Google Security Operations SIEM release notes

Feature

[Spotlight Feature] Analyze feed activity with Cloud Logging

This feature is in public preview. To use this feature, your Google SecOps instance must be configured with a Bring Your Own Project (BYOP) Google Cloud project. You can now monitor, debug, and troubleshoot Google SecOps SIEM ingestion pipelines and feeds using Cloud Logging. By sending, viewing, and querying ingestion and feed activity logs in Logs Explorer, you can diagnose log delivery issues, such as, missing, delayed, or failing logs, and decrease the time required to resolve ingestion anomalies.

This visibility into push- and pull-based ingestion mechanisms provides the following capabilities:

Investigate telemetry: Use Gemini Cloud Assist to investigate logging and metrics telemetry directly from the Google SecOps console.
Debug feeds: Use the Debug with logs option on the Feed management page to open Logs Explorer pre-filtered for a specific feed.
Filter routed logs: Configure exclusion filters in the Log Router to exclude specific logs, such as Storage Transfer Service (STS) logs, from being routed to Cloud Logging.

For more information, see Analyze feed activity with Cloud Logging.

Change

Google SecOps has updated the list of supported default parsers. Parsers are updated gradually, so it might take one to four days before you see the changes reflected in your region.

The following supported default parsers have been updated. Each parser is listed by product name and log_type value, where applicable. This list includes both released default parsers and pending parser updates.

Airlock Digital Application Allowlisting (AIRLOCK_DIGITAL)
AIX system (AIX_SYSTEM)
Akamai DataStream 2 (AKAMAI_DATASTREAM_2)
Akamai SIEM Connector (AKAMAI_SIEM_CONNECTOR)
Apache (APACHE)
Arcsight CEF (ARCSIGHT_CEF)
Armis Alerts (ARMIS_ALERTS)
Aruba Switch (ARUBA_SWITCH)
Atlassian Cloud Admin Audit (ATLASSIAN_AUDIT)
Linux Auditing System (AuditD) (AUDITD)
Avaya Aura Experience Portal (AVAYA_AURA)
AWS Cloudtrail (AWS_CLOUDTRAIL)
AWS CloudWatch (AWS_CLOUDWATCH)
AWS Control Tower (AWS_CONTROL_TOWER)
Microsoft Azure Activity (AZURE_ACTIVITY)
Azure AD (AZURE_AD)
Azure AD Organizational Context (AZURE_AD_CONTEXT)
Azure Application Gateway (AZURE_GATEWAY)
Azure Key Vault logging (AZURE_KEYVAULT_AUDIT)
Microsoft Azure Resource (AZURE_RESOURCE_LOGS)
Blue Coat Proxy (BLUECOAT_WEBPROXY)
BeyondTrust (BOMGAR)
Cato Networks (CATO_NETWORKS)
Check Point (CHECKPOINT_FIREWALL)
Check Point Harmony (CHECKPOINT_HARMONY)
Chrome Management (CHROME_MANAGEMENT)
ChromeOS XDR (CHROMEOS_XDR)
Cisco ASA (CISCO_ASA_FIREWALL)
Cisco Email Security (CISCO_EMAIL_SECURITY)
Cisco Firepower NGFW (CISCO_FIREPOWER_FIREWALL)
Cisco FireSIGHT Management Center (CISCO_FIRESIGHT)
Cisco ISE (CISCO_ISE)
Cisco Router (CISCO_ROUTER)
Cisco Switch (CISCO_SWITCH)
Cisco UCM (CISCO_UCM)
Claroty Xdome (CLAROTY_XDOME)
Claude Compliance Logs (CLAUDE_COMPLIANCE_LOGS)
HP Aruba (ClearPass) (CLEARPASS)
Cloudflare (CLOUDFLARE)
Palo Alto Cortex XDR Alerts (CORTEX_XDR)
CrowdStrike Falcon (CS_EDR)
Darktrace (DARKTRACE)
EfficientIP DDI (EFFICIENTIP_DDI)
F5 ASM (F5_ASM)
F5 BIGIP LTM (F5_BIGIP_LTM)
Fastly CDN (FASTLY_CDN)
FireEye eMPS (FIREEYE_EMPS)
FireEye HX (FIREEYE_HX)
FireEye NX (FIREEYE_NX)
Forcepoint Proxy (FORCEPOINT_WEBPROXY)
FortiGate (FORTINET_FIREWALL)
Fortinet FortiAnalyzer (FORTINET_FORTIANALYZER)
Fortinet FortiClient (FORTINET_FORTICLIENT)
Fortinet Switch (FORTINET_SWITCH)
GCP Cloud Audit (GCP_CLOUDAUDIT)
Security Command Center External Exposure (GCP_SECURITYCENTER_EXTERNAL_EXPOSURE)
Gitlab (GITLAB)
Google Threat Intelligence IOC (GTI_IOC)
AWS GuardDuty (GUARDDUTY)
Huawei Switches (HUAWEI_SWITCH)
IBM Security Access Manager (IBM_SAM)
Microsoft IIS (IIS)
Illumio Core (ILLUMIO_CORE)
Imperva SecureSphere Management (IMPERVA_SECURESPHERE)
Infoblox (INFOBLOX)
Infoblox DHCP (INFOBLOX_DHCP)
Jamf pro context (JAMF_PRO_CONTEXT)
Mobile Endpoint Security (LOOKOUT_MOBILE_ENDPOINT_SECURITY)
Apple macOS (MACOS)
McAfee IPS (MCAFEE_IPS)
Micro Focus iManager (MICROFOCUS_IMANAGER)
Microsoft Defender for Endpoint (MICROSOFT_DEFENDER_ENDPOINT)
Microsoft Defender for Office 365 (MICROSOFT_DEFENDER_MAIL)
Microsoft Graph API Alerts (MICROSOFT_GRAPH_ALERT)
Microsoft Sentinel (MICROSOFT_SENTINEL)
Microsoft SQL Server (MICROSOFT_SQL)
Mimecast URL Logs (MIMECAST_URL_LOGS)
MISP Threat Intelligence (MISP_IOC)
NetApp ONTAP (NETAPP_ONTAP)
Netskope V2 (NETSKOPE_ALERT_V2)
Unix system (NIX_SYSTEM)
Office 365 (OFFICE_365)
Okta (OKTA)
Onapsis (ONAPSIS)
OpenVPN (OPEN_VPN)
Oracle Fusion (ORACLE_FUSION)
Ping Identity (PING)
Proofpoint Sendmail Sentrion (PROOFPOINT_SENDMAIL_SENTRION)
SailPoint IAM (SAILPOINT_IAM)
Salesforce (SALESFORCE)
Sendmail (SENDMAIL)
Sentinelone Alerts (SENTINELONE_ALERT)
ServiceNow Audit (SERVICENOW_AUDIT)
ServiceNow CMDB (SERVICENOW_CMDB)
ServiceNow Security (SERVICENOW_SECURITY)
SonicWall (SONIC_FIREWALL)
STIX Threat Intelligence (STIX)
Tanium Threat Response (TANIUM_THREAT_RESPONSE)
Thinkst Canary (THINKST_CANARY)
ThreatConnect IOC V3 (THREATCONNECT_IOC_V3)
ThreatLocker Platform (THREATLOCKER)
Varonis (VARONIS)
VMware ESXi (VMWARE_ESX)
Windows DNS (WINDOWS_DNS)
Windows Event (WINEVTLOG)
Windows Event (XML) (WINEVTLOG_XML)
wiz.io (WIZ_IO)
Workspace Activities (WORKSPACE_ACTIVITY)
Zoom Operation Logs (ZOOM_OPERATION_LOGS)

The following log types were added without a default parser. Each parser is listed by product name and log_type value, where applicable.

Adobe Experience Platform (ADOBE_EXPERIENCE_PLATFORM)
AudioCodes Session Border Controller (AUDIOCODES_SBC)
Azure Application Gateway for Containers (AZURE_GATEWAY_CONTAINERS)
Azure Logic Apps (AZURE_LOGIC_APPS)
Azure NAT Gateway Flow (AZURE_NATGW_FLOW)
Broadcom DX NetOps Spectrum (BROADCOM_DX_NETOPS_SPECTRUM)
Carto Activity (CARTO_ACTIVITY)
Claude Code Observability (CLAUDE_CODE_OBSERVABILITY)
Cyble Attack Surface Management (CYBLE_ASM)
Cyble Brand Intelligence & Protection (CYBLE_BIP)
Darkweb IQ (DARKWEB_IQ)
Ellio Threat Intelligence (ELLIO_THREAT_INTEL)
Exeon NDR (EXEON_NDR)
Gravitee (GRAVITEE)
Kaspersky anti targeted attack (KASPERSKY_ANTI_TARGETED_ATTACK)
Microsoft Copilot Interaction (MICROSOFT_COPILOT_INTERACTION)
OSTTRA MarkitWire (OSTTRA_MARKITWIRE)
Proofpoint Adaptive Email Security (PROOFPOINT_ADAPTIVE_EMAIL_SECURITY)
Secomea GateManager (SECOMEA_GATEMANAGER)
Trend Micro Vision One Risk Event (TRENDMICRO_VISION_ONE_RISK_EVENT)
TXOne EdgeIPS (TXONE_EDGEIPS)
Vectra Respond UX (VECTRA_RUX)
Zoho CRM (ZOHO_CRM)

Feature

View prebuilt parser version content

You can now view the prebuilt parser preview version content even if you are using a custom parser for the same log type. Although the prebuilt parser version is inactive, you can still see the content of the new preview version for this parser.

Deprecated

[Spotlight Feature] Deprecation of Google Security Operations legacy SIEM APIs

Google Security Operations is deprecating its legacy SIEM APIs—Backstory API (including Customer Management API) and Ingestion API—in favor of the modern Chronicle API.

Key dates

October 26, 2026: New Google SecOps instances provisioned from this date will no longer support legacy API calls.
July 20, 2027: All requests to legacy endpoints fail from this date because legacy APIs for all existing instances will be completely turned down.

