Google Security Operations

Google Security Operations bundles a SIEM, a SOAR that came from the 2022 Siemplify acquisition, and Gemini features, sold in Standard, Enterprise and Enterprise Plus packages with no published price. Gemini playbook creation is documented with explicit limits. Playbooks move between instances as ZIP files, and the pages read first gave nothing on approvals.

What it is

Google Security Operations was named Chronicle until a rebrand that a Google staff post dates to 2024-04-25. Its SOAR came from Siemplify, which Google Cloud announced it had acquired on 2022-01-04 without publishing a completion date. The product page says SOAR is included, with playbooks, over 300 tools and a case wall that documents itself (vendor claim, read 2026-11-04). Gemini in security operations sits in the Enterprise package and above, not in Standard. Google says data residency is supported for specific regions.

The playbook artefact is a designed flow. A playbook is built from a trigger, which is the mandatory first step, actions such as enrichment, notification and host isolation, and flows that branch if-then-else. Reusable blocks are supported. Playbooks and blocks export and import as ZIP files, and the system accepts only ZIP for import. A Playbook Simulator tests them. Only one playbook attaches automatically to an alert, by priority (Google docs, updated 2026-10-28). No importer from another vendor was found. Integrations are edited in an IDE, and Python upgrade docs cover certified and custom integrations.

The vendor describes itself this way: Cloud security operations platform that combines a SIEM (log ingestion, search, YARA-L detections), SOAR (playbooks and case management, from the Siemplify acquisition) and threat intelligence. Gemini features assist with search, rule and playbook authoring and case summaries. Formerly named Chronicle. cloud.google.com, read 2026-11-04 (vendor claim)

How Google Security Operations scores

Nine rows, weights summing to 100, each scored 0 to 10 from pages read on 2026-11-03. The part is score times weight divided by 100. How the scoring works.

Where Google Security Operations is strong

• Gemini playbook creation is documented with its limits: no playbook blocks, no parallel actions, only installed integrations, no integration instances, and editing cannot change conditions through prompts. AI scores 8.5. docs.cloud.google.com, read 2026-11-03
• Playbooks can be simulated before release and moved from staging to production as ZIP files. Per-playbook statistics are available, and the playbooks screen docs were updated on 2026-10-28. docs.cloud.google.com, read 2026-11-04
• Google Cloud owns the product. No end-of-sale notice was found, and the Marketplace page is written for standalone SOAR customers, so standalone licensing appears to continue (read through a search summary). cloud.google.com, read 2026-11-03

Where Google Security Operations is behind

• Approvals, cases and hosting scored 4.0 each on the pages read on 2026-11-03 and are flagged for a re-read. A later read of the product page on 2026-11-04 found a documented case wall and a regions list for data residency, so those two rows may rise. Approvals are still not documented on a page read. cloud.google.com, read 2026-11-04
• All three packages say Contact sales for pricing, and the pricing sub-page returned 404 on 2026-11-04. No ingestion unit price or discount terms are published. cloud.google.com, read 2026-11-04
• Case playbook executions are excluded from Legacy Monitoring dashboards and from SOAR data exports to Managed BigQuery and Bring Your Own BigQuery, which limits auditing of run history. docs.cloud.google.com, read 2026-11-04

A fact only Google Security Operations has

Google documents that Gemini cannot create playbook blocks, parallel actions or integration instances, and that editing a playbook by prompt cannot change its conditions. docs.cloud.google.com, read 2026-11-03

Pricing as published

Sold in packages (Standard, Enterprise, Enterprise Plus) and based on ingestion, with one year of security telemetry retention included. No price is published for any package; each says 'Contact sales for pricing'. cloud.google.com, read 2026-11-04 (vendor claim)

Ownership and funding

Google Cloud announced the acquisition of Siemplify (SOAR) in a blog post by Sunil Potti dated 2022-01-04 and said it intended to integrate Siemplify capabilities into Chronicle. The post says Google 'has acquired' Siemplify and gives no completion date. The separate completion post (google-cloud-completes-acquisition-of-siemplify) returned HTTP 404 on 2026-11-03. cloud.google.com, read 2026-11-04

Google completed its acquisition of Wiz on 2026-03-11. Wiz is a cloud and AI security platform; the pages read do not place it inside Google Security Operations. googlecloudpresscorner.com, read 2026-11-03

