Emerging Threats Center general availability
The Emerging Threats Center is now in General Availability (GA) and includes the following new features and enhancements:
For more information, see Emerging Threats Center overview and Emerging Threats Center detail view.
]]>Search query editor enhancements
Google SecOps has enhanced the search query editor to provide intelligent auto-suggestions and improved error handling.
For more information, see Use auto-suggestions to build queries.
Health Hub
This feature is currently in Preview.
The Health Hub is the central location in Google Security Operations for you to monitor the status and health of all configured data sources. The Health Hub provides crucial information on data sources and log types, offering the context needed to diagnose and remediate data pipeline issues.
The Health Hub includes information about the following:
For more information, see Use the Health Hub.
]]>Updates to search query limits and error messaging
Google SecOps has updated search query limits for programmatic and web interface access:
For more information, see Search limits and quotas
v1 Cloud Storage Feed Types (GCS, S3, SQS, Azure)
The v1 feed types for GOOGLE_CLOUD_STORAGE, AMAZON_S3, AMAZON_SQS, and AZURE_BLOBSTORE are deprecated and will be discontinued on March 15, 2027. The new v2 feed types uses the Google Cloud Storage Transfer Service (STS) to provide improved performance, scalability, and reliability.
To ensure continued ingestion, transition your feeds before the March 15, 2027 shutdown date:
You can also self-migrate by creating new feeds using v2 feed types to substitute your existing feeds using v1 feed types by following the steps documented in our feed configuration guides before March 15, 2027.
Key Dates:
For more information, see Feature deprecations.
]]>Playbook Condition and Multi-Choice Question Flows
The maximum number of branches supported in Playbook Conditions and Multiple Choice Questions has been increased from 6 to 20. This allows for more complex branching logic within a single step.
For more information, see Use flows in playbooks.
]]>Google SecOps has updated the list of supported default parsers. Parsers are updated gradually, so it might take one to four days before you see the changes reflected in your region.
The following supported default parsers have been updated. Each parser is listed by product name and log_type value, where applicable. This list includes both released default parsers and pending parser updates.
ABNORMAL_SECURITY)AI_HUNTER)AIX_SYSTEM)APACHE)CASSANDRA)ARUBA_WIRELESS)ARUBA_EDGECONNECT_SDWAN)AUTH_ZERO)AWS_AURORA)AWS_CLOUDFRONT)AWS_CLOUDTRAIL)AWS_CLOUDWATCH)AWS_VPC_FLOW)AWS_WAF)AZURE_AD)AZURE_AD_AUDIT)AZURE_FRONT_DOOR)AZURE_SQL)BOMGAR)BEYONDTRUST_BEYONDINSIGHT)BLUECOAT_WEBPROXY)BROADCOM_SUPPORT_PORTAL)CHECKPOINT_HARMONY)CHRONICLE_SOAR_AUDIT)CISCO_ASA_FIREWALL)CISCO_EMAIL_SECURITY)CISCO_ISE)CISCO_MERAKI)CISCO_SECURE_ACCESS)CISCO_SWITCH)CISCO_UMBRELLA_AUDIT)UMBRELLA_DNS)CISCO_WSA)GCP_DNS)GCP_CLOUDSQL)CLOUDFLARE)CLOUDFLARE_WARP)CODE42_INCYDR)CS_ALERTS)CS_EDR)CS_STREAM)CYBERARK_PAM)CYBEREASON_EDR)CYJAX_THREAT_INTELLIGENCE)CTIX)DATABRICKS)DUO_AUTH)ELASTIC_DEFEND)ESET_AV)F5_ASM)F5_BIGIP_APM)FIREEYE_EMPS)FIREEYE_ETP)FIREEYE_NX)FORESCOUT_NAC)FORGEROCK_IDENTITY_CLOUD)FORTINET_FORTIANALYZER)GITHUB)GTI_IOC)CLEARPASS)HUAWEI_SWITCH)IBM_DATAPOWER)IBM_SAFENET)IBM_WEBSPHERE_APP_SERVER)IMPERVA_ABP)IMPERVA_SECURESPHERE)JUNIPER_FIREWALL)KOLIDE)KUBERNETES_AUDIT)KUBERNETES_NODE)AUDITD)MARIA_DB)MCAFEE_EPO)MCAFEE_SKYHIGH_CASB)MCAFEE_WEBPROXY)AZURE_ACTIVITY)MICROSOFT_DEFENDER_CLOUD_ALERTS)MICROSOFT_GRAPH_ALERT)IIS)MICROSOFT_SQL)MIMECAST_MAIL_V2)LOOKOUT_MOBILE_ENDPOINT_SECURITY)MOBILEIRON)NETAPP_ONTAP)NETSKOPE_ALERT_V2)NETSKOPE_WEBPROXY)OBSIDIAN)OFFICE_365)OORT)ORACLE_DB)ORCA)PAN_CORTEX_XDR_EVENTS)PAN_FIREWALL)PAN_PRISMA_CA)POSTFIX_MAIL)PROOFPOINT_ON_DEMAND)PROOFPOINT_MAIL)PROOFPOINT_TRAP)RADWARE_FIREWALL)REDHAT_OPENSHIFT)SALESFORCE)SAP_CHANGE_DOCUMENT)SAP_GATEWAY)SAP_HANA_AUDIT)SAP_SECURITY_AUDIT)GCP_SECURITYCENTER_POSTURE_VIOLATION)GCP_SECURITYCENTER_SENSITIVE_DATA_RISK)GCP_SECURITYCENTER_THREAT)GCP_SECURITYCENTER_TOXIC_COMBINATION)SNYK_SDLC)SURICATA_EVE)SYMANTEC_EDR)SYSDIG)TENABLE_ADS)THREATCONNECT_IOC_V3)TRELLIX_HX_ALERTS)TRELLIX_HX_AUDIT)TRELLIX_HX_ES)TRELLIX_HX_HOSTS)TRENDMICRO_VISION_ONE_ENDPOINT_VULNERABILITIES)TRENDMICRO_VISION_ONE_OBSERVERD_ATTACK_TECHNIQUES)TRENDMICRO_VISION_ONE_WORKBENCH)TRENDMICRO_APEX_CENTRAL)TRENDMICRO_STELLAR)UBIKA_WAF)NIX_SYSTEM)VARONIS)VMWARE_AVINETWORKS_IWAF)VMWARE_ESX)VMWARE_HORIZON)WALLIX_BASTION)WINDOWS_DNS)WINEVTLOG)WINEVTLOG_XML)WIZ_IO)BRO_JSON)ZSCALER_WEBPROXY)The following log types were added without a default parser. Each parser is listed by product name and log_type value, where applicable.
ACTION1)CDNETWORKS_CLOUD_SECURITY)CLAUDE_COMPLIANCE_LOGS)DELL_RECOVERPOINT)IBM_STORWIZE)LEAPXPERT_AUDIT)ORACLE_KEY_VAULT_AUDIT_LOGS)RSA_CLOUD)SERVICENOW_ANTIVIRUS_ACTIVITY)SERVICENOW_ATTACHMENT)SERVICENOW_EMAIL)VERSA_DIRECTOR)ZPE_SYSTEMS_NODEGRID)Chrome Enterprise Premium Integration general availability
The Chrome Enterprise Premium integration is now GA. This release includes the following new features and updates:
New Chrome Enterprise Connector which configures recommended data export settings and sends data through Google Cloud to Google Security Operations. Chrome Enterprise Premium customers can export data with additional security context provided by Google Safe Browsing.
Updates to the CHROME_MANAGEMENT parser documentation in Collect Chrome Enterprise data and
Chrome Enterprise Premium Threats.
Curated Detections for Chrome Enterprise Premium.
Curated Dashboards for Chrome Enterprise Premium.
Response actions to block and remove malicious extensions or to delete blocked extensions from the extension policy ExtensionInstallBlocklist.
Multi-stage queries in YARA-L
The Multi-stage queries feature is now GA. This feature lets you feed the output of one query stage into the input of another, providing more granular data transformation than a single, monolithic query.