This change applies only to custom scripts, integrations, SOAR connectors, or ingestion feeds calling legacy Backstory API or Ingestion API endpoints. Any changes impacting the Google SecOps UI are already addressed and don't call for your action.

Next steps

Audit API usage to identify any affected components that currently call legacy Backstory API or Ingestion API endpoints, and replace them with Chronicle API endpoints.
Validate and test that your updated components work properly.

For more information, see Migrate from legacy API to Chronicle API.

Feature

Advanced Filtering in Dashboards

This feature is in public preview.

Advanced Filtering in dashboards is now available in Google SecOps. This feature enhances dashboard capabilities by enabling security analysts to use query variables, also known as tokens, to inject dynamic values, complex regular expressions, or boolean logic directly into YARA-L queries at runtime.

Key aspects of Advanced Filtering include:

Token Variable Definition: When creating an advanced filter, you can define a Token Variable. Token variable names must consist only of alphanumeric characters and underscores (^[a-zA-Z0-9_]+$) and must be unique within the dashboard.
Filter Value Generation: Token values can be generated dynamically from YARA-L query results or entered manually as a static list.
Customizable Wrappers: You can specify prefixes and suffixes to wrap token values, enabling specific logic such as regular expressions.
Multi-Select Support: The ability to select multiple options for a token can be enabled, with a configurable delimiter (for example, |) for combining values in queries.

For more information, see Advanced filtering.

Feature

Parser extensions for code snippets now support Append/Replace for Repeated Fields

You can now use append and replace functionality for repeated fields when creating code snippet extensions. Previously, this was only available for no-code extensions. This enhancement provides more granular control over how data is handled in repeated UDM fields, allowing you to either add new values or entirely replace existing ones.

For more information, see Repeated fields selector.

Announcement

[Spotlight Feature] Security Tokens

Security Tokens are now available for metering agentic consumption within Google SecOps. Tokens are consumed by generally available security agents only. These agents are invoked automatically or manually using the web interface, CLI, chat, or Model Context Protocol (MCP). Assistive features, such as standard chat panels and automated summaries, along with preview agents, won't consume Security Tokens.

Security Tokens will start rolling out across all regions starting July 1. For more information, see Google SecOps Agentic SOC Security Tokens pricing and billing.

Announcement

Increased multiple event limits

Multiple event rule limits have been increased to 200 for Enterprise customers and 400 for Enterprise+ customers.

For more information, see Package comparison

Announcement

Unified rules interface

The new rules interface is now available in public preview.

The Google SecOps unified rules interface brings custom and curated rule management into a single, cohesive workflow. This optimizes detection engineering with a redesigned dashboard, an advanced rule editor, and expanded API capabilities to streamline rule deployment and troubleshooting.

You can still revert to the legacy experience. At the top right of the screen, click Switch to the legacy experience.

For more information about the Unified rules interface, see Manage unified rules.

Change

Google SecOps has updated the list of supported default parsers. Parsers are updated gradually, so it might take one to four days before you see the changes reflected in your region.

The following supported default parsers have been updated. Each parser is listed by product name and log_type value, where applicable. This list includes both released default parsers and pending parser updates.

AIX system (AIX_SYSTEM)
Amazon API Gateway (AWS_API_GATEWAY)
Apache (APACHE)
Appian Cloud (APPIAN_CLOUD)
Aruba Switch (ARUBA_SWITCH)
Atlassian Bitbucket (ATLASSIAN_BITBUCKET)
Avaya Aura Experience Portal (AVAYA_AURA)
AWS CloudWatch (AWS_CLOUDWATCH)
AWS GuardDuty (GUARDDUTY)
AWS Network Firewall (AWS_NETWORK_FIREWALL)
AWS RDS (AWS_RDS)
AWS Security Hub (AWS_SECURITY_HUB)
AWS VPC Flow (AWS_VPC_FLOW)
AWS VPC Flow (CSV) (AWS_VPC_FLOW_CSV)
AWS WAF (AWS_WAF)
Azure AD (AZURE_AD)
Barracuda WAF (BARRACUDA_WAF)
Blue Coat Proxy (BLUECOAT_WEBPROXY)
Cato Networks (CATO_NETWORKS)
Check Point Harmony (CHECKPOINT_HARMONY)
Chrome Management (CHROME_MANAGEMENT)
CircleCI (CIRCLECI)
Cisco ACS (CISCO_ACS)
Cisco ASA (CISCO_ASA_FIREWALL)
Cisco Email Security (CISCO_EMAIL_SECURITY)
Cisco Firepower NGFW (CISCO_FIREPOWER_FIREWALL)
Cisco IronPort (CISCO_IRONPORT)
Cisco ISE (CISCO_ISE)
Cisco Meraki (CISCO_MERAKI)
Cisco Router (CISCO_ROUTER)
Cisco Secure Access (CISCO_SECURE_ACCESS)
Cisco Switch (CISCO_SWITCH)
Cisco Umbrella Audit (CISCO_UMBRELLA_AUDIT)
Cisco Umbrella Cloud Firewall (UMBRELLA_FIREWALL)
Cisco Umbrella Web Proxy (UMBRELLA_WEBPROXY)
Cisco vManage SD-WAN (CISCO_SDWAN)
Cisco WLC/WCS (CISCO_WIRELESS)
Citrix Netscaler (CITRIX_NETSCALER)
Claroty Xdome (CLAROTY_XDOME)
Cloudflare (CLOUDFLARE)
Corelight (CORELIGHT)
CrowdStrike Alerts API (CS_ALERTS)
CrowdStrike Falcon (CS_EDR)
CyberArk PTA Privileged Threat Analytics (CYBERARK_PTA)
Cynet 360 AutoXDR (CYNET_360_AUTOXDR)
Dell Switch (DELL_SWITCH)
Elastic Windows Event Log Beats (ELASTIC_WINLOGBEAT)
F5 ASM (F5_ASM)
F5 BIGIP LTM (F5_BIGIP_LTM)
FireEye ETP (FIREEYE_ETP)
FireEye NX (FIREEYE_NX)
Forcepoint Proxy (FORCEPOINT_WEBPROXY)
FortiGate (FORTINET_FIREWALL)
FortiMail Email Security (FORTINET_FORTIMAIL)
Fortinet FortiAnalyzer (FORTINET_FORTIANALYZER)
Fortinet Web Application Firewall (FORTINET_FORTIWEB)
GitHub (GITHUB)
Google Cloud Audit (GCP_CLOUDAUDIT)
Google Cloud DNS (GCP_DNS)
HAProxy (HAPROXY)
IBM Tape Storages (IBM_LTO)
Imperva CEF (IMPERVA_CEF)
Imperva SecureSphere Management (IMPERVA_SECURESPHERE)
Infoblox DNS (INFOBLOX_DNS)
Island Browser logs (ISLAND_BROWSER)
JumpCloud Directory Insights (JUMPCLOUD_DIRECTORY_INSIGHTS)
Kemp Load Balancer (KEMP_LOADBALANCER)
Kubernetes Node (KUBERNETES_NODE)
ManageEngine ADAudit Plus (ADAUDIT_PLUS)
Microsoft Defender for Endpoint (MICROSOFT_DEFENDER_ENDPOINT)
Microsoft Defender for Office 365 (MICROSOFT_DEFENDER_MAIL)
Microsoft Graph API Alerts (MICROSOFT_GRAPH_ALERT)
Microsoft IIS (IIS)
Microsoft SQL Server (MICROSOFT_SQL)
MISP Threat Intelligence (MISP_IOC)
NetApp ONTAP (NETAPP_ONTAP)
NetIQ eDirectory (NETIQ_EDIRECTORY)
Netskope V2 (NETSKOPE_ALERT_V2)
Netskope Web Proxy (NETSKOPE_WEBPROXY)
NGINX (NGINX)
Noname API Security (NONAME_API_SECURITY)
Office 365 (OFFICE_365)
Okta (OKTA)
Oracle (ORACLE_DB)
Oracle Cloud Infrastructure VCN Flow Logs (OCI_FLOW)
Oracle NetSuite (ORACLE_NETSUITE)
Palo Alto Networks Firewall (PAN_FIREWALL)
Palo Alto Panorama (PAN_PANORAMA)
Palo Alto Prisma Access (PAN_CASB)
Palo Alto Prisma Cloud Alert payload (PAN_PRISMA_CA)
Ping Identity (PING)
Proofpoint On Demand (PROOFPOINT_ON_DEMAND)
RSA (RSA_AUTH_MANAGER)
Salesforce (SALESFORCE)
Security Command Center Error (GCP_SECURITYCENTER_ERROR)
Security Command Center Misconfiguration (GCP_SECURITYCENTER_MISCONFIGURATION)
Security Command Center Observation (GCP_SECURITYCENTER_OBSERVATION)
Security Command Center Posture Violation (GCP_SECURITYCENTER_POSTURE_VIOLATION)
Security Command Center Threat (GCP_SECURITYCENTER_THREAT)
Security Command Center Toxic Combination (GCP_SECURITYCENTER_TOXIC_COMBINATION)
Security Command Center Unspecified (GCP_SECURITYCENTER_UNSPECIFIED)
Security Command Center Vulnerability (GCP_SECURITYCENTER_VULNERABILITY)
Sendmail (SENDMAIL)
Sentinelone Activity (SENTINELONE_ACTIVITY)
ServiceNow CMDB (SERVICENOW_CMDB)
Sophos Firewall (Next Gen) (SOPHOS_FIREWALL)
Squid Web Proxy (SQUID_WEBPROXY)
Symantec EDR (SYMANTEC_EDR)
Symantec Endpoint Protection (SEP)
Sysdig (SYSDIG)
Thinkst Canary (THINKST_CANARY)
Trellix EDRF Trace Data and Telemetry (TRELLIX_EDRF)
Trend Micro Vision One Detections (TRENDMICRO_VISION_ONE_DETECTIONS)
Trend Micro Vision One Workbench (TRENDMICRO_VISION_ONE_WORKBENCH)
Unix system (NIX_SYSTEM)
Varonis (VARONIS)
Veeam (VEEAM)
VMware vCenter (VMWARE_VCENTER)
VMWare VSphere (VMWARE_VSPHERE)
Windows DNS (WINDOWS_DNS)
Windows Event (WINEVTLOG)
Windows Event (XML) (WINEVTLOG_XML)
Windows Sysmon (WINDOWS_SYSMON)
wiz.io (WIZ_IO)
Workday User Activity (WORKDAY_USER_ACTIVITY)
Zeek JSON (BRO_JSON)
Zscaler (ZSCALER_WEBPROXY)
ZScaler NGFW (ZSCALER_FIREWALL)

The following log types were added without a default parser. Each parser is listed by product name and log_type value, where applicable.

