Google SecOps Marketplace

Gitsync: Version 53.0 • (REGRESSIVE) Updated to support the latest Chronicle API. Important: Existing users must migrate their repository branch and re-export their content after updating. For…

Google Chronicle: Version 97.0 • Updated the alert synchronization logic in the following job: Google Chronicle Sync Job

SentinelOne Singularity Operations Center: Version 2.0 • Updated event processing logic and ontology mapping in the following connector: SentinelOne Singularity Operations Center - Unified Alerts…

Microsoft Graph Mail: Version 48.0 • Added support for message timezone in the following action: Send Thread Reply

Microsoft 365 Defender: Version 33.0 • Improved the case priority parsing mechanism to support protobuf format on remote agents and updated comment syncing logic to support multi-line…

Jira: Version 62.0 • Improved context properties processing logic in the following action: Create Issue

CrowdStrike Falcon: Version 83.0 • Updated comment syncing logic to support multi-line closure comments and sync comments from closed CrowdStrike alerts in the following action: Sync Alerts

Vertex AI: Version 9.0 • Integration: Improved API error message parsing.

Illusive Networks: Version 11.0 • Fixed the endpoint for retrieving forensic data in the following action: Run Forensic Scan

Cyberint: Version 8.0 • Added the Disable Overflow parameter to the following connector: Cyberint - Alerts Connector

Akeyless Security: Version 1.0 • New Akeyless Security integration.

Google Chronicle: Version 96.0 • Integration: Removed dummy network socket initialization during multipart response parsing and updated the default API root to point to the Chronicle API.

Palo Alto Cortex XDR: Version 33.0 • Added the Unzip File parameter and improved error handling for failed retrievals in the following action: Download File

Microsoft 365 Defender: Version 32.0 • Improved the rate limit handling and timestamp updating mechanism in the following connector: Microsoft 365 Defender - Incidents Connector Added the Sync…

Microsoft Graph Mail: Version 47.0 • Added support for S/MIME digital signing and encryption in the following action: Send Email Added support for HTML URL extraction, attachment exclusions, event…

Siemplify: Version 113.0 • The following new action has been added: Attach Playbook to Case

CrowdStrike Falcon: Version 82.0 • Updated the polling logic to prevent host containment flapping in the following actions: Contain Endpoint • Lift Contained Endpoint

Microsoft Graph Security: Version 29.0 • Integration: Added support for Microsoft Sovereign / GCC High environments by adding Login API Root and API Root parameters.

CyberArk PAM: Version 13.0 • The following new job has been added: Sync Integration Credentials Job

Trend Vision One: Version 12.0 • Made the Description parameter mandatory in the following actions: Isolate Endpoint • Unisolate Endpoint

Microsoft 365 Defender: Version 31.0 • Updated alert tracking logic, extracted alert object metadata, and improved the pagination and timeout handling mechanism in the following…

Google Chronicle: Version 95.0 • Integration: Improved OAuth 2.0/JWT authentication logging, validation diagnostics, and error messaging.

Google Chronicle: Version 95.0 • The following new action has been added: Is Value In Data Table Async

FireEye ETP: Version 11.0 • Updated ontology mapping rules and fixed missing alert details and event data for v2 API issue in the following connector: FireEye ETP - Email Alerts Connector

Google Chronicle: Version 94.0 • Reverted the execution mode to synchronous in the following action: Is Value in Data Table

ServiceNow: Version 72.0 • Added the ability to authenticate using client credentials without a refresh token to the following connector: Sync Incidents

Google Chronicle: Version 93.0 • Added the following new action: Execute UDM Query Async

ServiceNow: Version 72.0 • Added the ability to authenticate using client credentials without a refresh token to the following connector: Sync Incidents

Google Chronicle: Version 93.0 • Added the following new action: Execute UDM Query Async

FireEye ETP: Version 11.0 • Updated ontology mapping rules and fixed missing alert details and event data for v2 API issue in the following connector: FireEye ETP - Email Alerts Connector

Microsoft Graph Mail: Version 46.0 • Updated parameters and filtering options in the following actions: Wait For Email From User • Search Emails

ServiceNow: Version 71.0 • Added support for OAuth authentication in the following job: Sync Incidents Job

FireEye HX: Version 26.0 • Added the following new actions: Get File • Check Containment Status • Contain Host • Cancel Host Contain

Proofpoint Email Protection: Version 11.0 • Added the following new actions: Forward Quarantined Email • Release Quarantined Email

