[Spotlight Feature] Security Tokens
Security Tokens are now available for metering agentic consumption within Google SecOps. Tokens are consumed by generally available security agents only. These agents are invoked automatically or manually using the web interface, CLI, chat, or Model Context Protocol (MCP). Assistive features, such as standard chat panels and automated summaries, along with preview agents, won't consume Security Tokens.
Security Tokens will start rolling out across all regions starting July 1. For more information, see Google SecOps Agentic SOC Security Tokens pricing and billing.
]]>Increased multiple event limits
Multiple event rule limits have been increased to 200 for Enterprise customers and 400 for Enterprise+ customers.
For more information, see Package comparison
Unified rules interface
The new rules interface is now available in public preview.
The Google SecOps unified rules interface brings custom and curated rule management into a single, cohesive workflow. This optimizes detection engineering with a redesigned dashboard, an advanced rule editor, and expanded API capabilities to streamline rule deployment and troubleshooting.
You can still revert to the legacy experience. At the top right of the screen, click Switch to the legacy experience.
For more information about the Unified rules interface, see Manage unified rules.
]]>Google SecOps has updated the list of supported default parsers. Parsers are updated gradually, so it might take one to four days before you see the changes reflected in your region.
The following supported default parsers have been updated. Each parser is listed by product name and log_type value, where applicable. This list includes both released default parsers and pending parser updates.
AIX_SYSTEM)AWS_API_GATEWAY)APACHE)APPIAN_CLOUD)ARUBA_SWITCH)ATLASSIAN_BITBUCKET)AVAYA_AURA)AWS_CLOUDWATCH)GUARDDUTY)AWS_NETWORK_FIREWALL)AWS_RDS)AWS_SECURITY_HUB)AWS_VPC_FLOW)AWS_VPC_FLOW_CSV)AWS_WAF)AZURE_AD)BARRACUDA_WAF)BLUECOAT_WEBPROXY)CATO_NETWORKS)CHECKPOINT_HARMONY)CHROME_MANAGEMENT)CIRCLECI)CISCO_ACS)CISCO_ASA_FIREWALL)CISCO_EMAIL_SECURITY)CISCO_FIREPOWER_FIREWALL)CISCO_IRONPORT)CISCO_ISE)CISCO_MERAKI)CISCO_ROUTER)CISCO_SECURE_ACCESS)CISCO_SWITCH)CISCO_UMBRELLA_AUDIT)UMBRELLA_FIREWALL)UMBRELLA_WEBPROXY)CISCO_SDWAN)CISCO_WIRELESS)CITRIX_NETSCALER)CLAROTY_XDOME)CLOUDFLARE)CORELIGHT)CS_ALERTS)CS_EDR)CYBERARK_PTA)CYNET_360_AUTOXDR)DELL_SWITCH)ELASTIC_WINLOGBEAT)F5_ASM)F5_BIGIP_LTM)FIREEYE_ETP)FIREEYE_NX)FORCEPOINT_WEBPROXY)FORTINET_FIREWALL)FORTINET_FORTIMAIL)FORTINET_FORTIANALYZER)FORTINET_FORTIWEB)GITHUB)GCP_CLOUDAUDIT)GCP_DNS)HAPROXY)IBM_LTO)IMPERVA_CEF)IMPERVA_SECURESPHERE)INFOBLOX_DNS)ISLAND_BROWSER)JUMPCLOUD_DIRECTORY_INSIGHTS)KEMP_LOADBALANCER)KUBERNETES_NODE)ADAUDIT_PLUS)MICROSOFT_DEFENDER_ENDPOINT)MICROSOFT_DEFENDER_MAIL)MICROSOFT_GRAPH_ALERT)IIS)MICROSOFT_SQL)MISP_IOC)NETAPP_ONTAP)NETIQ_EDIRECTORY)NETSKOPE_ALERT_V2)NETSKOPE_WEBPROXY)NGINX)NONAME_API_SECURITY)OFFICE_365)OKTA)ORACLE_DB)OCI_FLOW)ORACLE_NETSUITE)PAN_FIREWALL)PAN_PANORAMA)PAN_CASB)PAN_PRISMA_CA)PING)PROOFPOINT_ON_DEMAND)RSA_AUTH_MANAGER)SALESFORCE)GCP_SECURITYCENTER_ERROR)GCP_SECURITYCENTER_MISCONFIGURATION)GCP_SECURITYCENTER_OBSERVATION)GCP_SECURITYCENTER_POSTURE_VIOLATION)GCP_SECURITYCENTER_THREAT)GCP_SECURITYCENTER_TOXIC_COMBINATION)GCP_SECURITYCENTER_UNSPECIFIED)GCP_SECURITYCENTER_VULNERABILITY)SENDMAIL)SENTINELONE_ACTIVITY)SERVICENOW_CMDB)SOPHOS_FIREWALL)SQUID_WEBPROXY)SYMANTEC_EDR)SEP)SYSDIG)THINKST_CANARY)TRELLIX_EDRF)TRENDMICRO_VISION_ONE_DETECTIONS)TRENDMICRO_VISION_ONE_WORKBENCH)NIX_SYSTEM)VARONIS)VEEAM)VMWARE_VCENTER)VMWARE_VSPHERE)WINDOWS_DNS)WINEVTLOG)WINEVTLOG_XML)WINDOWS_SYSMON)WIZ_IO)WORKDAY_USER_ACTIVITY)BRO_JSON)ZSCALER_WEBPROXY)ZSCALER_FIREWALL)The following log types were added without a default parser. Each parser is listed by product name and log_type value, where applicable.
