Google SecOps curated rules move to the GTI_IOC feed

10-12month and day

What happened

Google Security Operations release notes dated 2026-10-12 say Applied Threat Intelligence curated rules now match against the GTI_IOC feed. They also say custom rules that use legacy feeds need updating (release notes read 2026-11-03).

For a response team the change matters at the trigger. A custom rule that stops matching after a feed change stops raising the alert that starts a playbook, and nothing downstream runs.

What it changes for a buyer

If you run Google Security Operations with custom rules on legacy feeds, update them and test that the attached playbooks still fire. The note does not change Google's containment scores, which rest on the Response Agent documentation and the SOAR pages.

All notes are on the updates page. The scores on this site change only when a vendor-controlled page changes; see the corrections log.