gcp Google Cloud release notes ·

Google SecOps enhances multi-event rules with customizable scheduling in GA

securitygcpgaengineer
feature

Google SecOps now offers customizable schedules for multi-event rules, reaching General Availability. This feature provides security teams with granular control and transparency over how multi-event rules execute. Key capabilities include configuring settlement delays for log ingestion latency, leveraging automated true-up runs to capture late-arriving logs, and direct migration of legacy rules. Users with custom IAM roles must ensure permissions like `chronicle.rules.modifyRules` and `chronicle.ruleDeployments.update` are included.

Features (1)
  • Google SecOps [Spotlight Feature] Customizable schedules for multi-event rules general availability

    [Spotlight Feature] Customizable schedules for multi-event rules general availability The customizable schedules for multi-event rules feature is now in General Availability (GA). Customizable schedules give security teams granular control and transparency over how multi-event rules execute in Google SecOps, and provide the following capabilities: Configure settlement delays: Set first-run delay offsets (from 1 minute up to 48 hours) to account for log ingestion latency and reduce false negatives. Leverage automated true-up runs: Automatically re-evaluate time windows at 4 hours (and optionall

Read the original announcement →

https://docs.cloud.google.com/release-notes#August_31_2026

Related releases