Google Security Operations SOAR release notes

This page documents production updates to Google Security Operations SOAR. You can periodically check this page for announcements about new or updated features, bug fixes, known issues, and deprecated functionality.

You can see the latest product updates for all of Google Cloud on the Google Cloud page, browse and filter all release notes in the Google Cloud console, or programmatically access release notes in BigQuery.

To get the latest product updates delivered to you, add the URL of this page to your feed reader, or add the feed URL directly:

June 14, 2024

Remote Agents Release 2.0.0 is currently in Preview.

Support added for Python 3.11

The following articles have been updated as a result:

Create Agent with Installer for RHEL

Create Agent with Installer for CentOS

Perform a major upgrade using installer for CentOS

Perform a major upgrade using installer for RHEL

Release 6.3.6 is now in General Availability.

June 13, 2024

Release Notes 6.3.7 is currently in Preview.

Case filters are removed when refreshing the browser (ID #50834432)

Custom Actions, and the parameter types multi-select and password cause errors when trying to save a playbook (ID #51582854)

June 06, 2024

Release 6.3.5 is now in General Availability.

June 05, 2024

Release 6.3.6 is currently in Preview.

Change Alert Priority action does not update the case priority (ID #00277602)

May 30, 2024

Release 6.3.4 is now in General Availability.

May 29, 2024

Release 6.3.5 is currently in Preview.

Trying to set an SLA definition that is too similar to an existing one results in an incorrect error message (ID #00289305)

Tags not showing as expected in the Search page (ID #50691614)

All Environments is not supported when importing networks from CSV (ID #00276371)

Action All CVE Entity filter is not working (ID #51310124)

Subject Entity Search Filters are not working properly (ID #50841312)

Case actions - generate report has missing content (ID #50620576)

May 24, 2024

May 23, 2024

Release 6.3.4 is currently in Preview.

Unable to edit case comments via API (ID #49966652)

Unable to create or import advanced reports for certain Looker users (ID #00265303)

Error when trying to add a user to Google SecOps SOAR

Event details search option in alert tab stops working (ID #00287518)

SOAR filtering not working due to unsupported commas in names

Unable to re-run the playbooks (ID #00282282)

Google SecOps SOAR fails to return API keys (ID #50630848)

May 17, 2024

Release 6.3.2 is now in General Availability.

May 16, 2024

Release 6.3.3 is currently in Preview.

Search results distorting the screen (ID #00273643)

Inline CSS removed in Insights (ID #00273271)

SAML login page showing blank (ID #00279230)

Gitsync power up push content not triggering automatically (ID #00283331)

Job page loading slowly and needs to be refreshed many times (ID #50253417)

Alert Type is empty when trying to add alert grouping rules (ID # 00275434)

May 09, 2024

Release 6.3.1 is now in General Availability.

Remote Agents Release 1.6.0 is now in General Availability.

May 08, 2024

Release 6.3.2 is currently in Preview.

Issues when Siemplify > Set Case SLA actions run at the exact same time (ID #49397338)

Wrong error message displays when you to try add a custom list with a name that already exists (ID #50610331)

User mentioned in case not receiving an email notification (ID #00274991)

Widgets not fully aligned on Case view page (ID #49711925)

Number increased for integer type integration parameters (ID #00287205)

May 02, 2024

Remote Agents Release 1.6.0 is currently in Preview.

Jobs can now be run remotely over remote agents.

May 01, 2024

Release 6.3.1 is currently in Preview.

Create a new playbook using Gemini (Preview)

You can now use Gemini to create a fully structured playbook. All you need to do is write a well structured prompt and click Create.

For more information, see Create playbooks with Gemini.

Change entities to be marked as non suspicious

When an entity is marked as IsSuspicious, you can now change the value from True to False.

Two changes have been made to the sort within cases ability:

  • Option to sort cases by name has been removed.
  • Added ability to sort through all existing cases and not only across a single page.