You can use multi-stage queries in both Dashboards and Search to build sophisticated detection and visualization logic. No action is required to enable this feature.
Learn more about how to create multi-stage queries with YARA-L 2.0.
]]>Credential validation for third-party API feed types
Credential validation is now available for all 49 third-party API connectors.
When you create a feed using a third-party API feed type, Google SecOps now automatically validates the provided credentials. This ensures that if credentials are incorrect:
New parser documentation now available
New parser documentation is available to help you ingest and normalize logs from the following sources:
View Triage and Investigation Agent (TIN) results in the Case Summary
This feature is currently in Preview and is part of a gradual rollout.
You can now view TIN results and verdict summaries directly within the Case Summary view. This integration provides real-time progress updates and automated verdicts for true or false positives without leaving the case.
For more information, see Use Triage and Investigation Agent (TIN) to investigate alerts.
Agentic Automation
This feature is in Public Preview.
You can now use Agentic Automation to embed AI Agents directly into your workflows. This feature lets you integrate AI-driven capabilities into your existing playbooks while staying in charge of critical actions by combining agents with deterministic automation steps.
For more information, see Agentic Automation.
]]>Bindplane features for Google SecOps general availability
The following Bindplane features that relate to Google SecOps are now in General Availability (GA):
Single sign-on with custom claims role mapping: gives a production-ready way to manage Bindplane access through your identity provider. For more information, see Single Sign-On (Cloud).
SecOps parser validator: validates that your logs will be parsed correctly by Google SecOps directly from the snapshot view. Get immediate feedback on parsed events or validation errors without waiting for data to appear in Google SecOps. For more information, see Validate SecOps Parser.
Forwarder migration tool: provides production-ready paths to migrate existing forwarder configurations into Bindplane-managed pipelines. For more information, see Migrate Configurations.
Unified Feature Role-based Access Control (RBAC) is now in General Availability (GA). This enables administrators to manage feature access control for Google SecOps including SOAR by leveraging Google Cloud IAM instead of managing it separately for SIEM and SOAR.
You can enable it by migrating the legacy SOAR permission groups and permissions to Google Cloud IAM through a self-service migration available from January 26, 2026. Please check the documentation and video for full instructions.
This update is available to all customers who have completed Stage 1 of the SOAR migration to Google Cloud.
]]>Stage 2 of the SOAR migration to Google Cloud deadline has been extended from June 30th to September 30th, 2026.
]]>Manage parser versions
The Manage parser versions feature is in Public Preview for all customers.
]]>Set up and manage data processing pipelines
This feature is currently in Preview.
You can now use the Data Processing pipelines to filter, transform, and redact Google SecOps data before ingestion. This feature provides more control over ingested data, letting you reduce costs by filtering out unwanted events, transform data for better compatibility, and protect sensitive information by redacting or masking values before storage.
You can configure data processing pipelines using the Bindplane console or the Google SecOps Data Pipeline APIs.
For more information, see Set up and manage data processing pipelines.
]]>Google SecOps has updated the list of supported default parsers. Parsers are updated gradually, so it might take one to four days before you see the changes reflected in your region. For more information, see Supported log types and default parsers.
The following supported default parsers have been updated. Each parser is listed by product name and log_type value, where applicable. This list includes both released default parsers and pending parser updates.
