[{"id":"S19EmQLF3Y6nrCfXnmo1","number":"10375461989733712689","begin":"2026-04-16T23:56:00+00:00","created":"2026-04-17T04:19:23+00:00","end":"2026-04-17T05:26:00+00:00","modified":"2026-04-17T05:35:44+00:00","external_desc":"Ingestion delays for Google SecOps Globally.","updates":[{"created":"2026-04-17T05:35:25+00:00","modified":"2026-04-17T05:35:44+00:00","when":"2026-04-17T05:35:25+00:00","text":"**Summary**\n[Mitigated] Ingestion delays for Google SecOps leveraging version 1 based feeds Globally.\n**Description**\nThe issue with Google SecOps has been resolved for all affected users as of Thursday, 2026-04-16 22:26 PDT.\nFrom preliminary analysis, the issue occurred due to the internal system used to fetch data. That system recovered and hence our V1 feeds started ingesting data again.\nWe thank you for your patience while we worked on resolving the issue.\n**Customer Symptoms**\nCustomers may have experienced ingestion delays for Google SecOps leveraging version 1 based Ingestion Feeds. Rules detections may have also experienced higher latency.\n**Workaround**\nNone at this time as the issue stands mitigated","status":"AVAILABLE","affected_locations":[]},{"created":"2026-04-17T04:19:23+00:00","modified":"2026-04-17T05:35:25+00:00","when":"2026-04-17T04:19:23+00:00","text":"**Summary**\nIngestion delays for Google SecOps Globally.\n**Description**\nWe are experiencing an issue with Google SecOps beginning on Thursday, 2026-04-16 16:56 PDT. The US Multi-region is affected and other regions may also be affected.\nOur engineering team continues to investigate the issue.\nWe will provide an update by Thursday, 2026-04-16 23:45 PDT with current details.\nWe apologize to all who are affected by the disruption.\n**Customer Symptoms**\nCustomers may experience ingestion delays for Google SecOps leveraging version 1 based Ingestion Feeds. Rules detections may also experience higher latency.\n**Workaround**\nCustomers can migrate feeds to Version 2 ingestion feeds.","status":"SERVICE_DISRUPTION","affected_locations":[{"title":"Johannesburg (africa-south1)","id":"africa-south1"},{"title":"Tokyo (asia-northeast1)","id":"asia-northeast1"},{"title":"Mumbai (asia-south1)","id":"asia-south1"},{"title":"Singapore (asia-southeast1)","id":"asia-southeast1"},{"title":"Jakarta (asia-southeast2)","id":"asia-southeast2"},{"title":"Sydney (australia-southeast1)","id":"australia-southeast1"},{"title":"Multi-region: europe","id":"europe"},{"title":"Warsaw (europe-central2)","id":"europe-central2"},{"title":"Finland (europe-north1)","id":"europe-north1"},{"title":"Belgium (europe-west1)","id":"europe-west1"},{"title":"Turin (europe-west12)","id":"europe-west12"},{"title":"London (europe-west2)","id":"europe-west2"},{"title":"Frankfurt (europe-west3)","id":"europe-west3"},{"title":"Netherlands (europe-west4)","id":"europe-west4"},{"title":"Zurich (europe-west6)","id":"europe-west6"},{"title":"Paris (europe-west9)","id":"europe-west9"},{"title":"Doha (me-central1)","id":"me-central1"},{"title":"Dammam (me-central2)","id":"me-central2"},{"title":"Tel Aviv (me-west1)","id":"me-west1"},{"title":"Toronto (northamerica-northeast2)","id":"northamerica-northeast2"},{"title":"São Paulo (southamerica-east1)","id":"southamerica-east1"},{"title":"Multi-region: us","id":"us"},{"title":"Iowa (us-central1)","id":"us-central1"},{"title":"South Carolina (us-east1)","id":"us-east1"}]}],"most_recent_update":{"created":"2026-04-17T05:35:25+00:00","modified":"2026-04-17T05:35:44+00:00","when":"2026-04-17T05:35:25+00:00","text":"**Summary**\n[Mitigated] Ingestion delays for Google SecOps leveraging version 1 based feeds Globally.\n**Description**\nThe issue with Google SecOps has been resolved for all affected users as of Thursday, 2026-04-16 22:26 PDT.\nFrom preliminary analysis, the issue occurred due to the internal system used to fetch data. That system recovered and hence our V1 feeds started ingesting data again.\nWe thank you for your patience while we worked on resolving the issue.\n**Customer Symptoms**\nCustomers may have experienced ingestion delays for Google SecOps leveraging version 1 based Ingestion Feeds. Rules detections may have also experienced higher latency.\n**Workaround**\nNone at this time as the issue stands mitigated","status":"AVAILABLE","affected_locations":[]},"status_impact":"SERVICE_DISRUPTION","severity":"medium","service_key":"FHwvkSZ6RzzDYAvDZXMM","service_name":"Google SecOps","affected_products":[{"title":"Google SecOps","id":"FHwvkSZ6RzzDYAvDZXMM"}],"uri":"incidents/S19EmQLF3Y6nrCfXnmo1","currently_affected_locations":[],"previously_affected_locations":[{"title":"Johannesburg (africa-south1)","id":"africa-south1"},{"title":"Tokyo (asia-northeast1)","id":"asia-northeast1"},{"title":"Mumbai (asia-south1)","id":"asia-south1"},{"title":"Singapore (asia-southeast1)","id":"asia-southeast1"},{"title":"Jakarta (asia-southeast2)","id":"asia-southeast2"},{"title":"Sydney (australia-southeast1)","id":"australia-southeast1"},{"title":"Multi-region: europe","id":"europe"},{"title":"Warsaw (europe-central2)","id":"europe-central2"},{"title":"Finland (europe-north1)","id":"europe-north1"},{"title":"Belgium (europe-west1)","id":"europe-west1"},{"title":"Turin (europe-west12)","id":"europe-west12"},{"title":"London (europe-west2)","id":"europe-west2"},{"title":"Frankfurt (europe-west3)","id":"europe-west3"},{"title":"Netherlands (europe-west4)","id":"europe-west4"},{"title":"Zurich (europe-west6)","id":"europe-west6"},{"title":"Paris (europe-west9)","id":"europe-west9"},{"title":"Doha (me-central1)","id":"me-central1"},{"title":"Dammam (me-central2)","id":"me-central2"},{"title":"Tel Aviv (me-west1)","id":"me-west1"},{"title":"Toronto (northamerica-northeast2)","id":"northamerica-northeast2"},{"title":"São Paulo (southamerica-east1)","id":"southamerica-east1"},{"title":"Multi-region: us","id":"us"},{"title":"Iowa (us-central1)","id":"us-central1"},{"title":"South Carolina (us-east1)","id":"us-east1"}]},{"id":"914tnmfqkQf3BKpMxrnc","number":"7824115651708788609","begin":"2026-04-14T09:30:00+00:00","created":"2026-04-14T12:05:30+00:00","end":"2026-04-14T15:00:00+00:00","modified":"2026-04-21T05:48:44+00:00","external_desc":"Google SecOps search and dashboard features experienced higher latencies or queries timing out for customers in multiregion: us.","updates":[{"created":"2026-04-21T05:48:44+00:00","modified":"2026-04-21T05:48:45+00:00","when":"2026-04-21T05:48:44+00:00","text":"## Incident Report\n## Summary\nOn Tuesday, 14 April 2026, Google SecOps experienced higher latencies and query timeouts for its search and dashboard features in the multiregion: us, for a duration of 5 hours and 30 minutes. If your service or application was affected, we apologize. This is not the level of quality and reliability we strive to offer you, and we are taking immediate steps to improve the platform’s performance and availability.\n## Root Cause \\\nThe root cause of this incident was elevated latency within the storage management service, triggered by a \"hotspot\" on a specific configuration key within the underlying database. This condition resulted from a parallel service disruption in the database service which caused background maintenance jobs to fail. These background jobs are responsible for consolidating small, temporary data files into larger, more efficient sets; their failure led to a significant increase in the volume of unconsolidated files required for each query. \\\nThe sequence of events leading to customer impact was as follows:\n* A software update in the underlying database service led to performance degradation, preventing automated background jobs from consolidating temporary data files.\n* The number of unconsolidated files increased significantly, as the system could not merge them into optimized formats during the disruption.\n* Every lookup for these files required a configuration check against a single, shared configuration key in the database.\n* The high volume of lookup requests created a hotspot on the specific database tablet hosting that configuration key, resulting in extreme read contention and high latency.\n* The high latency in the storage layer caused Unified Data Model (UDM) search and dashboard queries to time out or experience severe performance degradation.\n## Remediation and Prevention\nGoogle engineers were alerted to the issue via internal monitoring frameworks (prober failure). Subsequently, a service disruption was declared, and relevant engineering teams were engaged to identify the root cause and mitigate the issue. Immediate steps were taken by engineering teams to stabilize the service and apply mitigation:\n* Engineering stabilized the storage management service by adding more capacity to specific storage management servers.\n* Engineering worked to shard the impacted configuration (cause of hotspot) to permanently reduce the load on single rows.\n* Engineers confirmed that latency returned to baseline levels and the issue was mitigated on 14 April at 08:00 PDT, once the configuration sharding was completed across all shards.\nGoogle is committed to preventing a repeat of this issue in the future and is completing the following actions:\n* **Distribute storage service configurations:** We are splitting the configuration for our storage management service into multiple shards to more effectively distribute lookup requests. This change will prevent performance bottlenecks previously caused by high volumes of requests hitting a single configuration entry.\n* **Detect unusual data volume patterns:** We are developing proactive alerting to monitor for rapid increases in the volume of data files being processed. This will allow us to identify and address potential performance triggers before they lead to customer-visible degradation.