Cisco Secure Access Enrollment (CISCO_SECURE_ACCESS_ENROLLMENT)
Cisco Secure Access Network (CISCO_SECURE_ACCESS_NETWORK)
CyberArk Certificate Manager SaaS (CYBERARK_CERTIFICATE_MANAGER_SAAS)
Gemini Enterprise Agent Platform (GEMINI_ENTERPRISE_AGENT_PLATFORM)
Schneider Electric GeoScada OT (GEOSCADA_OT)
Model Context Protocol Dev (MCPDEV)
Model Context Protocol Modify (MCPMODIFY)
Model Context Protocol View (MCPVIEW)
NetApp Ransomware Resilience (NETAPP_RANSOMWARE_RESILIENCE)
Netskope Log Streaming (NETSKOPE_LOG_STREAMING)
Pylon Audit Logs (PYLON_LOGS)
Reco AI CSPM (RECO_CSPM)
Salt Security API Protection Platform (SALT_SECURITY)
SentinelOne Application (SENTINELONE_APPLICATION)
Wiz Vulnerabilities (WIZ_VULNERABILITIES)

Announcement

Improved documentation portal navigation

Finding help is now easier! We've updated the navigation of our documentation portal to be primarily user-centric. Sections have been reorganized and renamed to align with your workflows, providing a logical path through the documentation.

We've also added:

A Support tab for technical support, changelogs, and release notes
A Use cases tab for persona-driven CUJs and workflows

Feature

Ask Gemini Cloud Assist in Feed Management

Google SecOps now provides Gemini Cloud Assist (GCA) directly within the Feed Management interface to help you with feed creation, setup, and general troubleshooting questions.

A new Ask Gemini Cloud Assist button is now available in the Feed Management interface. You can click this button to open the Gemini Cloud Assist panel and ask questions to get guidance on:

Configuring and managing data feeds.
Understanding ingestion pre-requisites and setup steps for different log sources.
Resolving common setup issues.

Note: Gemini Cloud Assist provides recommendations and answers to your questions, but does not perform configuration changes on your behalf. You must apply any recommended changes manually to your feeds.

For more information, see Feed management overview.

Change

Ingestion metrics reporting correction

Google Security Operations has resolved an issue where certain ingestion metrics—which are displayed in both the dashboard and Cloud Monitoring—were under-reported.

Because of this correction, you might notice a one-time apparent spike in your ingestion metrics when the update is enabled for your region (between June 29 and July 10, 2026). The actual log volume ingested remains unchanged.

Historical metrics recorded before this update will not be modified or backfilled. This correction does not affect customer billing.

If you have questions or need assistance, contact Google Security Operations support.

Change

Auto-collapse setting for the query editor

You can now configure the query editor to automatically collapse after you run a search, maximizing the screen space available for viewing your search results. By default, the query editor remains expanded.

For more information, see Configure query editor behavior.

Announcement

New Documentation changelogs

Google SecOps is now releasing a monthly changelog to capture major documentation updates.

For more information, refer to Documentation changelog.

Feature

Non-prioritized IoC Matching rules Category

Google SecOps has introduced a new detection category, Non-prioritized IoC Matching rules, as part of the Curated Detections feature. These rule sets integrate with Google's Indicators of Compromise (IoC) feeds and build on curated threat intelligence to identify malicious activities within Google SecOps environments, specifically focusing on threats identifiable through high-fidelity indicators like IPs, domains, and file hashes.

This rules category provides comprehensive coverage for threats often missed by standard managed content, including cryptomining, Command and Control (C2) communications, and the use of malicious anonymization services.

For more information, refer to Non-prioritized IoC Matching rules category overview.

Feature

[Spotlight Feature] Investigate detections in Google SecOps Search

Google SecOps Search now supports querying, filtering, and analyzing system-generated detections. When searching on events or entities, matching detections will now appear in the Alerts and Detections tab, providing a more holistic workflow for threat investigation.

For more details, see Investigate detections in Search.

Announcement

Asynchronous Search APIs for large datasets

Google SecOps now supports asynchronous Search APIs that let you perform long-running queries without blocking your applications. This is ideal for searches that return a large volume of results.

Non-blocking queries: Initiate searches and receive an operation ID to track progress, so your application remains responsive.
Handle large result sets: Retrieve up to 1 million results from data sources including Unified Data Model (UDM) events, data tables, and Entity Context Graph (ECG).
Paginated results: View results efficiently in manageable pages.

For more information, see Asynchronous Search APIs and Result limits for data sources.

Feature

UDM fields now show the sources of enrichment

The new Enrichment feature introduces improvements for managing and understanding your data. Each UDM field is now labeled with an icon to indicate its data source: U for unenriched fields and E for enriched fields. Enriched fields contain additional metadata values that indicate the source of the enriched data.

For more information, see: Viewing events.

Change

Google SecOps has updated the list of supported default parsers. Parsers are updated gradually, so it might take one to four days before you see the changes reflected in your region.

The following supported default parsers have been updated. Each parser is listed by product name and log_type value, where applicable. This list includes both released default parsers and pending parser updates.

1Password Audit Events (ONEPASSWORD_AUDIT_EVENTS)
AIX system (AIX_SYSTEM)
Apache (APACHE)
Aruba EdgeConnect SD-WAN (ARUBA_EDGECONNECT_SDWAN)
Avaya Aura Experience Portal (AVAYA_AURA)
AWS CloudFront (AWS_CLOUDFRONT)
AWS Cloudtrail (AWS_CLOUDTRAIL)
AWS GuardDuty (GUARDDUTY)
AWS Security Hub (AWS_SECURITY_HUB)
Azure AD (AZURE_AD)
Azure AD Organizational Context (AZURE_AD_CONTEXT)
Azure AD Sign-In (AZURE_AD_SIGNIN)
Azure SQL (AZURE_SQL)
Azure Storage Audit (AZURE_STORAGE_AUDIT)
Barracuda WAF (BARRACUDA_WAF)
Blue Coat Proxy (BLUECOAT_WEBPROXY)
Chrome Management (CHROME_MANAGEMENT)
Cisco ACS (CISCO_ACS)
Cisco ISE (CISCO_ISE)
Cisco Secure Access (CISCO_SECURE_ACCESS)
Cisco Secure Workload (CISCO_SECURE_WORKLOAD)
Cisco Switch (CISCO_SWITCH)
Cisco Umbrella Audit (CISCO_UMBRELLA_AUDIT)
Citrix Netscaler (CITRIX_NETSCALER)
Claroty Xdome (CLAROTY_XDOME)
Claude Compliance Logs (CLAUDE_COMPLIANCE_LOGS)
Cloudflare (CLOUDFLARE)
Cloudflare Warp (CLOUDFLARE_WARP)
Corelight (CORELIGHT)
CrowdStrike Alerts API (CS_ALERTS)
CrowdStrike Falcon (CS_EDR)
CyberArk (CYBERARK)
CyberArk Privileged Access Manager (PAM) (CYBERARK_PAM)
Duo Administrator Logs (DUO_ADMIN)
EfficientIP DDI (EFFICIENTIP_DDI)
Elastic Audit Beats (ELASTIC_AUDITBEAT)
Elastic Windows Event Log Beats (ELASTIC_WINLOGBEAT)
F5 ASM (F5_ASM)
Forcepoint Proxy (FORCEPOINT_WEBPROXY)
FortiGate (FORTINET_FIREWALL)
GitHub (GITHUB)
Google Cloud Asset Inventory (GCP_CLOUD_ASSET_INVENTORY)
Google Cloud Audit (GCP_CLOUDAUDIT)
Google Compute Context (GCP_COMPUTE_CONTEXT)
Google Threat Intelligence IOC (GTI_IOC)
GTB Technologies DLP (GTB_DLP)
HP Aruba (ClearPass) (CLEARPASS)
IBM Websphere Application Server (IBM_WEBSPHERE_APP_SERVER)
IBM z/OS (IBM_ZOS)
Imperva (IMPERVA_WAF)
Imperva CEF (IMPERVA_CEF)
Imperva DRA (IMPERVA_DRA)
Imperva SecureSphere Management (IMPERVA_SECURESPHERE)
Island Browser logs (ISLAND_BROWSER)
Juniper (JUNIPER_FIREWALL)
Juniper Mist (JUNIPER_MIST)
Kubernetes Node (KUBERNETES_NODE)
LastPass Password Management (LASTPASS)
Linux Auditing System (AuditD) (AUDITD)
Microsoft Azure Activity (AZURE_ACTIVITY)
Microsoft Defender for Office 365 (MICROSOFT_DEFENDER_MAIL)
Microsoft IIS (IIS)
Mobileiron (MOBILEIRON)
Mongo Database (MONGO_DB)
MySQL (MYSQL)
Netapp Storagegrid (NETAPP_STORAGEGRID)
Netskope V2 (NETSKOPE_ALERT_V2)
Netskope Web Proxy (NETSKOPE_WEBPROXY)
NGFW Enterprise (GCP_NGFW_ENTERPRISE)
Office 365 (OFFICE_365)
Office 365 Message Trace (OFFICE_365_MESSAGETRACE)
Okta Scaleft (OKTA_SCALEFT)
Oracle (ORACLE_DB)
Oracle Cloud Infrastructure Audit Logs (OCI_AUDIT)
Orca Cloud Security Platform (ORCA)
Proofpoint On Demand (PROOFPOINT_ON_DEMAND)
Radware Web Application Firewall (RADWARE_FIREWALL)
Red Hat Directory Server LDAP (REDHAT_DIRECTORY_SERVER)
Red Hat OpenShift (REDHAT_OPENSHIFT)
Salesforce (SALESFORCE)
Sangfor Next Generation Firewall (SANGFOR_NGAF)
Security Command Center Error (GCP_SECURITYCENTER_ERROR)
Security Command Center Misconfiguration (GCP_SECURITYCENTER_MISCONFIGURATION)
Security Command Center Observation (GCP_SECURITYCENTER_OBSERVATION)
Security Command Center Posture Violation (GCP_SECURITYCENTER_POSTURE_VIOLATION)
Security Command Center Threat (GCP_SECURITYCENTER_THREAT)
Security Command Center Toxic Combination (GCP_SECURITYCENTER_TOXIC_COMBINATION)
Security Command Center Unspecified (GCP_SECURITYCENTER_UNSPECIFIED)
Security Command Center Vulnerability (GCP_SECURITYCENTER_VULNERABILITY)
SentinelOne Singularity Cloud Funnel (SENTINELONE_CF)
ServiceNow Security (SERVICENOW_SECURITY)
Sourcefire (SOURCEFIRE_IDS)
Suricata EVE (SURICATA_EVE)
Symantec Endpoint Protection (SEP)
Sysdig (SYSDIG)
Trend Micro Deep Security (TRENDMICRO_DEEP_SECURITY)
Trend Micro Vision One Observerd Attack Techniques (TRENDMICRO_VISION_ONE_OBSERVERD_ATTACK_TECHNIQUES)
Ubiquiti UniFi Switch (UBIQUITI_SWITCH)
Unix system (NIX_SYSTEM)
Upwind (UPWIND)
VMware ESXi (VMWARE_ESX)
VMWare VSphere (VMWARE_VSPHERE)
Windows DNS (WINDOWS_DNS)
Windows Event (WINEVTLOG)
Wiz.io (WIZ_IO)
Workday User Activity (WORKDAY_USER_ACTIVITY)
Workspace Activities (WORKSPACE_ACTIVITY)
Zscaler (ZSCALER_WEBPROXY)
Zscaler CASB (ZSCALER_CASB)
Zscaler DLP (ZSCALER_DLP)
Zscaler Private Access (ZSCALER_ZPA)