ACALVIO)AIX_SYSTEM)AKAMAI_WAF)APACHE)CASSANDRA)HADOOP)ARCSIGHT_CEF)ARUBA_EDGECONNECT_SDWAN)ATTIVO)AWS_AURORA)AWS_CLOUDTRAIL)AWS_CLOUDWATCH)GUARDDUTY)AWS_NETWORK_FIREWALL)AWS_SECURITY_HUB)AWS_WAF)AZURE_AD)AZURE_AD_AUDIT)AZURE_AD_SIGNIN)AZURE_FIREWALL)AZURE_FRONT_DOOR)BARRACUDA_EMAIL)BARRACUDA_FIREWALL)BLUECOAT_WEBPROXY)CHECKPOINT_FIREWALL)CHECKPOINT_HARMONY)CISCO_ACI)CISCO_ASA_FIREWALL)CISCO_FIREPOWER_FIREWALL)CISCO_IOS)CISCO_ISE)CISCO_ROUTER)CISCO_SECURE_ACCESS)CISCO_SWITCH)CISCO_TACACS)CISCO_UCM)CISCO_UMBRELLA_AUDIT)CITRIX_NETSCALER)CLAROTY_CTD)CLAROTY_EMC)CLAROTY_XDOME)GCP_CLOUDSQL)CLOUDFLARE)CLOUDFLARE_AUDIT)CLOUDFLARE_WAF)CLOUDFLARE_WARP)CORELIGHT)CS_ALERTS)CS_DETECTS)CS_EDR)CS_STREAM)CYBERARK)CYBERARK_EPM)CYBERARK_PAM)DELL_EMC_DATA_DOMAIN)DELL_SWITCH)DUO_AUTH)F5_ASM)F5_BIGIP_LTM)F5_DCS)F5_DNS)FIREEYE_NX)FORCEPOINT_FIREWALL)FORCEPOINT_WEBPROXY)FORTINET_FIREWALL)FORTINET_FORTIANALYZER)GCP_SECURITYCENTER_THREAT)GCP_MONITORING_ALERTS)GTI_IOC)GREYNOISE)HALCYON)CLEARPASS)HUAWEI_SWITCH)INFOBLOX_DNS)ISLAND_BROWSER)KUBERNETES_NODE)AUDITD)LINUX_SYSMON)ADAUDIT_PLUS)MARIA_DB)MCAFEE_IPS)MCAFEE_WEBPROXY)AZURE_ACTIVITY)MICROSOFT_DEFENDER_CLOUD_ALERTS)MICROSOFT_GRAPH_ALERT)IIS)MICROSOFT_SQL)MISP_IOC)MOBILEIRON)MYSQL)NETAPP_ONTAP)NETSKOPE_ALERT_V2)NGINX)NOZOMI_GUARDIAN)OFFICE_365)OCSF)ORCA)PAN_FIREWALL)PAN_PANORAMA)PAN_PRISMA_CA)PING_ONE)PING_DIRECTORY)POSTFIX_MAIL)POSTGRESQL)PROOFPOINT_ON_DEMAND)PROOFPOINT_MAIL)PROOFPOINT_TRAP)RADWARE_FIREWALL)REDHAT_OPENSHIFT)RUBRIK_SECURITY_CLOUD)SAILPOINT_IIQ)SALESFORCE)SAP_CHANGE_DOCUMENT)SAP_GATEWAY)SAP_HANA)SAP_HANA_AUDIT)SAP_IDENTITY_AND_AUTH_DATA)SAP_ICM)SAP_SECURITY_AUDIT)SAP_WEBDISP)GCP_SECURITYCENTER_POSTURE_VIOLATION)GCP_SECURITYCENTER_TOXIC_COMBINATION)SOPHOS_CENTRAL)STIX)STORMSHIELD_FIREWALL)SURICATA_EVE)SEP)SYSDIG)TABLEAU)TELEPORT_ACCESS_PLANE)TIPPING_POINT)TRIPWIRE_FIM)TRENDMICRO_STELLAR)UBIKA_WAF)NIX_SYSTEM)VELO_FIREWALL)VERITAS_NETBACKUP)VERSA_FIREWALL)VMWARE_AVINETWORKS_IWAF)VMWARE_ESX)VMWARE_VCENTER)WATCHGUARD)WINDOWS_DNS)WINEVTLOG)WINEVTLOG_XML)WIZ_IO)WORKDAY_AUDIT)ZSCALER_WEBPROXY)ZSCALER_VPN)The following log types were added without a default parser. Each parser is listed by product name and log_type value, where applicable.
