Google SecOps: GoogleSQL Support for Search & IOC Feed Deprecation
Google SecOps introduces public preview for GoogleSQL query support within its Search functionality, offering a flexible, industry-standard alternative to YARA-L 2.0 for exploring security data. This enables SecOps users to query various telemetry tables, including UDM events and detection rules, for broad data exploration and ad hoc investigations. Concurrently, Google is deprecating the MANDIANT_ACTIVE_BREACH_IOC, MANDIANT_FUSION_IOC, and OPEN_SOURCE_INTEL_IOC feeds. Users are advised to migrate to the GTI_IOC feed, as the deprecated feeds will be removed after March 18, 2027.
- →[Spotlight Feature] GoogleSQL query support in Search
- →MANDIANT_ACTIVE_BREACH_IOC , MANDIANT_FUSION_IOC , and OPEN_SOURCE_INTEL_IOC` feeds are being removed
Deprecations (1) ›
- Google SecOps MANDIANT_ACTIVE_BREACH_IOC , MANDIANT_FUSION_IOC , and OPEN_SOURCE_INTEL_IOC` feeds are being removed
MANDIANT_ACTIVE_BREACH_IOC , MANDIANT_FUSION_IOC , and OPEN_SOURCE_INTEL_IOC` feeds are being removed The MANDIANT_ACTIVE_BREACH_IOC , MANDIANT_FUSION_IOC , and OPEN_SOURCE_INTEL_IOC feeds are deprecated in favor of the GTI_IOC feed. After March 18, 2027, we will be removing the MANDIANT_ACTIVE_BREACH_IOC , MANDIANT_FUSION_IOC , and OPEN_SOURCE_INTEL_IOC feeds. For more information on how to migrate, see Migrate Mandiant legacy feeds to GTI .
Features (1) ›
- Google SecOps [Spotlight Feature] GoogleSQL query support in Search
[Spotlight Feature] GoogleSQL query support in Search This feature is in public preview. You can now use GoogleSQL in Search to query your security data in Google SecOps, offering a flexible and powerful industry-standard alternative to YARA-L 2.0. GoogleSQL is optimized for broad data exploration, statistical aggregation, and deep-dive ad hoc investigations. You can query telemetry tables including but not limited to UDM events, entity graphs, detection rules, and case management data—using either standard declarative SQL or the linear, sequential Piped SQL syntax. For more information, see G
https://docs.cloud.google.com/release-notes#September_14_2026
Related releases
- Apigee hybrid v1.17.0 Enhances AI Integration, Security, and Networking Google Cloud release notes ·
- Cloud SQL for SQL Server 2017 Deprecation and End-of-Life Announced Google Cloud release notes ·
- GCP Network Intelligence Center simplifies Monitoring Point installation Google Cloud release notes ·
- Compute Engine now shows Workload Manager findings on Overview page Google Cloud release notes ·
- Vertex AI Search: Configurable Pricing for Query Add-ons Now GA Google Cloud release notes ·
- Google SecOps SIEM Deprecates Three Mandiant/Open Source Intelligence Feeds Google Cloud release notes ·