CISCO_SECURE_ACCESS_ENROLLMENT)CISCO_SECURE_ACCESS_NETWORK)CYBERARK_CERTIFICATE_MANAGER_SAAS)GEMINI_ENTERPRISE_AGENT_PLATFORM)GEOSCADA_OT)MCPDEV)MCPMODIFY)MCPVIEW)NETAPP_RANSOMWARE_RESILIENCE)NETSKOPE_LOG_STREAMING)PYLON_LOGS)RECO_CSPM)SALT_SECURITY)SENTINELONE_APPLICATION)WIZ_VULNERABILITIES)Improved documentation portal navigation
Finding help is now easier! We've updated the navigation of our documentation portal to be primarily user-centric. Sections have been reorganized and renamed to align with your workflows, providing a logical path through the documentation.
We've also added:
Ask Gemini Cloud Assist in Feed Management
Google SecOps now provides Gemini Cloud Assist (GCA) directly within the Feed Management interface to help you with feed creation, setup, and general troubleshooting questions.
A new Ask Gemini Cloud Assist button is now available in the Feed Management interface. You can click this button to open the Gemini Cloud Assist panel and ask questions to get guidance on:
Note: Gemini Cloud Assist provides recommendations and answers to your questions, but does not perform configuration changes on your behalf. You must apply any recommended changes manually to your feeds.
For more information, see Feed management overview.
Ingestion metrics reporting correction
Google Security Operations has resolved an issue where certain ingestion metrics—which are displayed in both the dashboard and Cloud Monitoring—were under-reported.
Because of this correction, you might notice a one-time apparent spike in your ingestion metrics when the update is enabled for your region (between June 29 and July 10, 2026). The actual log volume ingested remains unchanged.
Historical metrics recorded before this update will not be modified or backfilled. This correction does not affect customer billing.
If you have questions or need assistance, contact Google Security Operations support.
]]>Auto-collapse setting for the query editor
You can now configure the query editor to automatically collapse after you run a search, maximizing the screen space available for viewing your search results. By default, the query editor remains expanded.
For more information, see Configure query editor behavior.
]]>New Documentation changelogs
Google SecOps is now releasing a monthly changelog to capture major documentation updates.
For more information, refer to Documentation changelog.
]]>Non-prioritized IoC Matching rules Category
Google SecOps has introduced a new detection category, Non-prioritized IoC Matching rules, as part of the Curated Detections feature. These rule sets integrate with Google's Indicators of Compromise (IoC) feeds and build on curated threat intelligence to identify malicious activities within Google SecOps environments, specifically focusing on threats identifiable through high-fidelity indicators like IPs, domains, and file hashes.
This rules category provides comprehensive coverage for threats often missed by standard managed content, including cryptomining, Command and Control (C2) communications, and the use of malicious anonymization services.
For more information, refer to Non-prioritized IoC Matching rules category overview.
]]>[Spotlight Feature] Investigate detections in Google SecOps Search
Google SecOps Search now supports querying, filtering, and analyzing system-generated detections. When searching on events or entities, matching detections will now appear in the Alerts and Detections tab, providing a more holistic workflow for threat investigation.
For more details, see Investigate detections in Search.
Asynchronous Search APIs for large datasets
Google SecOps now supports asynchronous Search APIs that let you perform long-running queries without blocking your applications. This is ideal for searches that return a large volume of results.
For more information, see Asynchronous Search APIs and Result limits for data sources.