\n## Detailed Description of Impact\nOn Tuesday, 14 April 2026 from 02:30 to 08:00 US/Pacific, customers using Google SecOps in the multiregion:us experienced service degradation. Specifically, Google SecOps search and dashboard features encountered higher latencies or queries timing out. Customers trying to access these features saw queries and charts taking an unusually long time to load or failing with timeouts.","status":"AVAILABLE","affected_locations":[]},{"created":"2026-04-16T07:31:08+00:00","modified":"2026-04-21T05:48:44+00:00","when":"2026-04-16T07:31:08+00:00","text":"# Preliminary Incident Report\nWe apologize for the inconvenience this service disruption may have caused. We would like to provide some information about this incident below. Please note, this information is based on our best knowledge at the time of posting and is subject to change as our investigation continues. A final Incident Report with preventative actions will be posted once our investigation is complete. If you have experienced impact outside of what is listed below, please reach out to Google Cloud Support using https://cloud.google.com/support .\n## Date/Time of the Issue (All time US/Pacific)\nIncident Start: 14 April 2026 02:30\nIncident End: 14 April 2026 08:00\nDuration: 5 hours, 30 minutes\n## Summary\nOn Tuesday, 14 April 2026, Google SecOps experienced higher latencies and query timeouts for its search and dashboard features in the multiregion:us, for a duration of 5 hours and 30 minutes. If your service or application was affected, we apologize, this is not the level of quality and reliability we strive to offer you, and we have taken and are taking immediate steps to improve the platform’s performance and availability.\n## Preliminary Root Cause\nThe root cause of this incident was elevated latency within the storage management service, triggered by a hotspot on a specific configuration key. This likely resulted from shifts in traffic patterns that increased the volume of data files required for each Unified Data Model (UDM) query.\nThis situation had a direct effect on Google SecOps, leading to delays and failures within search and dashboard functionalities.\nThe sequence of events leading to customer impact was as follows:\n- The configuration was queried for every lookup request, triggering hotspot in storage service on a single configuration row.\n- This resulted in excessive load on specific storage services resulting in the high latency.\n- The high latency led to significant failures and delays when accessing Google SecOps search and dashboard features.\n- Customers experienced queries and charts taking an unusually long time to load or failing with timeouts.\nGoogle engineers have initiated a comprehensive root cause analysis and will share updates as they become available. A thorough Incident Report, including preventative measures, will be published.\n## Remediation\nGoogle engineers were alerted to the issue via internal monitoring frameworks (prober failure), after which a Service disruption was declared and relevant engineering teams engaged to root cause and mitigate. Immediate steps were taken by engineering teams to stabilize the service and apply mitigation:\n- Engineering stabilized the storage management service by adding more capacity to specific storage management servers.\n- The Eng team worked to shard the impacted configuration (cause of hotspot) to permanently reduce the load on single rows.\n- Engineers confirmed latency recovered and the issue was mitigated on 14 April at 08:00 PDT, after the latest mitigation action was rolled out.\nWe apologize for the length and severity of this incident. We are taking immediate steps to prevent a recurrence and improve reliability in the future.\n## Description of Impact\nOn Tuesday, 14 April 2026 from 02:30 to 08:00 US/Pacific, customers using Google SecOps in the multiregion:us experienced service degradation. Specifically, Google SecOps search and dashboard features encountered higher latencies or queries timing out. Customers trying to access these features saw queries and charts taking an unusually long time to load or failing with timeouts.","status":"AVAILABLE","affected_locations":[]},{"created":"2026-04-14T15:16:08+00:00","modified":"2026-04-16T07:31:08+00:00","when":"2026-04-14T15:16:08+00:00","text":"**Description:**\nThe latency and time out issue with Google Secops search and dashboard has been resolved for all affected users as of Tuesday, 2026-04-14 08:00 PDT\nFrom preliminary analysis, the issue was caused by hotspotting of the backend database. Our engineers mitigated the issue by sharding the files to reduce the load on the backend database.\nWe thank you for your patience while we worked on resolving the issue.\n**Customer Symptoms:**\nGoogle SecOps search/dashboard queries/charts took longer to load or failed to load for customers in multiregion: us.\n**Workaround:**\nThe issue is now mitigated.","status":"SERVICE_DISRUPTION","affected_locations":[{"title":"Multi-region: us","id":"us"}]},{"created":"2026-04-14T14:44:47+00:00","modified":"2026-04-14T15:16:08+00:00","when":"2026-04-14T14:44:47+00:00","text":"**Description:**\nEngineers are currently implementing additional mitigation strategies for this issue, as earlier efforts did not resolve the situation.\nWe do not have an ETA for mitigation at this point.\nWe will provide more information by Tuesday, 2026-04-14 08:45 PDT\n**Customer Symptoms:**\nGoogle SecOps search/dashboard queries/charts are taking longer to load or failing to load for customers in multiregion: us.\n**Workaround:**\nNone at this time.","status":"SERVICE_DISRUPTION","affected_locations":[{"title":"Multi-region: us","id":"us"}]},{"created":"2026-04-14T12:54:55+00:00","modified":"2026-04-14T14:44:47+00:00","when":"2026-04-14T12:54:55+00:00","text":"**Description:** Mitigation work is still underway by our engineering team.\nThe mitigation is expected to complete by Tuesday, 2026-04-14 08:00 PDT.\nWe will provide more information by Tuesday, 2026-04-14 08:00 PDT.\n**Customer Symptoms:** Google SecOps search/dashboard queries/charts are taking longer to load or failing to load for customers in multiregion: us.\n**Workaround:** None at this time.","status":"SERVICE_DISRUPTION","affected_locations":[{"title":"Multi-region: us","id":"us"}]},{"created":"2026-04-14T12:05:30+00:00","modified":"2026-04-14T12:54:55+00:00","when":"2026-04-14T12:05:30+00:00","text":"**Description:** We are experiencing an issue with Google SecOps beginning on Tuesday, 2026-04-14 02:30 PDT.\nOur engineering team continues to investigate the issue.\nWe will provide an update by Tuesday, 2026-04-14 06:00 PDT with current details.\nWe apologize to all who are affected by the disruption.\n**Customer Symptoms:** Google SecOps search/dashboard queries/charts are taking longer to load or failing to load for customers in multiregion: us.\n**Workaround:** None at this time.","status":"SERVICE_DISRUPTION","affected_locations":[{"title":"Multi-region: us","id":"us"}]}],"most_recent_update":{"created":"2026-04-21T05:48:44+00:00","modified":"2026-04-21T05:48:45+00:00","when":"2026-04-21T05:48:44+00:00","text":"## Incident Report\n## Summary\nOn Tuesday, 14 April 2026, Google SecOps experienced higher latencies and query timeouts for its search and dashboard features in the multiregion: us, for a duration of 5 hours and 30 minutes. If your service or application was affected, we apologize. This is not the level of quality and reliability we strive to offer you, and we are taking immediate steps to improve the platform’s performance and availability.\n## Root Cause \\\nThe root cause of this incident was elevated latency within the storage management service, triggered by a \"hotspot\" on a specific configuration key within the underlying database. This condition resulted from a parallel service disruption in the database service which caused background maintenance jobs to fail. These background jobs are responsible for consolidating small, temporary data files into larger, more efficient sets; their failure led to a significant increase in the volume of unconsolidated files required for each query. \\\nThe sequence of events leading to customer impact was as follows:\n* A software update in the underlying database service led to performance degradation, preventing automated background jobs from consolidating temporary data files.\n* The number of unconsolidated files increased significantly, as the system could not merge them into optimized formats during the disruption.\n* Every lookup for these files required a configuration check against a single, shared configuration key in the database.\n* The high volume of lookup requests created a hotspot on the specific database tablet hosting that configuration key, resulting in extreme read contention and high latency.\n* The high latency in the storage layer caused Unified Data Model (UDM) search and dashboard queries to time out or experience severe performance degradation.\n## Remediation and Prevention\nGoogle engineers were alerted to the issue via internal monitoring frameworks (prober failure). Subsequently, a service disruption was declared, and relevant engineering teams were engaged to identify the root cause and mitigate the issue. Immediate steps were taken by engineering teams to stabilize the service and apply mitigation:\n* Engineering stabilized the storage management service by adding more capacity to specific storage management servers.\n* Engineering worked to shard the impacted configuration (cause of hotspot) to permanently reduce the load on single rows.\n* Engineers confirmed that latency returned to baseline levels and the issue was mitigated on 14 April at 08:00 PDT, once the configuration sharding was completed across all shards.