Google Security Operations
Google Security Operations combines a SIEM, SOAR and Gemini features, and its Response Agent documents approval modes by risk tier. That agent is Pre-GA in Private Preview. It places third of 14 at 6.09, with 19 of 25 containment actions documented, helped by one product holding detection and response. No time-to-contain figure is published.
What Google Security Operations is
Google Security Operations, formerly Chronicle, joins a SIEM with log ingestion, search and YARA-L detections, a SOAR with playbooks and case management from the Siemplify acquisition, and threat intelligence (cloud.google.com/security/products/security-operations, read 2026-11-04). Gemini features help with search, rule and playbook authoring and case summaries.
The Response Agent is the part that matters for containment. Its documentation (docs.cloud.google.com/chronicle/docs/secops/response-agent, read 2026-11-03) describes approval settings by risk. It is Pre-GA, in Private Preview, and the page says it is not available to all customers in all regions.
vendor claim Cloud security operations platform that combines a SIEM (log ingestion, search, YARA-L detections), SOAR (playbooks and case management, from the Siemplify acquisition) and threat intelligence. Gemini features assist with search, rule and playbook authoring and case summaries. Formerly named Chronicle. cloud.google.com, read
Products named: Google Security Operations (SIEM), YARA-L 2.0 detection language, Community detection rules (chronicle/detection-rules), Google SecOps SOAR, Gemini in Google SecOps.
Ownership. Google Cloud announced the acquisition of Siemplify (SOAR) in a blog post by Sunil Potti dated 2022-01-04 and said it intended to integrate Siemplify capabilities into Chronicle. The post says Google 'has acquired' Siemplify and gives no completion date. The separate completion post (google-cloud-completes-acquisition-of-siemplify) returned HTTP 404 on 2026-11-03. cloud.google.com, read
no figureon the pages read
Published time to contain
| Figure | Metric | Sample and who measured | Grade | Source |
|---|---|---|---|---|
| Customer quote: time to detect and time to investigate reduced from 2 hours to about 15 to 30 minutes | adjacent measure | one customer (Apex FinTech Solutions), self-reported. Measured by customer quote on vendor page. Date: not stated. | C | vendor claim cloud.google.com, read |
None of these is a time to contain, so the home table shows an open bar. Grades run A (independent, method published) to D (unverifiable). The evidence register explains each grade.
19 of 255 of 5 domains
Containment coverage
Of 25 containment actions across EDR, identity, email, cloud and network, Google Security Operations documents 19 as native or partner on the pages read: 19 native, 0 partner, 0 custom step only, 6 not documented. Coverage share is 76 percent.
- native, vendor-documented
- partner or third-party documented
- custom step only
- not documented on the pages read
| Platform | EDR | Identity | Cloud | Network | |||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Isolate host | Release isolation | Kill process | Quarantine file | Run script or live response | Block hash | Disable user | Force password reset | Revoke sessions or tokens | Require MFA re-enrolment | Remove from group or role | Delete a delivered message | Quarantine a delivered message | Block sender or domain | Remove a URL rewrite exemption | Pull from quarantine | Disable IAM user or access key | Revoke cloud session | Isolate or stop an instance | Change a security group or firewall rule | Revoke OAuth app consent | Block IP or domain at the firewall | Block at the proxy or DNS filter | Disable a switch port or NAC quarantine | Add to a threat list on the NDR | |
| Google Security Operations19 of 25 documented | Google Security Operations: Require MFA re-enrolment, not documented | Google Security Operations: Quarantine a delivered message, not documented | Google Security Operations: Remove a URL rewrite exemption, not documented | Google Security Operations: Revoke cloud session, not documented | Google Security Operations: Revoke OAuth app consent, not documented | Google Security Operations: Add to a threat list on the NDR, not documented | |||||||||||||||||||
Basis: Action headings on the Google SecOps SOAR marketplace integration pages on cloud.google.com. The pages are Google-hosted; some integrations are authored by third parties and the pages do not always label the maintainer, so all are read as native with that caveat. Read 2026-11-04.
Limits: Maintainer is not stated on each page.
The full grid, with the page behind each cell, is on the scorecard. A cell reads not documented when the pages read did not show the action. That is a finding about public material, not a claim that the action is absent.
