › Collection Agents › Bindplane Enterprise (Google Edition) and download your license key.
    • Enables download of the Bindplane Enterprise (Google Edition) license key directly from the platform console under SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. Settings > Collection Agents > Bindplane Enterprise (Google Edition) for Enterprise Plus and Google Unified Security (GUS) customers.
    • Introduces v2 feed types that use the Google Cloud Storage Transfer Service (STSSTSAWS Security Token Service, an Amazon Web Services API that issues short-lived credentials for IAM roles, letting cyber tools authenticate to AWS without storing long-term secrets.) for improved performance, scalability, and reliability.

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Feeds using v1 feed types will be automatically migrated to v2 starting April 6, 2026; some feeds may require additional IP allowlist or service account permission updates before migration.
58. September 03, 2026 (2026-09-03) Sep 3, 2026 · issue 065

    Google SecOps Enterprise Plus and GUS customers can now self-serve their Bindplane Enterprise license key from the platform console.

    ▶ ⤢

    ▶ ⤢

    ⤢ ⤢
    └──▷ HOW TO FIND IT
    Retrieve your Bindplane Enterprise (Google Edition) license key without opening a support ticket — useful when spinning up new collection agents.
    📍In the Google SecOps console, go to SIEM Settings › Collection Agents, then locate and download your Bindplane Enterprise (Google Edition) license key.
59. September 03, 2026 Sep 3, 2026 · release notes

    Adds self-service license download for Bindplane Enterprise from SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. Settings > Collection Agents.

    └──▷ HOW TO FIND IT
    Retrieve the license key for Bindplane Enterprise without opening a support ticket.
    📍In the console, navigate to SIEM Settings › Collection Agents and locate the Download License button.
60. docs update Sep 1, 2026 · issue 061

    Google SecOps adds customizable multi-event rule schedules GA, Mandiant Frontline Threats Linux/macOS/GCP packs, and an Unroll processor for pipelines.

    ▶ ⤢

    ▶ ⤢
    └──▷ USE IT
    Parse a JSON array log payload and split it into discrete events before ingestion using the Unroll processor in a data processing pipeline.
    text copy

    # In your pipeline processor sequence:
    # 1. Transform processor (parse raw JSON body first)
    set(body, ParseJSON(body))
    # 2. Unroll processor (expand array into individual log events)
    # Add the Unroll processor after the Transform processor in the pipeline configuration.

    • General availability of customizable schedules for multi-event rules, enabling first-run delay offsets from 1 minute up to 48 hours to account for log ingestion latency and reduce false negatives.
    • Automated true-up runs re-evaluate time windows at 4 hours (and optionally 30 hours) to capture late-arriving logs in multi-event rule detections.
    • Existing custom multi-event rules can be migrated to customizable schedules directly from the Rules Dashboard.
    • New Unroll processor for data processing pipelines splits log entries containing arrays or slices of events into multiple individual log events before parsing and ingestion.
    • Unroll processor requires structured data input; raw string payloads must first be parsed with a Transform processor (e.g., set(body, ParseJSON(body))) placed before the Unroll processor in the pipeline sequence.

    5 details in Everything

61. changelog Aug 31, 2026 · issue 060

    Google SecOps adds an Unroll processor for pipeline event-breaking and expands Mandiant Frontline Threats rule packs to Linux, macOS, and Google Cloud.

    ▶ ⤢

    ▶ ⤢

    ⤢ ⤢
    └──▷ HOW TO FIND IT
    Split multi-event JSON array log entries into discrete events in a pipeline — parse the raw body first, then unroll it before ingestion.
    📍In the Google SecOps pipeline editor, add a Transform processor with expression set(body, ParseJSON(body)), then add an Unroll processor immediately after it in the pipeline execution sequence.
    • Adds the Unroll processor (event breaking) to Google SecOps data processing pipelines, splitting log entries that contain arrays or slices of events into individual log events before parsing and ingestion.
    • Requires a Transform processor (e.g., set(body, ParseJSON(body))) positioned before the Unroll processor in the pipeline execution sequence when inputs are raw string payloads.
    • Adds three new Mandiant Frontline Threats rule packs to the Content Hub: Mandiant Frontline Threats for Linux, Mandiant Frontline Threats for MacOS, and Mandiant Frontline Threats for Google Cloud.

    3 details in Everything

62. api-docs-b766a114a6e1 Aug 28, 2026 · issue 058

    Google SecOps adds endpoints to list dashboard charts and export playbook action results as ZIP files.

    API change

    Google SecOps adds endpoints to list dashboard charts and export playbook action results as ZIP files.

    • + GET /v1alpha/{parent}/dashboardCharts
    • + GET /v1alpha/{instance}/legacyPlaybooks:legacyExportActionResults
    ▶ ⤢

    ▶ ⤢
    └──▷ TRY IT
    Export playbook action results for post-incident review or offline analysis.
    copy

    $ curl -X GET 'https://chronicle.googleapis.com/v1alpha/<instance>/legacyPlaybooks:legacyExportActionResults' \
      -H 'Authorization: Bearer $(gcloud auth print-access-token)'

    Enumerate all dashboard charts for a given instance to audit or replicate dashboard configurations.
    copy

    $ curl -X GET 'https://chronicle.googleapis.com/v1alpha/<parent>/dashboardCharts' \
      -H 'Authorization: Bearer $(gcloud auth print-access-token)'

    • New GET /v1alpha/{parent}/dashboardCharts endpoint lists all dashboard charts for a given parent resource.
    • New GET /v1alpha/{instance}/legacyPlaybooks:legacyExportActionResults endpoint exports action results for a given case and action result ID as a ZIP file.
    • New endpoint documented: GET /v1alpha/{parent}/dashboardCharts
    • New endpoint documented: GET /v1alpha/{instance}/legacyPlaybooks:legacyExportActionResults

    4 details in Everything

63. August 26, 2026 (2026-08-26) Aug 26, 2026 · release notes

    Adds Mandiant Frontline Threats rule packs for Linux, MacOS, and Google Cloud to the Content Hub.

    └──▷ HOW TO FIND IT
    Deploy new Mandiant detections for Linux workloads directly from the Content Hub.
    📍In the Console, go to Content Hub and search for Mandiant Frontline Threats for Linux.
64. docs update Aug 25, 2026 · issue 056

    Google SecOps adds Operations in Emerging Threats Center, relative time filtering operators, and side-by-side alert inspection view.

    ▶ ⤢

    ▶ ⤢
    └──▷ HOW TO FIND IT
    Switch to side-by-side alert inspection in Cases to review Gemini insights and metadata without losing your place in the alert list.
    📍In Google SecOps, go to Cases › open a case › Alerts & Detections tab › click Side-by-side view in the layout toggle.
    Use the new Previous operator to filter dashboards to a complete prior calendar period (e.g. last full week) instead of a rolling window.
    📍In Google SecOps Search or a dashboard, open the time filter picker › select Previous › choose the time unit (e.g. Week) to scope results to the last complete calendar week.
    • Adds Side-by-side view layout on the Alerts & Detections tab in Cases, letting analysts inspect alert metadata, status, priority, creation date, and Gemini investigation insights in an adjacent side pane without leaving the main list.
    • Introduces three precise relative time filter operators — Past, Previous, and Current — in SecOps dashboards and Search to eliminate ambiguity between rolling windows and calendar-aligned periods across all time units (seconds through years); currently in public preview.
    • Adds Operations to the Emerging Threats Center feed, surfacing localized threat intelligence from frontline investigations (such as Managed Threat Defense engagements) alongside global Campaigns to map full adversary TTPsTTPsTactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind..

    3 details in Everything

65. August 24, 2026 (2026-08-24) Aug 24, 2026 · issue 056

    Google SecOps data processing pipelines gain an Unroll processor to split log arrays into discrete events before ingestion.

    ▶ ⤢

    ▶ ⤢

    ⤢ ⤢
    └──▷ USE IT
    Split JSON array log payloads into individual events in a pipeline — place the Transform processor before the Unroll processor so raw strings are parsed first.
    yaml copy

    # Pipeline processor sequence (data processing pipeline config)
    processors:
      - type: Transform
        expression: set(body, ParseJSON(body))
      - type: Unroll

    • Adds the Unroll processor (event breaking) to Google SecOps data processing pipelines, which automatically expands log entries containing arrays or slices into multiple individual log events prior to parsing and ingestion.
    • Requires structured input: raw string payloads must be converted first using a Transform processor (e.g., set(body, ParseJSON(body))) placed before the Unroll processor in the pipeline execution sequence.

    2 details in Everything

66. docs update Aug 20, 2026 · issue 051

    Google SecOps adds AI-powered Detection Engineering Agent, event simulation, Health Hub latency tables, and Cloud Logging for ingestion pipelines.

    ▶ ⤢

    ▶ ⤢
    • New Detection Engineering Agent (DEA) evaluates threat coverage and auto-drafts YARA-LYARA-LA rule language developed by Google for Chronicle that extends YARA syntax to express multi-event, time-windowed detections over log data rather than single-file pattern matching. detection rules via Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. (MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface.) tools, accessible from compatible AI clients such as Google Antigravity or Claude Code.
    • New event simulation capability programmatically delivers realistic threat sequences into the live ingestion pipeline for full-funnel detection coverage evaluation — covering UDM normalization, multi-event correlation, YARA-L 2.0YARA-L 2.0A rule language developed by Google for writing detection logic in Chronicle SIEM, extending YARA syntax to match sequences of log events over time rather than static file patterns. rule validation, and alerting — without disrupting production SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. workflows.
    • Health Hub gains two new latency tables: ingestion latency at the source level and at the log-type level, with drill-down into the Data Health Deep Dive page for detailed per-source or per-log-type analysis.
    • Supports monitoring, debugging, and troubleshooting of Google SecOps ingestion pipelines and feeds via Cloud Logging — send, view, and query ingestion and feed activity logs in Logs Explorer to diagnose missing, delayed, or failing logs. Requires a Bring Your Own Project (BYOP) Google Cloud project.

    4 details in Everything

67. api-docs-a2a002294402 Aug 16, 2026 · issue 047

    Google SecOps adds 30+ new REST endpoints spanning tenant management, case evidence, remediation actions, AI-assisted parsing, and BigQueryBigQueryA serverless, cloud-hosted analytical database from Google that runs SQL queries across massive datasets without managing infrastructure, giving cyber tools scalable storage and fast querying over large volumes of log or event data. export subscriptions.

    API change

    Google SecOps adds 30+ new REST endpoints spanning tenant management, case evidence, remediation actions, AI-assisted parsing, and BigQuery export subscriptions.

    • + PATCH /v1beta/{instance.name}
    • + POST /v1beta/{parent}:runThreatHunt
    • + GET /v1beta/{parent}/tenants
    • + PATCH /v1beta/{tenant.name}
    • + POST /v1alpha/{instance}:evaluateRuleCoverageLongRunning
    • + POST /v1alpha/{parent}:generateBindplaneLicense
    • + GET /v1alpha/{parent}/bigQueryExport:fetchSubscriptions
    • + POST /v1alpha/{parent}/bigQueryExport:provisionPartnerSubscription
    • + POST /v1alpha/{parent}/bigQueryExport:revokePartnerSubscription
    • + POST /v1alpha/{parent}/calculatedFieldDefinitions:validateDependency
    • + POST /v1alpha/{name}:batchAttachEvidence
    • + POST /v1alpha/{name}:batchDetachEvidence
    • + POST /v1alpha/{parent}/caseComments:batchCreate
    • + GET /v1alpha/{parent}/detections
    • + GET /v1alpha/{parent}/events
    • + GET /v1alpha/{parent}/events
    • + POST /v1alpha/{parent}/enrichmentAgent:executeRemediationActions
    • + GET /v1alpha/{parent}/enrichmentAgent:fetchRemediationActions
    • + GET /v1alpha/{parent}/integrations:fetchSupportedPythonVersions
    • + GET /v1alpha/{instance}/legacySdk:legacyDownloadBlob
    • + POST /v1alpha/{instance}/legacySdk:legacyUploadBlob
    • + POST /upload/v1alpha/{instance}/legacySdk:legacyUploadBlob
    • + POST /v1alpha/{parent}/parserExtensions:generateParserExtensionAi
    • + GET /v1alpha/{parent}/queryMetrics:fetchTimeSeries
    • + GET /v1alpha/{parent}/queryMetrics
    • + POST /v1alpha/{parent}/subdomains
    • + GET /v1alpha/{parent}/subdomains
    • + POST /v1alpha/{parent}/tagSubscriptions
    • + GET /v1alpha/{parent}/tagSubscriptions
    • + PATCH /v1alpha/{tagSubscription.name}
    • + POST /v1alpha/{parent}/tags
    • + GET /v1alpha/{parent}/tags
    • + PATCH /v1alpha/{tag.name}
    • + POST /v1alpha/{parent}/messages:createLongRunning
    • + POST /v1/{parent}/feeds
    • + PATCH /v1/{feed.name}
    • ⚠ (deprecated)
    • ⚠ Deprecated: no longer supported or in use.
    ▶ ⤢

    ▶ ⤢
    • New POST /v1beta/{parent}:runThreatHunt endpoint initiates a threat hunt programmatically via the v1beta API.
    • New GET /v1beta/{parent}/tenants and PATCH /v1beta/{tenant.name} endpoints enable tenant listing and updates under the v1beta.projects.locations.instances.tenants resource for MSSPMSSPA Managed Security Service Provider: a third-party company that operates cyber tooling and monitoring on behalf of clients, letting organizations outsource detection, response, and compliance functions./partner management.
    • New POST /v1alpha/{instance}:evaluateRuleCoverageLongRunning endpoint (evaluateRuleCoverageLongRunning) evaluates whether detection rules provide coverage for input UDM events.
    • New POST /v1alpha/{parent}:generateBindplaneLicense endpoint (generateBindplaneLicense) generates a Bindplane license for a customer instance.
    • New BigQuery export subscription endpoints: GET /v1alpha/{parent}/bigQueryExport:fetchSubscriptions (fetchSubscriptions), POST /v1alpha/{parent}/bigQueryExport:provisionPartnerSubscription, and POST /v1alpha/{parent}/bigQueryExport:revokePartnerSubscription for managing partner BigQuery export subscriptions.

    +52 more show less

    • New POST /v1alpha/{parent}/calculatedFieldDefinitions:validateDependency endpoint validates calculated field definition dependencies.
    • New POST /v1alpha/{name}:batchAttachEvidence (batchAttachEvidence) and POST /v1alpha/{name}:batchDetachEvidence (batchDetachEvidence) endpoints batch-attach or batch-detach evidence to/from cases.
    • New POST /v1alpha/{parent}/caseComments:batchCreate endpoint adds multiple case comments in a single operation.
    • New v1alpha.projects.locations.instances.cases.detections resource with GET /v1alpha/{parent}/detections for listing detections associated with a case.
    • New v1alpha.projects.locations.instances.cases.detections.events resource with GET /v1alpha/{parent}/events for listing events under a specific case detection.
    • New v1alpha.projects.locations.instances.cases.events resource with GET /v1alpha/{parent}/events for listing all events associated with a case.
    • New POST /v1alpha/{parent}/enrichmentAgent:executeRemediationActions (executeRemediationActions) and GET /v1alpha/{parent}/enrichmentAgent:fetchRemediationActions (fetchRemediationActions) endpoints execute and list available remediation actions on a SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. alert.
    • New GET /v1alpha/{parent}/integrations:fetchSupportedPythonVersions (fetchSupportedPythonVersions) endpoint returns supported Python versions for integrations.
    • New GET /v1alpha/{instance}/legacySdk:legacyDownloadBlob (downloadWebhookBlob) and POST /v1alpha/{instance}/legacySdk:legacyUploadBlob (uploadWebhookBlob) endpoints download and upload webhook blobs via the legacy SDK surface.
    • New POST /v1alpha/{parent}/parserExtensions:generateParserExtensionAi (generateParserExtensionAi) endpoint generates a parser extension using AI from a user prompt and optional raw log samples.
    • New v1alpha.projects.locations.instances.queryMetrics resource with GET /v1alpha/{parent}/queryMetrics:fetchTimeSeries (fetchTimeSeries) and GET /v1alpha/{parent}/queryMetrics for retrieving aggregated query performance time series data.
    • New v1alpha.projects.locations.instances.subdomains resource with POST /v1alpha/{parent}/subdomains and GET /v1alpha/{parent}/subdomains endpoints for creating and listing instance subdomains.
    • New v1alpha.projects.locations.instances.tagSubscriptions resource with full CRUDCRUDThe four basic database operations — Create, Read, Update, Delete — used as shorthand for any system that manages persistent data records, giving cyber tools a standard model for interacting with stored information. endpoints (POST, GET /v1alpha/{parent}/tagSubscriptions, PATCH /v1alpha/{tagSubscription.name}) for managing tag subscriptions.
    • New v1alpha.projects.locations.instances.tags resource with full CRUD endpoints (POST /v1alpha/{parent}/tags, GET /v1alpha/{parent}/tags, PATCH /v1alpha/{tag.name}) for creating, listing, and updating tags.
    • New POST /v1alpha/{parent}/messages:createLongRunning (createLongRunning) endpoint creates a new conversation message asynchronously.
    • New v1.instances.feeds resource with POST /v1/{parent}/feeds and PATCH /v1/{feed.name} endpoints for creating and updating feeds via the stable v1 API.
    • New PATCH /v1beta/{instance.name} endpoint enables patching instance configuration in the v1beta API.
    • New endpoint documented: PATCH /v1beta/{instance.name}
    • New endpoint documented: POST /v1beta/{parent}:runThreatHunt
    • New endpoint documented: GET /v1beta/{parent}/tenants
    • New endpoint documented: PATCH /v1beta/{tenant.name}
    • New endpoint documented: POST /v1alpha/{instance}:evaluateRuleCoverageLongRunning
    • New endpoint documented: POST /v1alpha/{parent}:generateBindplaneLicense
    • New endpoint documented: GET /v1alpha/{parent}/bigQueryExport:fetchSubscriptions
    • New endpoint documented: POST /v1alpha/{parent}/bigQueryExport:provisionPartnerSubscription
    • New endpoint documented: POST /v1alpha/{parent}/bigQueryExport:revokePartnerSubscription
    • New endpoint documented: POST /v1alpha/{parent}/calculatedFieldDefinitions:validateDependency
    • New endpoint documented: POST /v1alpha/{name}:batchAttachEvidence
    • New endpoint documented: POST /v1alpha/{name}:batchDetachEvidence
    • New endpoint documented: POST /v1alpha/{parent}/caseComments:batchCreate
    • New endpoint documented: GET /v1alpha/{parent}/detections
    • New endpoint documented: GET /v1alpha/{parent}/events
    • New endpoint documented: POST /v1alpha/{parent}/enrichmentAgent:executeRemediationActions
    • New endpoint documented: GET /v1alpha/{parent}/enrichmentAgent:fetchRemediationActions
    • New endpoint documented: GET /v1alpha/{parent}/integrations:fetchSupportedPythonVersions
    • New endpoint documented: GET /v1alpha/{instance}/legacySdk:legacyDownloadBlob
    • New endpoint documented: POST /v1alpha/{instance}/legacySdk:legacyUploadBlob
    • New endpoint documented: POST /upload/v1alpha/{instance}/legacySdk:legacyUploadBlob
    • New endpoint documented: POST /v1alpha/{parent}/parserExtensions:generateParserExtensionAi
    • New endpoint documented: GET /v1alpha/{parent}/queryMetrics:fetchTimeSeries
    • New endpoint documented: GET /v1alpha/{parent}/queryMetrics
    • New endpoint documented: POST /v1alpha/{parent}/subdomains
    • New endpoint documented: GET /v1alpha/{parent}/subdomains
    • New endpoint documented: POST /v1alpha/{parent}/tagSubscriptions
    • New endpoint documented: GET /v1alpha/{parent}/tagSubscriptions
    • New endpoint documented: PATCH /v1alpha/{tagSubscription.name}
    • New endpoint documented: POST /v1alpha/{parent}/tags
    • New endpoint documented: GET /v1alpha/{parent}/tags
    • New endpoint documented: PATCH /v1alpha/{tag.name}
    • New endpoint documented: POST /v1alpha/{parent}/messages:createLongRunning
    • New endpoint documented: POST /v1/{parent}/feeds
    • New endpoint documented: PATCH /v1/{feed.name}

    57 details in Everything

68. changelog Aug 15, 2026 · issue 046

    Google SecOps gains Cloud Logging integration for SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. ingestion pipeline monitoring and feed debugging (public preview, BYOP required).

    ▶ ⤢

    ▶ ⤢

    ⤢ ⤢
    └──▷ HOW TO FIND IT
    Quickly jump from a failing feed to its pre-filtered Logs Explorer view to diagnose missing or delayed log delivery.
    📍In the Google SecOps console, go to Feed management, locate the feed you want to debug, and select Debug with logs to open Logs Explorer pre-filtered for that feed.
69. docs update Aug 13, 2026 · issue 044

    Google SecOps adds Cloud Logging-based feed diagnostics and an upgraded rich-text editor across SOARSOARSecurity orchestration, automation and response, coordinating incident workflows across tools. Playbooks can gather evidence, assign work or carry out approved response actions. surfaces

    ▶ ⤢

    ▶ ⤢
    • New public preview: monitor, debug, and troubleshoot Google SecOps ingestion pipelines and feeds using Cloud Logging — requires a Bring Your Own Project (BYOP) Google Cloud project configuration.
    • New Debug with logs option on the Feed management page opens Logs Explorer pre-filtered for a specific feed, enabling fast per-feed diagnosis.
    • Supports configuring exclusion filters in the Log Router to exclude specific logs (e.g. Storage Transfer Service logs) from being routed to Cloud Logging.
    • Enables using Gemini Cloud Assist to investigate logging and metrics telemetry directly from the Google SecOps console.
    • Upgraded rich-text editor across Cases Wall, Use Case Upload dialog, Report Template dialog, and Dashboard Editor widget with semantic font sizes (Small, Normal, Large, Huge) and simplified table insertion/removal.

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The upgraded rich-text editor no longer supports formatting inside table cells.
    • !The Cut, Copy, and Paste buttons have been removed from the rich-text editor toolbar (standard OS keyboard shortcuts remain supported).
70. August 12, 2026 (2026-08-12) Aug 12, 2026 · issue 044

    Google SecOps gains Cloud Logging integration for feed pipeline visibility, debugging, and telemetry investigation via Gemini.

    ▶ ⤢

    ▶ ⤢

    ⤢ ⤢
    └──▷ HOW TO FIND IT
    Quickly isolate delivery failures for a specific feed without manually constructing Logs Explorer queries.
    📍In the Google SecOps console, go to Settings › Feed management, select a feed, and click Debug with logs to open Logs Explorer pre-filtered for that feed.
    • Adds Cloud Logging integration (public preview, requires BYOP Google Cloud project) to monitor, debug, and troubleshoot SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. ingestion pipelines and feeds via Logs Explorer, supporting both push- and pull-based ingestion mechanisms.
    • Adds Debug with logs option on the Feed management page that opens Logs Explorer pre-filtered for a specific feed.
    • Enables Gemini Cloud Assist to investigate logging and metrics telemetry directly from the Google SecOps console.
    • Supports configuring exclusion filters in the Log Router to exclude specific logs (e.g., Storage Transfer Service (STSSTSAWS Security Token Service, an Amazon Web Services API that issues short-lived credentials for IAM roles, letting cyber tools authenticate to AWS without storing long-term secrets.) logs) from being routed to Cloud Logging.

    4 details in Everything

71. August 12, 2026 Aug 12, 2026 · release notes

    Google SecOps August 12, 2026 adds BYOP Cloud Logging for SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. feed monitoring and debugging

    └──▷ HOW TO FIND IT
    Quickly debug feed delivery issues by opening Logs Explorer directly from the console
    📍Go to Feed management › Select your feed › Click Debug with logs
    Prevent noisy STSSTSAWS Security Token Service, an Amazon Web Services API that issues short-lived credentials for IAM roles, letting cyber tools authenticate to AWS without storing long-term secrets. logs from cluttering ingestion monitoring in Cloud Logging
    📍Configure exclusion filters in the Log Router to exclude Storage Transfer Service logs
    • Adds Analyze feed activity with Cloud Logging feature for public preview to monitor SIEM ingestion pipelines
    • Enables Debug with logs option on Feed management page to open pre-filtered Logs Explorer
    • Supports filtering routed logs via exclusion filters in Log Router for specific sources like STS

    3 details in Everything

72. changelog Aug 8, 2026 · issue 039

    Google SecOps adds 26 new log source integrations and self-service Bindplane Enterprise license download for Enterprise Plus and GUS customers.