The following log types were added without a default parser. Each parser is listed by product name and log_type value, where applicable.

Azure Software Vulnerabilities (AZURE_SOFTWARE_VULNERABILITIES)
Caller Verify (CALLER_VERIFY)
CertSecure Log (CERTSECURE_LOG)
Cisco MultiCloud Defense Firewall (CISCO_MULTICLOUD_DEFENSE_FIREWALL)
Cursor (CURSOR)
Cyfirma (CYFIRMA_DECYFIR_LOG)
Databahn (DATABAHN)
Flare Darkweb Alerts (FLARE_DARKWEB_ALERTS)
Fortinet FortiAppSec Cloud (FORTINET_FORTIAPPSEC)
Hikvision Network Video Recorders (HIKVISION_NVR)
IBM B2B Integrator (IBM_B2B_INTEGRATOR)
IBM InfoSphere Virtual Data Pipeline (IBM_VDP)
Imperva Account TakeOver (IMPERVA_ATO)
Imperva Client Side Protection (IMPERVA_CSP)
Imperva DNS (IMPERVA_DNS)
Imperva Network Security (IMPERVA_NETWORK_SECURITY)
Microsoft Defender XDR (MICROSOFT_DEFENDER_XDR)
Nakivo Backup and Recovery (NAKIVO_BACKUP)
Netcraft Takedown (NETCRAFT_TAKEDOWN)
Next Level Performance Amplify (NXL_AMPLIFY)
Siemens Desigo (SIEMENS_DESIGO)

Feature

Upgraded Chronicle API

We've upgraded the following Chronicle API resources from v1 beta to v1. This upgrade signals API stability and functional completeness, enabling customer and partner adoption for production usage. We recommend that customers and partners use Chronicle API for all new integrations, for a more robust, secure, and extensible experience. Learn more about API Stability.

The following features and resources are included in this update:

Alerts and ATIs, UEBA: Threat Collection, IoC, CoverageDetail, EntityRisk
Dashboards: NativeDashboard, DashboardChart, DashboardQuery, FeaturedContentNativeDashboard
Data Tables: DataTable, DataTableRow, DataTableOperationError
Ingestion: Logs, Feed, LogTypeSchema, FeedSourceSchema, FeedPack, Forwarder
Normalization: Logtype, Parser, IngestionLogLabel
Detections: FindingsRefinement, VerifyRuleText, FeaturedContentRule, RuleExecutionError
Search & Investigation: Event, Entity, SearchQuery, SavedColumnSet
Exports: BigQueryExportService
Enrichment Controls: EnrichmentControl, EnrichmentCombination

For a full list of updated resources and links to the documentation, please see the Chronicle API documentation.

Feature

Standard parser support policy

Google SecOps introduced a focused support policy for Standard parsers to scale platform stability, predictable performance, and high-quality data normalization. The new policy structures service level objectives (SLOs) and request triaging by customer support tiers (Standard versus Expert/Expert+), and prioritizes core security data through Important UDM Fields. Additionally, the policy outlines a community-driven model where low-usage, longtail prebuilt parsers migrate to a dedicated GitHub repository maintained by partners and the Google SecOps community.

For more information, see Standard parser support policy.

Feature

Enhanced Data Export API general availability and improvements

The Data Export API is now GA and introduces significant security and capability improvements. This feature facilitates the bulk export of your security data from Google SecOps to a Google Cloud Storage bucket that you control, and it provides a more secure and scalable data archival experience than the legacy Data Export API feature.

Here's what's new:

Advanced data filtering: the API now lets you additionally scope export jobs using namespaces and ingestion labels.
Zero-trust security (customer-managed encryption keys): full integration with Google Cloud Key Management Service (KMS) ensures that all exported data is encrypted with customer-managed keys.
Identity-aware extraction (RBAC): export jobs now inherit the data RBAC scope of users creating an export job, preventing unauthorized data extraction.

For more information, see Data Export API (enhanced).

Deprecated

The legacy Data Export API is deprecated in favor of the enhanced Data Export API, which provides a more secure and scalable data archival experience. After June 18, 2026, legacy Data Export API won't work.

Deprecated

The fetchavailablelogtypes API endpoint is deprecated in favor of the list endpoint. After June 18, 2026, the fetchavailablelogtypes API endpoint won't work.

Deprecated

The updateDataExport endpoint in the enhanced Data Export API is deprecated. The reduction in job queue times using the enhanced Data Export API has eliminated the need for the update functionality of the updateDataExport API endpoint. The updateDataExport endpoint was present in v1alpha only; it wasn't present in in v1beta or v1. After June 18, 2026, the updateDataExport API endpoint won't work. You can still cancel queued export jobs.

Deprecated

The logType field in the enhanced Data Export API is deprecated in favor of the new (optional)includeLogTypes field, which supports an array of log types for data filtering. If left blank, the export job includes all log types by default. The logType field was present in v1alpha only; it wasn't present in in v1beta or v1. After June 18, 2026, the logType field is discontinued.

Announcement

New parser documentation now available

New parser documentation is available to help you ingest and normalize logs from the following sources:

Change

Time range selection for searches

Google SecOps has now added relative and absolute time range options to define the required time period for retrieving search results.

Relative time range: Set a search window looking backward from the current time using custom intervals.
Absolute time range: Define fixed start and end times using calendar presets, exact date and time selections, or event-based timeframes.

For more information, see Set the date and time range.

Change

Google SecOps has updated the list of list of supported default parsers. Parsers are updated gradually, so it might take one to four days before you see the changes reflected in your region.

The following supported default parsers have been updated. Each parser is listed by product name and log_type value, where applicable. This list includes both released default parsers and pending parser updates.

