Google SecOps curated rules move to the GTI_IOC feed
Google Security Operations release notes dated 2026-10-12 say Applied Threat Intelligence curated rules now match against the GTI_IOC feed, and that custom rules on legacy feeds need updating (Google release notes, read 2026-11-03).
This is a content change that reaches into customer-written rules. A custom rule that names a legacy feed keeps existing, and may stop matching what its author expects. The docs read for this site describe no field drift alert tied to rules, so the check falls to the team.
Source: docs.cloud.google.com read 2026-11-04
What it changes for a buyer
Search your rule repository for legacy feed references and update them, and add that search to the pipeline so the next feed change is caught in review.
Where this stands on the rubric
Current rubric standing of the platforms this note names.
| Platform | Total, of 10 | Matrix, of 33 | Rule health, of 5 |
|---|---|---|---|
| Google Security Operations | 6.83 | 15.0 | 3.5 |
All notes are in the changelog. Spotted something wrong? See corrections.