    ▶ ⤢

    ▶ ⤢

    ⤢ ⤢
    └──▷ HOW TO FIND IT
    Retrieve your Bindplane Enterprise license key from the console so you can activate a self-managed collection agent without opening a support ticket.
    📍In the Google SecOps console, go to SIEM Settings › Collection Agents and download the Bindplane Enterprise (Google Edition) license key.
    • Adds self-service Bindplane Enterprise (Google Edition) license key download directly from SIEM Settings > Collection Agents for Enterprise Plus and Google Unified Security (GUS) customers (Preview).
    • Adds ARMIS_ALERTS (Armis Alerts) as a supported log ingestion source.
    • Adds GCP_SECURITYCENTER_EXTERNAL_EXPOSURE (Security Command Center External Exposure) as a supported log ingestion source.
    • Adds ADOBE_EXPERIENCE_PLATFORM (Adobe Experience Platform) as a supported log ingestion source.
    • Adds AUDIOCODES_SBC (AudioCodes Session Border Controller) as a supported log ingestion source.

    +21 more show less

    • Adds AZURE_GATEWAY_CONTAINERS (Azure Application Gateway for Containers) as a supported log ingestion source.
    • Adds AZURE_LOGIC_APPS (Azure Logic Apps) as a supported log ingestion source.
    • Adds AZURE_NATGW_FLOW (Azure NAT Gateway Flow) as a supported log ingestion source.
    • Adds BROADCOM_DX_NETOPS_SPECTRUM (Broadcom DX NetOps Spectrum) as a supported log ingestion source.
    • Adds CARTO_ACTIVITY (Carto Activity) as a supported log ingestion source.
    • Adds CLAUDE_CODE_OBSERVABILITY (Claude Code Observability) as a supported log ingestion source.
    • Adds CYBLE_ASM (Cyble Attack Surface Management) as a supported log ingestion source.
    • Adds CYBLE_BIP (Cyble Brand Intelligence & Protection) as a supported log ingestion source.
    • Adds DARKWEB_IQ (Darkweb IQ) as a supported log ingestion source.
    • Adds ELLIO_THREAT_INTEL (Ellio Threat Intelligence) as a supported log ingestion source.
    • Adds EXEON_NDR (Exeon NDRNDRNetwork detection and response, analyzing network activity to find threats and support investigation. It focuses on communication patterns and suspicious traffic across systems.) as a supported log ingestion source.
    • Adds GRAVITEE (Gravitee) as a supported log ingestion source.
    • Adds KASPERSKY_ANTI_TARGETED_ATTACK (Kaspersky Anti Targeted Attack) as a supported log ingestion source.
    • Adds MICROSOFT_COPILOT_INTERACTION (Microsoft Copilot Interaction) as a supported log ingestion source.
    • Adds OSTTRA_MARKITWIRE (OSTTRA MarkitWire) as a supported log ingestion source.
    • Adds PROOFPOINT_ADAPTIVE_EMAIL_SECURITY (Proofpoint Adaptive Email Security) as a supported log ingestion source.
    • Adds SECOMEA_GATEMANAGER (Secomea GateManager) as a supported log ingestion source.
    • Adds TRENDMICRO_VISION_ONE_RISK_EVENT (Trend Micro Vision One Risk Event) as a supported log ingestion source.
    • Adds TXONE_EDGEIPS (TXOne EdgeIPS) as a supported log ingestion source.
    • Adds VECTRA_RUX (Vectra Respond UX) as a supported log ingestion source.
    • Adds ZOHO_CRM (Zoho CRM) as a supported log ingestion source.

    26 details in Everything

73. docs update Aug 4, 2026 · issue 035

    Google SecOps adds Threat Hunt Agent (Public Preview) and 27 new log source integrations

    ▶ ⤢

    ▶ ⤢
    • New Threat Hunt Agent (Public Preview, Enterprise Plus) autonomously generates structured hunting plans targeting specific threat actors, campaigns, malware families, software toolkits, or MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. techniques, converts hypotheses into YARA-L 2.0YARA-L 2.0A rule language developed by Google for writing detection logic in Chronicle SIEM, extending YARA syntax to match sequences of log events over time rather than static file patterns. queries, executes them against historical telemetry, and auto-creates cases with verdicts (Substantial Evidence, Evidence Found, or Threat Not Found) in Case Management.
    • Adds 27 new log source integrations, including ARMIS_ALERTS, FORTINET_SWITCH, GCP_SECURITYCENTER_EXTERNAL_EXPOSURE, OPEN_VPN, THREATLOCKER, ADOBE_EXPERIENCE_PLATFORM, AUDIOCODES_SBC, AZURE_GATEWAY_CONTAINERS, AZURE_LOGIC_APPS, AZURE_NATGW_FLOW, BROADCOM_DX_NETOPS_SPECTRUM, CARTO_ACTIVITY, CLAUDE_CODE_OBSERVABILITY, CYBLE_ASM, CYBLE_BIP, DARKWEB_IQ, ELLIO_THREAT_INTEL, EXEON_NDR, GRAVITEE, KASPERSKY_ANTI_TARGETED_ATTACK, MICROSOFT_COPILOT_INTERACTION, OSTTRA_MARKITWIRE, PROOFPOINT_ADAPTIVE_EMAIL_SECURITY, SECOMEA_GATEMANAGER, TRENDMICRO_VISION_ONE_RISK_EVENT, TXONE_EDGEIPS, VECTRA_RUX, and ZOHO_CRM.
    • Extends the Stage 2 SOARSOARSecurity orchestration, automation and response, coordinating incident workflows across tools. Playbooks can gather evidence, assign work or carry out approved response actions. migration to Google Cloud deadline from September 30 to November 30, 2026.

    3 details in Everything

74. changelog Jul 31, 2026 · issue 031

    Google SecOps adds prebuilt parser preview visibility and append/replace control for repeated fields in code snippet extensions.

75. docs update Jul 29, 2026 · issue 029

    Google SecOps adds Data RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. for SOARSOARSecurity orchestration, automation and response, coordinating incident workflows across tools. Playbooks can gather evidence, assign work or carry out approved response actions. cases, revamped investigation management, customizable rule schedules, and richer parser extensions.

    └──▷ HOW TO FIND IT
    Enable and configure the new Investigation Management experience and access the new default case/alert views.
    📍In the Google SecOps console, go to SOAR Settings › Case Data › Views, then locate and enable New Default Alert View and New Default Case View. Manually copy any advanced widget configurations (e.g., Safe HTML Rendering) from Default Alert View and Default Case View before activating.
    • Adds Data RBAC for first-party SOAR cases and alerts (public preview): automatically applies SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. data access scopes to Chronicle-connector-ingested alerts and cases so analysts only see authorized data.
    • Introduces customizable execution schedules for multi-event rules (public preview): configure first-run delay offsets on the Rule Schedule tab to account for ingestion latency, with automated background true-up runs for late-arriving logs.
    • Launches revamped Investigation Management experience (public preview): track raw UDM events and detections alongside alerts in cases, with customizable table views, side-drawer previews, and integrated UDM Search workflows.
    • Enables attaching SIEM search results directly to cases: manually attach up to 5,000 UDM events or 500 detections from search results to new or existing cases as core evidence.
    • New Interactive Events Viewer: inspect parsed UDM records, review raw logs, pin key evidence, and build detection exclusions from an interactive side panel within a case.

    +3 more show less

    • Adds two new default views — New Default Alert View and New Default Case View — under SOAR Settings > Case Data > Views for the enhanced Cases experience.
    • Extends parser code snippet extensions to support Append and Replace operations for repeated UDM fields, previously only available for no-code extensions.
    • Allows viewing prebuilt parser preview version content even when a custom parser is active for the same log type.

    8 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Before enabling the new Investigation Management experience, advanced widget configurations (such as Safe HTML Rendering or custom widgets) must be manually copied from Default Alert View and Default Case View to the new New Default Alert View and New Default Case View, or those configurations will be lost.
76. July 29, 2026 (2026-07-29) Jul 29, 2026 · issue 029

    Google SecOps lets you inspect prebuilt parser preview content even when a custom parser is active for the same log type.

77. docs update Jul 24, 2026 · issue 024

    Google Unified Security adds Chrome Enterprise threat detection, multi-cloud CDIR, and AI Protection for securing AI workloads.

    └──▷ HOW TO FIND IT
    Enable Chrome Enterprise threat visibility and automated response in Google SecOps by connecting Chrome Enterprise Premium and activating curated detections.
    📍1. Configure the Chrome Enterprise Premium Reporting Connector to send data to Google SecOps. 2. Connect Chrome Enterprise Premium to Google SecOps. 3. Enable Chrome Enterprise Threats Curated Detections.
    Stand up multi-cloud CDIR coverage (Google Cloud, AWS, Azure) within Google SecOps for unified cloud threat detection and response.
    📍1. Activate the Enterprise Tier of SCC-E using your existing Google SecOps instance. 2. Enable Security Command Center Detection Services. 3. Connect Security Command Center to AWS (and optionally Azure in Preview) for Entity Graph resource data. 4. Ingest Google Cloud logs, AWS logs, and Azure logs into Google SecOps. 5. Enable the CDIR Curated Detections. 6. Install SOAR response playbooks.
    • Adds Chrome Enterprise Premium integration with curated detections enriched by Safe Browsing and Google Threat Intelligence (GTI) to surface browser-based threats in Google SecOps.
    • Adds dedicated Google SecOps dashboards for Chrome security events and anomalies to improve analyst visibility into browser activity.
    • Enables automated SOARSOARSecurity orchestration, automation and response, coordinating incident workflows across tools. Playbooks can gather evidence, assign work or carry out approved response actions. playbook response actions on Chrome Enterprise — including blocking malicious URLs, blocking extensions, and quarantining devices — directly from Google SecOps.
    • Adds Cloud Detection, Investigation, and Response (CDIR) capability spanning Google Cloud, AWS, and Azure, with Security Command Center findings automatically mapped to Google SecOps cases.
    • Adds Cloud Asset Inventory collection that flows multi-cloud asset metadata (AWS, Azure, Google Cloud) into the Google SecOps Entity Graph for enriched alert context.

    +4 more show less

    • Supports natural language query syntax alongside existing Yara-L and raw log search for SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. investigation during CDIR workflows.
    • Integrates AI Protection into Security Command Center Enterprise (SCC-E), providing discovery of AI asset inventory, virtual red teaming to surface toxic attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately., and detection and response for AI-targeted threats (LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. hijacking, data poisoning, exfiltration).
    • Adds Model Armor for model- and cloud-agnostic protection against data loss, brand damage, and offensive content in generative AI workloads.
    • Adds Agentic AI Triage and Investigation for automatic triage and investigation of security alerts.

    9 details in Everything

78. docs update Jul 24, 2026 · docs issue 004

    Google Unified Security adds Chrome Enterprise threat detection, multi-cloud CDIR, and AI Protection for securing AI workloads.

    └──▷ HOW TO FIND IT
    Enable Chrome Enterprise threat visibility and automated response in Google SecOps by connecting Chrome Enterprise Premium and activating curated detections.
    📍1. Configure the Chrome Enterprise Premium Reporting Connector to send data to Google SecOps. 2. Connect Chrome Enterprise Premium to Google SecOps. 3. Enable Chrome Enterprise Threats Curated Detections.
    Stand up multi-cloud CDIR coverage (Google Cloud, AWS, Azure) within Google SecOps for unified cloud threat detection and response.
    📍1. Activate the Enterprise Tier of SCC-E using your existing Google SecOps instance. 2. Enable Security Command Center Detection Services. 3. Connect Security Command Center to AWS (and optionally Azure in Preview) for Entity Graph resource data. 4. Ingest Google Cloud logs, AWS logs, and Azure logs into Google SecOps. 5. Enable the CDIR Curated Detections. 6. Install SOAR response playbooks.
    • Adds Chrome Enterprise Premium integration with curated detections enriched by Safe Browsing and Google Threat Intelligence (GTI) to surface browser-based threats in Google SecOps.
    • Adds dedicated Google SecOps dashboards for Chrome security events and anomalies to improve analyst visibility into browser activity.
    • Enables automated SOARSOARSecurity orchestration, automation and response, coordinating incident workflows across tools. Playbooks can gather evidence, assign work or carry out approved response actions. playbook response actions on Chrome Enterprise — including blocking malicious URLs, blocking extensions, and quarantining devices — directly from Google SecOps.
    • Adds Cloud Detection, Investigation, and Response (CDIR) capability spanning Google Cloud, AWS, and Azure, with Security Command Center findings automatically mapped to Google SecOps cases.
    • Adds Cloud Asset Inventory collection that flows multi-cloud asset metadata (AWS, Azure, Google Cloud) into the Google SecOps Entity Graph for enriched alert context.

    +4 more show less

    • Supports natural language query syntax alongside existing Yara-L and raw log search for SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. investigation during CDIR workflows.
    • Integrates AI Protection into Security Command Center Enterprise (SCC-E), providing discovery of AI asset inventory, virtual red teaming to surface toxic attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately., and detection and response for AI-targeted threats (LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. hijacking, data poisoning, exfiltration).
    • Adds Model Armor for model- and cloud-agnostic protection against data loss, brand damage, and offensive content in generative AI workloads.
    • Adds Agentic AI Triage and Investigation for automatic triage and investigation of security alerts.

    9 details in Everything

79. docs update Jul 24, 2026 · issue 024

    Google SecOps introduces Security Tokens for metering agentic consumption, and announces legacy SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. API deprecation timeline.

    └──▷ BREAKING ON UPGRADE

    • !From October 26, 2026, new Google SecOps instances will no longer support legacy Backstory API or Ingestion API calls.
    • !From July 20, 2027, all requests to legacy Backstory API and Ingestion API endpoints will fail for all existing instances as those APIs are fully turned down — custom scripts, integrations, SOARSOARSecurity orchestration, automation and response, coordinating incident workflows across tools. Playbooks can gather evidence, assign work or carry out approved response actions. connectors, and ingestion feeds calling these endpoints must be migrated to Chronicle API endpoints.
80. docs update Jul 24, 2026 · docs issue 004

    Google SecOps introduces Security Tokens for metering agentic consumption, and announces legacy SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. API deprecation timeline.

    └──▷ BREAKING ON UPGRADE

    • !From October 26, 2026, new Google SecOps instances will no longer support legacy Backstory API or Ingestion API calls.
    • !From July 20, 2027, all requests to legacy Backstory API and Ingestion API endpoints will fail for all existing instances as those APIs are fully turned down — custom scripts, integrations, SOARSOARSecurity orchestration, automation and response, coordinating incident workflows across tools. Playbooks can gather evidence, assign work or carry out approved response actions. connectors, and ingestion feeds calling these endpoints must be migrated to Chronicle API endpoints.
81. changelog Jul 23, 2026 · issue 023

    Google SecOps adds Advanced Filtering with dynamic YARA-LYARA-LA rule language developed by Google for Chronicle that extends YARA syntax to express multi-event, time-windowed detections over log data rather than single-file pattern matching. query variables in dashboards, plus Security Tokens for agentic consumption metering.

    └──▷ HOW TO FIND IT
    Create a dashboard filter with a multi-value token to dynamically scope a YARA-L detection query by hostname at runtime, rather than hardcoding values.
    📍In the Google SecOps console, open a dashboard and select Advanced Filtering. Define a Token Variable (e.g., target_hostname) with alphanumeric/underscore characters, set Filter Value Generation to YARA-L query results, enable Multi-Select, and set the delimiter to |. Reference the token in your YARA-L query to inject the selected values at runtime.
    • Adds Advanced Filtering in dashboards (Public Preview): security analysts can define Token Variables to inject dynamic values, complex regular expressions, or boolean logic directly into YARA-L queries at runtime.
    • Token values can be generated dynamically from YARA-L query results or entered as a static manual list.
    • Customizable prefix/suffix wrappers on token values enable advanced patterns such as inline regular expressions within dashboard queries.
    • Multi-select support for token variables allows combining multiple values in a query using a configurable delimiter (e.g., |).
    • Introduces Security Tokens for metering agentic consumption within Google SecOps, consumed by generally available security agents.

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !From October 26, 2026, new Google SecOps instances will no longer accept legacy Backstory API or Ingestion API calls; only Chronicle API endpoints will be supported.
    • !From July 20, 2027, all requests to legacy Backstory API and Ingestion API endpoints will fail for all existing instances as the legacy APIs are completely turned down.
82. docs update Jul 23, 2026 · docs issue 004

    Google SecOps adds Advanced Filtering with dynamic YARA-LYARA-LA rule language developed by Google for Chronicle that extends YARA syntax to express multi-event, time-windowed detections over log data rather than single-file pattern matching. query variables in dashboards, plus Security Tokens for agentic consumption metering.

    └──▷ HOW TO FIND IT
    Create a dashboard filter with a multi-value token to dynamically scope a YARA-L detection query by hostname at runtime, rather than hardcoding values.
    📍In the Google SecOps console, open a dashboard and select Advanced Filtering. Define a Token Variable (e.g., target_hostname) with alphanumeric/underscore characters, set Filter Value Generation to YARA-L query results, enable Multi-Select, and set the delimiter to |. Reference the token in your YARA-L query to inject the selected values at runtime.
    • Adds Advanced Filtering in dashboards (Public Preview): security analysts can define Token Variables to inject dynamic values, complex regular expressions, or boolean logic directly into YARA-L queries at runtime.
    • Token values can be generated dynamically from YARA-L query results or entered as a static manual list.
    • Customizable prefix/suffix wrappers on token values enable advanced patterns such as inline regular expressions within dashboard queries.
    • Multi-select support for token variables allows combining multiple values in a query using a configurable delimiter (e.g., |).
    • Introduces Security Tokens for metering agentic consumption within Google SecOps, consumed by generally available security agents.

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !From October 26, 2026, new Google SecOps instances will no longer accept legacy Backstory API or Ingestion API calls; only Chronicle API endpoints will be supported.
    • !From July 20, 2027, all requests to legacy Backstory API and Ingestion API endpoints will fail for all existing instances as the legacy APIs are completely turned down.
83. July 15, 2026 (2026-07-15) Jul 15, 2026 · issue 017

    Google SecOps dashboards gain Advanced Filtering with dynamic query variables, regex support, and multi-select logic injection into YARA-LYARA-LA rule language developed by Google for Chronicle that extends YARA syntax to express multi-event, time-windowed detections over log data rather than single-file pattern matching. at runtime.

    └──▷ HOW TO FIND IT
    When investigating across multiple threat actor IPs, use a multi-select advanced filter token to fan out a single YARA-L dashboard query across all selected values without editing the query manually.
    📍In the dashboard editor, go to Filters › Add Advanced Filter, define a Token Variable (e.g., source_ip), set Filter Value Generation to a YARA-L query result or static list, enable Multi-Select, and set the delimiter to | — then reference the token in your YARA-L rule where the value should be injected at runtime.
    • Adds Advanced Filtering in dashboards (Public Preview): security analysts can define token variables to inject dynamic values, complex regular expressions, or boolean logic directly into YARA-L queries at runtime.
    • Supports token values generated dynamically from YARA-L query results or entered as a static manual list.
    • Enables customizable prefix/suffix wrappers around token values to express regex or other query logic.
    • Supports multi-select tokens with a configurable delimiter (e.g., |) for combining multiple values in a single YARA-L query.

    4 details in Everything

84. July 15, 2026 Jul 15, 2026 · release notes

    Google SecOps adds Advanced Filtering with YARA-LYARA-LA rule language developed by Google for Chronicle that extends YARA syntax to express multi-event, time-windowed detections over log data rather than single-file pattern matching. token variables and parser extensions for repeated UDM fields

    • Adds Advanced Filtering in dashboards (public preview) allowing security analysts to inject dynamic values, complex regular expressions, or boolean logic directly into YARA-L queries at runtime using Token Variables with customizable prefixes/suffixes and multi-select support.

    1 detail in Everything

85. July 01, 2026 (2026-07-01) Jul 1, 2026 · issue 014

    Google SecOps introduces Security Tokens for metering agentic SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. consumption across GA agents.

    • Adds Security Tokens as a new metering unit for tracking and billing consumption by generally available security agents.
    • Supports agent invocation via web interface, CLI, chat, and Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. (MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface.) — all metered through Security Tokens.
    • Excludes assistive features (standard chat panels, automated summaries) and preview agents from Security Token consumption.

    3 details in Everything

86. July 01, 2026 Jul 1, 2026 · release notes

    Google SecOps introduces Security Tokens for metering agentic consumption via CLI, chat, or MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface..

    • Security Tokens are now available for metering agentic consumption within Google SecOps, rolled out across all regions starting July 1.
    • Security Tokens are consumed by generally available security agents invoked automatically or manually using the web interface, CLI, chat, or Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. (MCP).

    2 details in Everything

87. June 30, 2026 (2026-06-30) Jun 30, 2026 · issue 014

    Google SecOps raises event rule limits and launches unified rules interface in public preview.

    └──▷ HOW TO FIND IT
    Access the new unified rules interface to manage both custom and curated detection rules from a single dashboard.
    📍In the Google SecOps console, navigate to Detection › Rules. The unified rules interface loads by default in public preview. To revert, click Switch to the legacy experience at the top right of the screen.
    • Increases multiple event rule limits to 200 for Enterprise customers and 400 for Enterprise+ customers.
    • Introduces unified rules interface (public preview) combining custom and curated rule management into a single workflow with a redesigned dashboard, advanced rule editor, and expanded API capabilities.

    2 details in Everything

88. June 28, 2026 (2026-06-28) Jun 28, 2026 · issue 014

    Google SecOps adds 15 new log types including MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface., OT, and AI platform sources, plus updates 130+ default parsers.

    └──▷ HOW TO FIND IT
    Enable ingestion of Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. logs to detect and investigate AI agent activity (dev, modify, and view actions) in your environment.
    📍In the Google SecOps console, go to Settings › Log Ingestion, search for log types MCPDEV, MCPMODIFY, or MCPVIEW, and configure the appropriate feed for your MCP deployment.
    Onboard NetApp Ransomware Resilience telemetry to correlate storage-layer ransomware signals with endpoint and network detections.
    📍In the Google SecOps console, go to Settings › Log Ingestion, search for NETAPP_RANSOMWARE_RESILIENCE, and configure a feed pointing to your NetApp data source.
    Ingest Reco AI CSPMCSPMCloud security posture management, checking cloud resources for risky settings and policy violations. It helps teams find exposed services, overly broad permissions and other configuration gaps. findings to surface cloud security posture issues alongside other SecOps detections.
    📍In the Google SecOps console, go to Settings › Log Ingestion, search for RECO_CSPM, and configure the feed with your Reco AI credentials and endpoint.
    • Adds new log type CISCO_SECURE_ACCESS_ENROLLMENT for Cisco Secure Access Enrollment ingestion.
    • Adds new log type CISCO_SECURE_ACCESS_NETWORK for Cisco Secure Access Network ingestion.
    • Adds new log type CYBERARK_CERTIFICATE_MANAGER_SAAS for CyberArk Certificate Manager SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. audit data.
    • Adds new log type GEMINI_ENTERPRISE_AGENT_PLATFORM for Gemini Enterprise Agent Platform activity.
    • Adds new log type GEOSCADA_OT for Schneider Electric GeoScada operational technology logs.