\nGoogle is committed to preventing a repeat of this issue in the future and is completing the following actions:\n* **Distribute storage service configurations:** We are splitting the configuration for our storage management service into multiple shards to more effectively distribute lookup requests. This change will prevent performance bottlenecks previously caused by high volumes of requests hitting a single configuration entry.\n* **Detect unusual data volume patterns:** We are developing proactive alerting to monitor for rapid increases in the volume of data files being processed. This will allow us to identify and address potential performance triggers before they lead to customer-visible degradation.\n## Detailed Description of Impact\nOn Tuesday, 14 April 2026 from 02:30 to 08:00 US/Pacific, customers using Google SecOps in the multiregion:us experienced service degradation. Specifically, Google SecOps search and dashboard features encountered higher latencies or queries timing out. Customers trying to access these features saw queries and charts taking an unusually long time to load or failing with timeouts.","status":"AVAILABLE","affected_locations":[]},"status_impact":"SERVICE_DISRUPTION","severity":"medium","service_key":"FHwvkSZ6RzzDYAvDZXMM","service_name":"Google SecOps","affected_products":[{"title":"Google SecOps","id":"FHwvkSZ6RzzDYAvDZXMM"}],"uri":"incidents/914tnmfqkQf3BKpMxrnc","currently_affected_locations":[],"previously_affected_locations":[{"title":"Multi-region: us","id":"us"}]},{"id":"sRFNTZ8vCnc9vtkQMZ53","number":"2023925199217300625","begin":"2026-04-14T03:36:00+00:00","created":"2026-04-14T09:47:21+00:00","end":"2026-04-14T13:14:00+00:00","modified":"2026-04-14T13:22:36+00:00","external_desc":"Google SecOps customers may be experiencing delayed detection, latency or failures in the US regions.","updates":[{"created":"2026-04-14T13:22:36+00:00","modified":"2026-04-14T13:22:36+00:00","when":"2026-04-14T13:22:36+00:00","text":"**Description:** The issue with Google SecOps has been resolved for all affected users as of Tuesday, 2026-04-14 06:14 PDT.\nOur engineering teams continue to investigate the root cause to prevent future occurrences.\nWe thank you for your patience while we worked on resolving the issue.\n**Customer Symptoms:** During the incident, customers encountered significant delays in the generation of security alerts and intermittent timeouts or error messages when accessing the management console.\n**Workaround:** None.","status":"AVAILABLE","affected_locations":[]},{"created":"2026-04-14T11:57:47+00:00","modified":"2026-04-14T13:22:36+00:00","when":"2026-04-14T11:57:47+00:00","text":"**Description:** Engineering teams have initiated mitigation steps and are observing initial signs of service improvement, although recovery efforts are still ongoing.\nThe mitigation is expected to complete by Tuesday, 2026-04-14 09:00 PDT.\nWe will provide the next update by Tuesday, 2026-04-14 09:30 PDT.\n**Customer Symptoms:** Customers in the impacted regions may observe failures and delays while accessing Google SecOps and processing security detection alerts.\nIn addition, the users on GCP Cloud Console may experience intermittent timeouts while accessing the Sec Ops operations page, however they should be able to log in after retrying.\n**Workaround:** None at this time.","status":"SERVICE_DISRUPTION","affected_locations":[{"title":"Multi-region: us","id":"us"}]},{"created":"2026-04-14T10:48:11+00:00","modified":"2026-04-14T11:57:47+00:00","when":"2026-04-14T10:48:11+00:00","text":"**Description:** Google engineers are currently investigating the issue with an underlying storage service that seems to be affecting the platform’s ability to process detection rules and serve console requests.\nWe will provide the next update by Tuesday, 2026-04-14 05:00 PDT.\nWe apologize to all who are affected by the disruption.\n**Customer Symptoms:** Customers in the impacted regions may observe failures and delays while accessing Google SecOps and processing security detection alerts.\nIn addition, the users on GCP Cloud Console may experience intermittent timeouts while accessing the Sec Ops operations page, however they should be able to log in after retrying.\n**Workaround:** None at this time.","status":"SERVICE_DISRUPTION","affected_locations":[{"title":"Multi-region: us","id":"us"}]},{"created":"2026-04-14T09:47:21+00:00","modified":"2026-04-14T10:48:11+00:00","when":"2026-04-14T09:47:21+00:00","text":"**Description:** We are seeing internal requests being timed out which could impact the customer features across SecOps.\nThe team is investigating the issue to identify the root cause and proceed for mitigation.\nWe will provide the next update by Tuesday, 2026-04-14 03:45 PDT.\n**Customer Symptoms:** Customers in the impacted regions may observe failures and delays while accessing Google SecOps and generation security detection alerts.\nIn addition, the users on GCP Cloud Console may experience timeouts while accessing the Sec Ops operations page.\n**Workaround:** None at this time.","status":"SERVICE_DISRUPTION","affected_locations":[{"title":"Multi-region: us","id":"us"}]}],"most_recent_update":{"created":"2026-04-14T13:22:36+00:00","modified":"2026-04-14T13:22:36+00:00","when":"2026-04-14T13:22:36+00:00","text":"**Description:** The issue with Google SecOps has been resolved for all affected users as of Tuesday, 2026-04-14 06:14 PDT.\nOur engineering teams continue to investigate the root cause to prevent future occurrences.\nWe thank you for your patience while we worked on resolving the issue.\n**Customer Symptoms:** During the incident, customers encountered significant delays in the generation of security alerts and intermittent timeouts or error messages when accessing the management console.\n**Workaround:** None.","status":"AVAILABLE","affected_locations":[]},"status_impact":"SERVICE_DISRUPTION","severity":"medium","service_key":"FHwvkSZ6RzzDYAvDZXMM","service_name":"Google SecOps","affected_products":[{"title":"Google SecOps","id":"FHwvkSZ6RzzDYAvDZXMM"}],"uri":"incidents/sRFNTZ8vCnc9vtkQMZ53","currently_affected_locations":[],"previously_affected_locations":[{"title":"Multi-region: us","id":"us"}]},{"id":"Zfr1w9qmvYc1ykDqdCEJ","number":"8779502836420351796","begin":"2026-04-04T21:15:00+00:00","created":"2026-04-04T23:50:15+00:00","end":"2026-04-05T00:31:00+00:00","modified":"2026-04-05T00:43:39+00:00","external_desc":"Investigating ingestion delays for Google SecOps.","updates":[{"created":"2026-04-05T00:42:41+00:00","modified":"2026-04-05T00:43:39+00:00","when":"2026-04-05T00:42:41+00:00","text":"**Description:**\nThe issue with Google SecOps ingestion has been resolved for all affected users as of Friday, 2026-04-04 17:31 PDT.\nFrom preliminary analysis, the issue occurred due to the internal system used to fetch data. That system recovered and hence our V1 feeds started ingesting data again.\nWe thank you for your patience while we worked on resolving the issue.\n**Symptoms:**\nCustomers may have experienced ingestion delays for Google SecOps leveraging version 1 Xenon based Ingestion Feeds. Rules detections may also have experienced higher latency.\n**Workaround:**\nThe issue is now mitigated.","status":"AVAILABLE","affected_locations":[]},{"created":"2026-04-04T23:50:15+00:00","modified":"2026-04-05T00:42:41+00:00","when":"2026-04-04T23:50:15+00:00","text":"**Description:**\nWe are experiencing an issue with Google SecOps for all regions beginning at approximately 14:15 PDT on Saturday 2026-04-04. This affects Xenon based Version 1 ingestion feeds.\nVersion 2 STS feeds are not affected.\nOur engineering team continues to investigate the issue.\nWe will provide an update by Saturday, 2026-04-04 17:30 PDT with current details.\n**Symptoms:**\nCustomers may experience ingestion delays for Google SecOps leveraging version 1 Xenon based Ingestion Feeds. Rules detections may also experience higher latency.\n**Workaround:**\nCustomers can migrate feeds to Version 2 STS based ingestion feeds.","status":"SERVICE_INFORMATION","affected_locations":[{"title":"Johannesburg (africa-south1)","id":"africa-south1"},{"title":"Tokyo (asia-northeast1)","id":"asia-northeast1"},{"title":"Mumbai (asia-south1)","id":"asia-south1"},{"title":"Singapore (asia-southeast1)","id":"asia-southeast1"},{"title":"Jakarta (asia-southeast2)","id":"asia-southeast2"},{"title":"Sydney (australia-southeast1)","id":"australia-southeast1"},{"title":"Multi-region: europe","id":"europe"},{"title":"Warsaw (europe-central2)","id":"europe-central2"},{"title":"Finland (europe-north1)","id":"europe-north1"},{"title":"Belgium (europe-west1)","id":"europe-west1"},{"title":"Turin (europe-west12)","id":"europe-west12"},{"title":"London (europe-west2)","id":"europe-west2"},{"title":"Frankfurt (europe-west3)","id":"europe-west3"},{"title":"Netherlands (europe-west4)","id":"europe-west4"},{"title":"Zurich (europe-west6)","id":"europe-west6"},{"title":"Paris (europe-west9)","id":"europe-west9"},{"title":"Doha (me-central1)","id":"me-central1"},{"title":"Dammam (me-central2)","id":"me-central2"},{"title":"Tel Aviv (me-west1)","id":"me-west1"},{"title":"Toronto (northamerica-northeast2)","id":"northamerica-northeast2"},{"title":"São Paulo (southamerica-east1)","id":"southamerica-east1"},{"title":"Multi-region: us","id":"us"},{"title":"Iowa (us-central1)","id":"us-central1"},{"title":"South Carolina (us-east1)","id":"us-east1"}]}],"most_recent_update":{"created":"2026-04-05T00:42:41+00:00","modified":"2026-04-05T00:43:39+00:00","when":"2026-04-05T00:42:41+00:00","text":"**Description:**\nThe issue with Google SecOps ingestion has been resolved for all affected users as of Friday, 2026-04-04 17:31 PDT.\nFrom preliminary analysis, the issue occurred due to the internal system used to fetch data. That system recovered and hence our V1 feeds started ingesting data again.\nWe thank you for your patience while we worked on resolving the issue.\n**Symptoms:**\nCustomers may have experienced ingestion delays for Google SecOps leveraging version 1 Xenon based Ingestion Feeds. Rules detections may also have experienced higher latency.\n**Workaround:**\nThe issue is now mitigated.","status":"AVAILABLE","affected_locations":[]},"status_impact":"SERVICE_INFORMATION","severity":"low","service_key":"FHwvkSZ6RzzDYAvDZXMM","service_name":"Google SecOps","affected_products":[{"title":"Google SecOps","id":"FHwvkSZ6RzzDYAvDZXMM"}],"uri":"incidents/Zfr1w9qmvYc1ykDqdCEJ","currently_affected_locations":[],"previously_affected_locations":[{"title":"Johannesburg (africa-south1)","id":"africa-south1"},{"title":"Tokyo (asia-northeast1)","id":"asia-northeast1"},{"title":"Mumbai (asia-south1)","id":"asia-south1"},{"title":"Singapore (asia-southeast1)","id":"asia-southeast1"},{"title":"Jakarta (asia-southeast2)","id":"asia-southeast2"},{"title":"Sydney (australia-southeast1)","id":"australia-southeast1"},{"title":"Multi-region: europe","id":"europe"},{"title":"Warsaw (europe-central2)","id":"europe-central2"},{"title":"Finland (europe-north1)","id":"europe-north1"},{"title":"Belgium (europe-west1)","id":"europe-west1"},{"title":"Turin (europe-west12)","id":"europe-west12"},{"title":"London (europe-west2)","id":"europe-west2"},{"title":"Frankfurt (europe-west3)","id":"europe-west3"},{"title":"Netherlands (europe-west4)","id":"europe-west4"},{"title":"Zurich (europe-west6)","id":"europe-west6"},{"title":"Paris (europe-west9)","id":"europe-west9"},{"title":"Doha (me-central1)","id":"me-central1"},{"title":"Dammam (me-central2)","id":"me-central2"},{"title":"Tel Aviv (me-west1)","id":"me-west1"},{"title":"Toronto (northamerica-northeast2)","id":"northamerica-northeast2"},{"title":"São Paulo (southamerica-east1)","id":"southamerica-east1"},{"title":"Multi-region: us","id":"us"},{"title":"Iowa (us-central1)","id":"us-central1"},{"title":"South Carolina (us-east1)","id":"us-east1"}]},{"id":"LagjDocudaaZ1iZPLjjC","number":"2018423999926860971","begin":"2026-04-03T18:53:00+00:00","created":"2026-04-03T19:21:44+00:00","end":"2026-04-09T16:01:00+00:00","modified":"2026-04-09T17:24:06+00:00","external_desc":"Mandiant Digital Threat Monitoring is experiencing increased alert backlog.","updates":[{"created":"2026-04-09T17:23:35+00:00","modified":"2026-04-09T17:24:06+00:00","when":"2026-04-09T17:23:35+00:00","text":"**Description**\nThe increased alert backlog issue with Mandiant Digital Threat Monitoring has been resolved as of 2026-04-09 at 9:01 US/Pacific.\nAlerts will remain ungrouped and without a similarity score.\n**Workaround**\nFiltering by monitor name will allow users to see all alerts for a given monitor.","status":"AVAILABLE","affected_locations":[]},{"created":"2026-04-06T18:56:21+00:00","modified":"2026-04-09T17:23:35+00:00","when":"2026-04-06T18:56:21+00:00","text":"**Description:**\nMandiant Digital Threat Monitoring is experiencing increased alert backlog and as a result customers may experience seeing new alerts generated for events up to 6 days ago.\nFurthermore, these alerts may be ungrouped and without a similarity score.\nOur engineering team is actively working on reducing the alert backlog. We expect the backlog to be fully processed by Friday, 2026-04-10 16:00 US/Pacific.\nWe will provide more information by Friday, 2026-04-10 16:30 US/Pacific with current details.\n**Workaround:**\nFiltering by monitor name will allow users to see all alerts for a given monitor.","status":"SERVICE_INFORMATION","affected_locations":[{"title":"Global","id":"global"}]},{"created":"2026-04-03T19:21:44+00:00","modified":"2026-04-06T18:56:21+00:00","when":"2026-04-03T19:21:44+00:00","text":"**Description:**\nMandiant Digital Threat Monitoring is experiencing increased alert backlog and as a result customers may experience seeing new alerts generated for events up to 6 days ago.\nFurthermore, these alerts may be ungrouped and without a similarity score.\nOur engineering team is actively working on reducing the alert backlog.\nWe will provide more information by Monday, 2026-04-06 12:00 US/Pacific with current details.\n**Workaround:**\nFiltering by monitor name will allow users to see all alerts for a given monitor.","status":"SERVICE_INFORMATION","affected_locations":[{"title":"Global","id":"global"}]}],"most_recent_update":{"created":"2026-04-09T17:23:35+00:00","modified":"2026-04-09T17:24:06+00:00","when":"2026-04-09T17:23:35+00:00","text":"**Description**\nThe increased alert backlog issue with Mandiant Digital Threat Monitoring has been resolved as of 2026-04-09 at 9:01 US/Pacific.\nAlerts will remain ungrouped and without a similarity score.\n**Workaround**\nFiltering by monitor name will allow users to see all alerts for a given monitor.","status":"AVAILABLE","affected_locations":[]},"status_impact":"SERVICE_INFORMATION","severity":"low","service_key":"dgtVvWgKSlxi01VBC8mt","service_name":"Mandiant Digital Threat Monitoring","affected_products":[{"title":"Mandiant Digital Threat Monitoring","id":"dgtVvWgKSlxi01VBC8mt"}],"uri":"incidents/LagjDocudaaZ1iZPLjjC","currently_affected_locations":[],"previously_affected_locations":[{"title":"Global","id":"global"}]},{"id":"89hU1PgUVZx99yUUTAmx","number":"4457021737282917114","begin":"2026-04-03T11:00:00+00:00","created":"2026-04-03T15:24:17+00:00","end":"2026-04-03T20:00:00+00:00","modified":"2026-04-03T20:07:44+00:00","external_desc":"Mandiant Advantage Threat Intelligence customers are experiencing API errors related to MATI Dashboard, Actors, Campaigns, Malware, Reports, Vulnerabilities.","updates":[{"created":"2026-04-03T20:07:44+00:00","modified":"2026-04-03T20:07:44+00:00","when":"2026-04-03T20:07:44+00:00","text":"The issue with Mandiant Advantage Threat Intelligence has been resolved for all affected users as of Friday, 2026-04-03 13:00 US/Pacific.\nWe thank you for your patience while we worked on resolving the issue.","status":"AVAILABLE","affected_locations":[]},{"created":"2026-04-03T18:51:01+00:00","modified":"2026-04-03T20:07:44+00:00","when":"2026-04-03T18:51:01+00:00","text":"We are experiencing an issue with the MATI Dashboard, Actors, Campaigns, Malware, Reports, Vulnerabilities beginning on Friday, 2026-04-03 4:36:54 AM US/Pacific.\nOur engineering team is continuing to work towards mitigation of this issue. We do not have an ETA for mitigation at this time.\nWe will provide more information by Friday, 2026-04-03 14:00 US/Pacific with current details.\nWe apologize to all who are affected by the disruption.\n**Symptoms**\nMandiant Advantage Threat Intelligence customers are experiencing API errors related toMATI Dashboard, Actors, Campaigns, Malware, Reports, Vulnerabilities.\n**Workaround**\nNone at this time.","status":"SERVICE_INFORMATION","affected_locations":[{"title":"Global","id":"global"}]},{"created":"2026-04-03T16:55:08+00:00","modified":"2026-04-03T18:51:01+00:00","when":"2026-04-03T16:55:08+00:00","text":"We are experiencing an issue with the MATI Dashboard, Actors, Campaigns, Malware, Reports, Vulnerabilities beginning on Friday, 2026-04-03 4:36:54 AM US/Pacific.\nOur engineering team has identified a potential mitigation for this issue and are currently working to validate the fix.\nWe will provide more information by Friday, 2026-04-03 11:00 US/Pacific with current details.\nWe apologize to all who are affected by the disruption.\n**Symptoms**\nMandiant Advantage Threat Intelligence customers are experiencing API errors related toMATI Dashboard, Actors, Campaigns, Malware, Reports, Vulnerabilities.\n**Workaround**\nNone at this time.","status":"SERVICE_INFORMATION","affected_locations":[{"title":"Global","id":"global"}]},{"created":"2026-04-03T16:19:11+00:00","modified":"2026-04-03T16:55:08+00:00","when":"2026-04-03T16:19:11+00:00","text":"We are experiencing an issue with the MATI Dashboard, Actors, Campaigns, Malware, Reports, Vulnerabilities beginning on Friday, 2026-04-03 4:36:54 AM US/Pacific.\nOur engineering team continues to investigate the issue.\nWe will provide more information by Friday, 2026-04-03 10:00 US/Pacific with current details.\nWe apologize to all who are affected by the disruption.\n**Symptoms**\nMandiant Advantage Threat Intelligence customers are experiencing API errors related toMATI Dashboard, Actors, Campaigns, Malware, Reports, Vulnerabilities.\n**Workaround**\nNone at this time.","status":"SERVICE_INFORMATION","affected_locations":[{"title":"Global","id":"global"}]},{"created":"2026-04-03T15:24:17+00:00","modified":"2026-04-03T16:19:11+00:00","when":"2026-04-03T15:24:17+00:00","text":"We are experiencing an issue with the MATI Dashboard, Reports, Campaigns, Vulnerabilities, and Actors beginning on Friday, 2026-04-03 04:00 US/Pacific.\nOur engineering team continues to investigate the issue.\nWe will provide more information by Friday, 2026-04-03 09:00 US/Pacific with current details.\nWe apologize to all who are affected by the disruption.\n**Symptoms**\nMandiant Advantage Threat Intelligence customers are experiencing API errors related toMATI Dashboard, Actors, Campaigns, Malware, Reports, Vulnerabilities.\n**Workaround**\nNone at this time.","status":"SERVICE_INFORMATION","affected_locations":[]}],"most_recent_update":{"created":"2026-04-03T20:07:44+00:00","modified":"2026-04-03T20:07:44+00:00","when":"2026-04-03T20:07:44+00:00","text":"The issue with Mandiant Advantage Threat Intelligence has been resolved for all affected users as of Friday, 2026-04-03 13:00 US/Pacific.