Named customers

• BBVA (logo on product page) source, read 2026-11-04 (vendor claim)
• Morgan Sindall (logo on product page) source, read 2026-11-04 (vendor claim)
• Groupon (logo on product page) source, read 2026-11-04 (vendor claim)
• Telefonica (logo on product page) source, read 2026-11-04 (vendor claim)
• Vertiv (logo on product page) source, read 2026-11-04 (vendor claim)
• Jack Henry (logo on product page) source, read 2026-11-04 (vendor claim)
• Kroger (logo on product page) source, read 2026-11-04 (vendor claim)
• Telepass (logo on product page) source, read 2026-11-04 (vendor claim)
• Charles Schwab (logo on product page) source, read 2026-11-04 (vendor claim)
• Herjavec (logo on product page) source, read 2026-11-04 (vendor claim)
• Pfizer (quoted: Mark Ruiz, Head of Cybersecurity Analytics) source, read 2026-11-04 (vendor claim)
• Apex Fintech Solutions (quoted: Hector Pena, Senior Director of Information Security) source, read 2026-11-04 (vendor claim)

1 more names appear on the vendor's pages.

Recent releases

• 2026-10-12 Applied Threat Intelligence curated rules now match against the GTI_IOC feed; custom rules on legacy feeds need updating. Curated detections change. Affects rules that reference legacy feeds. docs.cloud.google.com, read 2026-11-03 (vendor claim)
• 2026-09-15 Grok parser filter gains match_all option. Parser syntax change. Extracts all non-overlapping matches in a field. docs.cloud.google.com, read 2026-11-03 (vendor claim)
• 2026-08-26 Mandiant Frontline Threats rule packs for Linux, macOS and Google Cloud added to Curated Detections and Content Hub. New curated detection packs. docs.cloud.google.com, read 2026-11-03 (vendor claim)
• 2026-08-24 Unroll processor in data processing pipelines splits arrays into separate log events before parsing. Pipeline processor change. docs.cloud.google.com, read 2026-11-03 (vendor claim)
• 2026-07-15 Advanced filtering in dashboards (public preview) uses token variables in YARA-L queries. Dashboards can inject dynamic values or regex into YARA-L queries. Preview status. docs.cloud.google.com, read 2026-11-03 (vendor claim)
• 2026-06-23 Feed Management adds an Ask Gemini Cloud Assist button for feed setup and troubleshooting. Guidance only. The button does not make configuration changes. docs.cloud.google.com, read 2026-11-03 (vendor claim)

Claims Google Security Operations makes about itself

These are vendor claims. They are not scored. Each carries an evidence grade: C means a vendor figure with no published method.

What the public pages did not say

• No accuracy, MTTR, auto-closure or time-saved number from Google found in the pages read. No Gemini accuracy claim recorded.
• YARA-L 2.0 overview is over 100000 characters; only the first part was read. No last-updated date shown.
• Release notes read only from the first entries shown to 2026-03-05. Entries from 2025-11-01 to early 2026 were not read in full.
• Pricing: all three packages say 'Contact sales for pricing' on 2026-11-04. No list price, no ingestion unit price and no discount terms are published. The pricing sub-page cloud.google.com/security/products/security-operations/pricing returned 404 on 2026-11-04; the tiers were read from the product page. The 'data benefits promotion' page was not read.
• The docs path /chronicle/docs/soar/overview returned 404 on 2026-11-04; SOAR docs were read at /soar/overview-and-introduction/soar-overview instead. SOAR playbook count and prebuilt integration list were not read beyond the product page figure of over 300 tools.
• Siemplify completion date is not published on any page read. The 2022-01-04 blog uses 'has acquired' without a closing date.

Gaps recorded on 3 November 2026. A gap is an absence on the pages read, and it is scored that way.

Who should shortlist Google Security Operations

• You already pay for Google Security Operations at Enterprise or above and want SOAR and Gemini playbook drafting under one contract.
• You want an AI authoring feature whose documentation says what it cannot create.
• You promote playbooks from staging to production and want a simulator and ZIP packages in that path.

Verdict. Google Security Operations is tenth of 14 scored at 5.98, in a band with Palo Alto Cortex XSOAR (6.18), Swimlane (6.14) and BlinkOps (5.82); its Gemini documentation states limits plainly, but four rows are flagged for a re-read.

Moving playbooks out of Google Security Operations

Google Security Operations is a source row in the portability matrix: 7 of 70 cells have a documented path. Source format: playbook ZIP export and import (cloud.google.com, read 2026-11-03). The switching guide is Leaving Google Security Operations.

Google Security Operations against the other eleven

• BlinkOps v Google Security Operations
• Cyware v Google Security Operations
• D3 Security v Google Security Operations
• Google Security Operations v Mate Security
• Google Security Operations v Microsoft Sentinel
• Google Security Operations v Palo Alto Cortex XSOAR
• Google Security Operations v ServiceNow Security Operations
• Google Security Operations v Splunk SOAR (Cisco)
• Google Security Operations v Swimlane (Turbine)
• Google Security Operations v Tines
• Google Security Operations v Torq

Alternatives to Google Security Operations, ordered by the rubric.