FeatureSep 6, 2026

Reaction triggers

Google Security OperationsGCP · Security and Identity

Reaction triggers

This feature is in preview. Google SecOps now supports reaction triggers. As post-ingestion triggers, they allow playbooks to automatically fire in response to real-time case or alert updates during active investigations, such as changes to the case assignee, case tags, alert priority, or newly added entities.

For more information, see Use reaction triggers in playbooks.

Read the original announcement

All Google Security Operations updates →

The deadline for the migration of SOAR APIs to the Chronicle API has been extended from November 30, 2026 until March 31, 2027.
For more information, refer to SOAR Migration overview
Google Security OperationsFeatureOct 12, 2026
[Spotlight Feature] Monitor response and playbook health with the Response Health Hub
Google SecOps now includes the Response Health Hub curated dashboard, a central location for monitoring playbook performance, execution latency, automation effectiveness, and integration health across environments.

Reaction triggers

More from Google Security Operations

Reaction triggers

More from Google Security Operations