Akeyless Vault Platform (AKEYLESS_VAULT)
Apache Cassandra (CASSANDRA)
Aruba (ARUBA_WIRELESS)
Aruba EdgeConnect SD-WAN (ARUBA_EDGECONNECT_SDWAN)
Auth0 (AUTH_ZERO)
AWS Aurora (AWS_AURORA)
AWS EC2 VPCs (AWS_EC2_VPCS)
AWS Security Hub (AWS_SECURITY_HUB)
Azure Firewall (AZURE_FIREWALL)
Azure Front Door (AZURE_FRONT_DOOR)
Barracuda CloudGen Firewall (BARRACUDA_CLOUDGEN_FIREWALL)
Blue Coat Proxy (BLUECOAT_WEBPROXY)
Check Point (CHECKPOINT_FIREWALL)
Check Point Sandblast (CHECKPOINT_EDR)
Checkpoint SmartDefense (CHECKPOINT_SMARTDEFENSE)
Chronicle SOAR Audit (CHRONICLE_SOAR_AUDIT)
Cisco Application Centric Infrastructure (CISCO_ACI)
Cisco ASA (CISCO_ASA_FIREWALL)
Cisco FireSIGHT Management Center (CISCO_FIRESIGHT)
Cisco Internetwork Operating System (CISCO_IOS)
Cisco ISE (CISCO_ISE)
Cisco Meraki (CISCO_MERAKI)
Cisco Secure Access (CISCO_SECURE_ACCESS)
Cisco Secure Workload (CISCO_SECURE_WORKLOAD)
Cisco Switch (CISCO_SWITCH)
Cisco Umbrella Audit (CISCO_UMBRELLA_AUDIT)
Cisco WLC/WCS (CISCO_WIRELESS)
Citrix Netscaler (CITRIX_NETSCALER)
Claroty Xdome (CLAROTY_XDOME)
Cloudflare Warp (CLOUDFLARE_WARP)
CrowdStrike Alerts API (CS_ALERTS)
CrowdStrike Falcon (CS_EDR)
CyberArk (CYBERARK)
CyberArk Privileged Access Manager (PAM) (CYBERARK_PAM)
EPIC Systems (EPIC)
F5 ASM (F5_ASM)
F5 BIGIP Access Policy Manager (F5_BIGIP_APM)
F5 BIGIP LTM (F5_BIGIP_LTM)
F5 Distributed Cloud Services (F5_DCS)
FireEye eMPS (FIREEYE_EMPS)
FireEye NX (FIREEYE_NX)
FortiGate (FORTINET_FIREWALL)
Fortinet FortiEDR (FORTINET_FORTIEDR)
Fortinet Proxy (FORTINET_WEBPROXY)
GitHub (GITHUB)
Google Cloud Audit (GCP_CLOUDAUDIT)
Google Threat Intelligence IOC (GTI_IOC)
Guardicore Centra (GUARDICORE_CENTRA)
HP Aruba (ClearPass) (CLEARPASS)
Huawei Switches (HUAWEI_SWITCH)
IBM Websphere Application Server (IBM_WEBSPHERE_APP_SERVER)
IBM z/OS (IBM_ZOS)
Imperva SecureSphere Management (IMPERVA_SECURESPHERE)
Infoblox (INFOBLOX)
Juniper (JUNIPER_FIREWALL)
Kubernetes Node (KUBERNETES_NODE)
Linux Auditing System (AuditD) (AUDITD)
ManageEngine ADManager Plus (ADMANAGER_PLUS)
McAfee ePolicy Orchestrator (MCAFEE_EPO)
McAfee Web Gateway (MCAFEE_WEBPROXY)
Microsoft Defender For Cloud (MICROSOFT_DEFENDER_CLOUD_ALERTS)
Microsoft Defender for Endpoint (MICROSOFT_DEFENDER_ENDPOINT)
Microsoft Defender for Identity (MICROSOFT_DEFENDER_IDENTITY)
Microsoft Graph API Alerts (MICROSOFT_GRAPH_ALERT)
Microsoft IIS (IIS)
Mobileiron (MOBILEIRON)
Model Armor (GCP_MODEL_ARMOR)
MySQL (MYSQL)
Netskope Web Proxy (NETSKOPE_WEBPROXY)
Noname API Security (NONAME_API_SECURITY)
Office 365 (OFFICE_365)
Okta (OKTA)
Oracle Cloud Infrastructure Audit Logs (OCI_AUDIT)
Oracle NetSuite (ORACLE_NETSUITE)
Palo Alto Networks Firewall (PAN_FIREWALL)
Palo Alto Panorama (PAN_PANORAMA)
Palo Alto Prisma Access (PAN_CASB)
Palo Alto Prisma Cloud Alert payload (PAN_PRISMA_CA)
Ping Identity (PING)
PostFix Mail (POSTFIX_MAIL)
Proofpoint On Demand (PROOFPOINT_ON_DEMAND)
Proofpoint Tap Alerts (PROOFPOINT_MAIL)
Proofpoint Threat Response (PROOFPOINT_TRAP)
Radware Web Application Firewall (RADWARE_FIREWALL)
Rapid7 Insight (RAPID7_INSIGHT)
SAP Hana Audit (SAP_HANA_AUDIT)
SecureAuth (SECUREAUTH_SSO)
Security Command Center Posture Violation (GCP_SECURITYCENTER_POSTURE_VIOLATION)
Security Command Center Threat (GCP_SECURITYCENTER_THREAT)
Security Command Center Toxic Combination (GCP_SECURITYCENTER_TOXIC_COMBINATION)
SentinelOne Deep Visibility (SENTINEL_DV)
SentinelOne Singularity Cloud Funnel (SENTINELONE_CF)
Silverfort Authentication Platform (SILVERFORT)
SiteMinder Web Access Management (CA_SSO_WEB)
SonicWall (SONIC_FIREWALL)
Squid Web Proxy (SQUID_WEBPROXY)
STIX Threat Intelligence (STIX)
Suricata EVE (SURICATA_EVE)
Sysdig (SYSDIG)
Tanium Threat Response (TANIUM_THREAT_RESPONSE)
Thinkst Canary (THINKST_CANARY)
Trend Micro Apex one (TRENDMICRO_APEX_ONE)
Unix system (NIX_SYSTEM)
Vectra XDR (VECTRA_XDR)
VMware ESXi (VMWARE_ESX)
Wallix Bastion (WALLIX_BASTION)
WatchGuard (WATCHGUARD)
Windows Defender AV (WINDOWS_DEFENDER_AV)
Windows DNS (WINDOWS_DNS)
Windows Event (WINEVTLOG)
Windows Event (XML) (WINEVTLOG_XML)
wiz.io (WIZ_IO)
Zscaler Email DLP (ZSCALER_EMAIL_DLP)

The following log types were added without a default parser. Each parser is listed by product name and log_type value, where applicable.

Altiris Logs (ALTIRIS_LOGS)
Aruba Access Point (ARUBA_AP)
BloxOne Threat Defense DHCP (BLOXONE_DHCP)
Checkmarx One (CHECKMARX_ONE)
Cisco Nexus Dashboard Orchestrator (CISCO_NDO)
CrowdStrike Cloud Security (CROWDSTRIKE_CSPM)
F5 F5OS-A Logging (F5_F5OS_A)
GateWatcher NDR (GATEWATCHER_NDR)
Hashicorp Terraform (HASHICORP_TERRAFORM)
Jamf Protect Alerts V2 (JAMF_PROTECT_V2)
Oracle Cloud Infrastructure Web Application Firewall (OCI_WAF)
Qualys File Integrity Monitoring (QUALYS_FIM)
SailPoint IdentityNow (SAILPOINT_IDENTITYNOW)
ServiceNow Certificate Logs (SERVICENOW_CERTIFICATE)
ServiceNow User Logs (SERVICENOW_USER)
ServiceNow User Login History (SERVICENOW_USER_LOGIN_HISTORY)
SiteGuard Server (SITEGUARD_SERVER)
Tosi Hub (TOSI_HUB)
Trellix Network Detection and Response (TRELLIX_NDR)

Deprecated

Support for the legacy Google Security Operations SIEM infrastructure will end on April 30, 2027. After this date, you will no longer have access to your Google SecOps SIEM instance on the legacy infrastructure. You need to self-migrate Google Security Operations SIEM in legacy Infrastructure to Google Cloud to align with industry standards and improve your reliability, privacy, security, compliance, and granular access controls. Follow the Migration guide and Community post to begin your transition.

This migration applies to you only if your SIEM instance meets one of the conditions below:

Not deployed in your Google Cloud Project
Not using Google Cloud Authentication (Workforce Identity Federation / Cloud Identity)
Not using Google Cloud IAM for Feature Role based access controls.

This migration does not apply to you if your SIEM instance meets all the conditions below:

Is deployed in your Google Cloud project
Uses Workforce Identity Federation or Cloud Identity for authentication
Uses Google Cloud IAM to manage granular access permissions

Announcement

New parser documentation now available

New parser documentation is available to help you ingest and normalize logs from the following sources:

Announcement

Emerging Threats Center general availability

The Emerging Threats Center is now in General Availability (GA) and includes the following new features and enhancements:

Expanded campaign filtering: Filter the Emerging Threats feed by new categories, including associated malware, tools, and threat actors.
MITRE ATT&CK matrix visualization: Evaluate your detection rule coverage for specific tactics, techniques, and procedures (TTPs) using the new visualization matrix in the Associated Rules panel. You can customize heat map metrics, filter the matrix by rule or alerting status, and view detailed context for specific sub-techniques.
Enhanced Entity context panel: Investigate an indicator of compromise (IoC) using the Entity context panel to view its point-in-time state and related cases.
GTI-associated IoC categories: Filter GTI-associated IoCs by specific categories, including Files, URLs, Domains, and IPs.

For more information, see Emerging Threats Center overview and Emerging Threats Center detail view.

Change

Search query editor enhancements

Google SecOps has enhanced the search query editor to provide intelligent auto-suggestions and improved error handling.

Auto-suggestions: The query editor now provides context-aware auto-suggestions for fields, operators, and valid values as you type.
Error handling: The editor now highlights syntax errors with a red squiggly line and displays a tooltip with the specific error description when you hover over it. Additionally, runtime errors now display persistently in the Results panel to assist with troubleshooting.

For more information, see Use auto-suggestions to build queries.

Feature

Health Hub

This feature is currently in Preview.

The Health Hub is the central location in Google Security Operations for you to monitor the status and health of all configured data sources. The Health Hub provides crucial information on data sources and log types, offering the context needed to diagnose and remediate data pipeline issues.

The Health Hub includes information about the following:

Ingestion volumes and ingestion health.
Parsing volumes from raw logs to Unified Data Model (UDM) events.
Context and links to interfaces with additional relevant information and functionality.
Irregular and failed sources and log types.

For more information, see Use the Health Hub.

Change

Updates to search query limits and error messaging

Google SecOps has updated search query limits for programmatic and web interface access:

Increased Queries Per Hour (QPH) limits of up to 2,000 for APIs and 1,000 for the web interface.
New concurrency limits for both simple and complex queries.
More descriptive error messages for quota failures in the API and web interface.

For more information, see Search limits and quotas

Deprecated

v1 Cloud Storage Feed Types (GCS, S3, SQS, Azure)

The v1 feed types for GOOGLE_CLOUD_STORAGE, AMAZON_S3, AMAZON_SQS, and AZURE_BLOBSTORE are deprecated and will be discontinued on March 15, 2027. The new v2 feed types uses the Google Cloud Storage Transfer Service (STS) to provide improved performance, scalability, and reliability.

