Google updates its SecOps playbooks screen documentation

Google updated the playbooks screen documentation for SecOps SOAR on 2026-10-28. A playbook starts with a mandatory trigger, then actions and if-then-else flows. Export and Import move playbooks and blocks between staging and production, and the system accepts only ZIP files. A Playbook Simulator tests them, and only one playbook attaches automatically to an alert, by priority.

A separate docs page on case playbooks, read on 2026-11-04, says their executions are excluded from Legacy Monitoring dashboards and from SOAR data exports. We did not find an update date for that page. No importer from another vendor is documented, so the matrix records no path into Google SecOps.

Source: docs.cloud.google.com, read 2026-11-03.

What it changes for a buyer

The ZIP is a staging-to-production format, not a way out. If you audit playbook runs from exported data, confirm the case playbooks are in it.

Other dispatches

• Mate Labs publishes the Blue City benchmark, without Mate in it, 3 November 2026
• XSOAR 8.11 reaches end-of-life on 2026-11-13, 3 November 2026
• Sentinel leaves the Azure portal on 2027-03-31, with automation differences listed, 3 November 2026
• ThreatConnect's domain now redirects to Dataminr, 3 November 2026
• Torq says IDC named it a Leader in its AI SOC MarketScape, 20 October 2026
• Mate publishes CPR, its gate for autonomous actions, 18 October 2026
• Google SecOps curated rules move to the GTI_IOC feed, 12 October 2026
• Splunk SOAR 8.7.0 drops Python 3.9 and adds a connector agent, 2 September 2026
• Mate Gamebooks reach general availability, 26 August 2026
• Microsoft updates its Splunk SOAR to Sentinel migration guide, 12 August 2026
• ServiceNow press report puts a Tier 2 SOC AI Specialist in December, 5 August 2026

More notes in Dispatches. To see the platforms side by side, start from the card.