Cannot insert images in reports (ID #00244001)

HTML templates, case sensitivity issue and generic error (ID #44058663)

Change Alert Priority action not working as expected (ID #00277602)

Clicking on events configuration takes you to the wrong mapping & modeling rules

Alert Grouping settings not displaying correctly.

April 19, 2024

Release 6.2.54 is now in General Availability.

April 18, 2024

Release 6.3.0 is currently in Preview.

Chronicle SOAR is being rebranded to Google Security Operations (Google SecOps). Both the logo and the platform name have been rebranded as part of this change. This rebranding reflects our commitment to bringing you the best of Google security operations features. There is no change to functionality in the platform.

Context-sensitive help added to the platform When you click the documentation link at the top of the platform, you will now be directed to the exact documentation page that relates to the screen you are on.

Custom List import error not propagated to the user (ID #1032784)

Advanced Text Editor text formatting not working (ID #00274952)

Issues with Login (ID #00283928)

Parse case wall email doesn't work in playbook simulator (ID #00260679)

Unable to create advanced reports when a specific environment is selected (ID #49898167)

Playbooks not visible due to missing categoryId and categoryName values (ID #00274872)

Events tab lists all artifacts even though they are part of different events (ID #49103838)

Tagged user is not highlighted or hyperlinked on the Case Wall page & Notification popup

April 12, 2024

Release 6.2.53 is now in General Availability.

Remote Agent Release 1.5.0 is now in General Availability.

April 11, 2024

Release 6.2.54 is currently in Preview.

In Release 6.2.45 the option to manually enter General placeholders was added. The General Placeholders section has now been added to the platform.

Error when adding or removing a tag on a closed case (ID #50195120)

Unable to import dynamic parameters (ID #00262571)

Playbooks re-running during platform update (ID 00282275)

Playbook block input can't be used to select dynamic instance (ID #00276416)

Refreshing dashboard changes displayed data (ID #49716319)

Playbooks not saving correctly (ID #49142793)

When logging in via SAML it doesn't show up in the SOAR Audit logs.

March 29, 2024

Release 6.2.52 is now in General Availability.

March 28, 2024

Release 6.2.53 is currently in Preview.

Issue when filtering Cases in Cases Page (ID #49689809)

Case filter is_not not working as expected (ID #00279039)

Unsupported providers causing playbooks not to run (ID #00262970)

Playbook block missing when trying to add it to a case (ID #00273133)

Report Scheduler not sending out reports as planned (ID #00277914)

March 27, 2024

Remote Agent Release 1.5.0 is currently in Preview.

Support for future major upgrades

Currently, Google supports minor upgrades which make changes to the remote agent code only.

We have now added support for the customer to carry out a major upgrade which requires changes to the entire OS or libraries in the machine.

You will receive clear instructions before a major upgrade. These must be followed very carefully in order to ensure the Remote Agent can continue to work with your machine.

Support for updating custom environment variables (ID #47675122)

You can now configure environment variables on the agent.

Remote connector logs are now written to the following path:

/opt/SiemplifyAgent/Integrations/<integration name>/Connectors/<connector instance>/remote_script.log

March 20, 2024

Release 6.2.52 is currently in Preview.

Case filter and URL now in a reciprocal relationship

In the Cases page, the filter and the URL now directly affect each other. Changing the filter changes the URL, and conversely, changing the URL changes the filter. You can take advantage of this feature by setting a filter for cases and putting the newly created URL in an external dashboard. Clicking on this link would then take you directly to the filtered case queue.

Incident Manager appearing in navigation even though user doesn"t have license (ID #49062139)

lastLoginTime returns wrong date for SAML users (ID #00278010)

Wrong error message returned for environment alias duplicates (ID #00271405)

Playbooks with async actions longer than 7 days can't be saved even though time set to 14 days in IDE (ID #00269032)

Clicking on events configuration opens the wrong mapping & modeling rules

March 15, 2024

Release is now in General Availability.