ALIBABA_SECURITY_CENTER)APACHE_AIRFLOW)BARAMUNDI)BRAVURA)BUILDKITE_AUDIT)CORTEX_XPANSE)CYFIRMA_DECYFIR)DATEV)ELO)FORCEPOINT_SWG)JUMPSERVER_PAM)KEEP_AWARE)LARK_SUITE)MACMON)MAMORI_DAM)N8N_SECURITY_AUDIT_LOGS)OCI_LOADBALANCER)OPENTEXT_SSPR)RACKSPACE)SECUI_BLUEMAX_NGF)SYMANTEC_ATP)TENABLE_VMGNT)TRELLIX_EDRF)TRENDMICRO_VISION_ONE_ENDPOINT_VULNERABILITIES)ZAFRAN)Google Agentic SOC Trial
There will be a no-cost trial for the Google SecOps Triage Investigative Agent (TIN) from April 1, 2026 to June 30, 2026. TIN is an agentic AI feature for Google SecOps that helps automate security investigations. For more information about the trial, see Google Agentic SOC Trial details. For more information about TIN, see Use Triage and Investigation Agent to investigate alerts.
]]>Chronicle.soarAnalyst, chronicle.soarViewer, chronicle.soarEngineer roles in Cloud IAM are being deprecated and will be fully removed in six months. Although these roles were accessible and can historically be assigned to users in Cloud IAM, they were non-operational. SOAR roles were managed through Permission Groups and with its migration to Cloud IAM as part of the SOAR Migration to Google Cloud, the preceding roles are being deprecated.
To maintain seamless access and adhere to the principle of least privilege, transition your SOAR users to the following options:
New Unified rules interface
This feature is currently in Preview.
Google Secops has launched a unified rules interface that brings custom and curated rule management into a single, cohesive workflow. This update optimizes detection engineering with a redesigned dashboard, an advanced rule editor, and expanded API capabilities to streamline rule deployment and troubleshooting.
Key enhancements
Developer and IDE enhancements:
Centralized management: A unified, single dashboard lets you browse, filter, and manage both custom and curated rules from one location. You can also update configurations for multiple rules simultaneously.
Curated rule transparency: You can now view the YARA-L text of curated rules, search directly within their logic, and independently toggle individual rule statuses without needing to alter the parent rule pack deployment.
Integrated IDE experience: The rule editor now features an enhanced IDE experience with inline error highlights, UDM field definitions on hover.
Expanded API and structured search:
The Rules API and dashboard have been upgraded to support deeper programmatic access and complex filtering:
Robust search syntax: Both the UI and API now support AIP-160 compliant structured search. You can filter rules by text, tags, author, and execution state.
Batch modifications: The rules.modifyRules method now supports
non-atomic batch updates, letting you change live status, alerting status, tags,
and archive status across multiple rules in a single API request.
Advanced resource views: The rules.list method introduces CONFIG_ONLY
and TRENDS views. These views provide expanded deployment information, access
to curated rule resources, and larger page sizes (up to 5000 results) for
efficient querying.
For details, see Manage unified rules.
]]>Added support for Google Cloud VPC Service Controls
This feature is currently in Preview.
VPC Service Controls helps protect against accidental or targeted action by external entities or insider entities, which helps to minimize unwarranted data exfiltration risks from Google Cloud services. You can use VPC Service Controls to create perimeters that protect the resources and data of services that you explicitly specify. For more information, see Overview of VPC Service Controls.
]]>New: cross joins in multi-stage queries
You can now use cross joins in YARA-L 2.0 multi-stage queries let you compare individual UDM event data against aggregated statistics calculated in previous YARA-L stages. They are supported in:
For more information, see Cross joins in multi-stage queries.
RBAC for ingestion metrics
Administrators can now use RBAC for ingestion metrics to restrict visibility of system health data, such as ingestion volume, errors, and throughput, based on a user's business scope.
The Data Ingestion and Health dashboard now uses Data Access scopes. When a scoped user loads the dashboard, the system automatically filters metrics to show only data that matches their assigned labels: Namespace, Log Type, and Ingestion Source.
For more information, see Ingestion metrics.
]]>New parser documentation now available
New parser documentation is available to help you ingest and normalize logs from the following sources:
Publisher Agent Version 2.6.4 removes support for Python 3.7 from the remote agent.
]]>New capabilities in Feeds page
The following options have been added to the Feeds page:
Control of MCP use with organization policies is deprecated. After March 17, 2026, organization policies that use the gcp.managed.allowedMCPServices constraint won't work, and you can control MCP use with IAM deny policies. For more information about controlling MCP use, see Control MCP use with IAM.