6.09rank 3 of 14
Rubric scores
Google Security Operations is in a band with Cyware (6.11), Palo Alto Cortex XSOAR (5.91), Swimlane (Turbine) (5.84), Splunk SOAR (Cisco) (5.79), Torq (5.74), Tines (5.62). A band is a run of neighbouring totals. Bands chain: a new band starts only where the gap to the total above exceeds 0.25, so a band can be wider than 0.25 and the order inside it is not an order.
| Criterion | Weight | Score | Points | Status, reason and source |
|---|---|---|---|---|
| Native containment coverage | 25 | 7.7 | 1.925 | documented. 19 of 25 containment actions documented as native or partner (76 percent) across 5 of 5 domains. Score is 2.0 plus 7.5 times the share, capped at 9.5. |
| Published time-to-contain evidence with method | 15 | 3.5 | 0.525 | not documented. The Response Agent page publishes no time-to-contain figure. docs.cloud.google.com, read |
| Approval, rollback and blast-radius controls documented | 15 | 8.0 | 1.200 | documented. Docs state manual approval as default, autonomous thresholds at Low, Medium or High risk, and per-integration or per-action overrides (Autonomous, Default, Manual Approval); no rollback; feature is Pre-GA in Private Preview. docs.cloud.google.com, read |
| Explanation and audit trail | 15 | 6.5 | 0.975 | partial. Docs say executed actions show success or failure status in the workflow and read-only users can view execution history and output; no export or retention stated. docs.cloud.google.com, read |
| Integration depth documented | 10 | 4.0 | 0.400 | not documented. The page read names EDR, firewall and identity tools only as categories under Available Tools; the SOAR integration list was not read. docs.cloud.google.com, read |
| Detection-to-response coupling | 8 | 8.0 | 0.640 | documented. The agent is configured under SIEM settings in the same product, so detection and response share one platform. docs.cloud.google.com, read |
| Pricing transparency | 6 | 3.5 | 0.210 | not documented. No pricing page was read; the docs say generating response plans uses no AI quota during Private Preview. docs.cloud.google.com, read |
| Deployment and data handling | 6 | 3.5 | 0.210 | not documented. Deployment and data handling were not on the page read; it says the feature is not available to all customers in all regions. docs.cloud.google.com, read |
| Total | 100 | 6.09 | Sum of the eight weighted points above, to two decimals. | |
Scores are proposals under the rubric bands, computed in code from the published weights. Where a score rests on a vendor's marketing page only, a read of its documentation can move it.
Where Google Security Operations is strong
- Documented: manual approval is the default, autonomous thresholds can be set at Low, Medium or High risk, and each integration or action can be overridden to Autonomous, Default or Manual Approval. That is the level of detail the rubric asks for. docs.cloud.google.com, read
- The agent is configured under SIEM settings in the same product, so detection and response share one platform. The product page also says SOAR is included, with playbooks and orchestration of 300+ tools across EDR, identity and network security. cloud.google.com, read
- Playbooks can be exported and imported as ZIP files between staging and production and tested in a Playbook Simulator, according to docs updated 2026-10-28. That gives a place to test a containment step before it runs live. docs.cloud.google.com, read
Where Google Security Operations is behind
- Time-to-contain evidence: none. The Response Agent page publishes no figure. The product page quotes Apex Fintech Solutions cutting time to detect and investigate from 2 hours to about 15 to 30 minutes, a customer quote with no period or measurement, and not a containment time. docs.cloud.google.com, read
- The Response Agent is Pre-GA in Private Preview, and the page states no rollback for actions. A buyer is choosing a design, not a shipped feature, and the page says availability is limited by region. docs.cloud.google.com, read
- Documentation says executed actions show success or failure in the workflow and that read-only users can view execution history and output. No export or retention for those records is stated. docs.cloud.google.com, read
What only Google Security Operations has
Google's Standard package includes 300+ SOAR integrations and caps detection at 1,000 single-event and 75 multi-event rules, with Gemini in security operations starting at Enterprise. cloud.google.com, read
nonelisted
Pricing as published
vendor claim Sold in packages (Standard, Enterprise, Enterprise Plus) and based on ingestion, with one year of security telemetry retention included. No price is published for any package; each says 'Contact sales for pricing'. cloud.google.com, read
Trial or free tier. No trial terms on the product page. The page links to a Google Cloud free-trial sign-up in site navigation only; no SecOps-specific trial terms are stated. cloud.google.com, read
Integrations. 300 published as a count; named: Office 365, Azure AD, VirusTotal (VT Context pivot), Secret Manager (feed credentials). vendor claim cloud.google.com, read
13names on its pages
Named customers
Customers below are names on Google Security Operations's own pages, so each is a vendor claim. A logo is not a reference, and none of these entries says what the customer uses the product for.