To ensure continued ingestion, transition your feeds before the March 15, 2027 shutdown date:

Google SecOps will automatically migrate your feeds using v1 feed types to v2 in waves starting from April 6, 2026. To facilitate this, some feeds may require additional IP allowlist or service account permission updates. You can also self-migrate by replacing your existing data feeds with new feeds using v2 feed types.

You can also self-migrate by creating new feeds using v2 feed types to substitute your existing feeds using v1 feed types by following the steps documented in our feed configuration guides before March 15, 2027.

Key Dates:

April 6, 2026: Transition begins; auto-migration available.
September 15, 2026: Support for v1 feeds is discontinued.
March 15, 2027: v1 feeds reach End of Life (EOL) and will stop returning data.

For more information, see Feature deprecations.

Change

Google Security Operations has updated the list of supported default parsers. Parsers are updated gradually, so it might take one to four days before you see the changes reflected in your region.

The following supported default parsers have been updated. Each parser is listed by product name and log_type value, where applicable. This list includes both released default parsers and pending parser updates.

Abnormal Security (ABNORMAL_SECURITY)
Active Countermeasures (AI_HUNTER)
AIX system (AIX_SYSTEM)
Apache (APACHE)
Apache Cassandra (CASSANDRA)
Aruba (ARUBA_WIRELESS)
Aruba EdgeConnect SD-WAN (ARUBA_EDGECONNECT_SDWAN)
Auth0 (AUTH_ZERO)
AWS Aurora (AWS_AURORA)
AWS CloudFront (AWS_CLOUDFRONT)
AWS Cloudtrail (AWS_CLOUDTRAIL)
AWS CloudWatch (AWS_CLOUDWATCH)
AWS VPC Flow (AWS_VPC_FLOW)
AWS WAF (AWS_WAF)
Azure AD (AZURE_AD)
Azure AD Directory Audit (AZURE_AD_AUDIT)
Azure Front Door (AZURE_FRONT_DOOR)
Azure SQL (AZURE_SQL)
BeyondTrust (BOMGAR)
BeyondTrust BeyondInsight (BEYONDTRUST_BEYONDINSIGHT)
Blue Coat Proxy (BLUECOAT_WEBPROXY)
Broadcom Support Portal Audit Logs (BROADCOM_SUPPORT_PORTAL)
Check Point Harmony (CHECKPOINT_HARMONY)
Chronicle SOAR Audit (CHRONICLE_SOAR_AUDIT)
Cisco ASA (CISCO_ASA_FIREWALL)
Cisco Email Security (CISCO_EMAIL_SECURITY)
Cisco ISE (CISCO_ISE)
Cisco Meraki (CISCO_MERAKI)
Cisco Secure Access (CISCO_SECURE_ACCESS)
Cisco Switch (CISCO_SWITCH)
Cisco Umbrella Audit (CISCO_UMBRELLA_AUDIT)
Cisco Umbrella DNS (UMBRELLA_DNS)
Cisco WSA (CISCO_WSA)
Cloud DNS (GCP_DNS)
Cloud SQL (GCP_CLOUDSQL)
Cloudflare (CLOUDFLARE)
Cloudflare Warp (CLOUDFLARE_WARP)
Code42 Incydr (CODE42_INCYDR)
CrowdStrike Alerts API (CS_ALERTS)
CrowdStrike Falcon (CS_EDR)
CrowdStrike Falcon Stream (CS_STREAM)
CyberArk Privileged Access Manager (PAM) (CYBERARK_PAM)
Cybereason EDR (CYBEREASON_EDR)
CYJAX Threat Intelligence (CYJAX_THREAT_INTELLIGENCE)
Cyware Threat Intelligence Exchange (CTIX)
Databricks (DATABRICKS)
Duo Auth (DUO_AUTH)
Elastic Defend (ELASTIC_DEFEND)
ESET AV (ESET_AV)
F5 ASM (F5_ASM)
F5 BIGIP Access Policy Manager (F5_BIGIP_APM)
FireEye eMPS (FIREEYE_EMPS)
FireEye ETP (FIREEYE_ETP)
FireEye NX (FIREEYE_NX)
Forescout NAC (FORESCOUT_NAC)
ForgeRock Identity Cloud (FORGEROCK_IDENTITY_CLOUD)
Fortinet FortiAnalyzer (FORTINET_FORTIANALYZER)
GitHub (GITHUB)
Google Threat Intelligence IOC (GTI_IOC)
HP Aruba (ClearPass) (CLEARPASS)
Huawei Switches (HUAWEI_SWITCH)
IBM DataPower Gateway (IBM_DATAPOWER)
IBM Safenet (IBM_SAFENET)
IBM Websphere Application Server (IBM_WEBSPHERE_APP_SERVER)
Imperva Advanced Bot Protection (IMPERVA_ABP)
Imperva SecureSphere Management (IMPERVA_SECURESPHERE)
Juniper (JUNIPER_FIREWALL)
Kolide Endpoint Security (KOLIDE)
Kubernetes Audit (KUBERNETES_AUDIT)
Kubernetes Node (KUBERNETES_NODE)
Linux Auditing System (AuditD) (AUDITD)
Maria Database (MARIA_DB)
McAfee ePolicy Orchestrator (MCAFEE_EPO)
McAfee Skyhigh CASB (MCAFEE_SKYHIGH_CASB)
McAfee Web Gateway (MCAFEE_WEBPROXY)
Microsoft Azure Activity (AZURE_ACTIVITY)
Microsoft Defender For Cloud (MICROSOFT_DEFENDER_CLOUD_ALERTS)
Microsoft Graph API Alerts (MICROSOFT_GRAPH_ALERT)
Microsoft IIS (IIS)
Microsoft SQL Server (MICROSOFT_SQL)
Mimecast Mail V2 (MIMECAST_MAIL_V2)
Mobile Endpoint Security (LOOKOUT_MOBILE_ENDPOINT_SECURITY)
Mobileiron (MOBILEIRON)
NetApp ONTAP (NETAPP_ONTAP)
Netskope V2 (NETSKOPE_ALERT_V2)
Netskope Web Proxy (NETSKOPE_WEBPROXY)
Obsidian (OBSIDIAN)
Office 365 (OFFICE_365)
Oort Security Tool (OORT)
Oracle (ORACLE_DB)
Orca Cloud Security Platform (ORCA)
Palo Alto Cortex XDR Events (PAN_CORTEX_XDR_EVENTS)
Palo Alto Networks Firewall (PAN_FIREWALL)
Palo Alto Prisma Cloud Alert payload (PAN_PRISMA_CA)
PostFix Mail (POSTFIX_MAIL)
Proofpoint On Demand (PROOFPOINT_ON_DEMAND)
Proofpoint Tap Alerts (PROOFPOINT_MAIL)
Proofpoint Threat Response (PROOFPOINT_TRAP)
Radware Web Application Firewall (RADWARE_FIREWALL)
Red Hat OpenShift (REDHAT_OPENSHIFT)
Salesforce (SALESFORCE)
SAP Change Document (SAP_CHANGE_DOCUMENT)
SAP Gateway (SAP_GATEWAY)
SAP Hana Audit (SAP_HANA_AUDIT)
SAP Security Audit (SAP_SECURITY_AUDIT)
Security Command Center Posture Violation (GCP_SECURITYCENTER_POSTURE_VIOLATION)
Security Command Center Sensitive Data Risk (GCP_SECURITYCENTER_SENSITIVE_DATA_RISK)
Security Command Center Threat (GCP_SECURITYCENTER_THREAT)
Security Command Center Toxic Combination (GCP_SECURITYCENTER_TOXIC_COMBINATION)
Snyk Group level audit Logs (SNYK_SDLC)
Suricata EVE (SURICATA_EVE)
Symantec EDR (SYMANTEC_EDR)
Sysdig (SYSDIG)
Tenable Active Directory Security (TENABLE_ADS)
ThreatConnect IOC V3 (THREATCONNECT_IOC_V3)
Trellix HX Alerts (TRELLIX_HX_ALERTS)
Trellix HX Audit Events (TRELLIX_HX_AUDIT)
Trellix HX Event Streamer (TRELLIX_HX_ES)
Trellix HX Hosts (TRELLIX_HX_HOSTS)
Trend Micro Vision One Endpoint Vulnerabilities (TRENDMICRO_VISION_ONE_ENDPOINT_VULNERABILITIES)
Trend Micro Vision One Observerd Attack Techniques (TRENDMICRO_VISION_ONE_OBSERVERD_ATTACK_TECHNIQUES)
Trend Micro Vision One Workbench (TRENDMICRO_VISION_ONE_WORKBENCH)
TrendMicro Apex Central (TRENDMICRO_APEX_CENTRAL)
TXOne Stellar (TRENDMICRO_STELLAR)
Ubika Waf (UBIKA_WAF)
Unix system (NIX_SYSTEM)
Varonis (VARONIS)
Vmware Avinetworks iWAF (VMWARE_AVINETWORKS_IWAF)
VMware ESXi (VMWARE_ESX)
VMware Horizon (VMWARE_HORIZON)
Wallix Bastion (WALLIX_BASTION)
Windows DNS (WINDOWS_DNS)
Windows Event (WINEVTLOG)
Windows Event (XML) (WINEVTLOG_XML)
wiz.io (WIZ_IO)
Zeek JSON (BRO_JSON)
Zscaler (ZSCALER_WEBPROXY)

The following log types were added without a default parser. Each parser is listed by product name and log_type value, where applicable.