March 13, 2024

Release 6.2.51 is currently in Preview.

Jobs Enhancement

When updating an integration, the jobs will now be updated automatically. This does not apply to any legacy jobs that were created before October 2023.

The Marketplace integration will clearly identify the legacy jobs that are affected and provide instructions on how to proceed.

In addition, legacy jobs are now marked as such in the Jobs Scheduler page so that you can take action and resolve issues beforehand.

APIs now documented

The following APIs are not new, but with this Release are now formally documented in Swagger:



Searching for cases from the last week doesn't produce results (ID #00269819)

Email HTML Templates > Show Email Template not rendering styles (ID #00249556)

SDK call for create entity failure displays the wrong error message (ID #48950075)

March 08, 2024

Release 6.2.49 is now in General Availability.

March 07, 2024

Release 6.2.50 is currently in Preview.

In the Entity Explorer page, Case Distribution has been renamed to Alert Distribution.

This change makes the information easier to understand. (ID #48941723)

Docker hub login is not needed and as such this instruction has been removed from the platform. (ID #49611790)

Users with a single character in their last name are unable to login (ID #49008785)

Alerts are being grouped into cases after the time specified in the platform.

Inline CSS with styles and classes are not supported in Insights. Note that Scripts are not supported for security reasons. (ID #00273271)

Custom integration settings: existing script dependencies don't show up (ID #49703871)

Unable to create new playbook blocks (ID #00275270)

February 22, 2024

Release 6.2.49 is currently in Preview.

In the IDE, using CrowdStrikeFalcon - Execute command and selecting scope as internal hosts and external hosts does not work (ID #00250316)

The following APIs have been deprecated and will be deleted in 6 months.

  • GET /api/external/v1/connectors/GetConnectorsData
  • POST /api/external/v1/connectors/DeleteConnector
  • POST /api/external/v1/connectors/AddOrUpdateConnector
  • POST /api/external/v1/connectors/UpdateConnectorFromIde
  • POST /api/external/v1/connectors/GetConnectorStatus

For each API above, there are one or more alternative endpoints that you can use as shown below:

Instead of
GET /api/external/v1/connectors/GetConnectorsData

Use one of the following:

  • GET /api/external/v1/connectors/template-cards
    Provides basic information per each accessible connector definition.

  • POST /api/external/v1/connectors/template
    Retrieves detailed information regarding a specific connector definition.

  • GET /api/external/v1/connectors/cards
    Provides basic information per each accessible connector.

  • GET /api/external/v1/connectors/{identifier}
    Retrieves detailed information regarding a specific connector instance.

Instead of
POST /api/external/v1/connectors/DeleteConnector
DELETE /api/external/v1/connectors/{identifier}

Instead of
POST /api/external/v1/connectors/AddOrUpdateConnector
POST /api/external/v1/connectors

Instead of
POST /api/external/v1/connectors/UpdateConnectorFromIde
POST /api/external/v1/connectors/update-from-ide

Instead of
POST /api/external/v1/connectors/GetConnectorStatus
GET /api/external/v1/connectors/{identifier}/statistics

February 21, 2024

Remote Agents Release 1.4.9 is currently in Preview.

The Docker image to pull for this release is

Upgrade agents from 1.3.8 on RHEL not working as expected (ID #00243884)

Publisher memory usage issue (ID #00273756)

February 19, 2024

The following items have been added to Release Notes 6.2.48.

The AI Investigation widget is now available in Europe. For more information, refer to AI Investigation widget.

Timeout for automatic and manual python-run operations failing after 5 minutes even though it's defined for a longer time in the platform (ID #00243596, #00213817, #45379045, #48348087, #00245583. #00227758, #00250153)

Automatic actions/operations now run for up to the time defined in the platform (maximum of 20 minutes).

The 5 minute timeout still applies for the following manual operations:

  • Run manual action
  • Run connector once
  • IDE - Play Item

February 16, 2024

Release 6.2.47 is now in General Availability.