]]>UDM fields now show the sources of enrichment
The new Enrichment feature introduces improvements for managing and understanding your data. Each UDM field is now labeled with an icon to indicate its data source: U for unenriched fields and E for enriched fields. Enriched fields contain additional metadata values that indicate the source of the enriched data.
For more information, see: Viewing events.
]]>Google SecOps has updated the list of supported default parsers. Parsers are updated gradually, so it might take one to four days before you see the changes reflected in your region.
The following supported default parsers have been updated. Each parser is listed by product name and log_type value, where applicable. This list includes both released default parsers and pending parser updates.
ONEPASSWORD_AUDIT_EVENTS)AIX_SYSTEM)APACHE)ARUBA_EDGECONNECT_SDWAN)AVAYA_AURA)AWS_CLOUDFRONT)AWS_CLOUDTRAIL)GUARDDUTY)AWS_SECURITY_HUB)AZURE_AD)AZURE_AD_CONTEXT)AZURE_AD_SIGNIN)AZURE_SQL)AZURE_STORAGE_AUDIT)BARRACUDA_WAF)BLUECOAT_WEBPROXY)CHROME_MANAGEMENT)CISCO_ACS)CISCO_ISE)CISCO_SECURE_ACCESS)CISCO_SECURE_WORKLOAD)CISCO_SWITCH)CISCO_UMBRELLA_AUDIT)CITRIX_NETSCALER)CLAROTY_XDOME)CLAUDE_COMPLIANCE_LOGS)CLOUDFLARE)CLOUDFLARE_WARP)CORELIGHT)CS_ALERTS)CS_EDR)CYBERARK)CYBERARK_PAM)DUO_ADMIN)EFFICIENTIP_DDI)ELASTIC_AUDITBEAT)ELASTIC_WINLOGBEAT)F5_ASM)FORCEPOINT_WEBPROXY)FORTINET_FIREWALL)GITHUB)GCP_CLOUD_ASSET_INVENTORY)GCP_CLOUDAUDIT)GCP_COMPUTE_CONTEXT)GTI_IOC)GTB_DLP)CLEARPASS)IBM_WEBSPHERE_APP_SERVER)IBM_ZOS)IMPERVA_WAF)IMPERVA_CEF)IMPERVA_DRA)IMPERVA_SECURESPHERE)ISLAND_BROWSER)JUNIPER_FIREWALL)JUNIPER_MIST)KUBERNETES_NODE)LASTPASS)AUDITD)AZURE_ACTIVITY)MICROSOFT_DEFENDER_MAIL)IIS)MOBILEIRON)MONGO_DB)MYSQL)NETAPP_STORAGEGRID)NETSKOPE_ALERT_V2)NETSKOPE_WEBPROXY)GCP_NGFW_ENTERPRISE)OFFICE_365)OFFICE_365_MESSAGETRACE)OKTA_SCALEFT)ORACLE_DB)OCI_AUDIT)ORCA)PROOFPOINT_ON_DEMAND)RADWARE_FIREWALL)REDHAT_DIRECTORY_SERVER)REDHAT_OPENSHIFT)SALESFORCE)SANGFOR_NGAF)GCP_SECURITYCENTER_ERROR)GCP_SECURITYCENTER_MISCONFIGURATION)GCP_SECURITYCENTER_OBSERVATION)GCP_SECURITYCENTER_POSTURE_VIOLATION)GCP_SECURITYCENTER_THREAT)GCP_SECURITYCENTER_TOXIC_COMBINATION)GCP_SECURITYCENTER_UNSPECIFIED)GCP_SECURITYCENTER_VULNERABILITY)SENTINELONE_CF)SERVICENOW_SECURITY)SOURCEFIRE_IDS)SURICATA_EVE)SEP)SYSDIG)TRENDMICRO_DEEP_SECURITY)TRENDMICRO_VISION_ONE_OBSERVERD_ATTACK_TECHNIQUES)UBIQUITI_SWITCH)NIX_SYSTEM)UPWIND)VMWARE_ESX)VMWARE_VSPHERE)WINDOWS_DNS)WINEVTLOG)WIZ_IO)WORKDAY_USER_ACTIVITY)WORKSPACE_ACTIVITY)ZSCALER_WEBPROXY)ZSCALER_CASB)ZSCALER_DLP)ZSCALER_ZPA)The following log types were added without a default parser. Each parser is listed by product name and log_type value, where applicable.