Action1 (ACTION1)
CDNetworks Cloud Security (CDNETWORKS_CLOUD_SECURITY)
Claude Compliance Logs (CLAUDE_COMPLIANCE_LOGS)
Dell RecoverPoint (DELL_RECOVERPOINT)
IBM Storwize (IBM_STORWIZE)
LeapXpert Audit Logs (LEAPXPERT_AUDIT)
Oracle Key Vault Audit Logs (ORACLE_KEY_VAULT_AUDIT_LOGS)
RSA Cloud (RSA_CLOUD)
ServiceNow Antivirus Activity (SERVICENOW_ANTIVIRUS_ACTIVITY)
ServiceNow Attachment (SERVICENOW_ATTACHMENT)
ServiceNow Email (SERVICENOW_EMAIL)
Versa Director (VERSA_DIRECTOR)
ZPE Systems NodeGrid (ZPE_SYSTEMS_NODEGRID)

Feature

Multi-stage queries in YARA-L

The Multi-stage queries feature is now GA. This feature lets you feed the output of one query stage into the input of another, providing more granular data transformation than a single, monolithic query.

You can use multi-stage queries in both Dashboards and Search to build sophisticated detection and visualization logic. No action is required to enable this feature.

Learn more about how to create multi-stage queries with YARA-L 2.0.

Feature

Credential validation for third-party API feed types

Credential validation is now available for all 49 third-party API connectors.

When you create a feed using a third-party API feed type, Google SecOps now automatically validates the provided credentials. This ensures that if credentials are incorrect:

Immediate feedback: The web interface displays an error message explaining the configuration failure.
Prevention of broken feeds: The system blocks the creation of the feed until valid credentials are provided, preventing the creation of broken feeds that fail to ingest data later.

Announcement

New parser documentation now available

New parser documentation is available to help you ingest and normalize logs from the following sources:

Feature

Bindplane features for Google SecOps general availability

The following Bindplane features that relate to Google SecOps are now in General Availability (GA):

Single sign-on with custom claims role mapping: gives a production-ready way to manage Bindplane access through your identity provider. For more information, see Single Sign-On (Cloud).
SecOps parser validator: validates that your logs will be parsed correctly by Google SecOps directly from the snapshot view. Get immediate feedback on parsed events or validation errors without waiting for data to appear in Google SecOps. For more information, see Validate SecOps Parser.
Forwarder migration tool: provides production-ready paths to migrate existing forwarder configurations into Bindplane-managed pipelines. For more information, see Migrate Configurations.

Announcement

Manage parser versions

The Manage parser versions feature is in Public Preview for all customers.

Feature

Set up and manage data processing pipelines

This feature is currently in Preview.

You can now use the Data Processing pipelines to filter, transform, and redact Google SecOps data before ingestion. This feature provides more control over ingested data, letting you reduce costs by filtering out unwanted events, transform data for better compatibility, and protect sensitive information by redacting or masking values before storage.

You can configure data processing pipelines using the Bindplane console or the Google SecOps Data Pipeline APIs.

For more information, see Set up and manage data processing pipelines.

Change

Google SecOps has updated the list of supported default parsers. Parsers are updated gradually, so it might take one to four days before you see the changes reflected in your region. For more information, see Supported log types and default parsers.

The following supported default parsers have been updated. Each parser is listed by product name and log_type value, where applicable. This list includes both released default parsers and pending parser updates.

Acalvio (ACALVIO)
AIX system (AIX_SYSTEM)
Akamai WAF (AKAMAI_WAF)
Apache (APACHE)
Apache Cassandra (CASSANDRA)
Apache Hadoop (HADOOP)
Arcsight CEF (ARCSIGHT_CEF)
Aruba EdgeConnect SD-WAN (ARUBA_EDGECONNECT_SDWAN)
Attivo Networks (ATTIVO)
AWS Aurora (AWS_AURORA)
AWS Cloudtrail (AWS_CLOUDTRAIL)
AWS CloudWatch (AWS_CLOUDWATCH)
AWS GuardDuty (GUARDDUTY)
AWS Network Firewall (AWS_NETWORK_FIREWALL)
AWS Security Hub (AWS_SECURITY_HUB)
AWS WAF (AWS_WAF)
Azure AD (AZURE_AD)
Azure AD Directory Audit (AZURE_AD_AUDIT)
Azure AD Sign-In (AZURE_AD_SIGNIN)
Azure Firewall (AZURE_FIREWALL)
Azure Front Door (AZURE_FRONT_DOOR)
Barracuda Email (BARRACUDA_EMAIL)
Barracuda Firewall (BARRACUDA_FIREWALL)
Blue Coat Proxy (BLUECOAT_WEBPROXY)
Check Point (CHECKPOINT_FIREWALL)
Check Point Harmony (CHECKPOINT_HARMONY)
Cisco Application Centric Infrastructure (CISCO_ACI)
Cisco ASA (CISCO_ASA_FIREWALL)
Cisco Firepower NGFW (CISCO_FIREPOWER_FIREWALL)
Cisco Internetwork Operating System (CISCO_IOS)
Cisco ISE (CISCO_ISE)
Cisco Router (CISCO_ROUTER)
Cisco Secure Access (CISCO_SECURE_ACCESS)
Cisco Switch (CISCO_SWITCH)
Cisco TACACS+ (CISCO_TACACS)
Cisco UCM (CISCO_UCM)
Cisco Umbrella Audit (CISCO_UMBRELLA_AUDIT)
Citrix Netscaler (CITRIX_NETSCALER)
Claroty Continuous Threat Detection (CLAROTY_CTD)
Claroty Enterprise Management Console (CLAROTY_EMC)
Claroty Xdome (CLAROTY_XDOME)
Cloud SQL (GCP_CLOUDSQL)
Cloudflare (CLOUDFLARE)
Cloudflare Audit (CLOUDFLARE_AUDIT)
Cloudflare WAF (CLOUDFLARE_WAF)
Cloudflare Warp (CLOUDFLARE_WARP)
Corelight (CORELIGHT)
CrowdStrike Alerts API (CS_ALERTS)
CrowdStrike Detection Monitoring (CS_DETECTS)
CrowdStrike Falcon (CS_EDR)
CrowdStrike Falcon Stream (CS_STREAM)
CyberArk (CYBERARK)
CyberArk Endpoint Privilege Manager (EPM) (CYBERARK_EPM)
CyberArk Privileged Access Manager (PAM) (CYBERARK_PAM)
Dell EMC Data Domain (DELL_EMC_DATA_DOMAIN)
Dell Switch (DELL_SWITCH)
Duo Auth (DUO_AUTH)
F5 ASM (F5_ASM)
F5 BIGIP LTM (F5_BIGIP_LTM)
F5 Distributed Cloud Services (F5_DCS)
F5 DNS (F5_DNS)
FireEye NX (FIREEYE_NX)
Forcepoint NGFW (FORCEPOINT_FIREWALL)
Forcepoint Proxy (FORCEPOINT_WEBPROXY)
FortiGate (FORTINET_FIREWALL)
Fortinet FortiAnalyzer (FORTINET_FORTIANALYZER)
Google Cloud (GCP_SECURITYCENTER_THREAT)
Google Cloud (GCP_MONITORING_ALERTS)
Google Threat Intelligence IOC (GTI_IOC)
GreyNoise (GREYNOISE)
Halcyon Anti Ransomware (HALCYON)
HP Aruba (ClearPass) (CLEARPASS)
Huawei Switches (HUAWEI_SWITCH)
Infoblox DNS (INFOBLOX_DNS)
Island Browser logs (ISLAND_BROWSER)
Kubernetes Node (KUBERNETES_NODE)
Linux Auditing System (AuditD) (AUDITD)
Linux Sysmon (LINUX_SYSMON)
ManageEngine ADAudit Plus (ADAUDIT_PLUS)
Maria Database (MARIA_DB)
McAfee IPS (MCAFEE_IPS)
McAfee Web Gateway (MCAFEE_WEBPROXY)
Microsoft Azure Activity (AZURE_ACTIVITY)
Microsoft Defender For Cloud (MICROSOFT_DEFENDER_CLOUD_ALERTS)
Microsoft Graph API Alerts (MICROSOFT_GRAPH_ALERT)
Microsoft IIS (IIS)
Microsoft SQL Server (MICROSOFT_SQL)
MISP Threat Intelligence (MISP_IOC)
Mobileiron (MOBILEIRON)
MySQL (MYSQL)
NetApp ONTAP (NETAPP_ONTAP)
Netskope V2 (NETSKOPE_ALERT_V2)
NGINX (NGINX)
Nozomi Networks Scada Guardian (NOZOMI_GUARDIAN)
Office 365 (OFFICE_365)
Open Cybersecurity Schema Framework (OCSF) (OCSF)
Orca Cloud Security Platform (ORCA)
Palo Alto Networks Firewall (PAN_FIREWALL)
Palo Alto Panorama (PAN_PANORAMA)
Palo Alto Prisma Cloud Alert payload (PAN_PRISMA_CA)
Ping One (PING_ONE)
PingIdentity Directory Server Logs (PING_DIRECTORY)
PostFix Mail (POSTFIX_MAIL)
PostgreSQL (POSTGRESQL)
Proofpoint On Demand (PROOFPOINT_ON_DEMAND)
Proofpoint Tap Alerts (PROOFPOINT_MAIL)
Proofpoint Threat Response (PROOFPOINT_TRAP)
Radware Web Application Firewall (RADWARE_FIREWALL)
Red Hat OpenShift (REDHAT_OPENSHIFT)
Rubrik Security Cloud (RUBRIK_SECURITY_CLOUD)
SailPoint IdentityIQ (SAILPOINT_IIQ)
Salesforce (SALESFORCE)
SAP Change Document (SAP_CHANGE_DOCUMENT)
SAP Gateway (SAP_GATEWAY)
SAP HANA (SAP_HANA)
SAP Hana Audit (SAP_HANA_AUDIT)
SAP Identity and Authentication Data (SAP_IDENTITY_AND_AUTH_DATA)
SAP Internet Communication Manager (SAP_ICM)
SAP Security Audit (SAP_SECURITY_AUDIT)
SAP Webdispatcher (SAP_WEBDISP)
Security Command Center Posture Violation (GCP_SECURITYCENTER_POSTURE_VIOLATION)
Security Command Center Toxic Combination (GCP_SECURITYCENTER_TOXIC_COMBINATION)
Sophos Central (SOPHOS_CENTRAL)
STIX Threat Intelligence (STIX)
Stormshield Firewall (STORMSHIELD_FIREWALL)
Suricata EVE (SURICATA_EVE)
Symantec Endpoint Protection (SEP)
Sysdig (SYSDIG)
Tableau (TABLEAU)
Teleport Access Plane (TELEPORT_ACCESS_PLANE)
Trend Micro (TIPPING_POINT)
Tripwire (TRIPWIRE_FIM)
TXOne Stellar (TRENDMICRO_STELLAR)
Ubika Waf (UBIKA_WAF)
Unix system (NIX_SYSTEM)
Velo Firewall (VELO_FIREWALL)
Veritas NetBackup (VERITAS_NETBACKUP)
Versa Firewall (VERSA_FIREWALL)
Vmware Avinetworks iWAF (VMWARE_AVINETWORKS_IWAF)
VMware ESXi (VMWARE_ESX)
VMware vCenter (VMWARE_VCENTER)
WatchGuard (WATCHGUARD)
Windows DNS (WINDOWS_DNS)
Windows Event (WINEVTLOG)
Windows Event (XML) (WINEVTLOG_XML)
wiz.io (WIZ_IO)
Workday Audit Logs (WORKDAY_AUDIT)
Zscaler (ZSCALER_WEBPROXY)
ZScaler VPN (ZSCALER_VPN)