February 15, 2024

Release 6.2.48 is currently in Preview.

Playbook condition branch name field can now hold up to 150 characters (ID #48159735)

Just-in-Time User Provisioning configuration not available in Okta configuration. (ID #49263630)

IDE - creating an integration or manager with the same name as an existing one results in the wrong error message (ID #47233004)

Save button not showing when adding lots of list items to the List type action parameter (ID #00266458)

February 09, 2024

Release 6.2.46 is now in General Availability.

February 08, 2024

Release 6.2.47 is currently in Preview.

Email settings: customer configuration change

In order to help with safe and secure communication, the Trust Certificate checkbox is scheduled to be deleted in April 2024 as it will be enabled automatically by default.

Customers who currently do not have this checkbox enabled are advised to carry out the following procedure.

  • In the Email Settings > Customer Configuration tab, enable the Trust Certificate checkbox.
  • Save the settings.
  • Click Test to ensure the configuration works.
  • Perform an action which will trigger a test email notification.
  • If errors are shown, follow the instructions in the error message.

Manual Action Menu - Group and Specific filters when chosen together lead to errors (ID #49013713)

Custom SAML provider configuration error (ID #49125693)

The placeholder CurrentUserRole that was removed from Release 6.2.45 is now supported.

February 04, 2024

In Release 6.2.45 we announced new placeholders. The placeholder CurrentUserRole has been removed and is not supported.

February 01, 2024

Release 6.2.46 is now in Preview.

New audit logs

The platform now captures audit logs when a playbook folder is deleted. (ID 48557086)

Mentioning users in a case is not working as expected. (ID #00180795)

January 31, 2024

Release 6.2.45 is scheduled to be in General Availability as of February 4th, 2024.

January 19, 2024

Remote Agents 1.4.8

Enhancement for Docker image upgrade.

Release 6.2.45 is now in General Availability.

January 18, 2024

Remote Agents 1.4.7

Bug Fix: Open SSL version on the remote agent is outdated. (ID #00250583)

January 17, 2024

Remote Agents 1.4.5

Bug Fix: Removed forced upgrade when enabling an agent. (ID #46257228)

Remote Agents 1.4.6

Bug Fix: Remote actions that use the API endpoint /api/external/v1/sdk/UpdateEntities fail with timeout. (ID #00265852)

January 11, 2024

Release 6.2.44 is now in General Availability.

January 10, 2024

Release 6.2.45 is currently in Preview.

New placeholders added

A new category of placeholders have been added which focus on the current state of the session, such as logged-in user and the platform. These can be used in a variety of scenarios. For example, you can use them in an HTML widget to create customized information specifically for logged-in users as opposed to the users assigned to the case.

A new section called General has been added to the placeholders. It contains the following placeholders

  • HostUrl
  • CurrentUserEmail
  • CurrentUserID
  • CurrentUserFullName
  • CurrentUserRole

Note that the Current User placeholders cannot be used in playbooks or jobs.

Case Queue not refreshing automatically (ID #00267303)

January 05, 2024

Release 6.2.43 is now in General Availability.

January 04, 2024

Release 6.2.44 is currently in Preview.

New platform navigation

An entirely new way of navigating the platform is now available. For more information, refer to Navigate the SOAR platform.

Delete SAML provider

You can now delete existing SAML providers in the External Authentication page.

Additional support for trimming large alerts

In order to prevent performance issues, when an alert contains over 500 entities, the alert is ingested with the key entities retained and the additional entities are removed.

This trimming support works in parallel with the current trimming mechanism as defined in Handle large alerts .

Issues when trying to update a specific playbook block (ID #00267635)

Playbooks and their folders within a specific environment are deleted without a corresponding entry in the audit logs. (ID #48557086)

The following API endpoints will be deprecated in July 2024.

  • api/external/v1/settings/AddOrUpdateSamlSettings
  • api/external/v1/accounts/DisableJitAndAutoRedirect
  • api/external/v1/settings/GetSamlSettingsTemplate

December 08, 2023

Release 6.2.42 is now in General Availability.

