ReleaseBytes
gcp Google Cloud release notes ·

Google SecOps Introduces Case Playbooks and Reaction Triggers in Preview

securitygcppreviewengineer
feature

Google SecOps now supports case playbooks and reaction triggers, both currently in preview. Case playbooks allow security teams to run playbooks and manual actions across entire case containers, streamlining response tasks during investigations. Reaction triggers enable playbooks to automatically respond to real-time case or alert updates, such as changes to assignees or alert priority. These additions aim to consolidate response efforts and reduce redundant operations for security analysts.

  • →[Spotlight Feature] Case playbooks
  • →[Spotlight Feature] Reaction triggers
Features (2) ›
  • Google SecOps [Spotlight Feature] Case playbooks

    [Spotlight Feature] Case playbooks This feature is in preview. Google SecOps now supports case playbooks. You can run playbooks or execute manual actions across an entire case container rather than individual alerts, consolidating response tasks and reducing redundant operations during investigations. For more information, see Case playbooks overview .

    Case playbooks overview
  • Google SecOps [Spotlight Feature] Reaction triggers

    [Spotlight Feature] Reaction triggers This feature is in preview. Google SecOps now supports reaction triggers. As post-ingestion triggers, they allow playbooks to automatically fire in response to real-time case or alert updates during active investigations, such as changes to the case assignee, case tags, alert priority, or newly added entities. For more information, see Use reaction triggers in playbooks .

    Use reaction triggers in playbooks
Read the original announcement →

https://docs.cloud.google.com/release-notes#September_06_2026

Related releases