Release 6.3.100 is being rolled out to the first phase of regions as listed here.
This release contains internal and customer bug fixes.
Reaction triggers
This feature is in preview. Google SecOps now supports reaction triggers. As post-ingestion triggers, they allow playbooks to automatically fire in response to real-time case or alert updates during active investigations, such as changes to the case assignee, case tags, alert priority, or newly added entities.
For more information, see Use reaction triggers in playbooks.
Case playbooks
This feature is in preview. Google SecOps now supports case playbooks. You can run playbooks or execute manual actions across an entire case container rather than individual alerts, consolidating response tasks and reducing redundant operations during investigations.
For more information, see Case playbooks overview.
]]>Release 6.3.99 is now available for all regions.
]]>Release 6.3.99 is being rolled out to the first phase of regions as listed here.
This release contains internal and customer bug fixes.
]]>Release 6.3.98 is now available for all regions.
]]>Scheduled maintenance
SOAR database and infrastructure maintenance is scheduled to take place during the standard maintenance window on Sunday, August 30. During this window, your system will experience a brief period of downtime. You don't need to take any action.
]]>Release 6.3.98 is being rolled out to the first phase of regions as listed here.
This release contains internal and customer bug fixes.
]]>Release 6.3.97 is now available for all regions.
]]>Scheduled Maintenance
SOAR database and infrastructure maintenance is scheduled to take place during the standard maintenance window on Sunday, August 16. During this window, your system will experience a brief period of downtime. No customer action is required.
]]>Release 6.3.97 is being rolled out to the first phase of regions as listed here.
This release contains internal and customer bug fixes.
Updated rich-text editor
Upgraded the rich-text editor across Google SecOps, including the Cases Wall, Use Case Upload dialog, Report Template dialog, and Dashboard Editor widget.
Key changes include:
Release 6.3.96 is now available for all regions.
]]>The deadline for Stage 2 of the SOAR migration to Google Cloud has been extended from September 30th to November 30th, 2026. For more information, refer to the SOAR migration guide.
]]>Release 6.3.96 is being rolled out to the first phase of regions as listed here.
This release contains internal and customer bug fixes.
]]>Release 6.3.95 is now available for all regions.
]]>Release 6.3.95 is being rolled out to the first phase of regions as listed here.
This release contains internal and customer bug fixes.
]]>Release 6.3.94 is now available for all regions.
]]>Release 6.3.94 is being rolled out to the first phase of regions as listed here.
This release contains internal and customer bug fixes.
]]>Release 6.3.93 is now available for all regions.
]]>Release 6.3.93 is being rolled out to the first phase of regions as listed here.
This release contains internal and customer bug fixes.
Publisher Agent Version 2.7.0
Publisher Agent Version 2.7.0 is now available for all regions.
]]>Release 6.3.92 is now available for all regions.
]]>SOAR migration to Google Cloud validation status
You can now check if the SOAR migration was successful by going to the SOAR Settings > License Management page. After successful completion of Stage 1, it will say Google.com after the system version number. After successful completion of Stage 2 of SOAR permissions to IAM roles, it will say both Google.com and CloudIAM Enabled after the system version number.
For more information on the migration, see the SOAR migration guide
]]>Release 6.3.92 is being rolled out to the first phase of regions as listed here.
This release contains internal and customer bug fixes.
Publisher Agent Version 2.7.0
Publisher Agent Version 2.7.0 is being rolled out to the first phase of regions.
This release includes the following updates for the remote agent:
Release 6.3.91 is now available for all regions.
]]>Release 6.3.91 is being rolled out to the first phase of regions as listed here.
This release contains internal and customer bug fixes.
Remote Agents Version 2.6.7
Remote Agents Version 2.6.7 is now available. This release contains minor bug fixes.
]]>Release 6.3.90 is now available for all regions.
]]>Improved documentation portal navigation
Finding help is now easier! We've updated the navigation of our documentation portal to be primarily user-centric. Sections have been reorganized and renamed to align with your workflows, providing a logical path through the documentation.
We've also added:
Critical Notice: Upcoming reservation of siemAlertId field
Effective July 5, 2026, the siemAlertId field will be strictly reserved for
internal Chronicle SIEM alert IDs.
Starting July 5, the system will automatically overwrite any custom or
user-supplied data passed through this field. This change impacts all ingestion
methods, including the Ingestion API, webhooks, and both first-party and
third-party connectors. If you are currently utilizing a custom field named
siemAlertId in any of your alert ingestion configurations, please
migrate to a different field name immediately to prevent data loss.
Release 6.3.90 is being rolled out to the first phase of regions as listed here.
This release contains internal and customer bug fixes.
Scheduled Maintenance
CloudSQL will undergo a scheduled minor upgrade.
]]>Release 6.3.89 is now available for all regions.
]]>New Documentation changelogs
Google SecOps is now releasing a monthly changelog to capture major documentation updates.
For more information, refer to Documentation changelog.
]]>Release 6.3.89 is being rolled out to the first phase of regions as listed here.
This release contains internal and customer bug fixes.
]]>