Google SecOps pipelines gain an Unroll processor
Dated . Source: Google SecOps release notes, read
08-24month and day
What happened
Google Security Operations release notes dated 2026-08-24 say data processing pipelines now support an Unroll processor, which splits a log entry that holds an array of events into separate log events before parsing (release notes read 2026-11-05).
The processor needs structured input. Raw string payloads must first be parsed by a Transform processor placed earlier in the pipeline.
What it changes for a buyer
It matters to a team that ingests batched logs and wants each event to reach detection rules, and so the playbooks attached to them, as its own record. It adds no containment action and changes no Google score.
All notes are on the updates page. The scores on this site change only when a vendor-controlled page changes; see the corrections log.