Release 6.3.98 is being rolled out to the first phase of regions as listed here.

This release contains internal and customer bug fixes.

Release 6.3.97 is now available for all regions.

Scheduled Maintenance

SOAR database and infrastructure maintenance is scheduled to take place during the standard maintenance window on Sunday, August 16. During this window, your system will experience a brief period of downtime. No customer action is required.

Release 6.3.97 is being rolled out to the first phase of regions as listed here.

This release contains internal and customer bug fixes.

Feature

Updated rich-text editor

Upgraded the rich-text editor across Google SecOps, including the Cases Wall, Use Case Upload dialog, Report Template dialog, and Dashboard Editor widget.

Key changes include:

• Simplified typography: Choose font sizes using semantic options (Small, Normal, Large, Huge). Legacy font sizes on existing text are preserved.
• Streamlined tables: You can insert or remove entire tables. Formatting inside table cells is no longer supported.
• Toolbar cleanup: Removed the Cut, Copy, and Paste buttons from the toolbar. Standard OS keyboard shortcuts remain supported.
• Visual alignment: Improved visual consistency between editor content during editing and after submission.

Release 6.3.96 is now available for all regions.

The deadline for Stage 2 of the SOAR migration to Google Cloud has been extended from September 30th to November 30th, 2026. For more information, refer to the SOAR migration guide.

Release 6.3.96 is being rolled out to the first phase of regions as listed here.

This release contains internal and customer bug fixes.

Release 6.3.95 is now available for all regions.

Release 6.3.95 is being rolled out to the first phase of regions as listed here.

This release contains internal and customer bug fixes.

Release 6.3.94 is now available for all regions.

Release 6.3.94 is being rolled out to the first phase of regions as listed here.

This release contains internal and customer bug fixes.

Release 6.3.93 is now available for all regions.

Release 6.3.93 is being rolled out to the first phase of regions as listed here.

This release contains internal and customer bug fixes.

Feature

Publisher Agent Version 2.7.0

Publisher Agent Version 2.7.0 is now available for all regions.

Release 6.3.92 is now available for all regions.

SOAR migration to Google Cloud validation status

You can now check if the SOAR migration was successful by going to the SOAR Settings > License Management page. After successful completion of Stage 1, it will say Google.com after the system version number. After successful completion of Stage 2 of SOAR permissions to IAM roles, it will say both Google.com and CloudIAM Enabled after the system version number.

For more information on the migration, see the SOAR migration guide

Release 6.3.92 is being rolled out to the first phase of regions as listed here.

This release contains internal and customer bug fixes.

Feature

Publisher Agent Version 2.7.0

Publisher Agent Version 2.7.0 is being rolled out to the first phase of regions.

This release includes the following updates for the remote agent:

• High Availability support: Adds applicative support for Publisher high availability.
• File transfer support: You can now upload and download files using playbooks and the SDK on agents that have been migrated to the GCOM infrastructure.

Release 6.3.91 is now available for all regions.

Release 6.3.91 is being rolled out to the first phase of regions as listed here.

This release contains internal and customer bug fixes.

Announcement

Remote Agents Version 2.6.7

Remote Agents Version 2.6.7 is now available. This release contains minor bug fixes.

Release 6.3.90 is now available for all regions.

Improved documentation portal navigation

Finding help is now easier! We've updated the navigation of our documentation portal to be primarily user-centric. Sections have been reorganized and renamed to align with your workflows, providing a logical path through the documentation.

We've also added:

• A Support tab for technical support, changelogs, and release notes
• A Use cases tab for persona-driven CUJs and workflows

Critical Notice: Upcoming reservation of siemAlertId field

Effective July 5, 2026, the siemAlertId field will be strictly reserved for internal Chronicle SIEM alert IDs.

Starting July 5, the system will automatically overwrite any custom or user-supplied data passed through this field. This change impacts all ingestion methods, including the Ingestion API, webhooks, and both first-party and third-party connectors. If you are currently utilizing a custom field named siemAlertId in any of your alert ingestion configurations, please migrate to a different field name immediately to prevent data loss.

Release 6.3.90 is being rolled out to the first phase of regions as listed here.

This release contains internal and customer bug fixes.

Announcement

Scheduled Maintenance

CloudSQL will undergo a scheduled minor upgrade.

Release 6.3.89 is now available for all regions.

New Documentation changelogs

Google SecOps is now releasing a monthly changelog to capture major documentation updates.

For more information, refer to Documentation changelog.

Release 6.3.89 is being rolled out to the first phase of regions as listed here.

This release contains internal and customer bug fixes.

Release 6.3.88 is now available for all regions.

Release 6.3.88 is being rolled out to the first phase of regions as listed here.

This release contains internal and customer bug fixes.

Release 6.3.87 is now available for all regions.

Release 6.3.87 is being rolled out to the first phase of regions as listed here.

This release contains internal and customer bug fixes.

Release 6.3.86 is now available for all regions.