AZURE_SOFTWARE_VULNERABILITIES)CALLER_VERIFY)CERTSECURE_LOG)CISCO_MULTICLOUD_DEFENSE_FIREWALL)CURSOR)CYFIRMA_DECYFIR_LOG)DATABAHN)FLARE_DARKWEB_ALERTS)FORTINET_FORTIAPPSEC)HIKVISION_NVR)IBM_B2B_INTEGRATOR)IBM_VDP)IMPERVA_ATO)IMPERVA_CSP)IMPERVA_DNS)IMPERVA_NETWORK_SECURITY)MICROSOFT_DEFENDER_XDR)NAKIVO_BACKUP)NETCRAFT_TAKEDOWN)NXL_AMPLIFY)SIEMENS_DESIGO)Upgraded Chronicle API
We've upgraded the following Chronicle API resources from v1 beta to v1. This upgrade signals API stability and functional completeness, enabling customer and partner adoption for production usage. We recommend that customers and partners use Chronicle API for all new integrations, for a more robust, secure, and extensible experience. Learn more about API Stability.
The following features and resources are included in this update:
For a full list of updated resources and links to the documentation, please see the Chronicle API documentation.
]]>Standard parser support policy
Google SecOps introduced a focused support policy for Standard parsers to scale platform stability, predictable performance, and high-quality data normalization. The new policy structures service level objectives (SLOs) and request triaging by customer support tiers (Standard versus Expert/Expert+), and prioritizes core security data through Important UDM Fields. Additionally, the policy outlines a community-driven model where low-usage, longtail prebuilt parsers migrate to a dedicated GitHub repository maintained by partners and the Google SecOps community.
For more information, see Standard parser support policy.
]]>Enhanced Data Export API general availability and improvements
The Data Export API is now GA and introduces significant security and capability improvements. This feature facilitates the bulk export of your security data from Google SecOps to a Google Cloud Storage bucket that you control, and it provides a more secure and scalable data archival experience than the legacy Data Export API feature.
Here's what's new:
For more information, see Data Export API (enhanced).
The legacy Data Export API is deprecated in favor of the enhanced Data Export API, which provides a more secure and scalable data archival experience. After June 18, 2026, legacy Data Export API won't work.
The fetchavailablelogtypes API endpoint is deprecated in favor of the list endpoint. After June 18, 2026, the fetchavailablelogtypes API endpoint won't work.
The updateDataExport endpoint in the enhanced Data Export API is deprecated. The reduction in job queue times using the enhanced Data Export API has eliminated the need for the update functionality of the updateDataExport API endpoint. The updateDataExport endpoint was present in v1alpha only; it wasn't present in in v1beta or v1. After June 18, 2026, the updateDataExport API endpoint won't work. You can still cancel queued export jobs.
The logType field in the enhanced Data Export API is deprecated in favor of the new (optional)includeLogTypes field, which supports an array of log types for data filtering. If left blank, the export job includes all log types by default. The logType field was present in v1alpha only; it wasn't present in in v1beta or v1. After June 18, 2026, the logType field is discontinued.
New parser documentation now available
New parser documentation is available to help you ingest and normalize logs from the following sources:
Time range selection for searches
Google SecOps has now added relative and absolute time range options to define the required time period for retrieving search results.
For more information, see Set the date and time range.
]]>Google SecOps has updated the list of list of supported default parsers. Parsers are updated gradually, so it might take one to four days before you see the changes reflected in your region.
The following supported default parsers have been updated. Each parser is listed by product name and log_type value, where applicable. This list includes both released default parsers and pending parser updates.