Wiz: Version 10.0 • Added the Authentication URL parameter to support Gov (FedRAMP) and custom environments. • Added the following new job: Wiz and Google SecOps Bi-directional Sync Job

Splunk: Version 67.0 • Updated the lookback timestamp progression logic when all fetched alerts in a cycle have already been processed in the following connector: Splunk ES - Notable Events…

Pub/Sub: Version 4.0 • Added support for pubsub_message_id in the Unique ID Field parameter in the following connector: Pub/Sub - Messages Connector

Exchange: Version 125.0 • Updated the parsing logic for nested S/MIME email attachments (.eml) sent from macOS and Windows in the following connector: Exchange Mail Connector v2 with Oauth…

Zscaler: Version 16.0 • Fixed an issue where legacy API key and password authentication failed due to URL path normalization issues.

Proofpoint Cloud Threat Response: Version 5.0 • Fixed an issue where null, missing, or unmapped priority values in API payloads caused log ingestion errors in the following connector: Proofpoint…

Wiz: Version 9.0 • Added the following new job: Wiz and Google SecOps Bi-directional Sync Job

Palo Alto Cortex XDR: Version 32.0 • Fixed an issue where the job repeatedly logged errors when a case was merged or deleted in Google SecOps in the following job: Sync Incidents

Microsoft Teams: Version 39.0 • Updated error handling in the following job: Refresh Token Renewal Job

Microsoft Graph Mail: Version 45.0 • The following new actions have been added: Block Domain • Block Sender • Delete Inbox Rules • List Rules • Remove Block Domain • Remove Block Sender

Cisco Umbrella: Version 21.0 • Fixed an issue in the following action where entity attachment failed due to a bytes object serialization error: Get Domain Security Info

CyberArk Credential Provider: Version 5.0 • The following new job has been added: Sync Integration Credentials Job

Active Directory: Version 45.0 • Fixed an issue in the following action where entity properties were incorrectly reset on update: Enrich Entities

Microsoft Graph Mail: Version 45.0 • Fixed an issue in the following action where an unhandled exception occurred when a user mailbox was not found: Get Mailbox Account Out Of Facility Settings

CrowdStrike Falcon: Version 81.0 • Added the ability to use device IDs as input parameters in the following actions: Hide Hosts • Contain Endpoint • Download File • Execute Command • Get Host…

GitSync • Fixed an issue in the following action where the Include Playbook Blocks parameter was ignored when a folder allowlist was used: Push Playbook

Microsoft 365 Defender: Version 30.0 • Added support for GCC High tenants by dynamically constructing API token scopes and adding a configurable API Root parameter in the…

AWS WAF: Version 14.0 • Updated integration dependencies.

Enrichment • Fixed an issue in the following action where unsupported entity types were selected during enrichment: Whois

ServiceNow: Version 70.0 • Fixed verification logic when updating reference fields in the following action: Update Incident

Jira: Version 61.0 • Added support for customizable status-to-closure mapping, Case-level job scope, custom field variables in Closed Reason Mapping, context value alignment to JIRA_ISSUE_KEY, and…

Google Chronicle: Version 92.0 • Updated the action to use new search API in the following action: Is Value in Data Table

Microsoft 365 Defender: Version 29.0 • Updated Google SecOps event structure, added support for incident tags and assignee filtering, updated ontology mapping, and optimized evidence handling with…

CrowdStrike Falcon: Version 80.0 • Implemented 500-device safety limit per entity search, updated device sorting by last_seen.desc, and added batch request chunking for device details,…

Microsoft Graph Mail Delegated: Version 21.0 • Updated logic for parsing email headers and S/MIME digitally signed emails in the following connector: Microsoft Graph Mail Delegated Connector

Google Chronicle: Version 91.0 • Updated Wiz Defend alert naming format in the following connector: Google Chronicle - Chronicle Alerts Connector

Vertex AI: Version 8.0 • Added support for multi-region endpoints across the integration configuration.

Active Directory: Version 44.0 • Added optional Connection Timeout and Receive Timeout parameters to configure network connectivity limits in the following action: Enrich Entities

Siemplify: Version 112.0 • Added Update Enabled Connectors Only filtering option in the following job: Response Integration & Connector Upgrade Job

Google Threat Intelligence: Version 20.0 • Added support for CHILDHASH and PARENTHASH entity types in the following action: Enrich Entities Added Entity Type Filter parameter to allow configuring…

Microsoft 365 Defender: Version 28.0 • Updated case syncing logic in the following action: Sync Alerts Updated alert processing logic in the following connector: • Microsoft 365 Defender -…

Anomali ThreatStream: Version 18.0 • Updated API output handling in the following action: Enrich Entities

Wiz: Version 14.0 • Added the following action: Get Blue Agent Analysis

QRadar: Version 69.0 • Updated timestamp filtering to use last_persisted_time for tracking modifications in the following connector: Qradar Offenses Connector

Jira: Version 60.0 • Added support for the Created Before date filter and Custom JQL query parameter in the following action: List Issues

Azure Monitor: Version 5.0 • Updated integration documentation links in the integration configuration.