After March 17, 2026, when you enable Google SecOps, the Google SecOps MCP server is automatically enabled.
]]>Advanced Joins in Search
Google SecOps now supports expanded capabilities for correlating data across multiple sources. These join operations are also supported in multistage queries.
Joins without a match section: You can now use join operations to correlate
and combine data from multiple sources based on common field values without
requiring a match section (unlike statistical joins). Results are displayed in a
Joins table, which you can download as a CSV, or for event-to-event joins,
exported to a datatable for further analysis.
For more information, see Implement joins without a match section.
Outer joins: Search now supports left and right outer joins. Unlike standard
inner joins, these operations let you retrieve all records from a primary
data source even if no matching entry exists in the secondary source (unmatched
fields are returned as null). This action lets you correlate data
without losing unmatched events.
For more information, see Correlate data with outer joins.
]]>Enhanced rule observability: New metadata, visual indicators, and dashboards
Google Security Operations has introduced updates to how detection and alert data is processed and visualized. These changes help Google SecOps teams distinguish between primary rule runs and rule replays, which provides clarity on detection delays and the impact of late-arriving enrichment data.
Key improvements
New metadata and third-party integration: Detections and alerts now emit specific metadata to help customers track timing and latency. This data is available for integration with third-party systems using the following fields:
detectionTimingDetails: An enum identifying the run type:DETECTION_TIMING_DETAILS_REPROCESSINGDETECTION_TIMING_DETAILS_RETROHUNTDETECTION_TIMING_DETAILS_UNSPECIFIEDlatencyMetrics: Includes timestamps for oldestIngestionTime, newestIngestionTime, oldestEventTime, and newestEventTime.Enhanced platform and visual indicators:
The re.capture_all function is now available
The new re.capture_all YARA-L 2.0 function is available in Rules, Search, and Dashboards.
Use the re.capture_all() function to extract every non-overlapping match of a regular expression from a string. While the standard re.capture function stops after the first match it finds, the re.capture_all() function continues through the entire string to identify every instance that matches your pattern.
New parser documentation now available
New parser documentation is available to help you ingest and normalize logs from the following sources:
Share custom column sets
Google SecOps now lets you share custom sets of columns in the Events table for consistent analysis across teams.
For more details, see Search for events and alerts
Data RBAC global scope changes for ATI
To enhance data security, several features related to Indicators of Compromise (IOCs) and Emerging Threats now require global scope data RBAC permissions. Users without global scope will see restricted information in the following areas:
Emerging threats page: IOC match counts per campaign are no longer visible.
Entity widget overlay: The Indicators table is hidden or appears empty.
Threat details page: The related entities, IOC matches, and GTI IOC tables are no longer visible.
Entity summary widget: GTI scores are excluded from the overlay.
IOC details page: The Indicator Details tab doesn't populate.
API impact: API calls to IocService and ThreatCollectionService now
require global scope. Direct calls made with the CLI or client libraries fail
without this permission.
Required: Google SecOps administrators should review user roles and grant global scope to those who require continued access to these threat intelligence features.
Mute an IoC deprecated
The Mute an IoC feature is deprecated, and the IOC details page no longer displays the Mute indicator.
]]>Google SecOps has updated the list of supported default parsers. Updates propagate gradually; changes typically appear in your region within one to four business days. For more information, see Supported log types and default parsers.
The following supported default parsers have been updated. Each parser is listed
by product name and log_type value, where applicable. This list includes both
released default parsers and pending parser updates.