AKEYLESS_VAULT)CASSANDRA)ARUBA_WIRELESS)ARUBA_EDGECONNECT_SDWAN)AUTH_ZERO)AWS_AURORA)AWS_EC2_VPCS)AWS_SECURITY_HUB)AZURE_FIREWALL)AZURE_FRONT_DOOR)BARRACUDA_CLOUDGEN_FIREWALL)BLUECOAT_WEBPROXY)CHECKPOINT_FIREWALL)CHECKPOINT_EDR)CHECKPOINT_SMARTDEFENSE)CHRONICLE_SOAR_AUDIT)CISCO_ACI)CISCO_ASA_FIREWALL)CISCO_FIRESIGHT)CISCO_IOS)CISCO_ISE)CISCO_MERAKI)CISCO_SECURE_ACCESS)CISCO_SECURE_WORKLOAD)CISCO_SWITCH)CISCO_UMBRELLA_AUDIT)CISCO_WIRELESS)CITRIX_NETSCALER)CLAROTY_XDOME)CLOUDFLARE_WARP)CS_ALERTS)CS_EDR)CYBERARK)CYBERARK_PAM)EPIC)F5_ASM)F5_BIGIP_APM)F5_BIGIP_LTM)F5_DCS)FIREEYE_EMPS)FIREEYE_NX)FORTINET_FIREWALL)FORTINET_FORTIEDR)FORTINET_WEBPROXY)GITHUB)GCP_CLOUDAUDIT)GTI_IOC)GUARDICORE_CENTRA)CLEARPASS)HUAWEI_SWITCH)IBM_WEBSPHERE_APP_SERVER)IBM_ZOS)IMPERVA_SECURESPHERE)INFOBLOX)JUNIPER_FIREWALL)KUBERNETES_NODE)AUDITD)ADMANAGER_PLUS)MCAFEE_EPO)MCAFEE_WEBPROXY)MICROSOFT_DEFENDER_CLOUD_ALERTS)MICROSOFT_DEFENDER_ENDPOINT)MICROSOFT_DEFENDER_IDENTITY)MICROSOFT_GRAPH_ALERT)IIS)MOBILEIRON)GCP_MODEL_ARMOR)MYSQL)NETSKOPE_WEBPROXY)NONAME_API_SECURITY)OFFICE_365)OKTA)OCI_AUDIT)ORACLE_NETSUITE)PAN_FIREWALL)PAN_PANORAMA)PAN_CASB)PAN_PRISMA_CA)PING)POSTFIX_MAIL)PROOFPOINT_ON_DEMAND)PROOFPOINT_MAIL)PROOFPOINT_TRAP)RADWARE_FIREWALL)RAPID7_INSIGHT)SAP_HANA_AUDIT)SECUREAUTH_SSO)GCP_SECURITYCENTER_POSTURE_VIOLATION)GCP_SECURITYCENTER_THREAT)GCP_SECURITYCENTER_TOXIC_COMBINATION)SENTINEL_DV)SENTINELONE_CF)SILVERFORT)CA_SSO_WEB)SONIC_FIREWALL)SQUID_WEBPROXY)STIX)SURICATA_EVE)SYSDIG)TANIUM_THREAT_RESPONSE)THINKST_CANARY)TRENDMICRO_APEX_ONE)NIX_SYSTEM)VECTRA_XDR)VMWARE_ESX)WALLIX_BASTION)WATCHGUARD)WINDOWS_DEFENDER_AV)WINDOWS_DNS)WINEVTLOG)WINEVTLOG_XML)WIZ_IO)ZSCALER_EMAIL_DLP)The following log types were added without a default parser. Each parser is listed by product name and log_type value, where applicable.
ALTIRIS_LOGS)ARUBA_AP)BLOXONE_DHCP)CHECKMARX_ONE)CISCO_NDO)CROWDSTRIKE_CSPM)F5_F5OS_A)GATEWATCHER_NDR)HASHICORP_TERRAFORM)JAMF_PROTECT_V2)OCI_WAF)QUALYS_FIM)SAILPOINT_IDENTITYNOW)SERVICENOW_CERTIFICATE)SERVICENOW_USER)SERVICENOW_USER_LOGIN_HISTORY)SITEGUARD_SERVER)TOSI_HUB)TRELLIX_NDR)Support for the legacy Google Security Operations SIEM infrastructure will end on April 30, 2027. After this date, you will no longer have access to your Google SecOps SIEM instance on the legacy infrastructure. You need to self-migrate Google Security Operations SIEM in legacy Infrastructure to Google Cloud to align with industry standards and improve your reliability, privacy, security, compliance, and granular access controls. Follow the Migration guide and Community post to begin your transition.
This migration applies to you only if your SIEM instance meets one of the conditions below:
This migration does not apply to you if your SIEM instance meets all the conditions below:
New parser documentation now available
New parser documentation is available to help you ingest and normalize logs from the following sources:
Emerging Threats Center general availability
The Emerging Threats Center is now in General Availability (GA) and includes the following new features and enhancements:
For more information, see Emerging Threats Center overview and Emerging Threats Center detail view.
]]>Search query editor enhancements
Google SecOps has enhanced the search query editor to provide intelligent auto-suggestions and improved error handling.
For more information, see Use auto-suggestions to build queries.
Health Hub
This feature is currently in Preview.
The Health Hub is the central location in Google Security Operations for you to monitor the status and health of all configured data sources. The Health Hub provides crucial information on data sources and log types, offering the context needed to diagnose and remediate data pipeline issues.
The Health Hub includes information about the following:
For more information, see Use the Health Hub.
