Security analytics (SIEM)

Release 6.3.103 is being rolled out to the first phase of regions as listed here.

Specify whether to reopen closed cases when the grouping is by Source Grouping Identifier

You can now specify whether Google SecOps reopens closed cases when grouping alerts by Source Grouping Identifier.

Deprecation of the ListCaseEvents API endpoint

Effective October 12, 2026, the ListCaseEvents API endpoint is deprecated. You should use the ListCaseEvidenceData API endpoint instead.

Release 6.3.102 is now available for all regions.

Microsoft Graph Mail Delegated: Version 26.0

Updated the Folder Name parameter to be optional, allowing searches across the entire mailbox when no folder is specified in the following action:

Microsoft Graph Mail: Version 49.0

Updated the Folder Name parameter to be optional, allowing searches across the entire mailbox when no folder is specified in the following action:

Google Chronicle: Version 98.0

Added the Use Cache and Cache TTL parameters to enable caching of data table responses in the following actions:

Splunk: Version 68.0

Added the Alert Start Time Field parameter to specify a custom field for determining the alert start time in the following connector:

Email Utilities: Version 17.0

Resolved an issue causing entities to not be created when Create Observed Entities was configured for specific entity types in the following action:

SentinelOneV2: Version 52.0

Fixed an issue to properly handle merged cases during threat synchronization in the following job:

Okta: Version 18.0

Fixed a pagination issue to retrieve all available roles and user groups in the following actions:

Google Threat Intelligence: Version 21.0

Improved issue ingestion to adaptively scan the configured Max Hours Backwards time range and skip periods without new issues in the following connector:

Google SecOps has updated the list of supported default parsers.

Parsers are updated gradually, so it might take one to four days before you see the changes reflected in your region.

The deadline for the migration of SOAR APIs to the Chronicle API has been extended from November 30, 2026 until March 31, 2027.

For more information, refer to SOAR Migration overview

Applied Threat Intelligence curated rules now use the GTI_IOC feed

As a follow-up to the release of the GTI_IOC feed and the deprecation of the legacy MANDIANT_ACTIVE_BREACH_IOC, MANDIANT_FUSION_IOC, and OPEN_SOURCE_INTEL_IOC feeds, the Applied Threat Intelligence (ATI) curated detection rules are being updated to match against the GTI_IOC…

[Spotlight Feature] Monitor response and playbook health with the Response Health Hub

Google SecOps now includes the Response Health Hub curated dashboard, a central location for monitoring playbook performance, execution latency, automation effectiveness, and integration health across environments.

Release 6.3.102 is being rolled out to the first phase of regions as listed here.

This release contains internal and customer bug fixes.

Release 6.3.101 is now available for all regions.

Google SecOps has updated the list of supported default parsers.

Parsers are updated gradually, so it might take one to four days before you see the changes reflected in your region.

Gitsync: Version 53.0

(REGRESSIVE) Integration: Updated to support the latest Chronicle API.