\nWe thank you for your patience while we worked on resolving the issue.","status":"AVAILABLE","affected_locations":[]},"status_impact":"SERVICE_INFORMATION","severity":"low","service_key":"Dvtt8cwUdpUYoGMpt2Fc","service_name":"Mandiant Advantage Threat Intelligence","affected_products":[{"title":"Mandiant Advantage Threat Intelligence","id":"Dvtt8cwUdpUYoGMpt2Fc"}],"uri":"incidents/89hU1PgUVZx99yUUTAmx","currently_affected_locations":[],"previously_affected_locations":[{"title":"Global","id":"global"}]},{"id":"DNZ9U962Jqk63JSMPzAb","number":"3635435410050964266","begin":"2026-04-01T02:43:00+00:00","created":"2026-04-01T02:47:16+00:00","end":"2026-04-01T04:37:00+00:00","modified":"2026-04-01T05:23:16+00:00","external_desc":"Mandiant Managed Defense Portal Threat Hunting section is inaccessible.","updates":[{"created":"2026-04-01T05:19:09+00:00","modified":"2026-04-01T05:23:16+00:00","when":"2026-04-01T05:19:09+00:00","text":"**Title**\nMandiant Managed Defense Portal Threat Hunting section is now accessible.\n**Description**\nThe issue with Mandiant Managed Defense has been resolved for all affected projects as of Tuesday, 2026-03-31 21:37 PDT.\nFrom preliminary analysis, the issue was caused by a configuration change in the load balancer settings.\nOur engineers mitigated the issue by restoring the configuration settings.\nWe thank you for your patience while we worked on resolving the issue.\n**Symptoms**\nThe feature inside the portal to display stats about the hunt service (https://md.mandiant.com/threat_hunting) is now accessible.\nThe threat hunting service was not affected by this issue.\n**Workaround**\nThis incident is now resolved.","status":"AVAILABLE","affected_locations":[]},{"created":"2026-04-01T03:40:43+00:00","modified":"2026-04-01T05:19:09+00:00","when":"2026-04-01T03:40:43+00:00","text":"**Title**\nMandiant Managed Defense Portal Threat Hunting section is inaccessible.\n**Description**\nWe are experiencing an issue with the Mandiant Managed Defense Portal beginning at Tuesday, 2026-03-31 18:34 PDT.\nOur engineering team continues to investigate the issue.\nWe will provide an update by Wednesday, 2026-04-01 05:00 PDT with current details.\nWe apologize to all who are affected by the disruption.\n**Symptoms**\nThe feature inside the portal to display stats about the hunt service (https://md.mandiant.com/threat_hunting) is inaccessible.\nThe threat hunting service is not affected by this issue.\n**Workaround**\nCustomers may try viewing threat hunting Investigations published by filtering the Investigations list by Source as “Hunting”.","status":"SERVICE_INFORMATION","affected_locations":[{"title":"Tokyo (asia-northeast1)","id":"asia-northeast1"},{"title":"Mumbai (asia-south1)","id":"asia-south1"},{"title":"Singapore (asia-southeast1)","id":"asia-southeast1"},{"title":"Sydney (australia-southeast1)","id":"australia-southeast1"},{"title":"Belgium (europe-west1)","id":"europe-west1"},{"title":"Turin (europe-west12)","id":"europe-west12"},{"title":"London (europe-west2)","id":"europe-west2"},{"title":"Frankfurt (europe-west3)","id":"europe-west3"},{"title":"Netherlands (europe-west4)","id":"europe-west4"},{"title":"Zurich (europe-west6)","id":"europe-west6"},{"title":"Paris (europe-west9)","id":"europe-west9"},{"title":"Global","id":"global"},{"title":"Doha (me-central1)","id":"me-central1"},{"title":"Dammam (me-central2)","id":"me-central2"},{"title":"Tel Aviv (me-west1)","id":"me-west1"},{"title":"São Paulo (southamerica-east1)","id":"southamerica-east1"},{"title":"Multi-region: us","id":"us"}]},{"created":"2026-04-01T02:47:16+00:00","modified":"2026-04-01T03:40:43+00:00","when":"2026-04-01T02:47:16+00:00","text":"**Title**\nMandiant Managed Defense Portal Threat Hunting section is inaccessible.\n**Description**\nWe are experiencing an issue with the Mandiant Managed Defense Portal beginning at Tuesday, 2026-03-31 18:34 PDT.\nOur engineering team continues to investigate the issue.\nWe will provide an update by Tuesday, 2026-03-31 20:30 PDT with current details.\nWe apologize to all who are affected by the disruption.\n**Symptoms**\nThe Threat Hunting section in the Managed Defense Portal (https://md.mandiant.com/threat_hunting) is inaccessible due to a network error.\nThe threat hunting service is not affected by this issue.\n**Workaround**\nCustomers may try viewing threat hunting Investigations published by filtering the Investigations list by Source as “Hunting”.","status":"SERVICE_INFORMATION","affected_locations":[{"title":"Tokyo (asia-northeast1)","id":"asia-northeast1"},{"title":"Mumbai (asia-south1)","id":"asia-south1"},{"title":"Singapore (asia-southeast1)","id":"asia-southeast1"},{"title":"Sydney (australia-southeast1)","id":"australia-southeast1"},{"title":"Belgium (europe-west1)","id":"europe-west1"},{"title":"Turin (europe-west12)","id":"europe-west12"},{"title":"London (europe-west2)","id":"europe-west2"},{"title":"Frankfurt (europe-west3)","id":"europe-west3"},{"title":"Netherlands (europe-west4)","id":"europe-west4"},{"title":"Zurich (europe-west6)","id":"europe-west6"},{"title":"Paris (europe-west9)","id":"europe-west9"},{"title":"Global","id":"global"},{"title":"Doha (me-central1)","id":"me-central1"},{"title":"Dammam (me-central2)","id":"me-central2"},{"title":"Tel Aviv (me-west1)","id":"me-west1"},{"title":"São Paulo (southamerica-east1)","id":"southamerica-east1"},{"title":"Multi-region: us","id":"us"}]}],"most_recent_update":{"created":"2026-04-01T05:19:09+00:00","modified":"2026-04-01T05:23:16+00:00","when":"2026-04-01T05:19:09+00:00","text":"**Title**\nMandiant Managed Defense Portal Threat Hunting section is now accessible.\n**Description**\nThe issue with Mandiant Managed Defense has been resolved for all affected projects as of Tuesday, 2026-03-31 21:37 PDT.\nFrom preliminary analysis, the issue was caused by a configuration change in the load balancer settings.\nOur engineers mitigated the issue by restoring the configuration settings.\nWe thank you for your patience while we worked on resolving the issue.\n**Symptoms**\nThe feature inside the portal to display stats about the hunt service (https://md.mandiant.com/threat_hunting) is now accessible.\nThe threat hunting service was not affected by this issue.\n**Workaround**\nThis incident is now resolved.","status":"AVAILABLE","affected_locations":[]},"status_impact":"SERVICE_INFORMATION","severity":"low","service_key":"zall","service_name":"Multiple Products","affected_products":[{"title":"Mandiant Hunt","id":"uomxopvCRv8y7bvrA1tK"},{"title":"Mandiant Managed Defense","id":"9aKw9s8p43AYeBmo4Gvx"}],"uri":"incidents/DNZ9U962Jqk63JSMPzAb","currently_affected_locations":[],"previously_affected_locations":[{"title":"Tokyo (asia-northeast1)","id":"asia-northeast1"},{"title":"Mumbai (asia-south1)","id":"asia-south1"},{"title":"Singapore (asia-southeast1)","id":"asia-southeast1"},{"title":"Sydney (australia-southeast1)","id":"australia-southeast1"},{"title":"Belgium (europe-west1)","id":"europe-west1"},{"title":"Turin (europe-west12)","id":"europe-west12"},{"title":"London (europe-west2)","id":"europe-west2"},{"title":"Frankfurt (europe-west3)","id":"europe-west3"},{"title":"Netherlands (europe-west4)","id":"europe-west4"},{"title":"Zurich (europe-west6)","id":"europe-west6"},{"title":"Paris (europe-west9)","id":"europe-west9"},{"title":"Global","id":"global"},{"title":"Doha (me-central1)","id":"me-central1"},{"title":"Dammam (me-central2)","id":"me-central2"},{"title":"Tel Aviv (me-west1)","id":"me-west1"},{"title":"São Paulo (southamerica-east1)","id":"southamerica-east1"},{"title":"Multi-region: us","id":"us"}]},{"id":"jwXZCkhPjeU8yihzzLuU","number":"8652355073905079088","begin":"2026-03-27T14:09:00+00:00","created":"2026-03-30T15:02:13+00:00","end":"2026-03-30T15:40:00+00:00","modified":"2026-03-30T15:54:33+00:00","external_desc":"Some Google SecOps customers are experiencing issues loading legacy dashboards in US","updates":[{"created":"2026-03-30T15:54:10+00:00","modified":"2026-03-30T15:54:33+00:00","when":"2026-03-30T15:54:10+00:00","text":"**Summary:**\nSome Google SecOps customers experienced issues loading legacy dashboards in Europe and US\n**Description:**\nThe issue with Google SecOps has been resolved for all affected users as of Monday, 2026-03-30 08:40 PDT.\nWe thank you for your patience while we worked on resolving the issue.\n**Symptoms:**\nSome customers may have experienced issues loading legacy dashboards.\n**Workaround:**\nAffected customers could use native dashboards as a workaround.","status":"AVAILABLE","affected_locations":[]},{"created":"2026-03-30T15:02:13+00:00","modified":"2026-03-30T15:54:10+00:00","when":"2026-03-30T15:02:13+00:00","text":"**Summary:**\nSome Google SecOps customers are experiencing issues loading legacy dashboards in US\n**Description:**\nWe are experiencing an issue with Google SecOps beginning on Friday, 2026-03-27 07:09 PDT.\nOur engineering team continues to investigate the issue.\nWe will provide an update by Monday, 2026-03-30 08:30 PDT with current details.\nWe apologize to all who are affected by the disruption.\n**Symptoms:**\nSome customers may experience issues loading legacy dashboards.\n**Workaround:**\nAffected customers may use native dashboards as a workaround.","status":"SERVICE_INFORMATION","affected_locations":[{"title":"Multi-region: us","id":"us"}]}],"most_recent_update":{"created":"2026-03-30T15:54:10+00:00","modified":"2026-03-30T15:54:33+00:00","when":"2026-03-30T15:54:10+00:00","text":"**Summary:**\nSome Google SecOps customers experienced issues loading legacy dashboards in Europe and US\n**Description:**\nThe issue with Google SecOps has been resolved for all affected users as of Monday, 2026-03-30 08:40 PDT.\nWe thank you for your patience while we worked on resolving the issue.\n**Symptoms:**\nSome customers may have experienced issues loading legacy dashboards.