Release 6.3.92 is now available for all regions.

Release 6.3.92 is being rolled out to the first phase of regions as listed here.

This release contains internal and customer bug fixes.

Feature

Publisher Agent Version 2.7.0

Publisher Agent Version 2.7.0 is being rolled out to the first phase of regions.

This release includes the following updates for the remote agent:

• High Availability support: Adds applicative support for Publisher high availability.
• File transfer support: You can now upload and download files using playbooks and the SDK on agents that have been migrated to the GCOM infrastructure.

Release 6.3.91 is now available for all regions.

Release 6.3.91 is being rolled out to the first phase of regions as listed here.

This release contains internal and customer bug fixes.

Announcement

Remote Agents Version 2.6.7

Remote Agents Version 2.6.7 is now available. This release contains minor bug fixes.

Release 6.3.90 is now available for all regions.

Improved documentation portal navigation

Finding help is now easier! We've updated the navigation of our documentation portal to be primarily user-centric. Sections have been reorganized and renamed to align with your workflows, providing a logical path through the documentation.

We've also added:

• A Support tab for technical support, changelogs, and release notes
• A Use cases tab for persona-driven CUJs and workflows

Critical Notice: Upcoming reservation of siemAlertId field

Effective July 5, 2026, the siemAlertId field will be strictly reserved for internal Chronicle SIEM alert IDs.

Starting July 5, the system will automatically overwrite any custom or user-supplied data passed through this field. This change impacts all ingestion methods, including the Ingestion API, webhooks, and both first-party and third-party connectors. If you are currently utilizing a custom field named siemAlertId in any of your alert ingestion configurations, please migrate to a different field name immediately to prevent data loss.

Release 6.3.90 is being rolled out to the first phase of regions as listed here.

This release contains internal and customer bug fixes.

Announcement

Scheduled Maintenance

CloudSQL will undergo a scheduled minor upgrade.

Release 6.3.89 is now available for all regions.

New Documentation changelogs

Google SecOps is now releasing a monthly changelog to capture major documentation updates.

For more information, refer to Documentation changelog.

Release 6.3.89 is being rolled out to the first phase of regions as listed here.

This release contains internal and customer bug fixes.

Release 6.3.88 is now available for all regions.

Release 6.3.88 is being rolled out to the first phase of regions as listed here.

This release contains internal and customer bug fixes.

Release 6.3.87 is now available for all regions.

Release 6.3.87 is being rolled out to the first phase of regions as listed here.

This release contains internal and customer bug fixes.

Release 6.3.86 is now available for all regions.

Unified and Upgraded Chronicle API

Chronicle API has been unified with API resources from legacy SOAR API. This unification provides a more robust, secure, and extensible experience. This upgrade signals API stability and functional completeness, enabling customer and partner adoption for production usage. We recommend that customers and partners use Chronicle API for a more robust, secure, and extensible experience. Learn more about API Stability.

This update includes the following resources: Case, CaseAlert, CaseStageDefinition, CaseTagDefinition, CaseQueueFilter, CaseCloseDefinition, ContextProperty, InvolvedEntity, Task, CaseComment, CaseWallRecord, ChatMessage, View, VisualFamily, ChatMessages.attachment, ContentPack, SocRole, EmailTemplate, DynamicParameter, EntitiesBlocklist, Environment, EnvironmentGroup, Integration, Integrationaction, UserNotification, Integrationactionrevision, Connector, ConnectorInstance, RemoteAgent, Connectorlog, Connectorrevision, IntegrationInstance, UniqueEntity, Integrationsjob, JobInstance, JobInstances.log, Jobs.revision, Integrationmanager, Integrationmanagerrevision, AlertGroupingRule, Announcement, Attachment, CustomList, FormDynamicParameter, MarketplaceIntegration, ModuleSetting, SlaDefinition, NotificationSetting, PropertySchemaDefinition, RequestTemplate, SoarDomain, SoarNetwork, WorkdeskLink, SystemNotification, WorkdeskContact, WorkdeskNote, LegacySoarUsers.localization.

For a full list of updated resources and links to the documentation, please see the Chronicle API documentation.

Create and manage calculated fields

The Calculated Fields feature is now available in Preview. With Calculated Fields, you can dynamically derive new data points within Google Security Operations cases and alerts. By defining logical formulas, you can compute values based on existing system or custom fields. The calculated value is automatically evaluated and stored in a user-selected, pre-existing custom field (labeled Target Field) in real time.

For more information, see Create and manage calculated fields.

Announcement

Release 6.3.86 is being rolled out to the first phase of regions as listed here.

This release contains internal and customer bug fixes.

Release 6.3.85 is now available for all regions.

Release 6.3.85 is being rolled out to the first phase of regions as listed here.

This release contains internal and customer bug fixes.

Release 6.3.84 is now available for all regions.

Release 6.3.84 is being rolled out to the first phase of regions as listed here.

This release contains internal and customer bug fixes.

Feature

Enhanced "Time to respond" options for multi-choice questions

Google SecOps now provides more granular control over playbook execution when the "time to respond" for a MultiChoiceQuestion step is exceeded. When configuring a multi-choice question, you can now choose to proceed with one of the predefined answer branches or to create a dedicated branch to handle this scenario.

For more information, see Add a multi-choice question flow.

Release 6.3.83 is now available for all regions.

Release 6.3.83 is being rolled out to the first phase of regions as listed here.

This release contains internal and customer bug fixes.

Release 6.3.82 is now available for all regions.

Release 6.3.82 is being rolled out to the first phase of regions as listed here.

This release contains internal and customer bug fixes.

Feature

Playbook Condition and Multi-Choice Question Flows

The maximum number of branches supported in Playbook Conditions and Multiple Choice Questions has been increased from 6 to 20. This allows for more complex branching logic within a single step.

For more information, see Use flows in playbooks.

Release 6.3.81 is now available for all regions.

Release 6.3.81 is being rolled out to the first phase of regions as listed here.

This release contains internal and customer bug fixes.

Release 6.3.80 is now available for all regions.

SOAR Permission Groups migration to Google Cloud IAM is now in General Availability (GA). You can now leverage Google Cloud IAM for precise, granular feature access, moving away from legacy permission groups.

You can enable it by migrating the legacy SOAR permission groups and permissions to Google Cloud IAM through a self-service migration available from January 26, 2026. Please check the documentation and video for full instructions.

This update is available to all customers who have completed Stage 1 of the SOAR migration to Google Cloud.