]]>Updates to search query limits and error messaging
Google SecOps has updated search query limits for programmatic and web interface access:
For more information, see Search limits and quotas
v1 Cloud Storage Feed Types (GCS, S3, SQS, Azure)
The v1 feed types for GOOGLE_CLOUD_STORAGE, AMAZON_S3, AMAZON_SQS, and AZURE_BLOBSTORE are deprecated and will be discontinued on March 15, 2027. The new v2 feed types uses the Google Cloud Storage Transfer Service (STS) to provide improved performance, scalability, and reliability.
To ensure continued ingestion, transition your feeds before the March 15, 2027 shutdown date:
You can also self-migrate by creating new feeds using v2 feed types to substitute your existing feeds using v1 feed types by following the steps documented in our feed configuration guides before March 15, 2027.
Key Dates:
For more information, see Feature deprecations.
]]>Google Security Operations has updated the list of supported default parsers. Parsers are updated gradually, so it might take one to four days before you see the changes reflected in your region.
The following supported default parsers have been updated. Each parser is listed by product name and log_type value, where applicable. This list includes both released default parsers and pending parser updates.
ABNORMAL_SECURITY)AI_HUNTER)AIX_SYSTEM)APACHE)CASSANDRA)ARUBA_WIRELESS)ARUBA_EDGECONNECT_SDWAN)AUTH_ZERO)AWS_AURORA)AWS_CLOUDFRONT)AWS_CLOUDTRAIL)AWS_CLOUDWATCH)AWS_VPC_FLOW)AWS_WAF)AZURE_AD)AZURE_AD_AUDIT)AZURE_FRONT_DOOR)AZURE_SQL)BOMGAR)BEYONDTRUST_BEYONDINSIGHT)BLUECOAT_WEBPROXY)BROADCOM_SUPPORT_PORTAL)CHECKPOINT_HARMONY)CHRONICLE_SOAR_AUDIT)CISCO_ASA_FIREWALL)CISCO_EMAIL_SECURITY)CISCO_ISE)CISCO_MERAKI)CISCO_SECURE_ACCESS)CISCO_SWITCH)CISCO_UMBRELLA_AUDIT)UMBRELLA_DNS)CISCO_WSA)GCP_DNS)GCP_CLOUDSQL)CLOUDFLARE)CLOUDFLARE_WARP)CODE42_INCYDR)CS_ALERTS)CS_EDR)CS_STREAM)CYBERARK_PAM)CYBEREASON_EDR)CYJAX_THREAT_INTELLIGENCE)CTIX)DATABRICKS)DUO_AUTH)ELASTIC_DEFEND)ESET_AV)F5_ASM)F5_BIGIP_APM)FIREEYE_EMPS)FIREEYE_ETP)FIREEYE_NX)FORESCOUT_NAC)FORGEROCK_IDENTITY_CLOUD)FORTINET_FORTIANALYZER)GITHUB)GTI_IOC)CLEARPASS)HUAWEI_SWITCH)IBM_DATAPOWER)IBM_SAFENET)IBM_WEBSPHERE_APP_SERVER)IMPERVA_ABP)IMPERVA_SECURESPHERE)JUNIPER_FIREWALL)KOLIDE)KUBERNETES_AUDIT)KUBERNETES_NODE)AUDITD)MARIA_DB)MCAFEE_EPO)MCAFEE_SKYHIGH_CASB)MCAFEE_WEBPROXY)AZURE_ACTIVITY)MICROSOFT_DEFENDER_CLOUD_ALERTS)MICROSOFT_GRAPH_ALERT)IIS)MICROSOFT_SQL)MIMECAST_MAIL_V2)LOOKOUT_MOBILE_ENDPOINT_SECURITY)MOBILEIRON)NETAPP_ONTAP)NETSKOPE_ALERT_V2)NETSKOPE_WEBPROXY)OBSIDIAN)OFFICE_365)OORT)ORACLE_DB)ORCA)PAN_CORTEX_XDR_EVENTS)PAN_FIREWALL)PAN_PRISMA_CA)POSTFIX_MAIL)PROOFPOINT_ON_DEMAND)PROOFPOINT_MAIL)PROOFPOINT_TRAP)RADWARE_FIREWALL)REDHAT_OPENSHIFT)SALESFORCE)SAP_CHANGE_DOCUMENT)SAP_GATEWAY)SAP_HANA_AUDIT)SAP_SECURITY_AUDIT)GCP_SECURITYCENTER_POSTURE_VIOLATION)GCP_SECURITYCENTER_SENSITIVE_DATA_RISK)GCP_SECURITYCENTER_THREAT)GCP_SECURITYCENTER_TOXIC_COMBINATION)SNYK_SDLC)SURICATA_EVE)SYMANTEC_EDR)SYSDIG)TENABLE_ADS)THREATCONNECT_IOC_V3)TRELLIX_HX_ALERTS)TRELLIX_HX_AUDIT)TRELLIX_HX_ES)TRELLIX_HX_HOSTS)TRENDMICRO_VISION_ONE_ENDPOINT_VULNERABILITIES)TRENDMICRO_VISION_ONE_OBSERVERD_ATTACK_TECHNIQUES)TRENDMICRO_VISION_ONE_WORKBENCH)TRENDMICRO_APEX_CENTRAL)TRENDMICRO_STELLAR)UBIKA_WAF)NIX_SYSTEM)VARONIS)VMWARE_AVINETWORKS_IWAF)VMWARE_ESX)VMWARE_HORIZON)WALLIX_BASTION)WINDOWS_DNS)WINEVTLOG)WINEVTLOG_XML)WIZ_IO)BRO_JSON)ZSCALER_WEBPROXY)The following log types were added without a default parser. Each parser is listed by product name and log_type value, where applicable.