\n**Workaround:**\nAffected customers could use native dashboards as a workaround.","status":"AVAILABLE","affected_locations":[]},"status_impact":"SERVICE_INFORMATION","severity":"low","service_key":"FHwvkSZ6RzzDYAvDZXMM","service_name":"Google SecOps","affected_products":[{"title":"Google SecOps","id":"FHwvkSZ6RzzDYAvDZXMM"}],"uri":"incidents/jwXZCkhPjeU8yihzzLuU","currently_affected_locations":[],"previously_affected_locations":[{"title":"Multi-region: europe","id":"europe"},{"title":"Multi-region: us","id":"us"}]},{"id":"HnzwpyTWLbegscHApoay","number":"12492820915395819324","begin":"2026-03-23T08:51:00+00:00","created":"2026-03-23T10:38:45+00:00","end":"2026-03-23T13:30:00+00:00","modified":"2026-03-23T14:03:27+00:00","external_desc":"Google SecOps customers are experiencing increased latency in Search, Dashboard and Rules queries in multiregion europe.","updates":[{"created":"2026-03-23T14:03:24+00:00","modified":"2026-03-23T14:03:27+00:00","when":"2026-03-23T14:03:24+00:00","text":"**Summary**\nGoogle SecOps customers were experiencing increased latency in Search, Dashboard and Rules queries in multiregion europe.\n**Description**\nThe issue with Google SecOps has been resolved for all affected users as of Monday, 2026-03-23 06:30 PDT.\nWe thank you for your patience while we worked on resolving the issue.\n**Symptoms**\nGoogle SecOps customers were experiencing increased latency in Search, Dashboard and Rules queries in multiregion europe.\n**Workaround**\nNone at this time.","status":"AVAILABLE","affected_locations":[]},{"created":"2026-03-23T12:22:03+00:00","modified":"2026-03-23T14:03:24+00:00","when":"2026-03-23T12:22:03+00:00","text":"**Summary**\nGoogle SecOps customers are experiencing increased latency in Search, Dashboard and Rules queries in multiregion europe.\n**Description**\nWe are experiencing an issue with Google SecOps beginning on Monday, 2026-03-23 01:51 PDT.\nThe increase in latency is 2x (35 secs to 73 secs) in 50% (p50) of the queries and 3x (50secs to 150 sec) in 10% (p90) of the queries.\nOur engineering team continues to investigate the issue.\nWe will provide an update by Monday, 2026-03-23 06:30 PDT with current details.\nWe apologize to all who are affected by the disruption.\n**Symptoms**\nGoogle SecOps customers are experiencing increased latency in Search, Dashboard and Rules queries in multiregion europe.\n**Workaround**\nNone at this time.","status":"SERVICE_DISRUPTION","affected_locations":[{"title":"Multi-region: europe","id":"europe"}]},{"created":"2026-03-23T10:38:45+00:00","modified":"2026-03-23T12:22:03+00:00","when":"2026-03-23T10:38:45+00:00","text":"**Summary**\nGoogle SecOps customers are experiencing increased latency in Search, Dashboard and Rules queries in multiregion europe.\n**Description**\nWe are experiencing an issue with Google SecOps beginning on Monday, 2026-03-23 01:51 PDT.\nThe increase in latency is 2x (35 secs to 73 secs) in 50% (p50) of the queries and 3x (50secs to 150 sec) in 10% (p90) of the queries.\nOur engineering team continues to investigate the issue.\nWe will provide an update by Monday, 2026-03-23 04:30 PDT with current details.\nWe apologize to all who are affected by the disruption.\n**Symptoms**\nGoogle SecOps customers are experiencing increased latency in Search, Dashboard and Rules queries in multiregion europe.\n**Workaround**\nNone at this time.","status":"SERVICE_DISRUPTION","affected_locations":[{"title":"Multi-region: europe","id":"europe"}]}],"most_recent_update":{"created":"2026-03-23T14:03:24+00:00","modified":"2026-03-23T14:03:27+00:00","when":"2026-03-23T14:03:24+00:00","text":"**Summary**\nGoogle SecOps customers were experiencing increased latency in Search, Dashboard and Rules queries in multiregion europe.\n**Description**\nThe issue with Google SecOps has been resolved for all affected users as of Monday, 2026-03-23 06:30 PDT.\nWe thank you for your patience while we worked on resolving the issue.\n**Symptoms**\nGoogle SecOps customers were experiencing increased latency in Search, Dashboard and Rules queries in multiregion europe.\n**Workaround**\nNone at this time.","status":"AVAILABLE","affected_locations":[]},"status_impact":"SERVICE_DISRUPTION","severity":"medium","service_key":"FHwvkSZ6RzzDYAvDZXMM","service_name":"Google SecOps","affected_products":[{"title":"Google SecOps","id":"FHwvkSZ6RzzDYAvDZXMM"}],"uri":"incidents/HnzwpyTWLbegscHApoay","currently_affected_locations":[],"previously_affected_locations":[{"title":"Multi-region: europe","id":"europe"}]},{"id":"Fq7fcqsXSP2ehqeun6Lv","number":"2989405227443274933","begin":"2026-03-20T15:00:00+00:00","created":"2026-03-20T18:09:28+00:00","end":"2026-03-21T22:34:00+00:00","modified":"2026-03-21T22:41:53+00:00","external_desc":"Some customers using Mandiant Digital Threat Intelligence may be experiencing issues accessing certain alerts","updates":[{"created":"2026-03-21T22:38:41+00:00","modified":"2026-03-21T22:41:53+00:00","when":"2026-03-21T22:38:41+00:00","text":"**Summary:**\nSome customers using Mandiant Digital Threat Intelligence may have received emails for alerts that return 404s.\n**Description:**\nSome customers using Mandiant Digital Threat Intelligence may be experiencing issues accessing alerts for emails sent on 2026-03-20 between 8AM and 9AM PDT.\nOur engineering team has identified the root cause and has completed the mitigation. A hardware failure required restoring a subset of documents. Documents that were impacted during this time have been restored, although links to alerts in emails during the impacted time will still return 404.\n**Customer Symptoms:**\nCustomers may be experiencing 404 errors accessing certain alerts generated between 8AM and 9 AM PDT on 2026-03-20.\n**Workaround:**\nAs a workaround, customers can search for documents using Research Tools for the period from 7am PDT to 8:30am PDT. Customers can use these time frames to reduce search volume.\nAdditionally, when fetching alerts through the API, impacted users can set refs=false so that the doc, labels, and topics are not returned in the response body (https://gtidocs.virustotal.com/reference/get-alerts).","status":"AVAILABLE","affected_locations":[]},{"created":"2026-03-21T19:07:40+00:00","modified":"2026-03-21T22:38:41+00:00","when":"2026-03-21T19:07:40+00:00","text":"**Summary:**\nSome customers using Mandiant Digital Threat Intelligence may be experiencing issues accessing certain alerts.\n**Description:**\nOur engineers have identified the root cause and are actively working on backfilling the data pertaining to the affected alerts.\nWe will provide more information by Saturday, 2026-03-21 16:00 PDT\n**Customer Symptoms:**\nCustomers may be experiencing 404 errors accessing certain alerts generated between 8AM and 9 AM PDT on 2026-03-20\n**Workaround:**\nAs a workaround, customers can search for documents using Research Tools for the period from 7am PDT to 8:30am PDT. Customers can use these time frames to reduce search volume.\nAdditionally, when fetching alerts through the API, impacted users can set refs=false so that the doc, labels, and topics are not returned in the response body (https://gtidocs.virustotal.com/reference/get-alerts).","status":"SERVICE_INFORMATION","affected_locations":[{"title":"Global","id":"global"}]},{"created":"2026-03-20T22:16:01+00:00","modified":"2026-03-21T19:07:40+00:00","when":"2026-03-20T22:16:01+00:00","text":"**Summary:**\nSome customers using Mandiant Digital Threat Intelligence may be experiencing issues accessing certain alerts.\n**Description:**\nOur engineering team has identified the root cause and is working on the mitigation.\nWe will provide more information by Saturday, 2026-03-21 12:00 PDT.\n**Customer Symptoms:**\nCustomers may be experiencing 404 errors accessing certain alerts generated between 8AM and 9 AM PDT on 2026-03-20\n**Workaround:**\nAs a workaround, customers can search for documents using Research Tools for the period from 7am PDT to 8:30am PDT. Customers can use these time frames to reduce search volume.\nAdditionally, when fetching alerts through the API, impacted users can set refs=false so that the doc, labels, and topics are not returned in the response body (https://gtidocs.virustotal.com/reference/get-alerts).","status":"SERVICE_INFORMATION","affected_locations":[{"title":"Global","id":"global"}]},{"created":"2026-03-20T18:09:28+00:00","modified":"2026-03-20T22:16:01+00:00","when":"2026-03-20T18:09:28+00:00","text":"**Description:**\nSome customers using Mandiant Digital Threat Intelligence may be experiencing issues accessing alerts generated on 2026-03-20 between 8AM and 9AM PDT.\nOur engineering team has identified the cause of the issue and is assessing options. We currently do not have an ETA for resolution.\n**Symptoms:**\nCustomers may be experiencing 404 errors accessing certain alerts generated between 8AM and 9 AM PDT on 2026-03-20\n**Workarounds:**\nNo workarounds available at this time.","status":"SERVICE_INFORMATION","affected_locations":[{"title":"Global","id":"global"}]}],"most_recent_update":{"created":"2026-03-21T22:38:41+00:00","modified":"2026-03-21T22:41:53+00:00","when":"2026-03-21T22:38:41+00:00","text":"**Summary:**\nSome customers using Mandiant Digital Threat Intelligence may have received emails for alerts that return 404s.\n**Description:**\nSome customers using Mandiant Digital Threat Intelligence may be experiencing issues accessing alerts for emails sent on 2026-03-20 between 8AM and 9AM PDT.\nOur engineering team has identified the root cause and has completed the mitigation. A hardware failure required restoring a subset of documents. Documents that were impacted during this time have been restored, although links to alerts in emails during the impacted time will still return 404.\n**Customer Symptoms:**\nCustomers may be experiencing 404 errors accessing certain alerts generated between 8AM and 9 AM PDT on 2026-03-20.\n**Workaround:**\nAs a workaround, customers can search for documents using Research Tools for the period from 7am PDT to 8:30am PDT. Customers can use these time frames to reduce search volume.