A10_LOAD_BALANCER)AIX_SYSTEM)AKAMAI_CLOUD_MONITOR)ALGOSEC)AWS_API_GATEWAY)APACHE)MACOS)APPOMNI)ARCSIGHT_CEF)ARISTA_SWITCH)ARUBA_WIRELESS)ARUBA_AIRWAVE)ARUBA_EDGECONNECT_SDWAN)ARUBA_SWITCH)ATTIVO)AUTH_ZERO)AUTOMATION_ANYWHERE)AVANAN_EMAIL)AWS_AURORA)AWS_CLOUDTRAIL)AWS_CLOUDWATCH)AWS_ELB)GUARDDUTY)AWS_RDS)AWS_SECURITY_HUB)AWS_WAF)AZURE_AD)AZURE_AD_AUDIT)AZURE_AD_SIGNIN)AZURE_FRONT_DOOR)BARRACUDA_EMAIL)BARRACUDA_WAF)BOMGAR)BEYONDTRUST_BEYONDINSIGHT)BEYONDTRUST_ENDPOINT)BEYONDTRUST_REMOTE_ACCESS)BIND_DNS)BINDPLANE_AGENT)BLUECOAT_WEBPROXY)BOX)CB_EDR)CATO_NETWORKS)CHECKPOINT_FIREWALL)CIPHERTRUST_MANAGER)CISCO_ACI)CISCO_ASA_FIREWALL)CISCO_EMAIL_SECURITY)CISCO_FIREPOWER_FIREWALL)CISCO_IOS)CISCO_ISE)CISCO_MERAKI)CISCO_PIX_FIREWALL)CISCO_ROUTER)CISCO_STEALTHWATCH)CISCO_SWITCH)CISCO_UMBRELLA_AUDIT)UMBRELLA_DNS)CISCO_SDWAN)CISCO_WIRELESS)CISCO_WSA)CITRIX_NETSCALER)CLAROTY_CTD)CLAROTY_XDOME)GCP_CLOUDSQL)CLOUDFLARE)CLOUDFLARE_AUDIT)GCP_COMPUTE)CORELIGHT)CS_ALERTS)CS_DETECTS)CS_EDR)CS_STREAM)CYBERARK)CYBERARK_EPM)CYBERARK_PAM)CYOLO_OT)DARKTRACE)DELINEA_SECRET_SERVER)DELL_ECS)DELL_SWITCH)DUO_AUTH)EXTRAHOP)EXTREME_WIRELESS)F5_AFM)F5_ASM)F5_BIGIP_APM)F5_BIGIP_LTM)F5_DCS)FASTLY_CDN)FIREEYE_ETP)FIREEYE_NX)FORCEPOINT_EMAILSECURITY)FORESCOUT_EYEINSPECT)FORTINET_FIREWALL)FORTINET_FORTIANALYZER)FORTINET_FORTIMANAGER)FORTINET_FORTIWEB)GCP_APP_ENGINE)GCP_MODEL_ARMOR)GITHUB)GITHUB_DEPENDABOT)GCP_CLOUDAUDIT)GCP_THREATINTEL)H3C_SWITCH)HASHICORP)CLEARPASS)HUAWEI_SWITCH)IBM_DATAPOWER)DB2_DB)ILLUMIO_CORE)IMPERVA_WAF)IMPERVA_DRA)ISLAND_BROWSER)JAMF_PRO_CONTEXT)JUMPCLOUD_DIRECTORY_INSIGHTS)JUNIPER_MX)KEYCLOAK)KNOWBE4_PHISHER)KOLIDE)KUBERNETES_NODE)AUDITD)MCAFEE_DLP)MCAFEE_EPO)MCAFEE_WEBPROXY)ADFS)MICROSOFT_DEFENDER_CLOUD_ALERTS)MICROSOFT_DEFENDER_ENDPOINT)MICROSOFT_GRAPH_ALERT)IIS)AZURE_MDM_INTUNE)POWERSHELL)MICROSOFT_SQL)MIMECAST_MAIL_V2)MISP_IOC)MOBILEIRON)MYSQL)NETAPP_ONTAP)NETFILTER_IPTABLES)NETIQ_ACCESS_MANAGER)NETSKOPE_ALERT_V2)NETSKOPE_WEBPROXY)MICROSOFT_NPS)NGINX)NOZOMI_GUARDIAN)NUTANIX_PRISM)OBSIDIAN)OFFICE_365)OKTA)ONAPSIS)ONEIDENTITY_TPAM)ONELOGIN_SSO)OCSF)ORACLE_DB)PAN_FIREWALL)PAN_PANORAMA)PING)POSTFIX_MAIL)POSTGRESQL)PROOFPOINT_CASB)PROOFPOINT_MAIL_FILTER)PROOFPOINT_ON_DEMAND)PROOFPOINT_MAIL)PULSE_SECURE_VPN)QNAP_NAS)RADWARE_FIREWALL)RECORDED_FUTURE_IOC)REDHAT_OPENSHIFT)SALESFORCE)SAP_ASE)GCP_SECURITYCENTER_CHOKEPOINT)GCP_SECURITYCENTER_POSTURE_VIOLATION)GCP_SECURITYCENTER_THREAT)GCP_SECURITYCENTER_TOXIC_COMBINATION)SERVICENOW_AUDIT)SNARE_SOLUTIONS)SNYK_ISSUES)SOLARIS_SYSTEM)SOPHOS_CENTRAL)STIX)STORMSHIELD_FIREWALL)SUBLIMESECURITY)SURICATA_EVE)SWIFT_AMH)SYMANTEC_DLP)SEP)SYMANTEC_MAIL)TABLEAU)TCPWAVE_DDI)TEAMVIEWER)TENABLE_ADS)TENABLE_OT)TENABLE_IO)THINKST_CANARY)THREATCONNECT_IOC_V3)TRELLIX_HX_ES)TIPPING_POINT)TRENDMICRO_VISION_ONE)TRENDMICRO_VISION_ONE_WORKBENCH)TRENDMICRO_DDI)TRENDMICRO_STELLAR)UNIFI_AP)NIX_SYSTEM)VECTRA_DETECT)VECTRA_XDR)VERITAS_NETBACKUP)VERSA_FIREWALL)VMWARE_ESX)VMWARE_NSX)VMWARE_VCENTER)WATCHGUARD)WINDOWS_DNS)WINEVTLOG)WINEVTLOG_XML)WIZ_IO)WORKDAY_AUDIT)WORKSPACE_ACTIVITY)WORKSPACE_ALERTS)ZIMPERIUM)ZSCALER_WEBPROXY)ZSCALER_CASB)ZSCALER_DLP)ZSCALER_DNS)ZSCALER_INTERNET_ACCESS)ZSCALER_FIREWALL)ZSCALER_ZPA)ZSCALER_ZPA_AUDIT)ZSCALER_TUNNEL)ZYWALL)The following log types were added without a default parser. Each parser is listed by product name and log_type value, where applicable.
AIKIDO)AKAMAI_API_SECURITY)ALKIRA_IP_FLOW)ATLASSIAN_GUARD_DETECT)BLINKOPS)CANVAS_LMS)CISCO_SECURE_EMAIL_THREAT_DEFENSE)CISCO_STAR_OS)CITADEL_IDENTITY360)CTIX)CYBERARK_IDENTITY_AUDIT)CYCOGNITO_ASM)DELL_VXRAIL)GENE6_FTP)IBM_CSM)LANGSMITH_AUDIT)MELLANOX_SWITCH)MICROSOFT_ENTRA_ID_PROTECTION)NSFOCUS_NGIPS)PERPLEXITY)PLEASANT_PASSWORD_SERVER)PROMPT_SECURITY)QUALTRICS_AUDIT)RANCHER_API_AUDIT_LOG)RUBRIK_SECURITY_CLOUD)SAP_BW)SAP_CHANGE_DOCUMENT)SAP_GATEWAY)SAP_HANA_AUDIT)SCALE_COMPUTING)SLACK_API)SNOWPLOW)STERLING_OMS_DATA)STRIVACITY)TENCENT_CLOUD_AUDIT)TRELLIX_EX)UNIFI_SYSTEM)WINDOWS_BINDPLANE)WITNESS_AI_CONTROL)ZENDESK_ADPP)The Case Federation feature is no longer dependent on the Case Federation integration in the primary platform.
The primary platform sync job is now disabled. Do not attempt to re-enable it.
For more information, see Set up federated case access for SecOps.
]]>The following v2 connectors, which utilize Google Storage Transfer Service (STS), are now in General Availability: