SecOps ATI curated rules use GTI_IOC feed; Response Health Hub dashboard added

Applied Threat Intelligence curated rules now use the GTI_IOC feed

As a follow-up to the release of the GTI_IOC feed and the deprecation of the legacy MANDIANT_ACTIVE_BREACH_IOC, MANDIANT_FUSION_IOC, and OPEN_SOURCE_INTEL_IOC feeds, the Applied Threat Intelligence (ATI) curated detection rules are being updated to match against the GTI_IOC feed. You don't need to take any action for curated rules. Updated rules continue to match only on reviewed, stable indicators. If you have custom rules that still reference the legacy feeds, update them to use the GTI_IOC feed. For more information, see Migrate to GTI_IOC.

The update follows the standard Google SecOps rollout schedule. It starts on Monday, October 12, 2026 and rolls out to all regions during the week.

[Spotlight Feature] Monitor response and playbook health with the Response Health Hub

Google SecOps now includes the Response Health Hub curated dashboard, a central location for monitoring playbook performance, execution latency, automation effectiveness, and integration health across environments.

Key capabilities include:

• Volume and adoption tracking: Monitor total playbook execution volume, daily trends, completion success rates, and queued playbook backlogs.
• Attachment and rerun insights: Track average and maximum playbooks attached per case or alert, and identify playbooks with high rerun counts.
• Execution latency diagnostics: Compare end-to-end playbook execution time against active action execution time, and drill down into the 30 slowest playbook and action runs.
• Playbook and integration health monitoring: Investigate the latest failed playbook runs, highest failure-rate and terminated playbooks, and integration action error reasons.
• Automation effectiveness metrics: Compare automated versus manual case closure rates and Mean Time to Resolve (MTTR).

For more information, see Monitor response and playbook health.