\nAdditionally, when fetching alerts through the API, impacted users can set refs=false so that the doc, labels, and topics are not returned in the response body (https://gtidocs.virustotal.com/reference/get-alerts).","status":"AVAILABLE","affected_locations":[]},"status_impact":"SERVICE_INFORMATION","severity":"low","service_key":"dgtVvWgKSlxi01VBC8mt","service_name":"Mandiant Digital Threat Monitoring","affected_products":[{"title":"Mandiant Digital Threat Monitoring","id":"dgtVvWgKSlxi01VBC8mt"}],"uri":"incidents/Fq7fcqsXSP2ehqeun6Lv","currently_affected_locations":[],"previously_affected_locations":[{"title":"Global","id":"global"}]},{"id":"nirgVYt314zYV2sPj2Zz","number":"13336233300045609055","begin":"2026-03-19T22:50:00+00:00","created":"2026-03-19T22:58:26+00:00","end":"2026-03-20T06:50:00+00:00","modified":"2026-03-20T07:47:17+00:00","external_desc":"[Informational] Service update notification for Google SecOps.","updates":[{"created":"2026-03-20T07:46:44+00:00","modified":"2026-03-20T07:47:17+00:00","when":"2026-03-20T07:46:44+00:00","text":"**Summary** [Informational] Service update notification for Google SecOps.\n**Description**\nThe issue with Google SecOps has been resolved for all affected users as of Thursday, 2026-03-19 23:50 PDT.\nWe thank you for your patience while we worked on resolving the issue.\n**Symptoms**\nAll rule-level settings are again respected, independent of pack settings.\nAll alerts and detections from affected rules will be reprocessed over the duration of the service update. Reprocessed alerts and detections may arrive with up to a 12 hour delay.\n**Workaround**\nNone for now as the issue stands mitigated.","status":"AVAILABLE","affected_locations":[]},{"created":"2026-03-20T03:08:02+00:00","modified":"2026-03-20T07:46:44+00:00","when":"2026-03-20T03:08:02+00:00","text":"**Summary**\n[Informational] Service update notification for Google SecOps.\n**Description**\nGoogle SecOps will be performing a service update between Thursday, 2026-03-19 18:00 PDT and Friday, 2026-03-20 00:30 PDT. The previously communicated 20:00 PDT window has been extended to 00:30 PDT.\nThis update is specifically targeted at customers with the following attributes: * Region: multiregions/us * Feature: Customers that are using Private Preview for Unified Rules and have configured Curated Detections with settings that override the corresponding rule pack settings.\nFor more information on the Unified Rules private preview, see the following documentation: https://docs.cloud.google.com/chronicle/docs/detection/unified-rules/get-started\nWe will provide an update by Friday, 2026-03-20 01:00 PDT with current details.\n**Symptoms**\nDuring this brief window, the rules with customized settings will revert to the settings for the rule’s parent pack. All alerts and detections from these rules will be created with up to a 12 hour delay.\nThis can manifest itself in changes to rule alerting status, Rules Dashboard and API may temporarily show inconsistent \"live\" or \"alerting\" states.\nAfter the update has completed, all rule-level settings will be respected, independent of pack settings.\n**Workaround**\nRule Pack settings will be respected; these can be updated to provide the desired detection behavior throughout the service window.","status":"SERVICE_INFORMATION","affected_locations":[{"title":"Multi-region: us","id":"us"}]},{"created":"2026-03-19T22:58:26+00:00","modified":"2026-03-20T03:08:02+00:00","when":"2026-03-19T22:58:26+00:00","text":"**Summary**\n[Informational] Service update notification for Google SecOps.\n**Description**\nGoogle SecOps will be performing a service update on Thursday, 2026-03-19 between 18:00 PDT and 20:00 PDT.\nThis update is specifically targeted at customers with the following attributes:\n* Region: multiregions/us\n* Feature: Customers that are using Private Preview for Unified Rules and have configured Curated Detections with settings that override the corresponding rule pack settings.\nFor more information on the Unified Rules private preview, see the following documentation: https://docs.cloud.google.com/chronicle/docs/detection/unified-rules/get-started\nWe will provide an update by Thursday, 2026-03-19 20:30 PDT with current details.\n**Symptoms**\nDuring this brief window, the rules with customized settings will revert to the settings for the rule’s parent pack. All alerts and detections from these rules will be created with up to a 2 hour delay.\nThis can manifest itself in changes to rule alerting status, Rules Dashboard and API may temporarily show inconsistent \"live\" or \"alerting\" states.\nAfter the update has completed, all rule-level settings will be respected, independent of pack settings.\n**Workaround**\nRule Pack settings will be respected; these can be updated to provide the desired detection behavior throughout the service window.","status":"SERVICE_INFORMATION","affected_locations":[{"title":"Multi-region: us","id":"us"}]}],"most_recent_update":{"created":"2026-03-20T07:46:44+00:00","modified":"2026-03-20T07:47:17+00:00","when":"2026-03-20T07:46:44+00:00","text":"**Summary** [Informational] Service update notification for Google SecOps.\n**Description**\nThe issue with Google SecOps has been resolved for all affected users as of Thursday, 2026-03-19 23:50 PDT.\nWe thank you for your patience while we worked on resolving the issue.\n**Symptoms**\nAll rule-level settings are again respected, independent of pack settings.\nAll alerts and detections from affected rules will be reprocessed over the duration of the service update. Reprocessed alerts and detections may arrive with up to a 12 hour delay.\n**Workaround**\nNone for now as the issue stands mitigated.","status":"AVAILABLE","affected_locations":[]},"status_impact":"SERVICE_INFORMATION","severity":"low","service_key":"FHwvkSZ6RzzDYAvDZXMM","service_name":"Google SecOps","affected_products":[{"title":"Google SecOps","id":"FHwvkSZ6RzzDYAvDZXMM"}],"uri":"incidents/nirgVYt314zYV2sPj2Zz","currently_affected_locations":[],"previously_affected_locations":[{"title":"Multi-region: us","id":"us"}]},{"id":"7bRpxkK7ytLn7Lp7gg25","number":"13448261581001329490","begin":"2026-03-10T23:30:00+00:00","created":"2026-03-11T03:09:36+00:00","end":"2026-03-11T04:10:00+00:00","modified":"2026-03-11T04:24:22+00:00","external_desc":"Google SecOps customers may experience errors loading Legacy Dashboards in few regions","updates":[{"created":"2026-03-11T04:24:22+00:00","modified":"2026-03-11T04:24:22+00:00","when":"2026-03-11T04:24:22+00:00","text":"**Summary**\nGoogle SecOps customers might have experienced errors loading Legacy Dashboards in few regions\n**Description**\nWe experienced an issue with SecOps Legacy Dashboard beginning at 2026-03-10 16:30 PDT.\nOur engineering team mitigated the impact by identifying the flag change that was causing this issue and reverting it.\nThe issue has been resolved for all affected users as of Tuesday, 2026-03-10 21:10 PDT.\nWe thank you for your patience while we worked on resolving the issue.\n**Symptoms**\nImpacted customers might have experienced errors while loading their legacy queries for looker dashboards in a few regions. The issue is now resolved.\n**Workaround**\nNone","status":"AVAILABLE","affected_locations":[]},{"created":"2026-03-11T03:09:36+00:00","modified":"2026-03-11T04:24:22+00:00","when":"2026-03-11T03:09:36+00:00","text":"**Summary**\nGoogle SecOps customers may experience errors loading Legacy Dashboards in few regions\n**Description**\nWe are experiencing an issue with SecOps Legacy Dashboard beginning at Tuesday, 2026-03-10 16:30 PDT.\nWe believe the issue with Google SecOps is partially resolved for the below regions:\neurope-west12, europe-west3, europe-west6, europe-west9, me-central1, me-central2, africa-south1, me-west1\nFull resolution is expected to complete by Tuesday, 2026-03-10 21:00 PDT.\nWe will provide an update by Tuesday, 2026-03-10 21:30 PDT with current details.\n**Symptoms**\nImpacted customers may have experienced errors while loading their legacy queries for looker dashboards in few regions.\nThe issue has been limited to the below regions as it is mitigated for few regions already:\neurope-west12, europe-west3, europe-west6, europe-west9, me-central1, me-central2, africa-south1, me-west1\nWe are currently working to mitigate the impact in europe-multiregion, europe-west2 regions.\n**Workaround**\nThe impacted customers can use the newer Dashboard feature instead of Legacy Dashboards.","status":"SERVICE_INFORMATION","affected_locations":[{"title":"Johannesburg (africa-south1)","id":"africa-south1"},{"title":"Multi-region: europe","id":"europe"},{"title":"Turin (europe-west12)","id":"europe-west12"},{"title":"London (europe-west2)","id":"europe-west2"},{"title":"Frankfurt (europe-west3)","id":"europe-west3"},{"title":"Zurich (europe-west6)","id":"europe-west6"},{"title":"Paris (europe-west9)","id":"europe-west9"},{"title":"Doha (me-central1)","id":"me-central1"},{"title":"Dammam (me-central2)","id":"me-central2"},{"title":"Tel Aviv (me-west1)","id":"me-west1"}]}],"most_recent_update":{"created":"2026-03-11T04:24:22+00:00","modified":"2026-03-11T04:24:22+00:00","when":"2026-03-11T04:24:22+00:00","text":"**Summary**\nGoogle SecOps customers might have experienced errors loading Legacy Dashboards in few regions\n**Description**\nWe experienced an issue with SecOps Legacy Dashboard beginning at 2026-03-10 16:30 PDT.\nOur engineering team mitigated the impact by identifying the flag change that was causing this issue and reverting it.\nThe issue has been resolved for all affected users as of Tuesday, 2026-03-10 21:10 PDT.\nWe thank you for your patience while we worked on resolving the issue.