ACTION1)CDNETWORKS_CLOUD_SECURITY)CLAUDE_COMPLIANCE_LOGS)DELL_RECOVERPOINT)IBM_STORWIZE)LEAPXPERT_AUDIT)ORACLE_KEY_VAULT_AUDIT_LOGS)RSA_CLOUD)SERVICENOW_ANTIVIRUS_ACTIVITY)SERVICENOW_ATTACHMENT)SERVICENOW_EMAIL)VERSA_DIRECTOR)ZPE_SYSTEMS_NODEGRID)Multi-stage queries in YARA-L
The Multi-stage queries feature is now GA. This feature lets you feed the output of one query stage into the input of another, providing more granular data transformation than a single, monolithic query.
You can use multi-stage queries in both Dashboards and Search to build sophisticated detection and visualization logic. No action is required to enable this feature.
Learn more about how to create multi-stage queries with YARA-L 2.0.
]]>Credential validation for third-party API feed types
Credential validation is now available for all 49 third-party API connectors.
When you create a feed using a third-party API feed type, Google SecOps now automatically validates the provided credentials. This ensures that if credentials are incorrect:
New parser documentation now available
New parser documentation is available to help you ingest and normalize logs from the following sources:
Bindplane features for Google SecOps general availability
The following Bindplane features that relate to Google SecOps are now in General Availability (GA):
Single sign-on with custom claims role mapping: gives a production-ready way to manage Bindplane access through your identity provider. For more information, see Single Sign-On (Cloud).
SecOps parser validator: validates that your logs will be parsed correctly by Google SecOps directly from the snapshot view. Get immediate feedback on parsed events or validation errors without waiting for data to appear in Google SecOps. For more information, see Validate SecOps Parser.
Forwarder migration tool: provides production-ready paths to migrate existing forwarder configurations into Bindplane-managed pipelines. For more information, see Migrate Configurations.
Manage parser versions
The Manage parser versions feature is in Public Preview for all customers.
]]>Set up and manage data processing pipelines
This feature is currently in Preview.
You can now use the Data Processing pipelines to filter, transform, and redact Google SecOps data before ingestion. This feature provides more control over ingested data, letting you reduce costs by filtering out unwanted events, transform data for better compatibility, and protect sensitive information by redacting or masking values before storage.
You can configure data processing pipelines using the Bindplane console or the Google SecOps Data Pipeline APIs.
For more information, see Set up and manage data processing pipelines.
]]>Google SecOps has updated the list of supported default parsers. Parsers are updated gradually, so it might take one to four days before you see the changes reflected in your region. For more information, see Supported log types and default parsers.
The following supported default parsers have been updated. Each parser is listed by product name and log_type value, where applicable. This list includes both released default parsers and pending parser updates.
