Google SecOps SIEM deprecates legacy IOC feeds
Google SecOps SIEM is deprecating three legacy Mandiant Indicator of Compromise (IOC) feeds: MANDIANT_ACTIVE_BREACH_IOC, MANDIANT_FUSION_IOC, and OPEN_SOURCE_INTEL_IOC. These feeds will be removed after March 18, 2027, and users are directed to migrate to the GTI_IOC feed. This change impacts security operations teams using these specific data feeds.
Deprecations (1) ›
- Google SecOps SIEM
The MANDIANT_ACTIVE_BREACH_IOC , MANDIANT_FUSION_IOC , and OPEN_SOURCE_INTEL_IOC feeds are deprecated in favor of the GTI_IOC feed. After March 18, 2027, we will be removing the MANDIANT_ACTIVE_BREACH_IOC , MANDIANT_FUSION_IOC , and OPEN_SOURCE_INTEL_IOC feeds. For more information on how to migrate, see Migrate Mandiant legacy feeds to GTI .
https://docs.cloud.google.com/release-notes#August_05_2026
Related releases
- Google SecOps: Scheduled SOAR Database Maintenance Google Cloud release notes ·
- VPC Service Controls Recommender Enters Public Preview Google Cloud release notes ·
- Data Studio Adds Chart and Component Customization Features Google Cloud release notes ·
- Google SecOps Marketplace Updates Integrations and Fixes Google Cloud release notes ·
- Access Approval Feature App Topology with One Graph Now Generally Available Google Cloud release notes ·
- Google SecOps SOAR Schedules Database and Infrastructure Maintenance Google Cloud release notes ·