- BBVA (logo on product page), Morgan Sindall (logo on product page), Groupon (logo on product page), Telefonica (logo on product page), Vertiv (logo on product page), Jack Henry (logo on product page), Kroger (logo on product page), Telepass (logo on product page), Charles Schwab (logo on product page), Herjavec (logo on product page), Pfizer (quoted: Mark Ruiz, Head of Cybersecurity Analytics), Apex Fintech Solutions (quoted: Hector Pena, Senior Director of Information Security), Etsy (customer story video linked from product page). cloud.google.com, read
7dated entries
Recent releases
| Date | Release | Source |
|---|---|---|
| 2026-10-12 | Applied Threat Intelligence curated rules now match against the GTI_IOC feed; custom rules on legacy feeds need updating. Curated detections change. Affects rules that reference legacy feeds. | vendor claim docs.cloud.google.com, read |
| 2026-09-15 | Grok parser filter gains match_all option. Parser syntax change. Extracts all non-overlapping matches in a field. | vendor claim docs.cloud.google.com, read |
| 2026-08-26 | Mandiant Frontline Threats rule packs for Linux, macOS and Google Cloud added to Curated Detections and Content Hub. New curated detection packs. | vendor claim docs.cloud.google.com, read |
| 2026-08-24 | Unroll processor in data processing pipelines splits arrays into separate log events before parsing. Pipeline processor change. | vendor claim docs.cloud.google.com, read |
| 2026-07-15 | Advanced filtering in dashboards (public preview) uses token variables in YARA-L queries. Dashboards can inject dynamic values or regex into YARA-L queries. Preview status. | vendor claim docs.cloud.google.com, read |
| 2026-06-23 | Feed Management adds an Ask Gemini Cloud Assist button for feed setup and troubleshooting. Guidance only. The button does not make configuration changes. | vendor claim docs.cloud.google.com, read |
| 2026-06-13 | Non-prioritised IoC matching rules category added to Curated Detections (cryptomining, C2 communications). New curated rule category. | vendor claim docs.cloud.google.com, read |
3graded
Claims Google Security Operations makes about itself
Each is a vendor claim, graded A to D on the method published: A independent with method, B vendor-measured with sample and method, C a number with no method, D unverifiable. This site's own voice does not repeat any of them as fact.
| Claim | Method stated | Grade | Source |
|---|---|---|---|
| Vertiv CISO: with Google Security Operations, logging about 22 times the data, seeing three times the events and closing investigations in half the time, versus a traditional SIEM that needed five to seven people | one customer (Vertiv). Measured by customer. | C | vendor claim cloud.google.com, read |
| Apex Fintech Solutions: time to detect and time to investigate reduced from 2 hours to about 15 to 30 minutes | one customer (Apex Fintech). Measured by customer. | C | vendor claim cloud.google.com, read |
| Forrester Consulting study: customers cite 240 percent ROI with Google Security Operations | not stated on the product page. Measured by analyst. | C | vendor claim cloud.google.com, read |
Who should shortlist Google Security Operations
- You already run Google Security Operations as the SIEM and want response in the same product.
- You want per-action overrides and risk thresholds you can read in documentation before a pilot.
- You can accept a Private Preview feature, or plan to use the established SOAR playbooks meanwhile.
Google Security Operations places 3rd of 14 at a total of 6.09, with 19 of 25 containment actions documented. Strong where detection and response sit in one product, with 19 of 25 documented actions and approval modes by risk tier. The Response Agent is Pre-GA in Private Preview, so confirm availability before relying on it. It shares a band with Cyware, Palo Alto Cortex XSOAR, Swimlane, Splunk SOAR, Torq and Tines.
The same platform under other weights
- Regulated financial: 2nd of 14, total 6.26.
- Lean team: 2nd of 14, total 5.97.
- MSSP: 5th of 14, total 5.83.
- Microsoft estate: 2nd of 14, total 6.29.
- CrowdStrike estate: 2nd of 14, total 6.37.
Compare Google Security Operations
- Google Security Operations alternatives: 3 gaps and 5 platforms that answer them.
- Google Security Operations against Cyware, totals 6.09 and 6.11.
- Google Security Operations against Palo Alto Cortex XSOAR, totals 6.09 and 5.91.
- Google Security Operations against Swimlane (Turbine), totals 6.09 and 5.84.
- Google Security Operations against Splunk SOAR (Cisco), totals 6.09 and 5.79.
Facts on this page were read 2026-11-04 and the days before it; the date beside each source is the date it was read. Last updated 4 November 2026.