ACALVIO)AIX_SYSTEM)AKAMAI_WAF)APACHE)CASSANDRA)HADOOP)ARCSIGHT_CEF)ARUBA_EDGECONNECT_SDWAN)ATTIVO)AWS_AURORA)AWS_CLOUDTRAIL)AWS_CLOUDWATCH)GUARDDUTY)AWS_NETWORK_FIREWALL)AWS_SECURITY_HUB)AWS_WAF)AZURE_AD)AZURE_AD_AUDIT)AZURE_AD_SIGNIN)AZURE_FIREWALL)AZURE_FRONT_DOOR)BARRACUDA_EMAIL)BARRACUDA_FIREWALL)BLUECOAT_WEBPROXY)CHECKPOINT_FIREWALL)CHECKPOINT_HARMONY)CISCO_ACI)CISCO_ASA_FIREWALL)CISCO_FIREPOWER_FIREWALL)CISCO_IOS)CISCO_ISE)CISCO_ROUTER)CISCO_SECURE_ACCESS)CISCO_SWITCH)CISCO_TACACS)CISCO_UCM)CISCO_UMBRELLA_AUDIT)CITRIX_NETSCALER)CLAROTY_CTD)CLAROTY_EMC)CLAROTY_XDOME)GCP_CLOUDSQL)CLOUDFLARE)CLOUDFLARE_AUDIT)CLOUDFLARE_WAF)CLOUDFLARE_WARP)CORELIGHT)CS_ALERTS)CS_DETECTS)CS_EDR)CS_STREAM)CYBERARK)CYBERARK_EPM)CYBERARK_PAM)DELL_EMC_DATA_DOMAIN)DELL_SWITCH)DUO_AUTH)F5_ASM)F5_BIGIP_LTM)F5_DCS)F5_DNS)FIREEYE_NX)FORCEPOINT_FIREWALL)FORCEPOINT_WEBPROXY)FORTINET_FIREWALL)FORTINET_FORTIANALYZER)GCP_SECURITYCENTER_THREAT)GCP_MONITORING_ALERTS)GTI_IOC)GREYNOISE)HALCYON)CLEARPASS)HUAWEI_SWITCH)INFOBLOX_DNS)ISLAND_BROWSER)KUBERNETES_NODE)AUDITD)LINUX_SYSMON)ADAUDIT_PLUS)MARIA_DB)MCAFEE_IPS)MCAFEE_WEBPROXY)AZURE_ACTIVITY)MICROSOFT_DEFENDER_CLOUD_ALERTS)MICROSOFT_GRAPH_ALERT)IIS)MICROSOFT_SQL)MISP_IOC)MOBILEIRON)MYSQL)NETAPP_ONTAP)NETSKOPE_ALERT_V2)NGINX)NOZOMI_GUARDIAN)OFFICE_365)OCSF)ORCA)PAN_FIREWALL)PAN_PANORAMA)PAN_PRISMA_CA)PING_ONE)PING_DIRECTORY)POSTFIX_MAIL)POSTGRESQL)PROOFPOINT_ON_DEMAND)PROOFPOINT_MAIL)PROOFPOINT_TRAP)RADWARE_FIREWALL)REDHAT_OPENSHIFT)RUBRIK_SECURITY_CLOUD)SAILPOINT_IIQ)SALESFORCE)SAP_CHANGE_DOCUMENT)SAP_GATEWAY)SAP_HANA)SAP_HANA_AUDIT)SAP_IDENTITY_AND_AUTH_DATA)SAP_ICM)SAP_SECURITY_AUDIT)SAP_WEBDISP)GCP_SECURITYCENTER_POSTURE_VIOLATION)GCP_SECURITYCENTER_TOXIC_COMBINATION)SOPHOS_CENTRAL)STIX)STORMSHIELD_FIREWALL)SURICATA_EVE)SEP)SYSDIG)TABLEAU)TELEPORT_ACCESS_PLANE)TIPPING_POINT)TRIPWIRE_FIM)TRENDMICRO_STELLAR)UBIKA_WAF)NIX_SYSTEM)VELO_FIREWALL)VERITAS_NETBACKUP)VERSA_FIREWALL)VMWARE_AVINETWORKS_IWAF)VMWARE_ESX)VMWARE_VCENTER)WATCHGUARD)WINDOWS_DNS)WINEVTLOG)WINEVTLOG_XML)WIZ_IO)WORKDAY_AUDIT)ZSCALER_WEBPROXY)ZSCALER_VPN)The following log types were added without a default parser. Each parser is listed by product name and log_type value, where applicable.
ALIBABA_SECURITY_CENTER)APACHE_AIRFLOW)BARAMUNDI)BRAVURA)BUILDKITE_AUDIT)CORTEX_XPANSE)CYFIRMA_DECYFIR)DATEV)ELO)FORCEPOINT_SWG)JUMPSERVER_PAM)KEEP_AWARE)LARK_SUITE)MACMON)MAMORI_DAM)N8N_SECURITY_AUDIT_LOGS)OCI_LOADBALANCER)OPENTEXT_SSPR)RACKSPACE)SECUI_BLUEMAX_NGF)SYMANTEC_ATP)TENABLE_VMGNT)TRELLIX_EDRF)TRENDMICRO_VISION_ONE_ENDPOINT_VULNERABILITIES)ZAFRAN)