Views
5

Your rating
Rate update installation process

Log in to rate this update.
Login

Risk factor
No ratings yet. Be the first to rate this update.

Smooth installs 0%
Minor issues 0%
Major issues 0%

Update Summary

Google SecOps introduces public preview for customizable schedules for multi-event rules and a revamped Investigation and case management experience. Release 6.3.95 is also rolling out to the first phase of regions with internal and customer bug fixes.

Update Details

Security

  • Customizable multi-event rule schedules require updated IAM permissions: chronicle.ruleDeployments.update and chronicle.rules.modifyRules.
  • Investigation and case management preview is limited to single-SIEM deployments and does not support federated or MSSP environments.

Bug Fixes

  • Release 6.3.95 includes internal and customer bug fixes.

New Features

  • Customizable schedules for multi-event rules with first-run delay offsets and automated background true-up runs.
  • Revamped Investigation Management experience with raw UDM events, detections, customizable table views, side-drawer previews, and integrated UDM Search workflows.
  • Ability to attach SIEM search results to cases, including up to 500 detections and 5,000 UDM events per case.
  • Interactive Events Viewer for inspecting parsed UDM records, raw logs, pinned evidence, and detection exclusions.
  • New default alert and case views for the enhanced Cases experience.

Known Issues

  • The revamped Investigation and case management experience is currently supported only for single-SIEM deployments and does not support federated or MSSP environments.
  • Before enabling the enhanced Cases experience, advanced widget configurations from the old default alert and case views must be manually copied to the new default views.

Hints

  • To manage rule schedules with custom IAM roles, add chronicle.ruleDeployments.update for API updates and chronicle.rules.modifyRules for web or batch updates.
  • Predefined roles such as Chronicle API Admin (roles/chronicle.admin) and Chronicle API Editor (roles/chronicle.editor) already include the required permissions.
  • The Investigation and case management preview is available only for single-SIEM deployments.
  • Copy advanced widget configurations from the existing Default Alert View and Default Case View to the new default views before enabling the enhanced Cases experience.

Links

Product Information

Vendor: Google

Product: Cloud

Product type: Other

Platform: Web

Version: Release 6.3.95

Vendor release date: Jul 26, 2026

Published on updatealert.io: Jul 27, 2026

Description: Cloud platform for compute, data, networking, and developer services.