    +9 more show less

    • Adds new log types MCPDEV, MCPMODIFY, and MCPVIEW for Model Context Protocol developer, modify, and view activity — enabling visibility into MCP-based AI agent interactions.
    • Adds new log type NETAPP_RANSOMWARE_RESILIENCE for NetApp Ransomware Resilience telemetry.
    • Adds new log type NETSKOPE_LOG_STREAMING for Netskope Log Streaming.
    • Adds new log type PYLON_LOGS for Pylon Audit Logs.
    • Adds new log type RECO_CSPM for Reco AI CSPM findings.
    • Adds new log type SALT_SECURITY for Salt Security API Protection Platform events.
    • Adds new log type SENTINELONE_APPLICATION for SentinelOne Application logs.
    • Adds new log type WIZ_VULNERABILITIES for Wiz Vulnerabilities data.
    • Updates default parsers for 130+ existing log sources across major vendors including AWS, Azure, Palo Alto, CrowdStrike, Okta, and Google Cloud.

    14 details in Everything

89. June 23, 2026 (2026-06-23) Jun 23, 2026 · issue 014

    Google SecOps adds Gemini Cloud Assist directly in Feed Management for guided feed setup and troubleshooting.

    └──▷ HOW TO FIND IT
    Get AI-guided help configuring a new data feed without leaving the Feed Management UI.
    📍In Google SecOps, go to Feed Management, then click the Ask Gemini Cloud Assist button to open the Gemini Cloud Assist panel and ask questions about feed configuration, ingestion prerequisites, or setup issues.
90. June 23, 2026 (2026-06-23) Jun 23, 2026 · release notes

    Google SecOps adds Ask Gemini Cloud Assist button in Feed Management interface

    └──▷ HOW TO FIND IT
    Open the Gemini Cloud Assist panel in Feed Management to get help with log source setup.
    📍In the Google SecOps console, go to Feed Management and click Ask Gemini Cloud Assist on the right side.
91. June 23, 2026 Jun 23, 2026 · release notes

    Adds Gemini Cloud Assist panel in Feed Management interface

92. June 17, 2026 (2026-06-17) Jun 17, 2026 · issue 014

    Google SecOps adds configurable auto-collapse for the query editor to maximize search results screen space.

    └──▷ HOW TO FIND IT
    Maximize visible search results during investigations by collapsing the query editor automatically after each query runs.
    📍In the console, go to the query editor settings and enable the Auto-collapse option so the editor collapses after you run a search.
    • New Auto-collapse setting for the query editor automatically hides the editor after a search runs, giving more screen real estate to results.

    1 detail in Everything

93. June 17, 2026 Jun 17, 2026 · release notes

    New Auto-collapse setting for the Chronicle query editor maximizes result screen space.

    • Adds autoCollapse configuration option to control whether the query editor collapses automatically after a search.

    1 detail in Everything

94. June 16, 2026 (2026-06-16) Jun 16, 2026 · issue 014

    Google SecOps launches a monthly documentation changelog to track major doc updates.

    └──▷ HOW TO FIND IT
    Stay current on major Google SecOps documentation changes by bookmarking the new monthly changelog.
    📍In the Google SecOps docs, navigate to Release Notes › Documentation changelog to view the monthly summary of major documentation updates.
95. June 13, 2026 Jun 13, 2026 · release notes

    Google SecOps adds Non-prioritized IoC Matching detection category for high-fidelity threat hunting.

    └──▷ HOW TO FIND IT
    View the newly available non-prioritized IoCIoCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. rules in your curated detections list to assess coverage.
    📍In the console, go to Security › Detections › Curated Detections and filter by category Non-prioritized IoC Matching rules.
    • Adds the Non-prioritized IoC Matching rules category to Curated Detections for matching IPs, domains, and file hashes against Google IoC feeds
    • Enables detection of cryptomining, Command and Control (C2) communications, and malicious anonymization services via non-prioritized IoCs

    2 details in Everything

96. June 12, 2026 (2026-06-12) Jun 12, 2026 · release notes

    Google SecOps June 12 2026 adds async search API for large datasets and detection visibility in Search UI.

    • Shows matching detections in the Alerts and Detections tab when searching events or entities in Google SecOps Search

    1 detail in Everything

97. June 12, 2026 Jun 12, 2026 · release notes

    Google SecOps adds async Search API for large datasets and detection visibility in Search

    └──▷ HOW TO FIND IT
    View detections alongside events in the Google SecOps Search UI to streamline threat investigation.
    📍In Google SecOps Search, run a query for an entity or event, then check the Alerts and Detections tab for matching system-generated findings.
    • Adds Investigate detections in Search feature displaying matching system-generated detections in the Alerts and Detections tab when searching events or entities
    • Adds Asynchronous Search APIs allowing long-running queries with operation ID tracking, up to 1 million results, and pagination for UDM events, data tables, and ECG

    2 details in Everything

98. June 09, 2026 Jun 9, 2026 · release notes

    UDM fields now display enrichment source icons (U/E) and metadata.

    └──▷ HOW TO FIND IT
    Verify if a specific UDM field in an event has been enriched by checking the icon and metadata.
    📍Look for the E icon next to the UDM field in the Chronicle UI event viewer and inspect the source metadata value.
    • Adds U (unenriched) and E (enriched) icons to UDM fields in the UI to visualize data provenanceprovenanceEvidence recording where a software artifact came from and how it was built, including its source and build process. It helps a consumer check that the artifact matches a trusted build.
    • Includes source-of-enrichment metadata values within enriched UDM fields
    • Requires chronicle.events.fetchEnrichedEvent IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. permission for access

    3 details in Everything

99. May 28, 2026 May 28, 2026 · release notes

    Chronicle API v1 GA includes alerts, UEBA, dashboards, and enrichment controls

    • Alerts and UEBA: Threat Collection resources are now part of the stable v1 Chronicle API for production use
    • Native dashboard components (NativeDashboard, DashboardChart, DashboardQuery) are exposed via the stable v1 API
    • Data table management is available through stable DataTable and DataTableRow resources in v1
    • Log ingestion configurations can be managed using Logs, Feed, and FeedSourceSchema resources in v1
    • Detection refinement capabilities are exposed via the new FindingsRefinement resource in v1

    +2 more show less

    • Search and investigation workflows utilize stable Event, Entity, and SearchQuery resources in v1
    • Enrichment settings are controlled via the new EnrichmentControl and EnrichmentCombination resources in v1

    7 details in Everything

100. May 18, 2026 May 18, 2026 · release notes

     Google SecOps enhances Data Export API with GKEGKEGoogle Kubernetes Engine, Google's managed Kubernetes service, which lets cyber tools run containerized workloads without managing the underlying cluster infrastructure. filtering, CMEK, RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. via v1 GA

     • The Data Export API reaches general availability (GA) as version 1 (v1), replacing the legacy v1alpha path for all export jobs.
     • New scoped data filtering capability using namespaces and ingestion labels to limit which logs are included in an export job.
     • Customer-managed encryption keys via Google Cloud Key Management ServiceKey Management ServiceA managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves. (KMSKMSA managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves.) for encrypted archival of exported security data.
     • Identity-aware extraction where export jobs automatically inherit the data RBAC scope of the user creating the job.

     4 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The legacy Data Export API endpoint path changes from /v1alpha/{parent}/dataExports to /v1/{parent}/dataExports after June 18, 2026.
     • !The fetchavailablelogtypes API endpoint is removed and replaced by the list endpoint after June 18, 2026.
     • !The updateDataExport API endpoint in the enhanced Data Export API is discontinued after June 18, 2026.
     • !The logType field in the enhanced Data Export API is removed; use includeLogTypes instead after June 18, 2026.
101. May 17, 2026 May 17, 2026 · release notes

     Google SecOps expands log ingestion support with new parsers for dozens of vendors including Arista, Microsoft, SAP, and Tenable.

     • Adds parser documentation and support for ingesting Arista VeloCloud SD-WANSD-WANSoftware-defined wide-area networking: an approach that decouples WAN routing logic from physical hardware, letting operators centrally control traffic paths across MPLS, broadband, and LTE links to reduce cost and improve resilience. logs
     • Adds parser documentation and support for ingesting Microsoft Defender for Endpoint logs
     • Adds parser documentation and support for ingesting PTC Windchill logs
     • Adds parser documentation and support for ingesting Riverbed SteelHead logs
     • Adds parser documentation and support for ingesting Sangfor Proxy logs

     +44 more show less

     • Adds parser documentation and support for ingesting SAP BTP logs
     • Adds parser documentation and support for ingesting SAP NetWeaver logs
     • Adds parser documentation and support for ingesting SAP SM20 logs
     • Adds parser documentation and support for ingesting SAP SuccessFactors logs
     • Adds parser documentation and support for ingesting SAP Sybase ASE logs
     • Adds parser documentation and support for ingesting Saviynt Enterprise Identity Cloud logs
     • Adds parser documentation and support for ingesting SecureLink logs
     • Adds parser documentation and support for ingesting Semperis DSP logs
     • Adds parser documentation and support for ingesting Sonrai Security logs
     • Adds parser documentation and support for ingesting SOTI MobiControl logs
     • Adds parser documentation and support for ingesting Splunk Attack Analyzer logs
     • Adds parser documentation and support for ingesting SpyCloud logs
     • Adds parser documentation and support for ingesting Stealthbits Audit logs
     • Adds parser documentation and support for ingesting Stealthbits StealthDEFEND logs
     • Adds parser documentation and support for ingesting STIXSTIXStructured Threat Information Expression, a standard format for describing threats, indicators and their relationships. It helps organizations exchange threat intelligence in a usable form. Threat Intelligence logs
     • Adds parser documentation and support for ingesting Swift Alliance Messaging Hub logs
     • Adds parser documentation and support for ingesting Symantec Messaging Gateway logs
     • Adds parser documentation and support for ingesting Symantec Security Analytics logs
     • Adds parser documentation and support for ingesting Tableau logs
     • Adds parser documentation and support for ingesting Talon logs
     • Adds parser documentation and support for ingesting TCPWave DDI logs
     • Adds parser documentation and support for ingesting Teleport Access Plane logs
     • Adds parser documentation and support for ingesting Tenable Audit logs
     • Adds parser documentation and support for ingesting Tenable CSPMCSPMCloud security posture management, checking cloud resources for risky settings and policy violations. It helps teams find exposed services, overly broad permissions and other configuration gaps. logs
     • Adds parser documentation and support for ingesting Teradata Database logs
     • Adds parser documentation and support for ingesting Terraform Enterprise logs
     • Adds parser documentation and support for ingesting Tetragon eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic. audit logs
     • Adds parser documentation and support for ingesting ThreatLocker Platform logs
     • Adds parser documentation and support for ingesting ThreatX WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. logs
     • Adds parser documentation and support for ingesting Tintri logs
     • Adds parser documentation and support for ingesting Trend Micro Apex Central logs
     • Adds parser documentation and support for ingesting uberAgent logs
     • Adds parser documentation and support for ingesting Ubika WAF logs
     • Adds parser documentation and support for ingesting UKG logs
     • Adds parser documentation and support for ingesting UPX AntiDDoS logs
     • Adds parser documentation and support for ingesting Verba Recording System logs
     • Adds parser documentation and support for ingesting Vercel WAF logs
     • Adds parser documentation and support for ingesting Virtru Email Encryption logs
     • Adds parser documentation and support for ingesting WatchGuard EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. logs
     • Adds parser documentation and support for ingesting Windows AppLocker logs
     • Adds parser documentation and support for ingesting Windows Defender Antivirus logs
     • Adds parser documentation and support for ingesting Windows Firewall logs
     • Adds parser documentation and support for ingesting Windows Hyper-V logs
     • Adds parser documentation and support for ingesting Windows Network Policy Server logs

     49 details in Everything

102. May 12, 2026 May 12, 2026 · release notes

     Google SecOps adds relative and absolute time range options for search queries

     • Adds relative and absolute time range selection for defining the required time period in searches

     1 detail in Everything

103. April 19, 2026 Apr 19, 2026 · release notes

     Google SecOps adds support for ingesting and normalizing logs from over 30 new sources.

     • Adds log collection support for Collect Group-IB Threat Intelligence logs
     • Adds log collection support for Collect Microsoft System Center Endpoint Protection (SCEPSCEPSimple Certificate Enrollment Protocol, an IETF-standardized protocol for automating X.509 certificate issuance and renewal over HTTP, letting cyber tools request PKI certificates from a CA without manual intervention.) logs
     • Adds log collection support for Collect Nagios XI logs
     • Adds log collection support for Collect Neo4j Aura logs
     • Adds log collection support for Collect Nucleus Security - Nucleus Unified Vulnerability Management logs

     +28 more show less

     • Adds log collection support for Collect Nyansa Voyance / VMware Edge Network Intelligence logs
     • Adds log collection support for Collect Okera Dynamic Access Platform (ODAP) audit logs
     • Adds log collection support for Collect Okta Advanced Server Access logs
     • Adds log collection support for Collect Onapsis Platform logs
     • Adds log collection support for Collect One Identity TPAM logs
     • Adds log collection support for Collect Oracle Cloud Infrastructure - Oracle Cloud Guard logs
     • Adds log collection support for Collect Cisco Identity Intelligence logs
     • Adds log collection support for Collect Microsoft SharePoint (Office 365) logs
     • Adds log collection support for Collect NetApp Console (formerly BlueXP) audit logs
     • Adds log collection support for Collect Netwrix Auditor logs
     • Adds log collection support for Collect Nokia VitalQIP DDI logs
     • Adds log collection support for Collect OpenAI Audit logs
     • Adds log collection support for Collect OpenTelemetryOpenTelemetryAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. Netflow Receiver logs
     • Adds log collection support for Collect Oracle Fusion Cloud Applications logs
     • Adds log collection support for Collect Oracle NetSuite - NetSuite Applications Suite logs
     • Adds log collection support for Collect Oracle NetSuite logs
     • Adds log collection support for Collect Vectra Alerts logs
     • Adds log collection support for Collect Vectra XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. logs
     • Adds log collection support for Collect Windows Event logs (XML format)
     • Adds log collection support for Collect WinSCP logs
     • Adds log collection support for Collect Workday User Activity logs
     • Adds log collection support for Collect WP Engine logs
     • Adds log collection support for Collect XAMS by Xiting logs
     • Adds log collection support for Collect Yubico OTPOTPOne-time password: a short-lived numeric or alphanumeric code valid for a single authentication attempt, generated via TOTP or HOTP standards, giving cyber tools phishing-resistant second-factor verification without stored shared secrets. logs
     • Adds log collection support for Collect Zero Networks logs
     • Adds log collection support for Collect Zix Email Encryption logs
     • Adds log collection support for Collect Zscaler NSS Feeds for Alerts logs
     • Adds log collection support for Collect ZyXEL ZyWALL logs

     33 details in Everything

104. April 08, 2026 Apr 8, 2026 · release notes

     Emerging Threats Center GA adds campaign filtering, MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. matrix visualization, and enhanced Entity context panel.

     • Adds expanded campaign filtering in the Emerging Threats feed to filter by associated malware, tools, and threat actors.
     • Adds MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. ATT&CKATT&CKA publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. matrix visualization in the Associated Rules panel to evaluate detection rule coverage for specific tactics, techniques, and procedures (TTPsTTPsTactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind.).
     • Adds enhanced Entity context panel to investigate indicators of compromiseindicators of compromiseAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. (IoCIoCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself.) by viewing point-in-time state and related cases.
     • Adds GTI-associated IoC category filtering to filter by Files, URLs, Domains, and IPs.

     4 details in Everything

105. April 07, 2026 Apr 7, 2026 · release notes

     Google SecOps adds Health Hub for data source monitoring and query editor auto-suggestions

     └──▷ HOW TO FIND IT
     Use context-aware suggestions to build queries faster.
     📍In the Search query editor, start typing a field name to see auto-suggestions
     • Adds Health Hub as the central location to monitor status and health of configured data sources, including ingestion volumes, parsing volumes, and failed sources.

     1 detail in Everything

106. March 31, 2026 Mar 31, 2026 · release notes

     Multi-stage queries in YARA-LYARA-LA rule language developed by Google for Chronicle that extends YARA syntax to express multi-event, time-windowed detections over log data rather than single-file pattern matching. reach GA for Dashboards and Search

     └──▷ HOW TO FIND IT
     Build sophisticated detection logic by chaining query stages directly within the UI.
     📍In the Search interface, create a new query and utilize Multi-stage queries to feed output from one stage into another.
     • Multi-stage queries in YARA-L are now generally available, enabling feeding the output of one query stage into another for granular data transformation.
     • Multi-stage queries can be used in both Dashboards and Search interfaces.

     2 details in Everything

107. March 25, 2026 Mar 25, 2026 · release notes

     Third-party API connectors now validate credentials at creation time to prevent broken feeds.

     • Adds automatic credential validation for all 49 third-party API feed connectors during configuration

     1 detail in Everything

108. March 18, 2026 Mar 18, 2026 · release notes

     Google SecOps March 18 GA release adds Bindplane SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. with custom claims role mapping, parser validator, and forwarder migration tool

     • Single sign-onSingle sign-onSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. with custom claims role mapping provides production-ready identity-provider access management for Bindplane.
     • SecOps parser validator allows immediate validation of log parsing from the snapshot view, returning parsed events or validation errors without waiting for data appearance.
     • Forwarder migration tool enables migration of existing forwarder configurations into Bindplane-managed pipelines.

     3 details in Everything

109. March 05, 2026 Mar 5, 2026 · release notes

     Google SecOps expands supported log types with over 80 new integrations for ingesting security data from vendors like Cisco, Palo Alto, and Tenable.

     • Adds support for ingesting logs from ALIBABA_SECURITY_CENTER, APACHE_AIRFLOW, BARAMUNDI, BRAVURA, BUILDKITE_AUDIT, CORTEX_XPANSE, CYFIRMA_DECYFIR, DATEV, ELO, FORCEPOINT_SWG, JUMPSERVER_PAM, KEEP_AWARE, LARK_SUITE, MACMON, MAMORI_DAM, N8N_SECURITY_AUDIT_LOGS, OCI_LOADBALANCER, OPENTEXT_SSPR, RACKSPACE, SECUI_BLUEMAX_NGF, SYMANTEC_ATP, TENABLE_VMGNT, TRELLIX_EDRF, TRENDMICRO_VISION_ONE_ENDPOINT_VULNERABILITIES, and ZAFRAN.
     • Updates default parsers for existing integrations including AWS_AURORA, AZURE_AD_SIGNIN, CLOUDFLARE_WAF, CS_ALERTS, CYBERARK_EPM, FORTINET_FORTIANALYZER, GCP_SECURITYCENTER_THREAT, MISP_IOC, OFFICE_365, and ZSCALER_WEBPROXY.

     2 details in Everything

110. March 02, 2026 Mar 2, 2026 · release notes

     Unified rules interface with AIP-160 search, non-atomic batch updates via rules.modifyRules, and CONFIG_ONLY/TRENDS views in rules.list.

     • Adds a unified dashboard for managing both custom and curated rules from a single location
     • Enables viewing YARA-LYARA-LA rule language developed by Google for Chronicle that extends YARA syntax to express multi-event, time-windowed detections over log data rather than single-file pattern matching. text of curated rules and toggling their status independently
     • Adds inline error highlights and UDM field definitions on hover in the rule editor
     • Supports AIP-160 compliant structured search across UI and API for filtering rules by text, tags, author, and execution state
     • Adds non-atomic batch updates via rules.modifyRules to change status, tags, and archive settings for multiple rules

     +1 more show less

     • Introduces CONFIG_ONLY and TRENDS views to rules.list with up to 5000 results per page

     6 details in Everything

111. February 25, 2026 Feb 25, 2026 · release notes

     Google SecOps adds Preview support for Google Cloud VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. Service Controls to restrict data exfiltrationdata exfiltrationMoving data out of a system or organization without authorization. It can happen through network transfers, removable media or other channels. via perimeters.

112. February 20, 2026 Feb 20, 2026 · release notes

     New search filtering, pagination, last refreshed time, and CSV export on the Feeds page

     └──▷ HOW TO FIND IT
     Find specific feeds using attribute search.
     📍In the console, go to Feeds and use Search Filtering (using feed attributes).
     Export feed metadata for offline analysis.
     📍In the console, go to Feeds and use Feed Metadata Export to CSV.
     • Adds Search Filtering (using feed attributes) to the Feeds page
     • Adds Pagination controls to the Feeds page
     • Adds Last Refreshed Time display to the Feeds page
     • Adds Feed Metadata Export to CSV capability on the Feeds page

     4 details in Everything

113. February 12, 2026 Feb 12, 2026 · release notes

     Google SecOps Search introduces advanced joins including unmatched correlation and CSV/datatable export

     • Adds support for join operations in Search without a match section, correlating data from multiple sources based on common field values with results displayed in a Joins table.
     • Adds left and right outer joins to Search, allowing retrieval of all records from a primary source even when no matching entry exists in the secondary source (unmatched fields returned as null).

     2 details in Everything

114. February 09, 2026 Feb 9, 2026 · release notes

     Google SecOps adds rule replay metadata, Detection Health dashboard, and timing fields to Detections schema

     └──▷ TRY IT
     Query detection latency via API using new timing fields
     copy

     $ GET /v1/detections?filter=latencyMetrics.oldestIngestionTime > "2026-01-01T00:00:00Z"

     Filter alerts by replay type in the UI
     📍In Alerts lister, add facet detectionTimingDetails and select RETROHUNT or REPROCESSING.
     • Adds detectionTimingDetails enum field to detection and alert objects for tracking run type (REPROCESSING, RETROHUNT, UNSPECIFIED)
     • Adds latencyMetrics object with oldestIngestionTime, newestIngestionTime, oldestEventTime, and newestEventTime timestamps to detection and alert metadata
     • Introduces new Detection Health dashboard for visualizing rule performance and replay status
     • Adds detectionTimingDetails as a filterable facet on the Alerts lister page
     • Updates Composite Detections table in Case Overview to display consistent iconography from SOARSOARSecurity orchestration, automation and response, coordinating incident workflows across tools. Playbooks can gather evidence, assign work or carry out approved response actions. integration

     5 details in Everything

115. February 04, 2026 Feb 4, 2026 · release notes

     New re.capture_all YARA-LYARA-LA rule language developed by Google for Chronicle that extends YARA syntax to express multi-event, time-windowed detections over log data rather than single-file pattern matching. function for full regex extraction; new parser docs for ForgeRock, Fortinet, Google, IBM and others

     └──▷ HOW TO FIND IT
     Extract all potential IP addresses or emails from a log message for further analysis instead of just the first occurrence.
     📍rule extract_all_ips { condition: re.capture_all(log.message, r'\b(\d{1,3}\.){3}\d{1,3}\b') }
     • Adds re.capture_all YARA-L 2.0YARA-L 2.0A rule language developed by Google for writing detection logic in Chronicle SIEM, extending YARA syntax to match sequences of log events over time rather than static file patterns. function to extract every non-overlapping regex match from a string
     • New parser documentation added for Collecting logs from ForgeRock OpenIDM, Forseti Open Source, Fortinet (FortiClient, FortiDDoS, FortiEDR, FortiManager, Switch), Fortra Powertech SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. Agent, Google App Engine, Google Cloud DNS Threat Detector, Google Cloud Monitoring alerting activity, Google Cloud Network Connectivity Center, Google Cloud Secure Web Proxy, Gmail, H3C Comware Platform Switch, HackerOne, Hillstone Firewall, Hitachi Content Platform, HYPR MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone., and IBM Guardium

     2 details in Everything

116. February 03, 2026 Feb 3, 2026 · release notes

     Google SecOps adds ability to share custom column sets for the Events table.

     └──▷ BREAKING ON UPGRADE

     • !API calls to IocService and ThreatCollectionService now require global scope; direct CLI/client library calls fail without it
     • !Emerging threats page no longer shows IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. match counts per campaign for users without global scope
     • !Entity widget overlay hides the Indicators table or shows it empty for users without global scope
     • !Threat details page no longer shows related entities, IOC matches, or GTI IOC tables for users without global scope
     • !Entity summary widget excludes GTI scores for users without global scope
     • !Indicator Details tab on the IOC details page no longer populates for users without global scope
117. January 30, 2026 Jan 30, 2026 · release notes

     Google SecOps GA for Google Cloud Storage v2, Amazon S3 v2, GCS Event Driven, SQS v2, and Azure Blobstore v2 feeds.

