Google SecOps adds an Unroll processor to data pipelines
Google Security Operations release notes dated 2026-08-24 say the Unroll processor in data processing pipelines splits arrays into separate log events before parsing (Google release notes, read 2026-11-03).
A change to how arrays become events changes what a rule counts. A rule that thresholds on events per host will see a different number if an array now unrolls into several events. The release note describes the processor, not any effect on existing rules.
Source: docs.cloud.google.com read 2026-11-04
What it changes for a buyer
If you adopt Unroll, check threshold and match-window rules on the affected log types, because event counts can change.
Where this stands on the rubric
Current rubric standing of the platforms this note names.
| Platform | Total, of 10 | Matrix, of 33 | Rule health, of 5 |
|---|---|---|---|
| Google Security Operations | 6.83 | 15.0 | 3.5 |
All notes are in the changelog. Spotted something wrong? See corrections.