December 07, 2023

Release 6.2.43 is currently in Preview.

Searching by entities does not return the full results (ID #47644037)

API endpoint /api/external/v1/logging/python not returning logs (ID #00258483)

Cases are loading too slowly (ID #00246621)

Predefined widgets not available after updating playbook block (ID #47667046)

November 30, 2023

Release 6.2.41 is now in General Availability.

November 29, 2023

Release 6.2.42 is currently in Preview.

Environments missing after toggling on All Environments in the Permission Group page (ID #00248779)

Hash values are displayed instead of analyst names when generating a report (ID #47508033)

The audit log shows the internal IPs instead of the external ones (ID #00170308, #00245571, #00262470)

Changing remote agents on an integration instance doesn't work

November 23, 2023

Release 6.2.40 is now in General Availability.

November 22, 2023

Release 6.2.41 is currently in Preview.

Jobs enhancement

The following features have been added:

  • Ability to sort the job execution table by time or status
  • Indication in the jobs queue for each failed job iteration

IDE's Live Autocomplete feature not working properly (ID #00250083)

November 16, 2023

Release 6.2.40 is currently in Preview.

Playbook actions carried out by automation are not labeled as such on the case wall (ID #47525692).

This bug fix is in Preview.

Case title is not picking up information if it's in square brackets (ID #00262914).

This bug fix is in Preview.

November 15, 2023

Release 6.2.39 is now in General Availability.

November 09, 2023

Release 6.2.39 - Preview

Dynamic mode instance support

When a playbook is built for more than one environment, you need to use dynamic mode which picks the relevant instance configuration from the target environment. When using dynamic mode within environments that contain multiple instances, the playbook needs to stop and wait for the analyst to pick the right instance by the context of the alert.

In this release, we have added a new option to the playbook designer, such that the analyst can specify an instance for the dynamic mode to use within the target environment by entering a name or a pattern in a new Specify Instance Name field.

For more information, see Specify instance in dynamic mode. This feature is in Preview.

Jobs enhancement

The Jobs page in the platform has been enhanced to provide more information at a glance for the security analyst. The following is a list of the added features:

  • Filter jobs according to success or failure.
  • Click View Details to open a side bar with full details.
  • Export the log details in raw text format.
  • View all job iterations with extra pagination support.

This feature is in Preview.

Update SiemplifyUtils to support Python 3 (ID #45825896).

This feature is in Preview

Incorrect playbook is attached to alert when using trigger Product Name when alerts are grouped (ID #47362407).

This bug fix is in Preview.

Issues with remote agent connected to remote connector in a shared instance configuration.

This bug fix is in Preview.

SDK function result.add_html which generates HTML reports within a case ends up generating blank text (ID #47721779).

This bug fix is in Preview

November 01, 2023

Release Notes 6.2.38

Beta - 5th November, 2023

GA - 12th November, 2023

Custom roles denied access to Advanced Reports (ID #47668375)

In certain cases, significantly large entity graphs failed to load (ID #00250400)

October 25, 2023

Release Notes 6.2.37

Beta - 29th October, 2023

GA - 5th November, 2023

A new Explore containing case-related fields has been added to the Advanced Reports module in the platform. This Explore allows you to find fields and build visualizations for your report. We recommend using this new Explore in new widgets.

Error when trying to log in again to Chronicle SOAR (ID #46831483)

Email HTML template shows blank page in Settings (ID #46912863)

Users filter in the Search page not displaying all the users (ID #00249930)

Active Directory Groups field removed from Settings Permission groups as it is not supported

October 24, 2023

Remote Agents 1.4.4

  • Added support for all SDK calls over remote agents
  • Improved managing integrations over the remote agent leading to a more overall stable product experience
  • Publisher Python version upgraded to Python 3.11

Remote Agents 1.4.4

  • Remote agent actions do not return script results in the same way local actions return them (ID #45682680)
  • Users unable to change the remote agent environment via agent CLI

October 03, 2023

Release 6.2.36

GA - 14th October, 2023

Internal security fixes

September 27, 2023

Release Notes 6.2.35

GA - 8th October

Risk Score and Severity added

Two new information fields have been added to the Alert Details widget which appears in the Alert overview tab. These are Risk score and Severity. These values will only be populated when using the Google Chronicle SIEM connector.