Google Chronicle: Version 90.0 • Updated handling of Wiz Defend detections and ontology mapping in the following connector: Chronicle Alerts Connector

Proofpoint Email Protection: Version 10.0 • Added the following action: Download Quarantined Email

SentinelOne Singularity Operations Center: Version 1.0 • Added SentinelOne Singularity Operations Center integration.

Google Chronicle: Version 88.0 • Added api_root parameter to alert extensions to expand normalization metadata options in the following connector: Chronicle Alerts Connector

Google Threat Intelligence: Version 18.0 • Added an optional Active Group parameter to support multi-tenant organization context routing in the integration configuration and the following…

Microsoft Defender ATP: Version 33.0 • Updated execution processing logic to improve backend tracking stability in the following action: Execute Live Response Command

CrowdStrike Falcon: Version 78.0 • Fixed pagination loop logic to prevent infinite timeouts during high-volume sweeps in the following action: Get Host Information

AWS GuardDuty: Version 14.0 • Added support for Google Cloud Web Identity (OIDC) Federation authentication.

ServiceNow: Version 68.0 • Updated affected CIs processing logic to handle missing reference keys smoothly in the following job: Sync Incidents Job

SCC Enterprise: Version 22.0 • Refactored integration code to optimize underlying execution performance.

Google Threat Intelligence: Version 17.0 • Fixed widget rendering failures by escaping raw HTML script tags within extended_response_body in the following action: Get ASM Entity Details

Google Chronicle: Version 87.0 • Improved case and alert synchronization logic by fixing the verification handling of valid external ID values in the following job: Google Chronicle Sync Job

FileUtilities: Version 27.0 • Added support for extracting files from .7z archives in the following action: Extract Zip Files

CrowdStrike Falcon: Version 77.0 • Updated syncing logic to support multiple CrowdStrike alert IDs mapped to a single SecOps alert and improved error handling for alert ID context values in the…

Siemplify: Version 110.0 • Updated results processing logic to cleanly escape backslashes in the following action: Create Gemini Case Summary

VirusTotalV3: Version 41.0 • Updated Predefined Widgets to fix cached fallback rendering in the following actions: Enrich Hash • Enrich IOC • Enrich IP • Enrich URL • Get Domain Details

Azure Active Directory: Version 29.0 • Updated error handling for sign-in activity retrieval in the following action: Enrich User

FireEye Helix: Version 20.0 • Added Trellix IAM OAuth authentication support.

EmailV2: Version 42.0 • Updated default values for IMAP server address, port, username, and password for the following connector: Generic IMAP Email Connector

Palo Alto Cortex XDR: Version 30.0 • The following new action has been added: Download File

Google Cloud Compute: Version 19.0 • Refactored action code in the following actions: Add IP To Firewall Rule • Remove external IP addresses • Execute VM Patch Job • Update Firewall Rule

CyberArk PAM: Version 11.0 • The following new action has been added: Change Account Password

Google Threat Intelligence: Version 16.0 • Updated Predefined Widgets to optimize loading performance and aligned layouts to prevent visual shifts in the following actions: Enrich Entities •…

Secret Manager: Version 2.0 • Updated action description in the following action: Ping

FireEye ETP: Version 9.0 • Added Trellix OAuth support, updated public API endpoints to v2, and removed legacy V1 API support.

Secret Manager: Version 1.0 • New Secret Manager integration.

Source code is now publicly available on <a href="https://github.com/chronicle/content-hub">GitHub</a> for the following integrations: • AlienVault USM Appliance: Version 29.0 • AlienVaultTI:…

Google Chronicle: Version 86.0 • Fixed an issue where the connector would idle or hang on heartbeats instead of breaking early when nextPageToken or nextPageStartTime is received, and updated…

Palo Alto Cortex XDR: Version 29.0 • Updated host name extraction logic in the raw payload in the following connector: Palo Alto Cortex XDR Connector

Siemplify: Version 109.0 • Refactored the code in the following action: Attach Playbook to Alert