The following log types were added without a default parser. Each parser is listed by product name and log_type value, where applicable.

Alibaba Security Center (ALIBABA_SECURITY_CENTER)
Apache Airflow (APACHE_AIRFLOW)
Baramundi (BARAMUNDI)
Bravura Security (BRAVURA)
Buildkite Audit (BUILDKITE_AUDIT)
Palo Alto Cortex Xpanse (CORTEX_XPANSE)
Cyfirma DeCYFIR ServiceNow (CYFIRMA_DECYFIR)
DATEV (DATEV)
ELO (ELO)
Forcepoint Secure Web Gateway (FORCEPOINT_SWG)
JumpServer PAM (JUMPSERVER_PAM)
Keep Aware (KEEP_AWARE)
Lark Suite (LARK_SUITE)
Macmon (MACMON)
Mamori Database Activity Monitoring (MAMORI_DAM)
N8N Security Audit Logs (N8N_SECURITY_AUDIT_LOGS)
Oracle Cloud Infrastructure LoadBalancer (OCI_LOADBALANCER)
OpenText Self Service Password Reset (OPENTEXT_SSPR)
Rackspace (RACKSPACE)
Secui Bluemax NGF (SECUI_BLUEMAX_NGF)
Symantec Advanced Threat Protection (SYMANTEC_ATP)
Tenable Vulnerabilities Management (TENABLE_VMGNT)
Trellix EDRF Trace Data and Telemetry (TRELLIX_EDRF)
Trend Micro Vision One Endpoint Vulnerabilities (TRENDMICRO_VISION_ONE_ENDPOINT_VULNERABILITIES)
Zafran (ZAFRAN)

Feature

New Unified rules interface

This feature is currently in Preview.

Google SecOps has launched a unified rules interface that brings custom and curated rule management into a single, cohesive workflow. This update optimizes detection engineering with a redesigned dashboard, an advanced rule editor, and expanded API capabilities to streamline rule deployment and troubleshooting.

Key enhancements

Developer and IDE enhancements:

Centralized management: A unified, single dashboard lets you browse, filter, and manage both custom and curated rules from one location. You can also update configurations for multiple rules simultaneously.
Curated rule transparency: You can now view the YARA-L text of curated rules, search directly within their logic, and independently toggle individual rule statuses without needing to alter the parent rule pack deployment.
Integrated IDE experience: The rule editor now features an enhanced IDE experience with inline error highlights, UDM field definitions on hover.

Expanded API and structured search:

The Rules API and dashboard have been upgraded to support deeper programmatic access and complex filtering:

Robust search syntax: Both the UI and API now support AIP-160 compliant structured search. You can filter rules by text, tags, author, and execution state.
Batch modifications: The rules.modifyRules method now supports non-atomic batch updates, letting you change live status, alerting status, tags, and archive status across multiple rules in a single API request.
Advanced resource views: The rules.list method introduces CONFIG_ONLY and TRENDS views. These views provide expanded deployment information, access to curated rule resources, and larger page sizes (up to 5000 results) for efficient querying.

For details, see Manage unified rules.

Feature

Added support for Google Cloud VPC Service Controls

This feature is currently in Preview.

VPC Service Controls helps protect against accidental or targeted action by external entities or insider entities, which helps to minimize unwarranted data exfiltration risks from Google Cloud services. You can use VPC Service Controls to create perimeters that protect the resources and data of services that you explicitly specify. For more information, see Overview of VPC Service Controls.

Feature

New: cross joins in multi-stage queries

You can now use cross joins in YARA-L 2.0 multi-stage queries let you compare individual UDM event data against aggregated statistics calculated in previous YARA-L stages. They are supported in:

Search
Dashboards

For more information, see Cross joins in multi-stage queries.

Feature

RBAC for ingestion metrics

Administrators can now use RBAC for ingestion metrics to restrict visibility of system health data, such as ingestion volume, errors, and throughput, based on a user's business scope.

The Data Ingestion and Health dashboard now uses Data Access scopes. When a scoped user loads the dashboard, the system automatically filters metrics to show only data that matches their assigned labels: Namespace, Log Type, and Ingestion Source.

For more information, see Ingestion metrics.

Announcement

New parser documentation now available

New parser documentation is available to help you ingest and normalize logs from the following sources:

Feature

New capabilities in Feeds page

The following options have been added to the Feeds page:

Search
Filtering (using feed attributes)
Pagination
Last Refreshed Time
Feed Metadata Export to CSV

Feature

Advanced Joins in Search

Google SecOps now supports expanded capabilities for correlating data across multiple sources. These join operations are also supported in multistage queries.

Joins without a match section: You can now use join operations to correlate and combine data from multiple sources based on common field values without requiring a match section (unlike statistical joins). Results are displayed in a Joins table, which you can download as a CSV, or for event-to-event joins, exported to a datatable for further analysis.

For more information, see Implement joins without a match section.

Outer joins: Search now supports left and right outer joins. Unlike standard inner joins, these operations let you retrieve all records from a primary data source even if no matching entry exists in the secondary source (unmatched fields are returned as null). This action lets you correlate data without losing unmatched events.

For more information, see Correlate data with outer joins.

Announcement

Enhanced rule observability: New metadata, visual indicators, and dashboards

Google Security Operations has introduced updates to how detection and alert data is processed and visualized. These changes help Google SecOps teams distinguish between primary rule runs and rule replays, which provides clarity on detection delays and the impact of late-arriving enrichment data.

Key improvements
- Enhanced metadata: Detection and alert objects now include specific metadata that identifies whether they were produced during a primary rule run, or as part of a rule replay or retrohunt.
- Improved troubleshooting: This data lets Google SecOps teams definitively answer critical operational questions, such as the cause of perceived detection delays or the specific impact of late-arriving enrichment data on active rules.
- Rule replay insights: Learn more about the distinction between primary runs and replays to manage the re-enrichment of Unified Data Model (UDM) events. For detailed definitions and technical workflows, see Understand rule replays and Understand rule detection delays.
- New detection dashboard: To support these backend metadata changes, a new Detection Health dashboard is now available. This interface provides a visual representation of rule performance and replay status, letting teams monitor detection health more effectively.
- Custom reporting: There are new fields available in the Detections schema, letting you build custom dashboards.
New metadata and third-party integration: Detections and alerts now emit specific metadata to help customers track timing and latency. This data is available for integration with third-party systems using the following fields:
- detectionTimingDetails: An enum identifying the run type:
- DETECTION_TIMING_DETAILS_REPROCESSING
- DETECTION_TIMING_DETAILS_RETROHUNT
- DETECTION_TIMING_DETAILS_UNSPECIFIED
- latencyMetrics: Includes timestamps for oldestIngestionTime, newestIngestionTime, oldestEventTime, and newestEventTime.
Enhanced platform and visual indicators:
- Alerts and rule details: A new visual indicator in the Detection Type column provides granular details on hover.
- Filter facets: The Alerts lister page now includes detection timing details as a filterable facet.
- SOAR integration: In the Case Overview, the Composite Detections table now carries through the same iconography for a consistent investigation experience.

Feature

The re.capture_all function is now available

The new re.capture_all YARA-L 2.0 function is available in Rules, Search, and Dashboards.

Use the re.capture_all() function to extract every non-overlapping match of a regular expression from a string. While the standard re.capture function stops after the first match it finds, the re.capture_all() function continues through the entire string to identify every instance that matches your pattern.

Announcement

New parser documentation now available

New parser documentation is available to help you ingest and normalize logs from the following sources:

Google Security Operations SIEM release notes Stay organized with collections Save and categorize content based on your preferences.

August 12, 2026

July 29, 2026

July 20, 2026

July 15, 2026

July 01, 2026

June 30, 2026

June 28, 2026

June 26, 2026

June 23, 2026

June 17, 2026

June 16, 2026

June 13, 2026

June 12, 2026

June 09, 2026

May 31, 2026

May 28, 2026

May 27, 2026

May 18, 2026

May 17, 2026

May 12, 2026

May 05, 2026

April 22, 2026

April 19, 2026

April 08, 2026

April 07, 2026

April 06, 2026

April 03, 2026

March 31, 2026

March 25, 2026

March 23, 2026

March 18, 2026

March 12, 2026

March 10, 2026

March 05, 2026

March 02, 2026

February 25, 2026

February 24, 2026

February 23, 2026

February 20, 2026

February 12, 2026

February 09, 2026

February 04, 2026

Google Security Operations SIEM release notes