     └──▷ HOW TO FIND IT
     Connect a new GCS bucket using the GA v2 feed type.
     📍In the console, go to Data Sources › Add Source and select Google Cloud Storage v2.
118. January 29, 2026 Jan 29, 2026 · release notes

     Google SecOps adds detection timing visibility via collection.detection_timing_details filter

     • collection.detection_timing_details field is available as a filter in the Alerts lister page and in dashboards to distinguish whether a detection was generated during a primary rule run or through a rule replay.

     1 detail in Everything

119. January 21, 2026 Jan 21, 2026 · release notes

     Google SecOps adds direct GCP_MODEL_ARMOR log ingestion and new parser docs for 17 sources.

     └──▷ HOW TO FIND IT
     Ingest Model Armor logs directly into Google SecOps to monitor for prompt injectionprompt injectionAn attack where text the model reads, such as a web page, file or tool result, carries instructions that override the user's. It is the main security risk for agents with tools..
     📍In the GCP console, configure Cloud Logging export filters for the GCP_MODEL_ARMOR log type and route them to Google SecOps.
120. January 16, 2026 Jan 16, 2026 · release notes

     Adds All Time search option in the Time Picker to query full retention data.

     └──▷ HOW TO FIND IT
     Perform a search across the entire data retention period to find historical anomalies.
     📍In the Search editor panel, click the Time Picker and select All Time.
     • Adds All Time option to the Time Picker in the Search editor panel for event searches (max 1M events).

     1 detail in Everything

121. January 13, 2026 Jan 13, 2026 · release notes

     Google SecOps auto extraction and self-service deprovisioning reach general availability.

     • Auto extraction feature reaches general availability with mandatory opt-in for field selection
     • Self-service deprovisioning feature reaches general availability

     2 details in Everything

122. December 24, 2025 Dec 24, 2025 · release notes

     New ThreatConnect IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. V3 connector with TQL filtering and THREATCONNECT_IOC_V3 log type replaces v2 integration

     • Adds a new ThreatConnect IOC V3 connector that ingests Indicators of Compromise via the v3 REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services., replacing the v2 integration.
     • Enables Advanced Filtering with TQL to perform highly targeted searches based on confidence scores, tags, or specific timeframes.
     • Introduces THREATCONNECT_IOC_V3 as the new log type for identifying data ingested through this connector.

     3 details in Everything

123. December 08, 2025 Dec 8, 2025 · release notes

     Adds N OF and or operator support in query condition sections

     • Adds N OF syntax to allow flexible conditional logic with event variables in the condition section of queries
     • Adds or operator support to combine multiple conditions within the condition section of queries

     2 details in Everything

124. November 13, 2025 Nov 13, 2025 · release notes

     Google SecOps adds filtered raw log download to CSV, column management, and legacySearchRawLogsV2 API

     └──▷ HOW TO FIND IT
     Download raw logs for offline analysis with custom columns.
     📍In Google SecOps UI, run a raw log search, apply filters, click Download, then use Column Manager to select Timestamp, Event Type, Raw log and any additional fields before saving as CSV.
     Programmatically query raw logs using the new API endpoint.
     copy

     $ curl -X POST 'https://chronicle.googleapis.com/v1alpha/projects/<project>/locations/<location>/instances/<instance>/legacySearchRawLogsV2' -H 'Authorization: Bearer <token>' -d '{"query": "error", "timeRange": {"startTime": "2025-11-13T00:00:00Z"}}'

     Filter raw logs by parsing status to isolate unprocessed entries.
     📍In the Raw Log Search UI, apply a filter for parsingStatus: 'unparsed' and a specific log source to narrow results before viewing or downloading.
     • Download raw log results to a CSV file with selectable columns via Column Manager
     • Filter raw log search results by parsing status or specific log sources
     • Access new legacySearchRawLogsV2 API method for programmatic raw log searching
     • View applied filters and search query directly on the Search page

     4 details in Everything

125. November 12, 2025 Nov 12, 2025 · release notes

     Google SecOps introduces Triage Agent for AI alert triage and Emerging Threats page with auto-generated detection rules

     • Adds the Triage Agent, an AI-powered investigation assistant that analyzes alerts to determine true/false positives and suggests next steps
     • Introduces the Emerging Threats page to align GTI intelligence with organizational telemetry and identify detection gaps
     • Enables automatic drafting of new detection rules by Gemini when Emerging Threats identifies coverage gaps

     3 details in Everything

126. November 07, 2025 Nov 7, 2025 · release notes

     Google SecOps adds a new MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. coverage dashboard for measuring posture and identifying gaps.

     └──▷ HOW TO FIND IT
     Use the new dashboard to quickly visualize which MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. techniques are covered by your detections and where critical gaps exist.
     📍In the console, go to Analytics › MITRE ATT&CK coverage dashboard
     • The MITRE ATT&CK coverage dashboard is now available to measure security posture against the MITRE ATT&CKATT&CKA publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. framework, helping assess threat coverage and identify gaps.

     1 detail in Everything

127. October 31, 2025 Oct 31, 2025 · release notes

     Google SecOps search adds pagination, all-time retention scope, customizable column views, and UI collapsing.

     └──▷ HOW TO FIND IT
     Configure the search scope to cover all historical data for long-term threat hunting.
     📍In the Search editor, select All Time from the time range picker
     Reduce UI clutter by collapsing the search editor and toggling result panels.
     📍After running a query, use the View Options list to hide or show Charts and Aggregations panels
     • Adds pagination to broad queries, allowing selection of rows per page for the 10,000 results displayed in the table
     • New All Time option lets you run a search over the entire data retention period
     • Customizable column views: create, save, and share custom sets of columns in the Events table
     • Search editor now automatically collapses after a query runs; View Options list controls Charts and Aggregations panels visibility

     4 details in Everything

128. October 30, 2025 Oct 30, 2025 · release notes

     New YARA-LYARA-LA rule language developed by Google for Chronicle that extends YARA syntax to express multi-event, time-windowed detections over log data rather than single-file pattern matching. functions (ends_with, split, window.range) and Chronicle API ingestion methods promoted to beta.

     └──▷ TRY IT
     Check if a username ends with admin in a YARA-L rule.
     copy

     $ strings.ends_with(username, "admin")

     Split a comma-separated field into an array for analysis.
     copy

     $ strings.split(tags, ",")

     Access the min/max values of numeric input fields in a window.
     copy

     $ window.range(bytes_sent)

     • strings.ends_with function allows suffix matching in YARA-L rules.
     • strings.split function splits strings by delimiter in YARA-L rules.
     • window.range function exposes the value range of input fields in YARA-L rules.
     • Chronicle API ingestion methods promoted from alpha to beta for production use.

     4 details in Everything

129. October 29, 2025 Oct 29, 2025 · release notes

     New Chrome Enterprise Premium integration with Safe Browsing logs, curated dashboards, and SOARSOARSecurity orchestration, automation and response, coordinating incident workflows across tools. Playbooks can gather evidence, assign work or carry out approved response actions. actions for extension management.

     └──▷ HOW TO FIND IT
     Use the new SOAR action to automatically block a malicious Chrome extension from your organization's devices.
     📍In the SOAR workflow, trigger the Block Extension action for a specific extension ID.
     View the new pre-built visualization to monitor Chrome Enterprise Premium security posture and Safe Browsing events.
     📍Navigate to the Chrome Enterprise Premium dashboard in Google SecOps.
     • Adds Streamlined connection to Google SecOps for Chrome Enterprise Premium using recommended security defaults
     • Adds Enhanced log events with Google Safe Browsing context for Chrome logs
     • Adds Curated dashboards for Chrome Enterprise Premium in Google SecOps
     • Adds Google Workspace SOAR actions Block Extension and Delete Extension to manage Chrome extension blocklist policies

     4 details in Everything

130. October 28, 2025 Oct 28, 2025 · release notes

     Adds ENTITY_RISK_CHANGE UDM event type for YARA-LYARA-LA rule language developed by Google for Chronicle that extends YARA syntax to express multi-event, time-windowed detections over log data rather than single-file pattern matching. rules triggering on entity risk score shifts

     └──▷ TRY IT
     Write a rule to alert when any entity's risk score increases significantly without needing specific log events.
     copy

     $ rule RiskChangeAlert {
       metadata {
         description: "Alerts on shifting entity risk levels"
         severity: high
       }
       condition:
         $event.event_type == 'ENTITY_RISK_CHANGE'
     }

131. October 22, 2025 Oct 22, 2025 · release notes

     Google SecOps ATI prioritization now uses the GTI score instead of IC-score

132. October 07, 2025 Oct 7, 2025 · release notes

     Google SecOps Oct 7 2025 introduces preview feature to manage pre-built parser versions including opt-in/out for updates and manual revert capabilities.

     └──▷ HOW TO FIND IT
     Review and revert a specific pre-built parser to a previously stable version via the management interface.
     📍In the SecOps console, navigate to Parser Management › Pre-built Parsers › AZURE_AD_CONTEXT › Version History, select the previous stable version, and click Revert.
     • Adds granular control over pre-built parser versions in preview, allowing users to opt in or out of automatic updates, compare processing logic between versions, manually update parsers, and revert to previous stable versions.

     1 detail in Everything

133. October 05, 2025 Oct 5, 2025 · release notes

     Google SecOps adds new parser documentation for AlphaSOC, Cisco vManage, Citrix, and Tanium log sources.

     └──▷ HOW TO FIND IT
     Configure your log ingestion pipeline to collect and normalize Tanium Asset logs using the new documentation.
     📍In the console, go to Ingestion settings › Select Tanium Asset and follow the configuration guide in the new parser documentation.
     Set up log collection for Cisco vManage SD-WANSD-WANSoftware-defined wide-area networking: an approach that decouples WAN routing logic from physical hardware, letting operators centrally control traffic paths across MPLS, broadband, and LTE links to reduce cost and improve resilience. devices.
     📍In the console, go to Ingestion settings › Select Cisco vManage SD-WAN and follow the configuration guide in the new parser documentation.
     • New parser documentation available to ingest and normalize logs from AlphaSOC alert logs
     • New parser documentation available to ingest and normalize logs from Cisco vManage SD-WAN logs
     • New parser documentation available to ingest and normalize logs from Citrix Analytics logs
     • New parser documentation available to ingest and normalize logs from Citrix Monitor Service logs
     • New parser documentation available to ingest and normalize logs from Citrix StoreFront logs

     +24 more show less

     • New parser documentation available to ingest and normalize logs from Delinea SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. logs
     • New parser documentation available to ingest and normalize logs from SailPoint IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. logs
     • New parser documentation available to ingest and normalize logs from Sentry logs
     • New parser documentation available to ingest and normalize logs from Snipe-IT logs
     • New parser documentation available to ingest and normalize logs from Sophos AV logs
     • New parser documentation available to ingest and normalize logs from Sophos Capsule8 logs
     • New parser documentation available to ingest and normalize logs from Sophos DHCP logs
     • New parser documentation available to ingest and normalize logs from Sophos Intercept EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. logs
     • New parser documentation available to ingest and normalize logs from Swimlane Platform logs
     • New parser documentation available to ingest and normalize logs from Symantec WSS logs
     • New parser documentation available to ingest and normalize logs from Tailscale logs
     • New parser documentation available to ingest and normalize logs from Tanium Asset logs
     • New parser documentation available to ingest and normalize logs from Tanium audit logs
     • New parser documentation available to ingest and normalize logs from Tanium Comply logs
     • New parser documentation available to ingest and normalize logs from Tanium Discover logs
     • New parser documentation available to ingest and normalize logs from Tanium Insight logs
     • New parser documentation available to ingest and normalize logs from Tanium Integrity Monitor logs
     • New parser documentation available to ingest and normalize logs from Tanium Patch logs
     • New parser documentation available to ingest and normalize logs from Tanium Question logs
     • New parser documentation available to ingest and normalize logs from Tanium Reveal logs
     • New parser documentation available to ingest and normalize logs from Tanium Stream logs
     • New parser documentation available to ingest and normalize logs from Tanium Threat Response logs
     • New parser documentation available to ingest and normalize logs from TeamViewer logs
     • New parser documentation available to ingest and normalize logs from Tines audit logs

     29 details in Everything

134. October 03, 2025 Oct 3, 2025 · release notes

     Google SecOps CMEK compliance coverage expands to include data tables

135. September 30, 2025 Sep 30, 2025 · release notes

     Adds select and unselect keywords to customize Events table columns in Search.

     └──▷ HOW TO FIND IT
     Show only specific event fields in the Search results table by filtering out unnecessary columns.
     📍In the Search page, use the select and unselect keywords to define the displayed columns in the Events table.
136. September 27, 2025 Sep 27, 2025 · release notes

     Google SecOps adds join support to YARA-LYARA-LA rule language developed by Google for Chronicle that extends YARA syntax to express multi-event, time-windowed detections over log data rather than single-file pattern matching. statistical Search queries for multi-source correlation

     • Adds join capability to YARA-L statistical Search queries that include a match section
     • Enables linking related data sources directly within a single statistical search query

     2 details in Everything

137. September 08, 2025 Sep 8, 2025 · release notes

     Google SecOps adds parsers for Akamai, AWS, Bitwarden, Box, Duo, Harness, Jamf, PingOne, Snyk, Venafi, Veritas, VMware, and Zoom logs

     • Adds support for ingesting Akamai Cloud Monitor logs via a new parser
     • Adds support for ingesting Akamai DataStream 2 logs via a new parser
     • Adds support for collecting Aware audit logs via a new parser
     • Adds support for collecting AWS API Gateway access logs via a new parser
     • Adds support for collecting AWS VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. Transit GatewayTransit GatewayAn AWS-managed network hub that connects VPCs and on-premises networks through a single gateway, replacing complex peering meshes and giving cyber tools a central point to route or inspect cross-network traffic. flow logs via a new parser

     +26 more show less

     • Adds support for collecting Bitwarden Enterprise event logs via a new parser
     • Adds support for collecting Box Collaboration JSON logs via a new parser
     • Adds support for collecting Censys logs via a new parser
     • Adds support for collecting Code42 Incydr core datasets via a new parser
     • Adds support for collecting CSV Custom IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. files via a new parser
     • Adds support for collecting Deep Instinct EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. logs via a new parser
     • Adds support for collecting DigiCert audit logs via a new parser
     • Adds support for collecting DomainTools Iris Investigate results via a new parser
     • Adds support for collecting Duo administrator logs via a new parser
     • Adds support for collecting Duo authentication logs via a new parser
     • Adds support for collecting Duo entity context logs via a new parser
     • Adds support for collecting Google Cloud Abuse Events logs via a new parser
     • Adds support for collecting Harness IO audit logs via a new parser
     • Adds support for collecting HPE Aruba Networking Central logs via a new parser
     • Adds support for collecting Jamf Pro context logs via a new parser
     • Adds support for collecting PingOne Advanced Identity Cloud logs via a new parser
     • Adds support for collecting Slack audit logs via a new parser
     • Adds support for collecting Snyk group-level audit logs via a new parser
     • Adds support for collecting Snyk group-level audit and issues logs via a new parser
     • Adds support for collecting Venafi Zero Touch PKIPKIA framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets. logs via a new parser
     • Adds support for collecting Veritas NetBackup logs via a new parser
     • Adds support for collecting VMware AirWatch logs via a new parser
     • Adds support for collecting VMware Avi Load Balancer WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. logs via a new parser
     • Adds support for collecting VMware Horizon logs via a new parser
     • Adds support for collecting VMware VeloCloud SD-WANSD-WANSoftware-defined wide-area networking: an approach that decouples WAN routing logic from physical hardware, letting operators centrally control traffic paths across MPLS, broadband, and LTE links to reduce cost and improve resilience. logs via a new parser
     • Adds support for collecting Zoom operation logs via a new parser

     31 details in Everything

138. September 05, 2025 Sep 5, 2025 · release notes

     Google SecOps allows filtering alerts and search results by any field in the detection object

     └──▷ HOW TO FIND IT
     Filter alerts by a specific nested event field to isolate relevant security incidents
     📍In the console, go to Alerts or Search, and use the Advanced filtering option to select any detection object field (e.g., event.source.ip)
139. September 04, 2025 Sep 4, 2025 · release notes

     Adds time zone override for forwarder logs; improves Okta and SEP parsers in Preview.

     └──▷ USE IT
     Override the default time zone for logs ingested via a specific forwarder to ensure correct timestamp alignment.
     json copy

     -- Set in the collector configuration JSON sent to the API:
     {
       "collector": {
         "type": "forwarder",
         "settings": {
           "timeZone": "America/New_York"
         }
       }
     }

     • Adds timeZone configuration option to forwarder collector settings to override the default log timestamp interpretation.
     • Provides updated Okta parser with increased UDM field coverage and more-accurate mappings (Preview).
     • Provides updated Symantec Endpoint Protection parser with increased UDM field coverage and more-accurate mappings (Preview).

     3 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !CBN alerts functionality is removed from all prebuilt parsers; existing CBN rules will no longer trigger.
140. September 03, 2025 Sep 3, 2025 · release notes

     Extended multi-event rule match window to 14 days with automatic run frequency.

     • Allows multi-event rules to analyze data over a maximum match window of 14 days
     • Automatically sets run frequency to 24 hours for windows greater than 48 hours

     2 details in Everything

141. August 29, 2025 Aug 29, 2025 · release notes

     New MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. coverage dashboard in preview to measure security posture and identify gaps

     └──▷ HOW TO FIND IT
     Use this dashboard to quickly assess current threat coverage and identify gaps in your security posture.
     📍In the Google SecOps console, navigate to the MITRE ATT&CK coverage dashboard.
     • Adds the Change MITRE ATT&CK coverage dashboard for assessing threat coverage against the MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. ATT&CKATT&CKA publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. framework

     1 detail in Everything

142. August 27, 2025 Aug 27, 2025 · release notes

     Google SecOps adds default parsers for new data sources including Trellix AX and Microsoft Entra Recommendations.

     • Adds TRELLIX_AX log type support for Trellix Malware Analysis data ingestion
     • Adds MS_ENTRA_RECOMMENDATIONS log type support for Microsoft Entra Recommendations data ingestion

     2 details in Everything

143. August 21, 2025 Aug 21, 2025 · release notes

     Curated detections now include composite detection content for Mandiant Hunt Cloud Classification across AWS, GCP, and Azure

     └──▷ HOW TO FIND IT
     Deploy cloud classification detection rules for AWS, GCP, and Azure within Mandiant Threat Defense.
     📍In the console, go to Detection › Curated Detections and enable Mandiant Hunt Cloud Classification for your enterprise license.
144. August 13, 2025 Aug 13, 2025 · release notes

     Google SecOps adds log parsers for Anomali ThreatStream, Cisco ACE/Firepower/Panorama, Duo, ExtraHop, MuleSoft, Palo Alto SD-WANSD-WANSoftware-defined wide-area networking: an approach that decouples WAN routing logic from physical hardware, letting operators centrally control traffic paths across MPLS, broadband, and LTE links to reduce cost and improve resilience., Recorded Future, Veeam, Veridium, VMware Tan

     • Adds support for ingesting and normalizing logs from Anomali ThreatStream IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. logs
     • Adds support for ingesting and normalizing logs from Cisco Application Control Engine (ACE)
     • Adds support for ingesting and normalizing logs from Cisco Firepower NGFWNGFWA next-generation firewall, combining network access rules with deeper inspection of applications and traffic. It can apply security controls beyond basic addresses and ports.
     • Adds support for ingesting and normalizing logs from Cisco Firewall Service Module (FWSM)
     • Adds support for ingesting and normalizing logs from Cisco IronPort

     +26 more show less

     • Adds support for ingesting and normalizing logs from Cisco PIX
     • Adds support for ingesting and normalizing logs from Cisco Prime
     • Adds support for ingesting and normalizing logs from Cisco Wireless Intrusion Prevention System (WIPS)
     • Adds support for ingesting and normalizing logs from Cisco Wireless LAN Controller (WLC)
     • Adds support for ingesting and normalizing logs from Cisco Wireless Security Management (WiSM)
     • Adds support for ingesting and normalizing logs from Cloudian HyperStore
     • Adds support for ingesting and normalizing logs from CrushFTP
     • Adds support for ingesting and normalizing logs from Delinea Distributed Engine
     • Adds support for ingesting and normalizing logs from Duo User context
     • Adds support for ingesting and normalizing logs from ExtraHop DNS
     • Adds support for ingesting and normalizing logs from ExtraHop RevealX
     • Adds support for ingesting and normalizing logs from Extreme Networks switch
     • Adds support for ingesting and normalizing logs from Extreme Networks Wireless
     • Adds support for ingesting and normalizing logs from MuleSoft Anypoint
     • Adds support for ingesting and normalizing logs from Palo Alto Prisma SD-WAN
     • Adds support for ingesting and normalizing logs from Recorded Future IOC
     • Adds support for ingesting and normalizing logs from Veeam
     • Adds support for ingesting and normalizing logs from Veridium ID
     • Adds support for ingesting and normalizing logs from VMware Tanzu
     • Adds support for ingesting and normalizing logs from VMware vCenter
     • Adds support for ingesting and normalizing logs from VMware vRealize
     • Adds support for ingesting and normalizing logs from VMware vSphere
     • Adds support for ingesting and normalizing logs from VSFTPD
     • Adds support for ingesting and normalizing logs from VyOS
     • Adds support for ingesting and normalizing logs from Workday audit
     • Adds support for ingesting and normalizing logs from Yamaha router

     31 details in Everything

145. August 12, 2025 Aug 12, 2025 · release notes

     Google SecOps adds self-service enablement for Data RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. to simplify onboarding

146. August 08, 2025 Aug 8, 2025 · release notes

     Google SecOps adds ingestion support for 45 new log sources including Akamai MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone., Fortinet FDR, Lumu SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. and others

     • Adds AKAMAI_MFA log type support for Akamai Multi-Factor Authentication logs
     • Adds FORTINET_FORTINDR log type support for Fortinet Network Detection and Response logs
     • Adds LUMU log type support for Lumu Universal SIEM integration
     • Adds MICROSOFT_DATABRICKS_WORKSPACES log type support for Microsoft Azure Databricks workspaces
     • Adds COREVIEW log type support for CoreView Audit-log SIEM integration

     +1 more show less

     • Adds VELOCIRAPTOR log type support for Velociraptor digital forensic & incident response tool logs

     6 details in Everything

147. August 05, 2025 Aug 5, 2025 · release notes

     YARA-L 2.0YARA-L 2.0A rule language developed by Google for writing detection logic in Chronicle SIEM, extending YARA syntax to match sequences of log events over time rather than static file patterns. GA adds condition, dedup, metrics functions, limit keyword, timestamp extraction, and expanded array limits to search.

     └──▷ TRY IT
     Use the limit keyword to quickly preview a subset of search results for performance testing.
     copy

     $ search kind=udm | limit 50

     • Adds condition clause to UDM search and dashboards for filtering aggregates
     • Introduces dedup section in standard UDM searches and YARA-LYARA-LA rule language developed by Google for Chronicle that extends YARA syntax to express multi-event, time-windowed detections over log data rather than single-file pattern matching. 2.0 queries
     • Enables metrics functions in the outcome section of UDM searches
     • Increases element limit for array and array_distinct aggregation functions to 1,000
     • Adds limit keyword to restrict search result count

     +1 more show less

     • Supports earliest and latest timestamps for time range extraction in aggregation

     6 details in Everything

148. August 04, 2025 Aug 4, 2025 · release notes

     Auto Extraction now supports XML formatted logs alongside existing JSON support.

     • Adds Chrome Enterprise Premium Browser Threat detections to Curated detections rule pack

     1 detail in Everything

149. July 22, 2025 Jul 22, 2025 · release notes

     Adds rule-based Silent Host Monitoring with UDM fields/labels and time windows in Google SecOps

     └──▷ HOW TO FIND IT
     Configure Silent Host Monitoring to detect anomalies based on specific UDM fields and labels over a defined period.
     📍In the SecOps console, go to Settings › Silent Host Monitoring and enable detection rules using UDM fields or labels with a time window.
     • Enables detection rule-based Silent Host Monitoring using UDM fields or labels, configurable within a specified time window

     1 detail in Everything

150. July 07, 2025 Jul 7, 2025 · release notes

     Google SecOps introduces Feature Dashboards with SOARSOARSecurity orchestration, automation and response, coordinating incident workflows across tools. Playbooks can gather evidence, assign work or carry out approved response actions. data, reports, drilldowns, and markdown widgets.

