FeatureOct 18, 2026

Specify whether to reopen closed cases when the grouping is by Source Grouping Identifier

Google Security OperationsGCP · Security and Identity

Specify whether to reopen closed cases when the grouping is by Source Grouping Identifier

You can now specify whether Google SecOps reopens closed cases when grouping alerts by Source Grouping Identifier. When the option is enabled and a new alert is received with a source grouping identifier of a case that was previously closed in Google SecOps, then Google SecOps reopens the case. For more information, see Configure alert grouping.

Read the original announcement

All Google Security Operations updates →

Release 6.3.103 is being rolled out to the first phase of regions as listed here.
Google Security OperationsRegionOct 18, 2026
Deprecation of the ListCaseEvents API endpoint
Effective October 12, 2026, the ListCaseEvents API endpoint is deprecated. You should use the ListCaseEvidenceData API endpoint instead.
Google Security OperationsDeprecationOct 18, 2026Effective Oct 12, 2026
Release 6.3.102 is now available for all regions.
Google Security OperationsRegionOct 17, 2026
Microsoft Graph Mail Delegated: Version 26.0
Updated the Folder Name parameter to be optional, allowing searches across the entire mailbox when no folder is specified in the following action:
Google Security OperationsFeatureOct 14, 2026
Microsoft Graph Mail: Version 49.0
Updated the Folder Name parameter to be optional, allowing searches across the entire mailbox when no folder is specified in the following action:
Google Security OperationsFeatureOct 14, 2026

Specify whether to reopen closed cases when the grouping is by Source Grouping Identifier

More from Google Security Operations

Specify whether to reopen closed cases when the grouping is by Source Grouping Identifier

More from Google Security Operations