New Documentation changelogs

Google SecOps is now releasing a monthly changelog to capture major documentation updates.

For more information, refer to Documentation changelog.

Release 6.3.89 is being rolled out to the first phase of regions as listed here.

This release contains internal and customer bug fixes.

Release 6.3.88 is now available for all regions.

Release 6.3.88 is being rolled out to the first phase of regions as listed here.

This release contains internal and customer bug fixes.

Release 6.3.87 is now available for all regions.

Release 6.3.87 is being rolled out to the first phase of regions as listed here.

This release contains internal and customer bug fixes.

Release 6.3.86 is now available for all regions.

Unified and Upgraded Chronicle API

Chronicle API has been unified with API resources from legacy SOAR API. This unification provides a more robust, secure, and extensible experience. This upgrade signals API stability and functional completeness, enabling customer and partner adoption for production usage. We recommend that customers and partners use Chronicle API for a more robust, secure, and extensible experience. Learn more about API Stability.

This update includes the following resources: Case, CaseAlert, CaseStageDefinition, CaseTagDefinition, CaseQueueFilter, CaseCloseDefinition, ContextProperty, InvolvedEntity, Task, CaseComment, CaseWallRecord, ChatMessage, View, VisualFamily, ChatMessages.attachment, ContentPack, SocRole, EmailTemplate, DynamicParameter, EntitiesBlocklist, Environment, EnvironmentGroup, Integration, Integrationaction, UserNotification, Integrationactionrevision, Connector, ConnectorInstance, RemoteAgent, Connectorlog, Connectorrevision, IntegrationInstance, UniqueEntity, Integrationsjob, JobInstance, JobInstances.log, Jobs.revision, Integrationmanager, Integrationmanagerrevision, AlertGroupingRule, Announcement, Attachment, CustomList, FormDynamicParameter, MarketplaceIntegration, ModuleSetting, SlaDefinition, NotificationSetting, PropertySchemaDefinition, RequestTemplate, SoarDomain, SoarNetwork, WorkdeskLink, SystemNotification, WorkdeskContact, WorkdeskNote, LegacySoarUsers.localization.

For a full list of updated resources and links to the documentation, please see the Chronicle API documentation.

Create and manage calculated fields

The Calculated Fields feature is now available in Preview. With Calculated Fields, you can dynamically derive new data points within Google Security Operations cases and alerts. By defining logical formulas, you can compute values based on existing system or custom fields. The calculated value is automatically evaluated and stored in a user-selected, pre-existing custom field (labeled Target Field) in real time.

For more information, see Create and manage calculated fields.

Announcement

Release 6.3.86 is being rolled out to the first phase of regions as listed here.

This release contains internal and customer bug fixes.

Release 6.3.85 is now available for all regions.

Release 6.3.85 is being rolled out to the first phase of regions as listed here.

This release contains internal and customer bug fixes.

Release 6.3.84 is now available for all regions.

Release 6.3.84 is being rolled out to the first phase of regions as listed here.

This release contains internal and customer bug fixes.

Feature

Enhanced "Time to respond" options for multi-choice questions

Google SecOps now provides more granular control over playbook execution when the "time to respond" for a MultiChoiceQuestion step is exceeded. When configuring a multi-choice question, you can now choose to proceed with one of the predefined answer branches or to create a dedicated branch to handle this scenario.

For more information, see Add a multi-choice question flow.

Release 6.3.83 is now available for all regions.

Release 6.3.83 is being rolled out to the first phase of regions as listed here.

This release contains internal and customer bug fixes.

Release 6.3.82 is now available for all regions.

Release 6.3.82 is being rolled out to the first phase of regions as listed here.

This release contains internal and customer bug fixes.

Feature

Playbook Condition and Multi-Choice Question Flows

The maximum number of branches supported in Playbook Conditions and Multiple Choice Questions has been increased from 6 to 20. This allows for more complex branching logic within a single step.

For more information, see Use flows in playbooks.

Release 6.3.81 is now available for all regions.

Release 6.3.81 is being rolled out to the first phase of regions as listed here.

This release contains internal and customer bug fixes.

Release 6.3.80 is now available for all regions.

SOAR Permission Groups migration to Google Cloud IAM is now in General Availability (GA). You can now leverage Google Cloud IAM for precise, granular feature access, moving away from legacy permission groups.

You can enable it by migrating the legacy SOAR permission groups and permissions to Google Cloud IAM through a self-service migration available from January 26, 2026. Please check the documentation and video for full instructions.

This update is available to all customers who have completed Stage 1 of the SOAR migration to Google Cloud.

Stage 2 of the SOAR migration to Google Cloud deadline has been extended from June 30th to September 30th, 2026.

Release 6.3.80 is being rolled out to the first phase of regions as listed here.

This release contains internal and customer bug fixes.

Release 6.3.79 is now available for all regions.

Release 6.3.79 is being rolled out to the first phase of regions as listed here.

This release contains internal and customer bug fixes.

Release 6.3.78 is now available for all regions.

Release 6.3.78 is being rolled out to the first phase of regions as listed here.

This release contains internal and customer bug fixes.

Release 6.3.77 is now available for all regions.

Release 6.3.77 is being rolled out to the first phase of regions as listed here.

This release contains the following changes:

Change

Publisher Agent Version 2.6.4 removes support for Python 3.7 from the remote agent.

Release 6.3.76 is now available for all regions.