     └──▷ HOW TO FIND IT
     Access new Feature Dashboards to enhance threat hunting and investigation workflows.
     📍Navigate to the Dashboards section in the Google SecOps console to explore SOAR data, downloadable reports, custom drilldowns, and markdown widgets.
     • Adds Feature Dashboards for enhanced visualizations and threat hunting
     • Enables access to SOAR data within dashboards
     • Adds Downloadable reports capability
     • Supports Custom drilldowns in dashboards
     • Includes Markdown widgets for dashboard composition

     +1 more show less

     • Provides 51 curated dashboards covering broad security categories

     6 details in Everything

151. June 30, 2025 Jun 30, 2025 · release notes

     Data tables support number data types and repeated fields.

     • Support for the number data type in data table columns
     • Support for repeated fields in data table columns

     2 details in Everything

152. June 19, 2025 Jun 19, 2025 · release notes

     Google SecOps June 19, 2025 allows configuring multiple log-type feeds per product type via a new UI flow

     └──▷ HOW TO FIND IT
     Configure multiple log-type feeds for the same product type using the new in-product guided flow.
     📍Navigate to Configure feeds by product and add multiple log-type feeds for the target product.
153. June 18, 2025 Jun 18, 2025 · release notes

     New ingestion/health dashboard widgets and ability to remove UDM mappings via parser extensions in Google SecOps

     • Adds Silent host monitoring widget showing hosts active in the last 7 days with days since last ingestion count
     • Adds BindPlane agent logging and health visualization widget for logging activity and agent health
     • Adds Throughput in bytes dashboard widget showing ingestion volume over time
     • Improves log type distribution charts for better readability and usability

     4 details in Everything

154. May 26, 2025 May 26, 2025 · release notes

     Google SecOps introduces STSSTSAWS Security Token Service, an Amazon Web Services API that issues short-lived credentials for IAM roles, letting cyber tools authenticate to AWS without storing long-term secrets.-based feed types in preview for Google Cloud Storage, S3, SQS, and Azure Blobstore

155. May 14, 2025 May 14, 2025 · release notes

     New premium parser versions for Zscaler ecosystem in Google SecOps

     • Adds new premium versions of parsers: ZSCALER_WEBPROXY, ZSCALER_FIREWALL, ZSCALER_DNS, ZSCALER_INTERNET_ACCESS, ZSCALER_VPN, ZSCALER_ZPA, ZSCALER_TUNNEL, ZSCALER_CASB, and ZSCALER_DLP

     1 detail in Everything

156. May 12, 2025 May 12, 2025 · release notes

     Google SecOps adds data table RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. and enables data tables as search sources in YARA-LYARA-LA rule language developed by Google for Chronicle that extends YARA syntax to express multi-event, time-windowed detections over log data rather than single-file pattern matching..

     └──▷ HOW TO FIND IT
     Use data tables as a source in YARA-L searches via the Investigation menu.
     📍Steps: In the web interface, go to Investigation › Data Tables. Run a YARA-L search using a selected data table as the data source.
     Manage access to data tables using RBAC in custom roles.
     📍Update custom role permissions in Google SecOps to grant access to data_tables via the new APIs if you encounter access errors on the detection UI page.
     • data_tables are now accessible from the Investigation menu and usable as a data source in YARA-L search queries
     • Role-based access controlRole-based access controlRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. (RBAC) for data_tables management

     2 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Feature rollout on May 8, 2025 introduced new APIs that may require updated permissions for custom roles to access the detection UI page
157. May 02, 2025 May 2, 2025 · release notes

     Google SecOps adds auto extraction of JSON logs for direct field access in search and detections.

     └──▷ HOW TO FIND IT
     Access JSON payload fields directly in a Native Dashboard widget to monitor application errors.
     📍Configure the data source to use Auto Extraction of JSON logs and select raw fields for your dashboard queries.
     • Adds Auto Extraction of JSON logs to process raw log fields directly in search, detection rules, and Native Dashboards without a parser.

     1 detail in Everything

158. April 25, 2025 Apr 25, 2025 · release notes

     Google SecOps adds native Azure Event Hub integration for real-time log ingestion via feed management API or web interface.

159. April 23, 2025 Apr 23, 2025 · release notes

     Google SecOps adds support for composite detections linking multiple YARA-LYARA-LA rule language developed by Google for Chronicle that extends YARA syntax to express multi-event, time-windowed detections over log data rather than single-file pattern matching. rules

160. April 22, 2025 Apr 22, 2025 · release notes

     Google SecOps adds support for parsing logs from over 40 new cyber tooling sources including Barracuda, CrowdStrike, Juniper, and AWS.

     └──▷ HOW TO FIND IT
     Enable collection of Barracuda WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. logs by configuring the new parser connector in your Google SecOps ingestion settings.
     📍In the console, go to Settings › Log Ingestion › Connectors and enable Collect Barracuda WAF logs
     Set up collection for CrowdStrike Falcon events using the CEFCEFCommon Event Format, an ArcSight (Micro Focus) log standard that defines a fixed header plus extensible key-value pairs so cyber tools can emit and ingest alerts in a predictable, parseable structure. format parser.
     📍In the console, go to Settings › Log Ingestion › Connectors and enable Collect CrowdStrike Falcon logs in CEF
     Configure AWS IAMAWS IAMAWS Identity and Access Management is Amazon's service for controlling who and what can call AWS APIs, by attaching policies that allow or deny actions on resources. Cyber tools use it to scope credentials to least privilege. log ingestion for identity threat detection.
     📍In the console, go to Settings › Log Ingestion › Connectors and enable Collect AWS IAM logs
     • Adds log ingestion parsers for Barracuda Email Security Gateway
     • Adds log ingestion parsers for Barracuda WAF
     • Adds log ingestion parsers for CrowdStrike Falcon in CEF format
     • Adds log ingestion parsers for Juniper NetScreen Firewall
     • Adds log ingestion parsers for Micro Focus NetIQ Access Manager

     +39 more show less

     • Adds log ingestion parsers for Symantec DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest.
     • Adds log ingestion parsers for Aruba ClearPass
     • Adds log ingestion parsers for Aruba Wireless Controller and Access Point
     • Adds log ingestion parsers for BeyondTrust Secure Remote Access
     • Adds log ingestion parsers for CyberArk Privileged Threat Analytics
     • Adds log ingestion parsers for Fortinet FortiMail
     • Adds log ingestion parsers for Sophos Central
     • Adds log ingestion parsers for Sophos XG Firewall
     • Adds log ingestion parsers for AWS EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. Hosts
     • Adds log ingestion parsers for AWS EC2 Instance
     • Adds log ingestion parsers for AWS IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access.
     • Adds log ingestion parsers for Cisco Stealthwatch
     • Adds log ingestion parsers for Cisco Umbrella audit logs
     • Adds log ingestion parsers for Cisco Umbrella DNS logs
     • Adds log ingestion parsers for Cisco Umbrella Web Proxy logs
     • Adds log ingestion parsers for CommVault Backup and Recovery
     • Adds log ingestion parsers for Forcepoint Proxy
     • Adds log ingestion parsers for Fortinet FortiAnalyzer
     • Adds log ingestion parsers for Fortinet FortiAuthenticator
     • Adds log ingestion parsers for Fortinet Firewall
     • Adds log ingestion parsers for Palo Alto Networks Traps
     • Adds log ingestion parsers for SecureAuth Identity Platform
     • Adds log ingestion parsers for Claroty CTD
     • Adds log ingestion parsers for Claroty xDome
     • Adds log ingestion parsers for F5 BIG-IP ASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them.
     • Adds log ingestion parsers for FireEye HX
     • Adds log ingestion parsers for Microsoft IIS
     • Adds log ingestion parsers for PowerShell
     • Adds log ingestion parsers for Snort
     • Adds log ingestion parsers for A10 Network Load Balancer
     • Adds log ingestion parsers for Alcatel switch
     • Adds log ingestion parsers for AlgoSec Security Management
     • Adds log ingestion parsers for Arbor Edge Defense
     • Adds log ingestion parsers for Epic Systems
     • Adds log ingestion parsers for Fortra Digital Guardian DLP
     • Adds log ingestion parsers for MobileIron
     • Adds log ingestion parsers for Microsoft Windows Defender ATP
     • Adds log ingestion parsers for Nokia Router
     • Adds log ingestion parsers for Broadcom Symantec SiteMinder Web Access

     44 details in Everything

161. April 21, 2025 Apr 21, 2025 · release notes

     Curated Detections adds Office 305 and Okta rule packs in public preview.

     • Adds new Okta detection rule pack for Cloud Threats to Curated Detections.

     1 detail in Everything

162. April 18, 2025 Apr 18, 2025 · release notes

     New Chrome Enterprise Threats detection category for extension and browser threats.

     └──▷ HOW TO FIND IT
     Monitor for malicious Chrome extensions or browser-based attacks using the new dedicated rule set.
     📍In the console, go to Analytics › Detections and filter by Chrome Enterprise Threats category.
163. January 28, 2025 Jan 28, 2025 · release notes

     New feature environment groups for MSSPMSSPA Managed Security Service Provider: a third-party company that operates cyber tooling and monitoring on behalf of clients, letting organizations outsource detection, response, and compliance functions. management and IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. email mapping support

     • Introduces Feature Environment groups to group environments for MSSP use cases
     • Adds capability to map individual user emails on the IdP group mapping page for Cloud Identity Provider customers
     • Adds instructions and capability to create SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents.-only or SOARSOARSecurity orchestration, automation and response, coordinating incident workflows across tools. Playbooks can gather evidence, assign work or carry out approved response actions.-only user permissions

     3 details in Everything

164. January 07, 2025 Jan 7, 2025 · release notes

     Google SecOps adds Zscaler and other log collection parsers for January 7 release

     • New Zscaler DNS logs parser available for collecting DNS data from Zscaler Internet Access
     • New Zscaler Firewall logs parser available for collecting firewall logs from Zscaler
     • New Zscaler Internet Access logs parser available for collecting access logs from Zscaler
     • New Zscaler Webproxy logs parser available for collecting web proxy logs from Zscaler

     4 details in Everything

165. December 27, 2024 Dec 27, 2024 · release notes

     Google SecOps ATI adds Inbound IP Address Authentication rule set to identify inbound authentications to local infrastructure.

     └──▷ HOW TO FIND IT
     Monitor your SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. dashboard for the new ATI rule set to detect inbound authentication attempts from external IPs.
     📍In Google SecOps, go to Applied Threat Intelligence and view queries for Inbound IP Address Authentication.
166. December 23, 2024 Dec 23, 2024 · release notes

     New log parsers added for CrowdStrike, Azure AD, GitHub, GitLab, ServiceNow and other providers to Google SecOps Chronicle.

     └──▷ HOW TO FIND IT
     Ingest GitHub audit logs to monitor repository changes and user activity in Google SecOps.
     📍Configure the Chronicle parser connector for Collect GitHub audit logs via the UI.
     Monitor AWS CloudTrailCloudTrailAWS service that records API calls and account activity across an AWS environment, giving cyber tools an audit log to detect anomalous or malicious actions. and Defender for Cloud alerts by enabling their respective log collectors.
     📍Enable 'Collect Microsoft Defender for Cloud alert logs' and Collect Azure DevOps audit logs in the integration settings.
     Collect network security events from Palo Alto Networks Prisma Cloud to correlate with endpoint telemetry.
     📍Set up the 'Collect Palo Alto Prisma Cloud alert logs' parser configuration.
     • Adds support for ingesting CrowdStrike Detection logs
     • Adds Collect Microsoft Azure AD Audit logs capability
     • Adds Collect Microsoft Azure AD Context logs capability
     • Adds ability to ingest Chrome Enterprise Premium data
     • Adds support for Ansible AWX logs

     +36 more show less

     • Adds Collect Atlassian Bitbucket logs support
     • Adds Collect Atlassian Jira logs support
     • Adds Collect Auth0 logs support
     • Adds Collect Azion firewall logs support
     • Adds Collect Azure DevOps audit logs support
     • Adds Collect GitHub audit logs support
     • Adds Collect GitLab logs support
     • Adds Collect Microsoft Defender for Cloud alert logs support
     • Adds Collect Microsoft Graph activity logs support
     • Adds Collect Microsoft Sentinel logs support
     • Adds Collect Twingate VPN logs support
     • Adds Collect Wordpress CMS logs support
     • Adds Collect CrowdStrike IOC logs support
     • Adds Collect Jenkins logs support
     • Adds Collect Wazuh logs support
     • Adds Collect OpenCanary logs support
     • Adds Collect Synology logs support
     • Adds Collect Palo Alto Networks IOC logs support
     • Adds Collect Fastly WAF logs support
     • Adds Collect MISP IOC logs support
     • Adds Collect ntopng logs support
     • Adds Collect Cloudflare logs support
     • Adds Collect Palo Alto Prisma Cloud alert logs support
     • Adds Collect ServiceNow Security logs support
     • Adds Collect Akamai WAF logs support
     • Adds Collect Aqua Security logs support
     • Adds Collect Cohesity logs support
     • Adds Collect Datadog logs support
     • Adds Collect Lacework Cloud Security logs support
     • Adds Collect Netskope alert logs v1 support
     • Adds Collect Netskope alert logs v2 support
     • Adds Collect Nutanix Prism logs support
     • Adds Collect Salesforce logs support
     • Adds Collect Trend Micro Cloud One logs support
     • Adds Collect VMware ESXi logs support
     • Adds Collect WatchGuard Fireware logs support

     41 details in Everything

167. December 22, 2024 Dec 22, 2024 · release notes

     Google SecOps adds dozens of new log source support (log_types) including Akamai, Jamf, Nessus, and OpenCTI.

     • Adds support for the ADDIGY_MDM log_type without a default parser
     • Adds support for the AKAMAI_DATASTREAM_2 log_type without a default parser
     • Adds support for the ANZENNA log_type without a default parser
     • Adds support for the AWS_ECS_METRICS log_type without a default parser
     • Adds support for the AZURE_LOG_ANALYTICS_WORKSPACE log_type without a default parser

     +27 more show less

     • Adds support for the BLOCKDAEMON_API log_type without a default parser
     • Adds support for the CHRONICLE_FEED log_type without a default parser
     • Adds support for the CLAROTY_XDOME_SECURE_ACCESS log_type without a default parser
     • Adds support for the CLOUDFLARE_SPECTRUM log_type without a default parser
     • Adds support for the CLOUDSEK_ALERTS log_type without a default parser
     • Adds support for the SENSATO_HONEYPOT log_type without a default parser
     • Adds support for the DOCKER_HUB_ACTIVITY log_type without a default parser
     • Adds support for the FORTINET_FORTIDDOS log_type without a default parser
     • Adds support for the HONEYWELL_CYBERINSIGHTS log_type without a default parser
     • Adds support for the IPFIRE log_type without a default parser
     • Adds support for the JAMF_CONNECT log_type without a default parser
     • Adds support for the KNOWBE4 log_type without a default parser
     • Adds support for the LOGICGATE log_type without a default parser
     • Adds support for the MANAGEENGINE_NCM log_type without a default parser
     • Adds support for the MICROSOFT_DOTNET log_type without a default parser
     • Adds support for the NESSUS_NETWORK_MONITOR log_type without a default parser
     • Adds support for the NETOGRAPHY_FUSION log_type without a default parser
     • Adds support for the NETWRIX_STEALTHAUDIT log_type without a default parser
     • Adds support for the OOMNITZA log_type without a default parser
     • Adds support for the OPENCTI log_type without a default parser
     • Adds support for the ORACLE_EBS log_type without a default parser
     • Adds support for the ORACLE_ZDLRA log_type without a default parser
     • Adds support for the PHISHALARM log_type without a default parser
     • Adds support for the SAVVY_SECURITY log_type without a default parser
     • Adds support for the SYMANTEC_SA log_type without a default parser
     • Adds support for the VENAFI_ZTPKI log_type without a default parser
     • Updates supported default parsers for existing log sources including Atlassian, Azure AD, Cisco, CrowdStrike, and Windows Event logs

     32 details in Everything

168. November 09, 2024 Nov 9, 2024 · release notes

     Google SecOps adds parsers for Azure AD, AWS VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware./GuardDuty/RDS, Cloudflare, FortiWeb, F5 BIG-IP, and many others.

     └──▷ HOW TO FIND IT
     Ingest Azure AD and AWS VPC Flow logs using the new parser capabilities.
     📍Configure the Chronicle ingestion pipeline to select Microsoft Azure AD and AWS VPC Flow logs parsers for your data source connectors.
     • Adds parsers to collect Microsoft Azure AD logs
     • Adds parsers to collect AWS VPC Flow logs
     • Adds parsers to collect AWS GuardDuty logs
     • Adds parsers to collect Cisco Meraki logs
     • Adds parsers to collect Cisco Secure Email Gateway logs

     +34 more show less

     • Adds parsers to collect Cisco ISE logs
     • Adds parsers to collect Cisco Secure ACS logs
     • Adds parsers to collect Amazon CloudFront logs
     • Adds parsers to collect AWS RDS logs
     • Adds parsers to collect Cloudflare WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. logs
     • Adds parsers to collect Forcepoint DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. logs
     • Adds parsers to collect FortiWeb WAF logs
     • Adds parsers to collect F5 BIG-IP APMAPMApplication Performance Monitoring — a category of software that collects metrics, traces, and logs from running applications so developers can detect slowdowns and diagnose their root cause. logs
     • Adds parsers to collect F5 BIG-IP LTM logs
     • Adds parsers to collect CrowdStrike EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. logs
     • Adds parsers to collect the General Dynamics Fidelis XPS logs
     • Adds parsers to collect CyberX logs
     • Adds parsers to collect Imperva Incapsula Web Application Firewall logs
     • Adds parsers to collect Infoblox logs
     • Adds parsers to collect Juniper Junos logs
     • Adds parsers to collect Microsoft Intune logs
     • Adds parsers to collect Microsoft GraphMicrosoft GraphMicrosoft's unified REST API for accessing data and services across Microsoft 365, Azure AD, and related cloud products, giving cyber tools a single authenticated endpoint to query users, emails, files, and sign-in logs. security API alert logs
     • Adds parsers to collect Kemp Load Balancer logs
     • Adds parsers to collect Mimecast Secure Email Gateway logs
     • Adds parsers to collect Netgate pfSense logs
     • Adds parsers to collect NetScaler logs
     • Adds parsers to collect Proofpoint TAP alerts logs
     • Adds parsers to collect Pulse Secure logs
     • Adds parsers to collect Qualys scan logs
     • Adds parsers to collect RSARSAThe oldest widely used public-key algorithm, for both encryption and signatures, with security resting on factoring large numbers. A large quantum computer would break it. Authentication Manager logs
     • Adds parsers to collect SentinelOne EDR logs
     • Adds parsers to collect SonicWall logs
     • Adds parsers to collect Sophos UTM logs
     • Adds parsers to collect Symantec Event Export logs
     • Adds parsers to collect Tripwire logs
     • Adds parsers to collect Palo Alto Prisma Cloud logs
     • Adds parsers to collect Okta logs
     • Adds parsers to collect Palo Alto Cortex XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. alerts logs
     • Adds parsers to collect CrowdStrike Detection logs

     39 details in Everything

169. October 28, 2024 Oct 28, 2024 · release notes

     Adds log types including Adobe I/O Runtime, Azure Container Registry, and Elastic Defend without default parsers; also updates existing parsers.

     • Adds Adobe I/O Runtime (ADOBE_IO_RUNTIME) as a supported log type without a default parser.
     • Adds Amazon VPC Transit Gateway Flow Logs (AWS_VPC_TRANSIT_GATEWAY) as a supported log type without a default parser.
     • Adds Appsentinels (APPSENTINELS) as a supported log type without a default parser.
     • Adds Asset Panda (ASSET_PANDA) as a supported log type without a default parser.
     • Adds AstriX (ASTRIX) as a supported log type without a default parser.

     +32 more show less

     • Adds Atlan (ATLAN) as a supported log type without a default parser.
     • Adds Azure Container Registry (AZURE_CONTAINER_REGISTRY) as a supported log type without a default parser.
     • Adds Backbase Engagement Banking Platform (BACKBASE) as a supported log type without a default parser.
     • Adds Barracuda Incident Response (BARRACUDA_INCIDENTRESPONSE) as a supported log type without a default parser.
     • Adds Cloudflare Access (CLOUDFLARE_ACCESS) as a supported log type without a default parser.
     • Adds Control D DNS (CONTROL_D) as a supported log type without a default parser.
     • Adds Digicert (DIGICERT) as a supported log type without a default parser.
     • Adds Elastic Defend (ELASTIC_DEFEND) as a supported log type without a default parser.
     • Adds FingerprintJS (FINGERPRINT_JS) as a supported log type without a default parser.
     • Adds Hashicorp Nomad (HASHICORP_NOMAD) as a supported log type without a default parser.
     • Adds IBM NS1 (IBM_NS1) as a supported log type without a default parser.
     • Adds Intel 471 Malware Intelligence (INTEL471_MALWARE_INTEL) as a supported log type without a default parser.
     • Adds MacStadium (MACSTADIUM) as a supported log type without a default parser.
     • Adds N-Able N-Central RMM (N_ABLE_N_CENTRAL_RMM) as a supported log type without a default parser.
     • Adds Opentext Exstream (OPENTEXT_EXSTREAM) as a supported log type without a default parser.
     • Adds OVHcloud (OVHCLOUD) as a supported log type without a default parser.
     • Adds OX Security (OX_SECURITY) as a supported log type without a default parser.
     • Adds Pharos (PHAROS) as a supported log type without a default parser.
     • Adds ReliaQuest (RELIAQUEST) as a supported log type without a default parser.
     • Adds Rublon (RUBLON) as a supported log type without a default parser.
     • Adds Snyk Group level audit/issues logs (SNYK_ISSUES) as a supported log type without a default parser.
     • Adds SolarWinds Network Performance Monitor (SOLARWINDS_NPM) as a supported log type without a default parser.
     • Adds StackHawk (STACKHAWK) as a supported log type without a default parser.
     • Adds Tencent Cloud Firewall (TENCENT_CLOUD_FIREWALL) as a supported log type without a default parser.
     • Adds Tencent Cloud Waf (TENCENT_CLOUD_WAF) as a supported log type without a default parser.
     • Adds Tencent Cloud Workload Protection (TENCENT_CLOUD_WORKLOAD_PROTECTION) as a supported log type without a default parser.
     • Adds Trend Micro Server Protect (TRENDMICRO_SERVER_PROTECT) as a supported log type without a default parser.
     • Adds UKG (UKG) as a supported log type without a default parser.
     • Adds Uptivity (UPTIVITY) as a supported log type without a default parser.
     • Adds USBAV Koramis (USBAV_KORAMIS) as a supported log type without a default parser.
     • Adds Virtual Network Flow Logs (VIRTUAL_NETWORK_FLOW_LOGS) as a supported log type without a default parser.
     • Adds Windows Performance Monitor (MS_PERFMON) as a supported log type without a default parser.

     37 details in Everything

170. September 09, 2024 Sep 9, 2024 · release notes

     YARA-L 2.0YARA-L 2.0A rule language developed by Google for writing detection logic in Chronicle SIEM, extending YARA syntax to match sequences of log events over time rather than static file patterns. adds array/string/math/time/window functions for rule and search authoring.

     • Adds arrays.concat, arrays.join_string, arrays.max, arrays.min, arrays.size, arrays.index_to_int to YARA-LYARA-LA rule language developed by Google for Chronicle that extends YARA syntax to express multi-event, time-windowed detections over log data rather than single-file pattern matching. 2.0 Rules and Search
     • Adds casting and math functions (cast.as_bool, cast.as_float, math.ceil, math.floor, math.geo_distance, math.is_increasing, math.pow, math.random) to YARA-L 2.0 Rules and Search
     • Adds string processing functions (strings.contains, strings.count_substrings, strings.extract_domain, strings.extract_hostname, strings.from_hex, strings.ltrim, strings.reverse, strings.rtrim, strings.trim, strings.url_decode) to YARA-L 2.0 Rules and Search
     • Adds timestamp functions (timestamp.as_unix_seconds, timestamp.now) to YARA-L 2.0 Rules and Search
     • Adds hash and window aggregation functions (hash.sha256, window.avg, window.first, window.last, window.median, window.mode, window.stddev, window.variance) to YARA-L 2.0 Rules

     5 details in Everything

171. August 01, 2024 Aug 1, 2024 · release notes

     Google SecOps enables direct Google Cloud data ingestion without access codes

     └──▷ HOW TO FIND IT
     Skip the manual access code step when setting up new Google Cloud data sources.
     📍In the console, go to Settings › Data Ingestion and enable Direct ingestion from Google Cloud
172. July 25, 2024 Jul 25, 2024 · release notes

     Google SecOps adds support for 40 new log sources and updates existing default parsers.

     • Adds support for Backstage (BACKSTAGE), ChatGPT Audit Logs (CHATGPT_AUDIT_LOGS), and Google Cloud Abuse Events (GCP_ABUSE_EVENTS) among other new integrations.
     • Updates the list of supported default parsers to include recent changes for existing sources like AWS CloudTrailCloudTrailAWS service that records API calls and account activity across an AWS environment, giving cyber tools an audit log to detect anomalous or malicious actions., Okta, and Zscaler.

     2 details in Everything

173. July 18, 2024 Jul 18, 2024 · release notes

     Google SecOps July 18, 2024 adds support for migrating RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. to IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. via auto-generated commands.

     • Adds auto-generated commands to migrate existing feature RBAC configuration to IAM permissions and roles when binding an instance to a Google Cloud project.

     1 detail in Everything

174. June 26, 2024 Jun 26, 2024 · release notes

     Google SecOps adds BindPlane agent for Windows logs, SQL queries, file reading, and syslog ingestion.

175. June 24, 2024 Jun 24, 2024 · release notes

     Google SecOps June 24, 2024 release adds Cloud Identity and Google Workspace as configurable identity providersidentity providersA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. during onboarding

     └──▷ HOW TO FIND IT
     Set up a new Google SecOps instance using Cloud Identity for admin access control instead of default local or other configured providers.
     📍During the Google Security Operations onboarding steps, select Cloud Identity as the identity provider and specify the administrator groups to grant access to SOAR-related features.
     • Configures Cloud Identity or Google Workspace as an identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. during Google Security Operations onboarding steps to specify admin identity provider groups.

     1 detail in Everything

176. June 18, 2024 Jun 18, 2024 · release notes

     Google SecOps adds Access Transparency integration, GetRule API field, and data RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists..

     • Adds Access Transparency logs to Google SecOps when Google personnel accesses customer content
     • Adds lastAlertStatusChangeTime field to the GetRule Detection Engine API response
     • Adds lastAlertStatusChangeTime field to RuleDeployment of Chronicle API v1 alpha
     • Introduces data RBAC to control user access to data within Google SecOps based on assigned roles

     4 details in Everything

177. May 06, 2024 May 6, 2024 · release notes

     Gemini for investigation assistance adds natural language search, YARA-LYARA-LA rule language developed by Google for Chronicle that extends YARA syntax to express multi-event, time-windowed detections over log data rather than single-file pattern matching. rule generation, and threat intel analysis.

     • Adds Gemini for investigation assistance with natural language Search capabilities to build, edit, and run queries against events
     • Adds automatic Search summaries of results and contextual follow-up Q&A after search or filter actions
     • Adds Rule generation creating new YARA-L rules directly from generated UDM search queries
     • Adds Security questions and threat intelligence analysis for summarizing threat actors, IOCsIOCsAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself., and threat intel topics
     • Adds Incident remediation suggestions for follow-on steps based on returned event information

     5 details in Everything

178. May 02, 2024 May 2, 2024 · release notes

     Google SecOps adds support for 120+ new log types including BloodHound, Kyverno, and Duo Activity Logs.

     • Adds parsing support for BLOODHOUND logs via the BloodHound product entry
     • Adds parsing support for KYVERNO logs via the Kyverno product entry
     • Adds parsing support for DUO_ACTIVITY logs via the Duo Activity Logs product entry
     • Adds parsing support for ADAXES logs via the Adaxes product entry
     • Adds parsing support for DEFECTDOJO logs via the DefectDojo product entry

     5 details in Everything

179. April 26, 2024 Apr 26, 2024 · release notes

     Google SecOps adds HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. log feeds with custom naming and troubleshooting details via UI/API

     └──▷ HOW TO FIND IT
     Configure a new webhook feed with a custom name and view its success status via the UI
     📍In the feed management UI, create a new feed, select Webhook as the source type, assign a custom Feed name, and generate an API key for authentication.
     Diagnostics: Check last successful fetch time and error details for a specific feed
     📍View the Last succeeded time timestamp and access troubleshooting information (issue cause and recommendations) directly from the feed's detail page in the UI or via the feed management API.
     • Adds ability to push logs via HTTPS endpoint for Amazon Data Firehose, Google Cloud Pub/Sub, and Webhooks using the feed management UI or API.
     • Adds secret key and API key authentication options for Amazon Data Firehose and webhook feed sources.
     • Adds Feed names support to assign custom names to new and existing data feeds.
     • Adds troubleshooting information access for error feeds, including issue cause and recommended actions.
     • Adds Last succeeded time timestamp to show when data was last successfully fetched by each feed.

     5 details in Everything

180. March 25, 2024 Mar 25, 2024 · release notes

     Google SecOps adds Applied Threat Intelligence with IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. enrichment, active breach alerting, and Fusion integration

     └──▷ HOW TO FIND IT
     Access the new curated views to investigate active breaches by identifying associations between current indicators and known threat actors or campaigns.
     📍In the Chronicle console, navigate to the Applied Threat Intelligence Insights section to view indicator-to-actor mappings and statistics.
     • Adds Event-level enrichment ingesting IOCsIOCsAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. curated by Mandiant Threat Intelligence (IC-Score > 80) into Chronicle telemetry
     • Adds Active breach alerting using Mandiant incident response intelligence to flag potential breaches
     • Adds DIY detection engineering via Fusion intelligence for customer-authored rules and response playbooks
     • Adds Insights views showing associations between indicators, threat actors, campaigns, or malware

     4 details in Everything

181. March 22, 2024 Mar 22, 2024 · release notes

     Google SecOps adds Serverless Threats detection rule set and reCAPTCHA Enterprise log ingestion

     • Adds new Serverless Threats rule set in Cloud Threat Detections to detect compromise of Google Cloud serverless resources like Cloud RunCloud RunGoogle's managed container runtime that executes stateless workloads on demand, scaling to zero when idle, so tools can deploy without managing servers or paying for idle capacity. and Cloud Functions
     • Enables direct ingestion and parsing of reCAPTCHA Enterprise logs from Google Cloud

     2 details in Everything

182. March 15, 2024 Mar 15, 2024 · release notes

     Chronicle expands Cloud Threat Detections with Sensitive Actions Service integration.

     └──▷ HOW TO FIND IT
     Enable monitoring of Sensitive Actions Service findings in your threat detection rule sets.
     📍In the Chronicle console, navigate to Threat Detections and configure Sensitive Actions Service as an input source for existing or new CDIR SCC rule sets (e.g., CDIR SCC Enhanced Defense Evasion).
183. March 14, 2024 Mar 14, 2024 · release notes

     Google SecOps adds support for 45 new log types across cloud, network, and endpoint vendors.

     • Adds support for 45 new log types without default parsers including Aruba Switch, Azure Front Door, HaveIBeenPwned, IBM-i Operating System, Nextthink Finder, PingIdentity Directory Server Logs, SafeBreach, Sendsafely, Solace Pub Sub Cloud, and Ubiquiti Accesspoint.

     1 detail in Everything

     └──▷ BREAKING ON UPGRADE

     • !The default parsers for existing log types have changed (e.g., Akamai WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server., AWS Config, Cisco Umbrella DNS, etc.); verify your log_type mappings to ensure logs are still processed correctly.
184. February 20, 2024 Feb 20, 2024 · release notes

     Google SecOps (Chronicle) adds Tokyo region support with new API endpoint

     └──▷ TRY IT
     Configure API client to point to the new Tokyo region endpoint
     copy

     $ export CHRONICLE_API_ENDPOINT=https://asia-northeast1-backstory.googleapis.com

     • Adds https://asia-northeast1-backstory.googleapis.com as a new regional endpoint for Chronicle APIs in the Tokyo (Japan) region.
     • Enables storing customer data in the newly added Tokyo (Japan) region for Chronicle customers.

     2 details in Everything

185. February 15, 2024 Feb 15, 2024 · release notes

     Google SecOps adds support for over 50 new log sources and updates default parsers for existing integrations.

     • Adds support for Arista Guardian For Network Identity (ARISTA_AGNI) log type
     • Adds support for HPE Aruba Networking Central (ARUBA_CENTRAL) log type
     • Adds support for Blackberry Workspaces (BLACKBERRY_WORKSPACES) log type
     • Adds support for Barracuda CloudGen Firewall (BARRACUDA_CLOUDGEN_FIREWALL) log type
     • Adds support for Cisco EStreamer (CISCO_ESTREAMER) log type

     +41 more show less

     • Adds support for Cyderes IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. (CYDERES_IOC) log type
     • Adds support for Dataiku DSS Logging (DATAIKU_DSS_LOGS) log type
     • Adds support for Edgecore Networks (EDGECORE_NETWORKS) log type
     • Adds support for Fisglobal Quantum (FISGLOBAL_QUANTUM) log type
     • Adds support for ForgeRock Identity Cloud (FORGEROCK_IDENTITY_CLOUD) log type
     • Adds support for Forgerock OpenIdM (FORGEROCK_OPENIDM) log type
     • Adds support for FS-ISAC IOC (FS_ISAC_IOC) log type
     • Adds support for Genetec Audit (GENETEC_AUDIT) log type
     • Adds support for HiBob (HIBOB) log type
     • Adds support for Imperva Audit Trail (IMPERVA_AUDIT_TRAIL) log type
     • Adds support for KerioControl Firewall (KERIOCONTROL) log type
     • Adds support for Looker Audit (LOOKER_AUDIT) log type
     • Adds support for Mobile Endpoint Security (LOOKOUT_MOBILE_ENDPOINT_SECURITY) log type
     • Adds support for ManageEngine PAM360 (MANAGE_ENGINE_PAM360) log type
     • Adds support for Melissa (MELISSA) log type
     • Adds support for Microsoft CASBCASBA Cloud Access Security Broker is a policy-enforcement proxy, on-premises or cloud-hosted, that sits between users and cloud services to provide visibility, compliance controls, and threat protection over SaaS and IaaS traffic. Files & Entities (MICROSOFT_CASB_CONTEXT) log type
     • Adds support for Windows Local Administrator Password Solution (MICROSOFT_LAPS) log type
     • Adds support for Network Policy Server (MICROSOFT_NPS) log type
     • Adds support for Power BI Activity Log (MICROSOFT_POWERBI_ACTIVITY_LOG) log type
     • Adds support for Nxlog Agent (NXLOG_AGENT) log type
     • Adds support for Nxlog Fim (NXLOG_FIM) log type
     • Adds support for Opus Codec (OPUS) log type
     • Adds support for Oracle NetSuite (ORACLE_NETSUITE) log type
     • Adds support for Pega Automation (PEGA) log type
     • Adds support for Qualys Knowledgebase (QUALYS_KNOWLEDGEBASE) log type
     • Adds support for RealiteQ (REALITEQ) log type
     • Adds support for SAP Webdispatcher (SAP_WEBDISP) log type
     • Adds support for Serpico (SERPICO) log type
     • Adds support for Software House Ccure9000 (SOFTWARE_HOUSE_CCURE9000) log type
     • Adds support for Spirion (SPIRION) log type
     • Adds support for Spur data feeds (SPUR_FEEDS) log type
     • Adds support for Swift (SWIFT) log type
     • Adds support for Technitium DNS (TECHNITIUM_DNS) log type
     • Adds support for Tetragon Ebpf Audit Logs (TETRAGON_EBPF_AUDIT_LOGS) log type
     • Adds support for Trend Micro Email Security Advanced (TRENDMICRO_EMAIL_SECURITY) log type
     • Adds support for Tridium Niagara Framework (TRIDIUM_NIAGARA_FRAMEWORK) log type
     • Adds support for VeridiumID by Veridium (VERIDIUM_ID) log type
     • Adds support for Wallarm Webhook Notifications (WALLARM_NOTIFICATIONS) log type
     • Adds support for Winscp (WINSCP) log type
     • Adds support for XAMS by Xiting (XITING_XAMS) log type
     • Updates default parsers for 100+ existing log types including A10 Load Balancer, Apache, AWS CloudWatch, Azure AD, CrowdStrike Detection Monitoring, and Zscaler

     46 details in Everything

186. February 12, 2024 Feb 12, 2024 · release notes

     New Risk Analytics capability for Chronicle adds entity risk scoring, dashboards, and custom rule authoring.

     └──▷ HOW TO FIND IT
     Visualize risk trends for high-priority entities using the new dashboard.
     📍Navigate to Chronicle › Risk Analytics dashboard in the console to view entity risk scores.
     Create a watchlist to monitor specific entities suspected of higher risk.
     📍In the Risk Analytics interface, create a new watchlist and add target entities for continuous monitoring.
     Author custom risk rules using YARA-LYARA-LA rule language developed by Google for Chronicle that extends YARA syntax to express multi-event, time-windowed detections over log data rather than single-file pattern matching. metric functions for tailored threat detection.
     📍Use YARA-L metric functions in the rule editor to define custom risk criteria beyond predefined detections.
     • Introduces Risk Analytics engine to assign risk scores to entities and activities across the enterprise
     • Adds Risk Analytics dashboard for visualizing entity risk trends and identifying unusual behavior
     • Allows specification of watchlists to monitor high-risk entities
     • Provides predefined curated detections for risk patterns
     • Adds YARA-L metric functions for authoring custom risk rules

     5 details in Everything

187. February 01, 2024 Feb 1, 2024 · release notes

     Chronicle feed management API gains four AWS log types

188. January 24, 2024 Jan 24, 2024 · release notes

     Chronicle passes through GCP Security Command Center threat detections to alert on VM, Container, and Event findings.

     • Adds passthrough detections for GCP Security Command Center Event Threat Detections, Virtual Machine Threat Detections, and Container Threat Detections
     • Exposes new detection packs (e.g., CDIR SCC Enhanced Exfiltration, CDIR SCC Enhanced Malware) to ingest the above findings

     2 details in Everything

189. January 19, 2024 Jan 19, 2024 · release notes

     Adds eight log types without default parsers and updates existing default parsers.

     • Adds support for ALICLOUD_ANTI_DDOS log type; no default parser is included.
     • Adds support for ALICLOUD_WAF log type; no default parser is included.
     • Adds support for ARISTA_CVP log type; no default parser is included.
     • Adds support for CIPHERTRUST_MANAGER log type; no default parser is included.
     • Adds support for CYBERGATEKEEPER_NAC log type; no default parser is included.

     +47 more show less

     • Adds support for MICROSOFT_GRAPH_ACTIVITY_LOGS log type; no default parser is included.
     • Adds support for TRENDMICRO_EDGEIPS log type; no default parser is included.
     • Adds support for VANGUARD log type; no default parser is included.
     • Updates default parser for AWS_AURORA
     • Updates default parser for AZURE_AD
     • Updates default parser for AZURE_AD_AUDIT
     • Updates default parser for AZURE_AD_CONTEXT
     • Updates default parser for AZURE_DEVOPS
     • Updates default parser for BARRACUDA_EMAIL
     • Updates default parser for BOMGAR
     • Updates default parser for BOX
     • Updates default parser for CISCO_FIREPOWER_FIREWALL
     • Updates default parser for CISCO_UMBRELLA_AUDIT
     • Updates default parser for CISCO_VPN
     • Updates default parser for CISCO_WIRELESS
     • Updates default parser for CLOUDFLARE
     • Updates default parser for DELL_SWITCH
     • Updates default parser for F5_ASM
     • Updates default parser for FIREEYE_ALERT
     • Updates default parser for FIREEYE_HX
     • Updates default parser for FIREEYE_PX
     • Updates default parser for FORTINET_FORTIWEB
     • Updates default parser for CLEARPASS
     • Updates default parser for INFOBLOX_DHCP
     • Updates default parser for JUMPCLOUD_DIRECTORY_INSIGHTS
     • Updates default parser for KUBERNETES_AUDIT_AZURE
     • Updates default parser for AZURE_ACTIVITY
     • Updates default parser for MICROSOFT_GRAPH_ALERT
     • Updates default parser for IIS
     • Updates default parser for NUTANIX_PRISM
     • Updates default parser for OFFICE_365
     • Updates default parser for PAN_FIREWALL
     • Updates default parser for QUEST_CHANGE_AUDITOR_EMC
     • Updates default parser for QUEST_FILE_AUDIT
     • Updates default parser for RH_ISAC_IOC
     • Updates default parser for STEELHEAD
     • Updates default parser for SENTINELONE_CF
     • Updates default parser for SYMANTEC_DLP
     • Updates default parser for SYNOLOGY
     • Updates default parser for SYSDIG
     • Updates default parser for NIX_SYSTEM
     • Updates default parser for VECTRA_DETECT
     • Updates default parser for VECTRA_STREAM
     • Updates default parser for WINDOWS_DNS
     • Updates default parser for WINEVTLOG
     • Updates default parser for WINEVTLOG_XML
     • Updates default parser for ZSCALER_WEBPROXY

     52 details in Everything

190. January 17, 2024 Jan 17, 2024 · release notes

     Google SecOps Jan 17 2024: New UDM objects and fields expand entity analysis surface

     • Adds new Unified Data Model objects: DNSRecord, Favicon, ThreatVerdict, PopularityRank, SSLCertificate hierarchy (SSLCertificate.AuthorityKeyId, SSLCertificate.CertSignature, SSLCertificate.DSA, SSLCertificate.EC, SSLCertificate.Extension, SSLCertificate.PublicKey, SSLCertificate.RSA, SSLCertificate.Subject, SSLCertificate.Validity), Tracker, Url, and SecurityResult.AnalyticsMetadata
     • Adds new fields to existing UDM nouns: url_metadata on Noun; ruleset_category_display_name, confidence_score, analytics_metadata, threat_verdict, last_discovered_time on SecurityResult; last_dns_records, categories, favicon, jarm, last_dns_records_time, last_https_certificate, last_https_certificate_time, popularity_ranks, tags, whois_time on Domain; security_result and main_icon on File
     • Adds new fields to SecurityResult.Association: sponsor_region, targeted_regions, and tags
     • Extends File.FileType values with support for DWG, DXF, 3DS, WEBM, MKV, OneNote, OOXMLOOXMLAn ISO-standardized file format family for Office documents (Word, Excel, PowerPoint), maintained by Microsoft, that stores content as XML inside a ZIP archive, giving cyber tools a parseable, scriptable structure for document analysis., ZST, LZFSE, Python WHL/PKG, M4, Objective-C, JMOD, Makefile, INI, Clojure (CLJ), PDBPDBA debug symbol file format used by Microsoft's toolchain that maps compiled binaries back to source code, function names, and variable types, letting cyber tools resolve symbols during reverse engineering or memory analysis., SQL, Neko, WER, GoLang, SGML, JSON, CSV, SquashFS, VHD, IPSIPSAn intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection., PEM, PGP, CRT, PYC
     • Extends Metric.Dimension with PRINCIPAL_PROCESS_FILE_PATH, PRINCIPAL_PROCESS_FILE_HASH, SECURITY_RESULT_RULE_NAME and adds ALERT_EVENT_NAME_COUNT to Metric.MetricName

     +1 more show less

     • Adds NONE as a valid value for SecurityResult.ProductSeverity

     6 details in Everything

191. January 03, 2024 Jan 3, 2024 · release notes

     Google SecOps adds support for 19 new log types including Asimily, Checkpoint Gaia, Cisco Cyber Vision and more.

     • Adds ASIMILY log type for Asimily product data ingestion
     • Adds CHECKPOINT_GAIA log type for Check Point Gaia device logs
     • Adds CISCO_CYBER_VISION log type for Cisco Cyber Vision IoTIoTA collective label for internet-connected physical devices — sensors, cameras, routers, appliances — that tools target because they run embedded firmware with limited patching and broad network exposure./OT telemetry
     • Adds CISCO_IRONPORT log type for Cisco IronPort email gateway logs
     • Adds CYBER_2_IDS log type for Cyber 2.0 Intrusion Detection System alerts

     +17 more show less

     • Adds CYPHERTRUST_MANAGER log type for CypherTrust Manager key management logs
     • Adds DUO_TRUST_MONITOR log type for Duo Trust Monitor authentication signals
     • Adds EXTREME_WIRELESS log type for Extreme Networks wireless controller events
     • Adds FIREEYE_PX log type for FireEye PX endpoint protection data
     • Adds HARFANGLAB_EDR log type for Harfanglab EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. telemetry
     • Adds IMAGENOW log type for ImageNow document management logs
     • Adds INFINICO_NETWYVERN log type for INFINICO NetWyvern appliance events
     • Adds QUEST_CA_AUDIT log type for Quest CA Audit Trail data
     • Adds QUEST_CHANGE_AUDITOR_EMC log type for Quest Change Auditor for EMC logs
     • Adds QUEST_FILE_AUDIT log type for Quest File Access Audit events
     • Adds RADIFLOW_IDS log type for RadiFlow IDSIDSAn intrusion detection system, monitoring traffic or host activity for suspicious behavior and producing alerts. Detection alone does not necessarily block the activity. alerting data
     • Adds SENTRIGO log type for rigo security analytics logs
     • Adds SEPPMAIL log type for SEPPmail secure email communication logs
     • Adds SPECTERX log type for SpecterX endpoint visibility data
     • Adds VIACONTROL log type for ViaControl Server Application logs
     • Adds WINDCHILL log type for PTC WindChill product lifecycle management logs
     • Adds WS_FTP log type for WS Ftp file transfer logs

     22 details in Everything

192. December 15, 2023 Dec 15, 2023 · release notes

     Adds KSA (Dammam) and India (Mumbai) regions with new regional API endpoints

     • Adds https://me-central2-backstory.googleapis.com as a new regional API endpoint for Chronicle in the KSA (Dammam) region
     • Adds http://asia-south1-backstory.googleapis.com as a new regional API endpoint for Chronicle in the India (Mumbai) region

     2 details in Everything

193. December 14, 2023 Dec 14, 2023 · release notes

     Adds log types including Akamai Guardicore, Cohesity Helios, and Nozomi Networks without default parsers.

194. December 06, 2023 Dec 6, 2023 · release notes

     New WORKSPACE_ACTIVITY ingestion mechanism and updated Curated Detections for Google Cloud threats

     • Adds an additional mechanism to set up the ingestion of Google Workspace Activities logs ( WORKSPACE_ACTIVITY ), simplifying configuration steps.
     • Enhances Chronicle Curated Detections with new detection content for Google Cloud threats to identify anomalous activity in Google Workspace data.

     2 details in Everything

195. November 15, 2023 Nov 15, 2023 · release notes

     Adds 38 supported log types without default parsers.

     • Adds ARUBA_ORCHESTRATOR as a supported log type without a default parser
     • Adds AWS_SHIELD as a supported log type without a default parser
     • Adds AZURE_DNS as a supported log type without a default parser
     • Adds BACKBOX as a supported log type without a default parser
     • Adds BITVISE_SSHD as a supported log type without a default parser

     +33 more show less

     • Adds CYLERA_IOT as a supported log type without a default parser
     • Adds DRUVA_BACKUP as a supported log type without a default parser
     • Adds ENSONO as a supported log type without a default parser
     • Adds EXTREME_CONTROL as a supported log type without a default parser
     • Adds EZPROXY as a supported log type without a default parser
     • Adds GITHUB_EVENTS as a supported log type without a default parser
     • Adds GLEAN as a supported log type without a default parser
     • Adds IVANTI_XTRACTION as a supported log type without a default parser
     • Adds LIRA as a supported log type without a default parser
     • Adds LOGONBOX as a supported log type without a default parser
     • Adds MANDIANT_CUSTOM_IOC as a supported log type without a default parser
     • Adds MONDAY as a supported log type without a default parser
     • Adds ONAPSIS as a supported log type without a default parser
     • Adds OPENTELEMETRY as a supported log type without a default parser
     • Adds OPSWAT_KIOSK as a supported log type without a default parser
     • Adds OUTPOST24 as a supported log type without a default parser
     • Adds PENTERA_LEEF as a supported log type without a default parser
     • Adds PHISHLABS as a supported log type without a default parser
     • Adds PORTNOX_AUDIT as a supported log type without a default parser
     • Adds PORTNOX_CEF as a supported log type without a default parser
     • Adds PROOFPOINT_SENDMAIL_SENTRION as a supported log type without a default parser
     • Adds SAP_SM20 as a supported log type without a default parser
     • Adds SPLUNK_ATTACK_ANALYZER as a supported log type without a default parser
     • Adds STELLAR_CYBER as a supported log type without a default parser
     • Adds TALON as a supported log type without a default parser
     • Adds TERADICI_PCOIP as a supported log type without a default parser
     • Adds TRENDMICRO_APEX_CENTRAL as a supported log type without a default parser
     • Adds TRENDMICRO_WEBPROXY_DSM as a supported log type without a default parser
     • Adds VONAGE as a supported log type without a default parser
     • Adds WATERFALL_DSM as a supported log type without a default parser
     • Adds YSOFT_DSM as a supported log type without a default parser
     • Adds ZSCALER_ZCC as a supported log type without a default parser
     • Adds ZSCALER_ZDX as a supported log type without a default parser

     38 details in Everything

196. November 08, 2023 Nov 8, 2023 · release notes

     Detection Engine adds Limited and Paused statuses for Chronicle YARA-LYARA-LA rule language developed by Google for Chronicle that extends YARA syntax to express multi-event, time-windowed detections over log data rather than single-file pattern matching. rules running on live data.

197. November 02, 2023 Nov 2, 2023 · release notes

     Adds 11 log types without default parsers and updates existing default parsers.

198. October 27, 2023 Oct 27, 2023 · release notes

     Chronicle adds Frankfurt and Zurich regions with new API endpoints

     • Adds europe-west3 (Frankfurt) and europe-west6 (Zurich) as new data residency regions for Chronicle customers.
     • Adds https://europe-west3-backstory.googleapis.com and https://europe-west6-backstory.googleapis.com as new regional API endpoints.

     2 details in Everything

199. October 18, 2023 Oct 18, 2023 · release notes

     Google SecOps adds support for 15 new log types including ADVA FSP, Bluecat AM, Kion, and Kiteworks.

     • Adds support for the ADVA_FSP log type from the ADVA Fiber Service Platform without a default parser
     • Adds support for the BLUECAT_AM log type from Bluecat Address Manager without a default parser
     • Adds support for the FORTINET_SWITCH log type without a default parser
     • Adds support for the GCP_KUBERNETES_CONTEXT log type from GCP Google Kubernetes Engine without a default parser
     • Adds support for the KION log type without a default parser

     +10 more show less

     • Adds support for the KITEWORKS log type without a default parser
     • Adds support for the NOKIA_ROUTER log type without a default parser
     • Adds support for the NTOPNG log type without a default parser
     • Adds support for the OPNSENSE log type without a default parser
     • Adds support for the ORACLE_HCM log type without a default parser
     • Adds support for the POWERSHELL_TRANSCRIPT log type without a default parser
     • Adds support for the RAD_ETX log type without a default parser
     • Adds support for the SPAMHAUS log type without a default parser
     • Adds support for the UPGUARD log type without a default parser
     • Adds support for the VSFTPD log type without a default parser

     15 details in Everything

200. October 05, 2023 Oct 5, 2023 · release notes

     Google SecOps adds Azure App Gateway, IBM SIM, Jamf Pro, Raritan, PAN IoTIoTA collective label for internet-connected physical devices — sensors, cameras, routers, appliances — that tools target because they run embedded firmware with limited patching and broad network exposure. and other new log type support in Oct 05, 2023 release.

     • Adds AZURE_GATEWAY log_type for Azure Application Gateway to the supported log types list; no default parser is included.
     • Adds IBM_SIM log_type for IBM Security Identity Manager to the supported log types list; no default parser is included.
     • Adds JAMF_PRO_MDM log_type for Jamf Pro MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. to the supported log types list; no default parser is included.
     • Adds RARITAN_DOMINION log_type for Raritan Dominion SX II to the supported log types list; no default parser is included.
     • Adds PAN_IOT log_type for Palo Alto Networks IoT Security to the supported log types list; no default parser is included.

     +1 more show less

     • Adds AWS_EMR, CLOUDBOLT, DNSFILTER, GITGUARDIAN_ENTERPRISE, GOANYWHERE_MFT, and MULTIPAY log types without default parsers.

     6 details in Everything

201. October 03, 2023 Oct 3, 2023 · release notes

     New left-side navigation menu replaces top-right icon in Chronicle SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. UI.

     • Replaces the 9-dot icon with a new expandable left-side navigation menu for easier access to commonly used features
     • Makes Reference Lists accessible from the Search page or Rules Editor page.

     2 details in Everything

202. September 19, 2023 Sep 19, 2023 · release notes

     New fetchFeedServiceAccount API endpoint and UI field for GCS feed service accounts.

     • Adds fetchFeedServiceAccount method to the feed management API
     • Adds Get service account field in the Chronicle feed management UI

     2 details in Everything

203. August 24, 2023 Aug 24, 2023 · release notes

     Chronicle rules engine now reports warnings for YARA-L 2.0YARA-L 2.0A rule language developed by Google for writing detection logic in Chronicle SIEM, extending YARA syntax to match sequences of log events over time rather than static file patterns. syntax that may cause unexpected behavior.

     • Adds warnings output to the YARA-LYARA-LA rule language developed by Google for Chronicle that extends YARA syntax to express multi-event, time-windowed detections over log data rather than single-file pattern matching. 2.0 compiler for syntactically valid rules with potential runtime risks
     • Enables viewing and expanding warnings in the Rules Editor alongside errors
     • Supports detection of multi-event non-distinct outcome section aggregations as a warning condition
     • Supports detection of deprecated UDM fields or enum values as a warning condition

     4 details in Everything

204. August 16, 2023 Aug 16, 2023 · release notes

     Chronicle YARA-L 2.0YARA-L 2.0A rule language developed by Google for writing detection logic in Chronicle SIEM, extending YARA syntax to match sequences of log events over time rather than static file patterns. rules now support float literals and unlimited arguments in concat/coalesce functions.

     • float literals are supported in YARA-LYARA-LA rule language developed by Google for Chronicle that extends YARA syntax to express multi-event, time-windowed detections over log data rather than single-file pattern matching. 2.0 rule expressions

     1 detail in Everything

205. August 10, 2023 Aug 10, 2023 · release notes

     UDM Search adds UDM Lookup to find fields and Event Viewer labels enriched/unenriched data icons.

     • Adds UDM Lookup feature in UDM Search to quickly find a UDM field by text string in name or specific value stored.
     • Adds U (unenriched) and E (enriched) icon labels to each UDM field when viewing an event in Event Viewer.

     2 details in Everything

206. July 27, 2023 Jul 27, 2023 · release notes

     Begins rolling out self-service parser management and pending parser-update visibility to direct Chronicle customers.

     • Begins enabling direct Chronicle customers to create and customize parsers through self-service parser management.
     • Displays pre-release default parsers on the Parsers page as Pending updates

     2 details in Everything

207. July 12, 2023 Jul 12, 2023 · release notes

     Chronicle Curated Detections adds Linux threat rules for AuditD and Unix Syslog.

208. July 10, 2023 Jul 10, 2023 · release notes

     Self Service Parser Management allows customers to create and customize UDM parsers.

     • Introduces Self Service Parser Management feature enabling creation and customization of log parsers for the Unified Data Model

     1 detail in Everything

209. July 06, 2023 Jul 6, 2023 · release notes

     UDM Events Explore enhancements include instant search results, consistent field naming, in-context descriptions, and enum/timestamp format improvements.

     • Udm Events Principal Hostname is now displayed as UDM principal.hostname to align with Detection Engine rules
     • Deprecated UDM fields are now indicated by the [D] suffix in field names for easy identification
     • Enum fields such as UDM.network.ip_protocol now display human-readable values (e.g., ICMP, TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it., UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery.) instead of numeric codes
     • Timestamp fields are now available in multiple date formats beyond nano and second
     • Location fields are parsed accurately and can be used in maps within UDM Events Explore

     5 details in Everything

210. July 05, 2023 Jul 5, 2023 · release notes

     Rules now support arithmetic expressions and cross-referencing outcome variables in rule configurations

     • Adds Outcome field support for arithmetic expressions, including aggregations, event fields, constants, and other outcome variables.
     • Enables deriving one Outcome variable's value from another within the same rule configuration.

     2 details in Everything

211. June 29, 2023 Jun 29, 2023 · release notes

     Google SecOps adds Israel (Tel Aviv) region and new API endpoint me-west1-backstory.googleapis.com

     └──▷ TRY IT
     Use the Chronicle API endpoint for the Tel Aviv region.
     copy

     $ https://me-west1-backstory.googleapis.com

     • Supports Google SecOps data storage in the new Israel (Tel Aviv) region for Chronicle customers.
     • Adds a new regional API endpoint https://me-west1-backstory.googleapis.com for Chronicle services.

     2 details in Everything

212. June 22, 2023 Jun 22, 2023 · release notes

     Dashboard sharing between instances/users and rule exclusions for Curated Detections

     • Adds dashboard sharing capability to share dashboard files between instances or users without manual copying
     • Adds rule exclusion support to tune alerts returned by Curated Detections, replacing predefined reference lists

     2 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Predefined reference lists for Curated Detections in Cloud Threats and Windows Threats categories are removed; empty lists deleted, non-empty migrated to rule exclusions
213. June 16, 2023 Jun 16, 2023 · release notes

     Google SecOps adds GCTI Remote Access Tools data source for threat investigation.

214. June 09, 2023 Jun 9, 2023 · release notes

     UDM Search adds support for querying bytes fields via base64 encoded literals

     • Adds bytes field type support in UDM Search, allowing queries on byte-literal fields like network.dhcp.client_identifier

     1 detail in Everything

215. June 06, 2023 Jun 6, 2023 · release notes

     June 06, 2023 release adds Entity/Metric types and new Enumerated types to Google SecOps Unified Data Model.

     • Adds risk_score and metric fields to Entity in the Unified Data Model
     • Adds event_metadata field to EntityMetadata in the Unified Data Model
     • Adds EntityRisk, Metric, RiskDelta, and Metric.Measure types to Entity
     • Adds AttackDetails, ExifInfo, FileMetadataCodesign, FileMetadataPE, FileMetadataSignatureInfo, PDFInfo, and SignatureInfo types to Event
     • Adds Tactic, Technique, SecurityResult.Association, SecurityResult.Source, SecurityResult.ProviderMLVerdict, SecurityResult.AnalystVerdict, and SecurityResult.Verdict nested types under Event structures

     +13 more show less

     • Adds new enumerated types Metric.AggregateFunction, Metric.Dimension, Metric.MetricName, and Relation.EntityLabel
     • Adds enumerated types Process.TokenElevationType, SecurityResult.VerdictResponse, and SecurityResult.Association.AssociationType
     • Adds entity_label field to Relation in the Unified Data Model
     • Adds METRIC value to EntityMetadata.EntityType enumerated type
     • Adds log_type, base_labels, and enrichment_labels fields to Event.Metadata
     • Adds security_result and network fields to Noun in the Unified Data Model
     • Adds risk_score, attack_details, first_discovered_time, associations, campaigns, and verdicts fields to SecurityResult
     • Adds pe_file, tags, last_analysis_time, embedded_urls, embedded_domains, embedded_ips, exif_info, and signature_info fields to File
     • Adds integrity_level_rid and token_elevation_type fields to Process
     • Adds status, valid_usage, and cert_issuer fields to SignerInfo
     • Adds new enumerated type values DEVICE_FIRMWARE_UPDATE, DEVICE_CONFIG_UPDATE, DEVICE_PROGRAM_UPLOAD, and DEVICE_PROGRAM_DOWNLOAD to EventTypes
     • Adds CIP, COTP, DNP3DNP3A serial and TCP/IP communication protocol used in industrial control systems, especially power grids and water utilities, to let control software poll and command field devices like sensors and switches., DICOMDICOMAn open standard for storing and transmitting medical imaging data, maintained by NEMA, that defines both the file format and network protocol used to exchange scans between clinical systems., GOOSE, IEC104, MMSMMSMultimedia Messaging Service, a mobile carrier protocol that extends SMS to carry images, audio, and video between handsets; cyber tools use it to analyze or simulate rich-media mobile message delivery., PTP, SNMPSNMPA UDP-based protocol for querying and managing network devices, standardized by the IETF. Cyber tools use it to pull interface stats, topology data, and device state from routers, switches, and servers at scale., and SV values to ApplicationProtocol enumerated type
     • Adds ICMP and SCTPSCTPA transport-layer protocol (RFC 4960) maintained by the IETF that delivers messages with optional ordering and built-in multi-homing, giving cyber tools reliable framing without TCP's head-of-line blocking. to the Network.IpProtocol enumerated type

     18 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The Resource.id field is deprecated; use resource.name or resource.product_object_id instead
216. June 01, 2023 Jun 1, 2023 · release notes

     Google SecOps adds Overview/History tabs to Alert view, Risk Score/Tags columns, and AND/OR filters.

     • Adds Overview and Alert History tabs to the Alert view, separating investigation snapshots from audit history
     • Adds Risk Score and Tags columns to the Alert list for prioritization
     • Adds Ingestion Time and Last Modified columns to the Alert list
     • Enables AND/OR operators in Alert list filters for complex queries
     • Allows users to customize columns (add/remove) in the Alert list table

     +1 more show less

     • Adds a View other alerts from this rule button in the Detection widget of the Alert view

     6 details in Everything

217. May 25, 2023 May 25, 2023 · release notes

     Chronicle introduces new events table in BigQueryBigQueryA serverless, cloud-hosted analytical database from Google that runs SQL queries across massive datasets without managing infrastructure, giving cyber tools scalable storage and fast querying over large volumes of log or event data. to replace udm_events

218. May 24, 2023 May 24, 2023 · release notes

     Chronicle Curated Detections adds Cloud SQL Ransom rule and YARA-L 2.0YARA-L 2.0A rule language developed by Google for writing detection logic in Chronicle SIEM, extending YARA syntax to match sequences of log events over time rather than static file patterns. arrays.length() function with bracket indexing

     • Adds Cloud SQL Ransom to Chronicle Curated Detections for detecting exfiltration or ransom activity in Cloud SQL databases.
     • Adds arrays.length() function to the YARA-LYARA-LA rule language developed by Google for Chronicle that extends YARA syntax to express multi-event, time-windowed detections over log data rather than single-file pattern matching. 2.0 language runtime to return element count of repeated fields.
     • Enables bracket notation array indexing on repeated fields in YARA-L 2.0, allowing access to elements at specific indices.

     3 details in Everything

219. May 04, 2023 May 4, 2023 · release notes

     Chronicle detection engine adds arithmetic ops, new coalesce() function, case-insensitive keywords, and expanded reference list limits.

     • Adds multiplication and division support in the events section and outcome section of YARA-LYARA-LA rule language developed by Google for Chronicle that extends YARA syntax to express multi-event, time-windowed detections over log data rather than single-file pattern matching. rules
     • Adds a new coalesce() function to the YARA-L syntax that returns the first non-empty string passed to it
     • Makes keywords such as and, match, or condition case-insensitive in YARA-L 2.0YARA-L 2.0A rule language developed by Google for writing detection logic in Chronicle SIEM, extending YARA syntax to match sequences of log events over time rather than static file patterns.
     • Increases the maximum number of lines for Regex type reference lists to 100 and for CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. type reference lists to 150
     • Increases the maximum number of statements in a rule that evaluate a reference list from 2 to 4

     5 details in Everything

220. May 01, 2023 May 1, 2023 · release notes

     UDM Search Pivot Table adds grouping by 5 UDM fields and aggregations on up to 5 values

221. April 25, 2023 Apr 25, 2023 · release notes

     Chronicle forwarder for Windows on Docker introduces hot config loading, default data compression, and increased minimum batch size.

     • Adds hot config loading to apply configuration changes within 5 minutes without restarting the forwarder
     • Enables data compression by default, reducing network bandwidth consumption by 80%
     • Increases the minimum batch size for the forwarder to 200KB

     3 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The legacy Chronicle forwarder executable for Windows is deprecated and scheduled for shutdown on March 31, 2024
     • !You must update the Chronicle forwarder for Windows on Docker image every 6 months as the signing key rotates
222. April 21, 2023 Apr 21, 2023 · release notes

     Chronicle forwarder for Linux adds automatic configuration reload and default data compression.

     • For the Linux forwarder, changes to <FORWARDER_NAME>.conf or <FORWARDER_NAME>_auth.conf apply automatically within five minutes without restarting the container.
     • Enables data compression by default, reducing network bandwidth consumption by 80%
     • Increases minimum batch size to 200 KB for better performance

     3 details in Everything

223. April 19, 2023 Apr 19, 2023 · release notes

     New WHOIS, VirusTotal, and Google Threat Intel enrichment capabilities; precomputed first/last seen metrics for entities.

     • Adds WHOIS data enrichment to entities
     • Adds VirusTotal relationship data enrichment to entities
     • Adds VirusTotal file metadata enrichment to events
     • Ingests data from Google Cloud Threat Intelligence curated threat feeds
     • Provides precomputed first-seen and last-seen occurrence for domains, IP addresses, and file hashes (SHA256SHA256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data., SHA1, MD5)

     +1 more show less

     • Provides precomputed first-seen occurrence for assets and users

     6 details in Everything

224. April 14, 2023 Apr 14, 2023 · release notes

     UDM saved searches now support placeholder variables for reusable queries

     • Adds $<variable name> placeholder variable support to UDM saved searches

     1 detail in Everything

225. April 03, 2023 Apr 3, 2023 · release notes

     Adds Australia (Sydney) region support and australia-southeast1-backstory.googleapis.com API endpoint to Google SecOps Chronicle

     └──▷ TRY IT
     Configure Chronicle clients to route requests to the new Sydney regional endpoint.
     copy

     $ https://australia-southeast1-backstory.googleapis.com/

     • Supports data storage in the new Australia (Sydney) region for Chronicle customers
     • Adds a new regional API endpoint at https://australia-southeast1-backstory.googleapis.com/

     2 details in Everything

226. March 30, 2023 Mar 30, 2023 · release notes

     Google SecOps adds Grouped Fields to UDM Search for querying multiple related fields simultaneously.

     • Adds support for Grouped fields (aliases for groups of related UDM fields) in UDM Search, enabling queries across multiple fields without listing each individually
     • Enables matching grouped fields using regular expressions and the nocase operator
     • Integrates Reference lists support with grouped fields

     3 details in Everything

227. March 23, 2023 Mar 23, 2023 · release notes

     SentinelOne Alert feed now supports ingesting only threats via a new configuration option

     • Adds isAlertApiSubscribed when creating a SentinelOne feed: true ingests alerts and threats for customers subscribed to SentinelOne alerts; false ingests threats only.

     1 detail in Everything

228. March 09, 2023 Mar 9, 2023 · release notes

     SentinelOne Alert feed now ingests threats in addition to alerts

229. March 01, 2023 Mar 1, 2023 · release notes

     Adds scheduled email delivery for Chronicle dashboards and expanded Qualys VM log support.

     • Adds ability to schedule Chronicle dashboard reports (default and custom) via email with configurable interval, format, pagination, and test delivery
     • Adds support for Qualys VM Detections API in Feed Management

     2 details in Everything

230. February 17, 2023 Feb 17, 2023 · release notes

     Google SecOps Feb 17, 2023: udmSearch limit increases and comment/float support

     • Adds udmSearch comment syntax (single-line and block) for clearer query maintenance.
     • Enables filtering by float and bool types in UDM search queries.
     • Increases udmSearch QPH limit from 60 to 120, doubling capacity for high-volume investigations.

     3 details in Everything

231. February 15, 2023 Feb 15, 2023 · release notes

     February 15, 2023 update modifies default parsers for supported cyber tooling

     • Updates the default parsers for numerous supported integrations including AWS GuardDuty (GUARDDUTY), Azure AD Directory Audit (AZURE_AD_AUDIT), and Windows Event (WINEVTLOG).

     1 detail in Everything

232. February 09, 2023 Feb 9, 2023 · release notes

     Adds up to 20 named outcome variables for YARA-LYARA-LA rule language developed by Google for Chronicle that extends YARA syntax to express multi-event, time-windowed detections over log data rather than single-file pattern matching. rules and new Python ingestion script templates for Chronicle.

     • YARA-L outcomes now support up to 20 outcome variables with arbitrary names
     • New Python ingestion scripts for Aruba Central, Azure Event Hub, Cloud Storage, Proofpoint, Tenable.io, Trend Micro Cloud App Security, and Trend Micro Vision One audit logs

     2 details in Everything

233. January 31, 2023 Jan 31, 2023 · release notes

     Chronicle Curated Detections add HTTP User Agent exclusion lists and new GeoIPGeoIPA database that maps IP addresses to geographic locations; tools use it to attribute traffic or alerts to countries, cities, or ASNs without querying external services. enrichment for external IPs

     • Adds gcti__cld__admin_action__network_http_user_agent__exclusion_list to the Admin Action rule set in The Chronicle Curated Detections > Cloud Threats policy to exclude events based on HTTP User Agent string
     • Adds gcti__cld__iamabuse__network_http_user_agent__exclusion_list to the IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. Abuse rule set in The Chronicle Curated Detections > Cloud Threats policy to exclude events based on HTTP User Agent string
     • Enables geolocation data enrichment (GeoIP data) for external IP addresses using Google location data to provide approximate geographic context

     3 details in Everything

234. January 30, 2023 Jan 30, 2023 · release notes

     Google SecOps adds File stat fields, updates Unified Data Model Software object, deprecates legacy Location fields

     • Adds File.stat_mode, File.stat_inode, File.stat_dev, File.stat_nlink, and File.stat_flags fields to the Unified Data Model
     • Adds Software.description and Software.vendor_name fields to the Unified Data Model Software object

     2 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Location.region_latitude and Location.region_longitude are deprecated; use Location.region_coordinates.latitude and Location.region_coordinates.longitude instead.
     • !Noun.ip_location is deprecated; use Noun.ip_geo_artifact.location instead.
235. January 20, 2023 Jan 20, 2023 · release notes

     Google SecOps Jan 2023 adds Detection Engine API methods for curated rules and new Unified Data Model fields.

