Google SecOps curated rules move to the GTI_IOC feed

Google's Security Operations release notes of 2026-10-12 say Applied Threat Intelligence curated rules now match against the GTI_IOC feed. They also say custom rules that use legacy feeds need updating. The change is on the SIEM side and carries no SOAR change that day.

SOAR buyers feel SIEM changes because detections create the alerts that playbooks consume. A Google SecOps SOAR owner should check which custom rules reference legacy feeds, and whether the alerts feeding their playbooks change. We read the notes on 2026-11-03.

Source: docs.cloud.google.com, read 2026-11-03.

What it changes for a buyer

It changes the input to your playbooks, not the playbooks. Review custom rules before the next release cycle.

Other dispatches

• Mate Labs publishes the Blue City benchmark, without Mate in it, 3 November 2026
• XSOAR 8.11 reaches end-of-life on 2026-11-13, 3 November 2026
• Sentinel leaves the Azure portal on 2027-03-31, with automation differences listed, 3 November 2026
• ThreatConnect's domain now redirects to Dataminr, 3 November 2026
• Google updates its SecOps playbooks screen documentation, 28 October 2026
• Torq says IDC named it a Leader in its AI SOC MarketScape, 20 October 2026
• Mate publishes CPR, its gate for autonomous actions, 18 October 2026
• Splunk SOAR 8.7.0 drops Python 3.9 and adds a connector agent, 2 September 2026
• Mate Gamebooks reach general availability, 26 August 2026
• Microsoft updates its Splunk SOAR to Sentinel migration guide, 12 August 2026
• ServiceNow press report puts a Tier 2 SOC AI Specialist in December, 5 August 2026

More notes in Dispatches. To see the platforms side by side, start from the card.