Export/Import for Advanced Reports (using Looker) now supported both in the platform and using new APIs.

This enables customers to create reports on their staging environment and then import the template without the data into their production environment.

In the platform, the import is at the top of the Reports queue while the export icon is inside the actual report itself. The report file is in yaml format.

New APIs are as follows:


Playbook name drop-down not showing any playbook names in various Playbook actions (ID #00248732)

Placeholders located inside other placeholders not always picked up correctly (ID #00244133)

Case title says unknown (ID #00249611)

GetCaseFullDetails and GetWallActivitiesV2 API endpoints failing to return results (ID # 00243878)

September 12, 2023

Remote Agents

Remote agent now supports the same alert and event trimming logic as implemented in the server. New parameters in the database control the size of the alert as well as the size of the fields and events within them. Alerts that are bigger than this size will be automatically trimmed. If the alert is still too big, then the size of the fields and events will be trimmed. The resulting alert ingested into the case might therefore not contain all the original information.

Remote connector logs now display as required in the platform.

Remote agent no longer takes ownership of the entire /var/log directory when using the installer.

August 30, 2023

Release Notes 6.2.34

  • Alerts ingested using webhooks are missing details (ID #00249611)
  • Entity Graph widget either not appearing or appearing without information (ID #00246250, #46124390)
  • Entity Graph API call not working

August 16, 2023

Release Notes 6.2.33

New Case Mentions in Playbook Actions

You can now mention the case assignee directly from a Playbook action

To mention the case assignee:

  1. Drag the Siemplify Case Comment action into a Playbook step.
  2. In the Comment field, write a message that you want the case assignee to see.
  3. Click on the placeholder, drill down to Case > case.mentioncaseassignee and double click it in order for it to appear in the Comment field with the message. Alternatively, write [case.mentioncaseassignee] in the Comment field.

After the Playbook runs, the notification is written to the case wall and depending on your notification settings, sent to the user.

July 26, 2023

Release Notes 6.2.32

Playbook not running with Playbook Simulator turned on in rare cases (ID #45093920)

Playbooks do not appear on the platform for some customers due to null category creation (ID #45985799, #00244424)

The timestamp displayed on the Cases>Alert>Playbooks tab drawer menu corresponds to the most recent modification time of the playbooks/blocks, rather than the actual execution time of the actions. Timestamp now displays actual execution time. (ID #00245107)

July 19, 2023

Release Notes 6.2.31

Added the ability to write comments on cases that have already been closed.

New API for Logs: Admin users can now retrieve raw python logs directly from the platform using the following API: POST/api/external/v1/logging/python

Release Notes 6.2.31

Importing a custom integration on top of an existing commercial integration causes the connector to not work properly (ID #00243798)

Specific Integration showing incorrect update available (ID #00181718)

SDK call siemplify.current_alert.creation_time returns 0 (ID #00226591)

In rare situations, unable to access several cases via the Platform or via API (ID #00243878)

When changing the Case Stage under the Cases tab, the drop down list of stages does not follow the same numerical order as defined in the Settings (ID #44453181)

Entities that should be internal are created as external if ingested using the environment alias (ID #00225318)

In certain situations, alerts are ingested into the platform for environments that don't exist yet in the platform and as soon as the environments are created - the cases are opened and playbooks run. It is now possible to configure alerts to be dropped if the source environment doesn't exist. (ID #00180834)

July 12, 2023

Release Notes 6.2.30: Playbooks not always saved correctly within Platform (ID #00243484)