     • Adds ListCuratedRules method to the Detection Engine API to list all Chronicle rules with detections
     • Adds ListCuratedRuleDetections method to the Detection Engine API to list detections for a specific rule
     • Adds source_labels field to EntityMetadata in the Unified Data Model
     • Adds enrichment_state field to event.metadata in the Unified Data Model
     • Adds ip_geo_artifact field to Noun in the Unified Data Model

     +6 more show less

     • Adds parsed_user_agent field to network.http in the Unified Data Model
     • Adds Metadata.EnrichmentState enumerated list type to the Unified Data Model
     • Adds Artifact type to the Unified Data Model
     • Adds EXECUTES, DOWNLOADED_FROM, and CONTACTS values to relation.relationship enumerated list
     • Adds IOS, ANDROID, and CHROME_OS values to Noun.Platform enumerated list
     • Adds TOR_EXIT_NODE value to SecurityResult.SecurityCategory enumerated list

     11 details in Everything

236. January 19, 2023 Jan 19, 2023 · release notes

     New Python ingestion scripts added for Citrix, Duo, OneLogin, MISP, Slack, Box, and STIXSTIXStructured Threat Information Expression, a standard format for describing threats, indicators and their relationships. It helps organizations exchange threat intelligence in a usable form. via Cloud Functions

     • Adds CITRIX_MONITOR ingestion script for Citrix audit logs deployed as Cloud Functions
     • Adds DUO_ADMIN ingestion script for Duo Admin events deployed as Cloud Functions
     • Adds ONELOGIN_USER_CONTEXT ingestion script for One Login User Context data deployed as Cloud Functions
     • Adds MISP_IOC ingestion script for MISP threat intelligence indicators deployed as Cloud Functions
     • Adds CITRIX_SESSION_METADATA ingestion script for Citrix session metadata deployed as Cloud Functions

     +4 more show less

     • Adds SLACK_AUDIT ingestion script for Slack Audit logs deployed as Cloud Functions
     • Adds BOX ingestion script for Box event data deployed as Cloud Functions
     • Adds ONELOGIN_SSO ingestion script for OneLogin SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. logs deployed as Cloud Functions
     • Adds STIX ingestion script for Google Cloud Pub/Sub STIX/TAXIISTIX/TAXIISTIX is an OASIS-maintained JSON schema for expressing threat intelligence objects; TAXII is the companion HTTP protocol for exchanging them, giving cyber tools a vendor-neutral way to share indicators and threat data. threat intelligence deployed as Cloud Functions

     9 details in Everything

237. January 10, 2023 Jan 10, 2023 · release notes

     UDM Search adds pre-made templates, shared searches, and reference lists.

     • Adds Chronicle-provided pre-made search templates in Quick Searches and Search Manager
     • Enables creating, editing, and sharing searches in Search Manager
     • Supports use of reference lists in UDM searches

     3 details in Everything

238. January 06, 2023 Jan 6, 2023 · release notes

     Google SecOps (Chronicle) enhanced its Curated Detections with a new detection rule for Windows threats.

239. December 16, 2022 Dec 16, 2022 · release notes

     Increases active rule limit to 500 (75 multi-event) in Google SecOps Chronicle

     • Enables up to 500 active rules within your Chronicle account

     1 detail in Everything

240. December 08, 2022 Dec 8, 2022 · release notes

     UDM Search adds bottom values filtering, field pinning, layout saving, and special character escaping

     └──▷ HOW TO FIND IT
     Search for exact key-value matches in additional or labels fields.
     📍field[key] = value
     • field[key] = value exact match syntax for searching additional and labels fields in UDM Search results
     • Pin fields using the push pin icon in Quick Filter to save favorites at the top of the list
     • Save and load column layouts in UDM Search
     • Escape special characters with backslashes and double-quotes in UDM Search queries

     4 details in Everything

241. November 15, 2022 Nov 15, 2022 · release notes

     November 15, 2022 release adds UDM Search capabilities and enhanced Reference List types (REGEX, CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network.) to Google SecOps.

     • Introduces UDM Search, a new search feature for Chronicle enabling navigation of UDM events with Quick Filters, Event Viewer, and Search Manager
     • Adds a new UDM search API method to the Chronicle Search API
     • Enables REGEX and CIDR list types for Reference Lists in Detection Engine rules, alongside the existing STRING type

     3 details in Everything

242. November 10, 2022 Nov 10, 2022 · release notes

     Chronicle Curated Detections adds Windows-based threats and cloud threat coverage.

     • Adds Security Posture Downgrade detection for activity attempting to disable or decrease the effectiveness of security tools.
     • Adds Suspicious Behavior detection for uncommon and suspicious activity in cloud environments.
     • Adds Service Disruption detection for destructive actions that may cause significant outages.
     • Adds Suspicious Infrastructure Change detection for modifications to production infrastructure aligning with known persistence tactics.

     4 details in Everything

243. November 09, 2022 Nov 9, 2022 · release notes

     New unified Alerts and IOCsIOCsAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. page with SOARSOARSecurity orchestration, automation and response, coordinating incident workflows across tools. Playbooks can gather evidence, assign work or carry out approved response actions. case pivot authentication

     • Adds the Alerts and IOCs page to centralize alert and IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. visibility for the enterprise

     1 detail in Everything

244. November 07, 2022 Nov 7, 2022 · release notes

     Chronicle Feed Management now supports Sentinel One Alerts API. CSV downloads from the UI no longer include raw log data unless Raw Log Scan is used.

     • Added support for the Sentinel One Alerts API as a new feed source in Chronicle Feed Management
     • Updated Chronicle user interface so that downloading events to CSV excludes raw log data (requires Raw Log Scan)

     2 details in Everything

245. November 02, 2022 Nov 2, 2022 · release notes

     StreamDetectionAlerts API now returns both user-created and Chronicle Curated Detections

246. October 31, 2022 Oct 31, 2022 · release notes

     Chronicle Feed Management adds hostname configuration and API support for Azure AD and Office 365 log types.

     • Adds hostname field to the Chronicle Feed Management configuration workflow for AzureAD, AzureADAudit, AzureADContext, AzureMDMIntune, MicrosoftGraphAlert, MicrosoftSecurityCenterAlert, and Office365 log types.
     • Updates the Chronicle Feed Management API to accept the hostname field for the supported log types listed above.

     2 details in Everything

247. October 13, 2022 Oct 13, 2022 · release notes

     Adds the Chronicle CLI and key-value field access in Detection Engine rules through map syntax.

     • Adds the Chronicle CLI to provide a text-based interface for all user workflows

     1 detail in Everything

248. October 06, 2022 Oct 6, 2022 · release notes

     Adds configurable Rapid7 Insight hostname for feed management

     • Adds hostname field to the Rapid7 Insight configuration workflow to set a custom API endpoint instead of the default us.api.insight.rapid7.com

     1 detail in Everything

249. October 04, 2022 Oct 4, 2022 · release notes

     Google SecOps adds Chronicle Curated Detections for Windows LotL, Cloud Hacktool, and IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. Abuse

     • Adds detection content for Windows-based threats using Living off the land (LotL) techniques
     • Adds detection content for Cloud Hacktool activity targeting Google Cloud resources
     • Adds detection content for IAM Abuse within Google Cloud projects or organizations

     3 details in Everything

250. September 29, 2022 Sep 29, 2022 · release notes

     New UDM fields risk_score, data_tap_config_name, network packet metrics, and enum values for challenge/risk updates

     • risk_score field added to Noun.investigation in the Unified Data Model
     • data_tap_config_name field added to Event.metadata.tags in the Unified Data Model
     • New fields application_protocol_version, sent_packets, and received_packets added to Network in the Unified Data Model
     • ENUM value CHALLENGE added to SecurityResult.Action in the Unified Data Model
     • ENUM value ANALYST_UPDATE_RISK_SCORE added to Metadata.EventType in the Unified Data Model

     5 details in Everything

251. September 26, 2022 Sep 26, 2022 · release notes

     Chronicle introduces Context Aware Detections risk dashboard and contextual enrichment for events/entities

     • Enables contextual enrichment in events and entities by calculating prevalence statistics and ingesting Safe Browsing threat list data for file hashes

     1 detail in Everything

252. September 21, 2022 Sep 21, 2022 · release notes

     Chronicle Search API adds ListAssetAliases and ListUserAliases methods

     • Adds ListAssetAliases API method to list all aliases of an asset in an enterprise
     • Adds ListUserAliases API method to list all aliases of a user in an enterprise

     2 details in Everything

253. September 01, 2022 Sep 1, 2022 · release notes

     Google SecOps adds ip_location, day_max_sub_domains, and source_type fields to UDM

     • Adds ip_location field to the Noun type in the Unified Data Model
     • Adds day_max_sub_domains field to the Prevalence type in the Unified Data Model
     • Adds source_type field to the EntityMetadata type in the Unified Data Model

     3 details in Everything

254. August 18, 2022 Aug 18, 2022 · release notes

     Enhanced Google SecOps integration with VirusTotal via VT Context pivot.

     • Adds VT Context button in Chronicle's Asset, Domain, and IP Address views to pivot directly to VirusTotal data Some VirusTotal information requires a VirusTotal Enterprise account.
     • Removes older VirusTotal links including the first 50 results graph option and Insights panel from Asset view

     2 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Removed access to older VirusTotal links such as the 'first 50 results in VirusTotal Graph' option and the VirusTotal Insights results panel in Asset view
255. August 17, 2022 Aug 17, 2022 · release notes

     Google SecOps adds Chronicle curated detections for Windows threats, cloud misconfigurations, and updates supported default parsers.

     • Adds Chronicle curated detections — out-of-the-box threat detection content built by Google Cloud Threat Intelligence (GCTI) researchers
     • Adds coverage for Windows-based threats including infostealers, ransomware, RATs, misused software, and crypto activity
     • Adds coverage for cloud attacks and misconfigurations including data exfiltrationdata exfiltrationMoving data out of a system or organization without authorization. It can happen through network transfers, removable media or other channels., suspicious behavior, and additional vectors
     • Updates supported default parsers including Akamai WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server., AWS CloudWatch, Azure AD, and Windows Sysmon.

     4 details in Everything

256. August 16, 2022 Aug 16, 2022 · release notes

     Chronicle now allows self-service data feed configuration via Feed Management UI or API.

     • Adds the Feed Management user interface for configuring new data feeds in your Chronicle account without support assistance
     • Adds the Feed Management API endpoint to programmatically configure and manage new data feeds

     2 details in Everything

257. July 29, 2022 Jul 29, 2022 · release notes

     Detection Engine supports outcome sections in single-event rules and outcome variables in conditions.

     • outcome section supported in single-event rules (previously multi-event only)
     • Variables defined in the outcome section can now be used in the condition section
     • Placeholder variable syntax for function call results available in match, outcome, and condition sections

     3 details in Everything

258. July 28, 2022 Jul 28, 2022 · release notes

     Google SecOps adds new UDM fields for investigation context, protocol support, and security categorization

     • Adds the id field to the Event.metadata type in the Unified Data Model.
     • Adds priority, root_cause, and reason fields to Investigation type for richer incident context.
     • Adds rule_set and rule_set_display_name fields to SecurityResult type for improved alert traceability.
     • Adds DCERPC and KRB5 values to Network.ApplicationProtocol to support specific protocol detection in UDM.
     • Adds SOCIAL_ENGINEERING and PHISHING values to SecurityResult.SecurityCategory for specialized threat classification.

     +1 more show less

     • Adds new enumerated types Priority, Reason, and OPEN status value to expand investigation state modeling.

     6 details in Everything

259. July 06, 2022 Jul 6, 2022 · release notes

     Adds UDM fields for files, email, users, SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure. and Noun, plus the new Artifact object.

     • Adds prevalence, first_seen_time, and last_seen_time fields to the File object in the Unified Data Model
     • Adds bounce_address field to the Email object
     • Adds an artifact field to the existing Noun object; Artifact is a new object.
     • Adds rolling_max_sub_domains field to the Prevalence object
     • Adds first_seen_time field to the User object

     +1 more show less

     • Adds helo, mail_from, rcpt_to, server_response, message_path, is_webmail, and is_tls fields to the Smtp object

     6 details in Everything

260. June 29, 2022 Jun 29, 2022 · release notes

     Chronicle Forwarder on Linux now uses separate log ingestion and auth config files.

     • Adds <x>.conf file to store Chronicle Forwarder configuration related to log ingestion
     • Adds <x>_auth.conf file to store authentication credentials for the Chronicle Forwarder

     2 details in Everything

261. June 14, 2022 Jun 14, 2022 · release notes

     YARA-L 2.0YARA-L 2.0A rule language developed by Google for writing detection logic in Chronicle SIEM, extending YARA syntax to match sequences of log events over time rather than static file patterns. detection rules gain integer/string outcomes, 10-variable limit, and new aggregate functions

     • Adds support for up to 10 outcome variables in YARA-LYARA-LA rule language developed by Google for Chronicle that extends YARA syntax to express multi-event, time-windowed detections over log data rather than single-file pattern matching. 2.0 Detection Engine rules
     • Allows integer and string data types for outcome variables in YARA-L 2.0 rules
     • Introduces count(), count_distinct(), array(), and array_distinct() aggregate functions for YARA-L 2.0

     3 details in Everything

262. April 27, 2022 Apr 27, 2022 · release notes

     Chronicle Detection Engine gains new string, regex, timestamp and math functions for YARA-LYARA-LA rule language developed by Google for Chronicle that extends YARA syntax to express multi-event, time-windowed detections over log data rather than single-file pattern matching. rules

     • Adds strings.concat, strings.to_lower, strings.to_upper, and strings.base64_decode functions to YARA-L 2.0YARA-L 2.0A rule language developed by Google for writing detection logic in Chronicle SIEM, extending YARA syntax to match sequences of log events over time rather than static file patterns. Detection Engine rules
     • Adds re.capture and re.replace regex functions to YARA-L 2.0 Detection Engine rules
     • Adds timestamp.get_minute, timestamp.get_hour, timestamp.get_day_of_week, timestamp.get_week, and timestamp.current_seconds timestamp functions to YARA-L 2.0 Detection Engine rules
     • Adds math.abs function to YARA-L 2.0 Detection Engine rules

     4 details in Everything

263. April 25, 2022 Apr 25, 2022 · release notes

     Detection rules gain configurable run frequencies that affect detection latency.

     • Rules can run at different frequencies. Rules with a window of at least one hour are limited to one-hour or 24-hour run frequencies.

     1 detail in Everything

264. April 07, 2022 Apr 7, 2022 · release notes

     Google SecOps April 07, 2022 release introduces visibility into exported Google Cloud Logs and Asset Metadata.

     • Introduces lists of specific Google Cloud Logs and Google Cloud Asset Metadata exported to Chronicle upon enabling Google Cloud log ingestion.

     1 detail in Everything

265. February 15, 2022 Feb 15, 2022 · release notes

     Chronicle RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. API gains DeleteSubject method for removing role assignments

266. December 14, 2021 Dec 14, 2021 · release notes

     Adds role-based access controlrole-based access controlRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. (RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists.) to tailor access to Google SecOps features.

267. December 08, 2021 Dec 8, 2021 · release notes

     Google SecOps adds configurable reporting formats for dashboards

     • Adds the ability to convert dashboards to shareable files in PDF, Excel, and CSV formats
     • Introduces custom personal and shared dashboard support alongside default monitoring views

     2 details in Everything

268. October 15, 2021 Oct 15, 2021 · release notes

     Chronicle's Detection Engine API now supports efficient listing of detections across multiple rule versions using timestamp filters.

269. September 22, 2021 Sep 22, 2021 · release notes

     Linux Forwarder now supports load balancing and high-availability deployments behind a Layer 4 LB

     • Adds load balancing and high-availability support to the Linux Forwarder for syslog data sources

     1 detail in Everything

270. July 13, 2021 Jul 13, 2021 · release notes

     Google SecOps adds documentation on Chronicle supported default parsers for ingestion planning

271. July 01, 2021 Jul 1, 2021 · release notes

     Google SecOps July 2021 adds asset namespaces for search, Linux Forwarder disk buffering, regex filters, arbitrary labels, Kafka input, and namespace support.

     • Adds asset namespaces feature to classify assets by network environment and search by namespace in the Chronicle UI
     • Adds disk buffering capability to the Linux Forwarder to store backlogged messages on disk instead of memory
     • Adds regular expression filters to the Linux Forwarder to filter logs based on regex matches
     • Adds support for arbitrary labels (key-value pairs) on logs in the Linux Forwarder
     • Adds namespace label support in the Linux Forwarder to identify logs from distinct network segments and deconflict overlapping IPs

     +1 more show less

     • Adds Kafka input capability to the Linux Forwarder, supporting consumer groups for up to 3 Forwarders pulling from the same topic

     6 details in Everything

272. June 30, 2021 Jun 30, 2021 · release notes

     Chronicle adds CSV export for threat detection events

     • Adds ability to download event data for threat detections as a CSV file

     1 detail in Everything

273. June 28, 2021 Jun 28, 2021 · release notes

     Google SecOps adds VerifyRule method to Detection Engine API for validating YARA-L 2.0YARA-L 2.0A rule language developed by Google for writing detection logic in Chronicle SIEM, extending YARA syntax to match sequences of log events over time rather than static file patterns. rules

274. June 21, 2021 Jun 21, 2021 · release notes

     Chronicle customers with Uppercase access can view Uppercase alerts, provide feedback, and retrieve alerts through the API.

     • Enterprise Insights page now includes a dedicated Uppercase Alert view displaying alerts derived from Google's internal threat detection and Uppercase security analysts research. Available to Chronicle customers who are also Uppercase customers.

     1 detail in Everything

275. June 01, 2021 Jun 1, 2021 · release notes

     Google SecOps adds automatic ingestion of Google Cloud Audit and DNS logs into Chronicle

     • Enables Google Cloud customers to send Cloud Audit and Cloud DNS logs directly to their Chronicle account.

     1 detail in Everything

276. April 23, 2021 Apr 23, 2021 · release notes

     Chronicle adds ingestion support for Aruba Airwave, Blue Coat, Citrix, Intune, and 18 other data sources.

277. January 25, 2021 Jan 25, 2021 · release notes

     Google SecOps introduces Chronicle Detection Engine with YARA-L 2.0YARA-L 2.0A rule language developed by Google for writing detection logic in Chronicle SIEM, extending YARA syntax to match sequences of log events over time rather than static file patterns. support and programmatic API access

     • Enables automation of security issue detection by allowing customers to specify Rules that search across enterprise data and trigger notifications for potential or known threats
     • Integrates the Chronicle Detection Engine directly within the Chronicle UI, providing a dedicated Rules Dashboard for monitoring Rule activity and a Rules Editor for creating, testing, and activating new Rules
     • Provides the Chronicle Detection Engine API to enable programmatic modification and operation of all Detection Engine functionality available in the UI
     • Introduces YARA-LYARA-LA rule language developed by Google for Chronicle that extends YARA syntax to express multi-event, time-windowed detections over log data rather than single-file pattern matching. 2.0 as the rule specification language for the Detection Engine

     4 details in Everything

278. June 12, 2020 Jun 12, 2020 · release notes

     Adds StreamRuleNotifications for continuous HTTP results and ingestion support for additional identity, cloud, network, and server data sources.

     • Adds StreamRuleNotifications method to the Chronicle Rules Engine API for continuous HTTP stream results
     • Adds data ingestion support for OpenAM (Access Management)
     • Adds data ingestion support for ManageEngine ADAudit Plus (Audit)
     • Adds data ingestion support for Preempt (Authentication)
     • Adds data ingestion support for Symantec SiteMinder (Authentication)

     +12 more show less

     • Adds data ingestion support for Thycotic (Authentication)
     • Adds data ingestion support for Honeywell Pro-Watch (Badging)
     • Adds data ingestion support for Microsoft Cloud Access Security Broker (CASBCASBA Cloud Access Security Broker is a policy-enforcement proxy, on-premises or cloud-hosted, that sits between users and cloud services to provide visibility, compliance controls, and threat protection over SaaS and IaaS traffic.) (Cloud)
     • Adds data ingestion support for Salesforce (Cloud)
     • Adds data ingestion support for Linux DHCP Server (DHCP)
     • Adds data ingestion support for VMware ESXi JSON (Hypervisor)
     • Adds data ingestion support for Juniper Intrusion Prevention System (IPSIPSAn intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection.) (Intrusion Detection and Prevention)
     • Adds data ingestion support for AlgoSec (Security Management)
     • Adds data ingestion support for BeyondTrust (Security Management)
     • Adds data ingestion support for DMP Entré (Security Management)
     • Adds data ingestion support for Microsoft Internet Information Services (IIS) (Server)
     • Adds data ingestion support for Microsoft SQL Server (Server)

     17 details in Everything

279. May 15, 2020 May 15, 2020 · release notes

     New Live Rules API for real-time rule management and expanded data ingestion for Defender ATP, Bitdefender, Trend Micro, Zscaler, and more.

     • Adds the Live Rules API to enable running and managing security rules in real time against incoming logs
     • Adds location metadata fields to UDM Reference
     • Adds support for ingesting Microsoft Defender ATP data
     • Adds support for ingesting Bitdefender Antivirus data
     • Adds support for ingesting Trend Micro Antivirus data

     +5 more show less

     • Adds support for ingesting Cisco ACS authentication logs
     • Adds support for ingesting RSARSAThe oldest widely used public-key algorithm, for both encryption and signatures, with security resting on factoring large numbers. A large quantum computer would break it. Authentication Manager version 8.1 logs
     • Adds support for ingesting Digital Guardian EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. data
     • Adds support for ingesting Cyberark IDM and PAMPAMBrokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. logs
     • Adds support for ingesting Forescout NAC data

     10 details in Everything

280. May 08, 2020 May 8, 2020 · release notes

     Chronicle expands supported data sources with new parsers for Suricata, Aruba, Zscaler and others

     • Adds Suricata support to the Alerts data set for log ingestion and parsing
     • Adds Cisco antivirus logs support via the Antivirus data set integration
     • Adds Microsoft Office 365 application logs support via the Application data set integration
     • Adds Aruba ClearPass, Cisco ISE, and Duo authentication logs support via the Authentications data set integration
     • Adds Acalvio deception log support via the Deception data set integration

     +8 more show less

     • Enables ingestion of EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. logs from Endgame for Red Canary customers
     • Adds McAfee ePolicy Orchestrator endpoint logs support via the Endpoint data set integration
     • Adds Zscaler firewall log support via the Firewall data set integration
     • Adds Emerging Threats Pro IoCIoCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. data support via the IoC data set integration
     • Adds Cisco router logs support via the Router data set integration
     • Adds Cloudflare and Google G Suite Audit SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. log support via the SAAS data set integration
     • Adds Cisco switch logs support via the Switch data set integration
     • Adds Pulse Connect Secure VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. log support via the VPN data set integration

     13 details in Everything

281. March 30, 2020 Mar 30, 2020 · release notes

     Chronicle adds data ingestion from ESET EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device., Barracuda/Mimecast mail gateways, Citrix Netscaler WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server., and Packetbeat for DHCP/DNS; column sorting now available in UI.

     • Adds Enterprise Insights column sorting capability
     • Adds support for parsing data from DHCP via Elastic Packetbeat
     • Adds support for parsing DNS data via Elastic Packetbeat
     • Adds support for parsing EDR data from ESET
     • Adds support for parsing Mail Gateway data from Barracuda Email Security

     +2 more show less

     • Adds support for parsing Mail Gateway data from Mimecast Email Security
     • Adds support for parsing Web Application Firewall data from Citrix Netscaler

     7 details in Everything

282. March 19, 2020 Mar 19, 2020 · release notes

     Google SecOps adds ingestion and parsing support for F5 Big-IP LTM and Cisco Meraki data.

     • Added support for ingesting and parsing F5 Big-IP Local Traffic Manager (LTM) traffic management logs.
     • Added support for ingesting and parsing Cisco Meraki unified threat management logs.

     2 details in Everything

283. January 01, 2020 Jan 1, 2020 · release notes

     New January 01, 2020 features expand Google SecOps capabilities with UDM batch ingestion and programmatic search APIs.

284. July 01, 2019 Jul 1, 2019 · release notes

     Google SecOps adds raw log scanning with regex support and a new Hash View feature.

     • Adds Raw Log Scan to examine raw, unparsed logs.
     • Enables regular expression search capabilities on raw logs
     • Introduces Hash View for file investigation based on hash values

     3 details in Everything

285. March 01, 2019 Mar 1, 2019 · release notes

     Enterprise Insights gets procedural filtering, Assets with Alerts list, EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. timeline viewing, and new domain/IP search capabilities.

     • Adds a Procedural Filtering menu to Enterprise Insights
     • Lists all Assets with Alerts in the enterprise view within Enterprise Insights
     • Enables viewing Endpoint Detection and Response (EDR) data in the timeline
     • Includes Domain Context Analytics using VirusTotal, EmergingThreats, WHOIS, and DHS AIS sources
     • Adds search for external IP addresses and URLs when investigating domains and IPs

     +1 more show less

     • Adds the Chronicle Chrome Extension for searching indicators

     6 details in Everything