\n**Symptoms**\nImpacted customers might have experienced errors while loading their legacy queries for looker dashboards in a few regions. The issue is now resolved.\n**Workaround**\nNone","status":"AVAILABLE","affected_locations":[]},"status_impact":"SERVICE_INFORMATION","severity":"low","service_key":"FHwvkSZ6RzzDYAvDZXMM","service_name":"Google SecOps","affected_products":[{"title":"Google SecOps","id":"FHwvkSZ6RzzDYAvDZXMM"}],"uri":"incidents/7bRpxkK7ytLn7Lp7gg25","currently_affected_locations":[],"previously_affected_locations":[{"title":"Johannesburg (africa-south1)","id":"africa-south1"},{"title":"Multi-region: europe","id":"europe"},{"title":"Turin (europe-west12)","id":"europe-west12"},{"title":"London (europe-west2)","id":"europe-west2"},{"title":"Frankfurt (europe-west3)","id":"europe-west3"},{"title":"Zurich (europe-west6)","id":"europe-west6"},{"title":"Paris (europe-west9)","id":"europe-west9"},{"title":"Doha (me-central1)","id":"me-central1"},{"title":"Dammam (me-central2)","id":"me-central2"},{"title":"Tel Aviv (me-west1)","id":"me-west1"}]},{"id":"YUnarm1Dq29PAWsi4tA9","number":"9686349514157032400","begin":"2026-03-09T11:00:00+00:00","created":"2026-03-09T18:37:55+00:00","end":"2026-03-09T16:10:00+00:00","modified":"2026-03-09T18:41:20+00:00","external_desc":"Google SecOps customers experienced issues logging into the SecOps UI","updates":[{"created":"2026-03-09T18:41:20+00:00","modified":"2026-03-09T18:41:20+00:00","when":"2026-03-09T18:41:20+00:00","text":"**Description**\nSome customers in us-central1 region experienced an issue authenticating and accessing Google SecOps web application beginning on Wednesday 2026-03-09 04:00 US/Pacific.\nThe issue has been resolved for all affected projects as of Wednesday 2026-03-09 09:10 US/Pacific.\nWe thank you for your patience while we worked on resolving the issue.\n**Diagnosis**\nUnable to login in to the SecOps website.\n**Workaround**\nN/A","status":"AVAILABLE","affected_locations":[]},{"created":"2026-03-09T18:37:55+00:00","modified":"2026-03-09T18:41:20+00:00","when":"2026-03-09T18:37:55+00:00","text":"**Description**\nSome customers in us-central1 region experienced an issue authenticating and accessing Google SecOps web application beginning on Wednesday 2026-03-09 04:00 US/Pacific.\nThe issue has been resolved for all affected projects as of Wednesday 2026-03-09 09:10 US/Pacific.\nWe thank you for your patience while we worked on resolving the issue.\n**Diagnosis**\nUnable to login in to the SecOps website.\n**Workaround**\nN/A","status":"SERVICE_DISRUPTION","affected_locations":[{"title":"Iowa (us-central1)","id":"us-central1"}]}],"most_recent_update":{"created":"2026-03-09T18:41:20+00:00","modified":"2026-03-09T18:41:20+00:00","when":"2026-03-09T18:41:20+00:00","text":"**Description**\nSome customers in us-central1 region experienced an issue authenticating and accessing Google SecOps web application beginning on Wednesday 2026-03-09 04:00 US/Pacific.\nThe issue has been resolved for all affected projects as of Wednesday 2026-03-09 09:10 US/Pacific.\nWe thank you for your patience while we worked on resolving the issue.\n**Diagnosis**\nUnable to login in to the SecOps website.\n**Workaround**\nN/A","status":"AVAILABLE","affected_locations":[]},"status_impact":"SERVICE_DISRUPTION","severity":"medium","service_key":"GTT16Lf72XZKWArC9VxA","service_name":"Google SecOps SOAR","affected_products":[{"title":"Google SecOps SOAR","id":"GTT16Lf72XZKWArC9VxA"}],"uri":"incidents/YUnarm1Dq29PAWsi4tA9","currently_affected_locations":[],"previously_affected_locations":[{"title":"Iowa (us-central1)","id":"us-central1"}]},{"id":"xNuMc5QAsWGwS1LsqThZ","number":"10359456992071338271","begin":"2026-02-26T22:20:00+00:00","created":"2026-02-26T23:45:26+00:00","end":"2026-02-26T22:50:00+00:00","modified":"2026-02-26T23:45:51+00:00","external_desc":"Mandiant Managed Defense customers may have experienced SSO unavailability","updates":[{"created":"2026-02-26T23:45:26+00:00","modified":"2026-02-26T23:45:51+00:00","when":"2026-02-26T23:45:26+00:00","text":"**Summary**\nMandiant Managed Defense customers may have experienced SSO unavailability\n**Description**\nMandiant Managed Defense SSO may have been unavailable for the customers on Thursday, 2026-02-26 between 14:20 PST to 14:50 PST.\nOur Engineering team has identified the root cause of the issue and applied the fix to mitigate the impact.\nWe thank you for your patience while we worked on resolving the issue.\n**Customer Symptoms**\nCustomers may have seen Cloudflare error pages, or missing content in the customer Portal, impacting their ability to log in to Managed Defense Portal and Mandiant Advantage products.\n**Workaround**\nNone at this time.","status":"AVAILABLE","affected_locations":[]}],"most_recent_update":{"created":"2026-02-26T23:45:26+00:00","modified":"2026-02-26T23:45:51+00:00","when":"2026-02-26T23:45:26+00:00","text":"**Summary**\nMandiant Managed Defense customers may have experienced SSO unavailability\n**Description**\nMandiant Managed Defense SSO may have been unavailable for the customers on Thursday, 2026-02-26 between 14:20 PST to 14:50 PST.\nOur Engineering team has identified the root cause of the issue and applied the fix to mitigate the impact.\nWe thank you for your patience while we worked on resolving the issue.\n**Customer Symptoms**\nCustomers may have seen Cloudflare error pages, or missing content in the customer Portal, impacting their ability to log in to Managed Defense Portal and Mandiant Advantage products.\n**Workaround**\nNone at this time.","status":"AVAILABLE","affected_locations":[]},"status_impact":"SERVICE_INFORMATION","severity":"low","service_key":"9aKw9s8p43AYeBmo4Gvx","service_name":"Mandiant Managed Defense","affected_products":[{"title":"Mandiant Managed Defense","id":"9aKw9s8p43AYeBmo4Gvx"}],"uri":"incidents/xNuMc5QAsWGwS1LsqThZ","currently_affected_locations":[],"previously_affected_locations":[{"title":"Global","id":"global"}]},{"id":"K6VB74JiPnRu1gp2hYyN","number":"12283818099846420962","begin":"2026-02-23T14:00:00+00:00","created":"2026-02-24T19:55:59+00:00","end":"2026-02-23T22:00:00+00:00","modified":"2026-02-24T22:14:17+00:00","external_desc":"Google SecOps customers using Bindplane agents configured with HTTPS endpoints are experiencing intermittent drop in ingestion volume in US multi-region, asia-south-1 and me-central-1. It’s possible customers in other regions may experience the issue.","updates":[{"created":"2026-02-24T22:14:17+00:00","modified":"2026-02-24T22:14:18+00:00","when":"2026-02-24T22:14:17+00:00","text":"**Summary**\nGoogle SecOps customers using Bindplane agents configured with HTTPS endpoints may experience intermittent drop in ingestion volume in US multi-region, asia-south-1 and me-central-1. It’s possible that customers in other regions may experience the issue as well.\n**Description**\nA fix is now available for customers experiencing issues with Google SecOps customers using Bindplane agents configured with HTTPS. The impacted customers should update to Bindplane Collector v1.94.2 which resolves the issue by enqueuing the data retrying when 429s occur. This release is available in [GitHub](https://github.com/observIQ/bindplane-otel-collector/releases/tag/v1.94.2) and when installing the agent through the Bindplane UI.\nIf the data still exist at the log source, customers should try to recollect that data. For example: with Windows Events Source, the Start at Beginning setting in the Bindplane receiver, can be used to recollect the potentially lost events.\nWe thank you for your patience while we worked on resolving the issue.\n**Customer Symptoms**\nHow to Monitor if you are impacted:\nIf you are using Bindplane HTTPS then follow below-\n1. Go to your GCP project on the SIEM settings\n2. APIs \u0026 Services\n3. Select Chronicle APIs\n4. Select only `ImportLogs` in methods\nLook for any 429 errors in `Traffic by response code`\n**Workaround**\nNone at this time.","status":"AVAILABLE","affected_locations":[]},{"created":"2026-02-24T19:55:59+00:00","modified":"2026-02-24T22:14:17+00:00","when":"2026-02-24T19:55:59+00:00","text":"**Description**\nWe are experiencing intermittent issues with Google SecOps for customers using HTTPS endpoints using Bindplane, symptoms began Monday, 2026-02-23 06:00 PST and continued for approximately one hour. The issue reoccurred on Tuesday, 2026-02-24 06:00 PST, for approximately one hour. The issue has been intermittent since then.\nSecOps started returning HTTP 429 errors to certain customers for a limited period of time, which led to the Bindplane agent dropping logs.\nOur engineering team and Bindplane’s engineering team have identified the issue and are working on a fix.\nWe will provide more information by Tuesday, 2026-02-24 15:30 PST with current details.\nWe apologize to all who are affected by the disruption.\n**Diagnosis/Symptoms**\nHow to Monitor if you are impacted:\nIf you are using Bindplane HTTPS then follow below-\n1. Go to your GCP project on the SIEM settings\n2. APIs \u0026 Services\n3. Select Chronicle APIs\n4. select only `ImportLogs` in methods\nLook for any 429 errors in `Traffic by response code`\n**Workaround**\nNone at this time.","status":"SERVICE_DISRUPTION","affected_locations":[{"title":"Mumbai (asia-south1)","id":"asia-south1"},{"title":"Doha (me-central1)","id":"me-central1"},{"title":"Multi-region: us","id":"us"}]}],"most_recent_update":{"created":"2026-02-24T22:14:17+00:00","modified":"2026-02-24T22:14:18+00:00","when":"2026-02-24T22:14:17+00:00","text":"**Summary**\nGoogle SecOps customers using Bindplane agents configured with HTTPS endpoints may experience intermittent drop in ingestion volume in US multi-region, asia-south-1 and me-central-1. It’s possible that customers in other regions may experience the issue as well.\n**Description**\nA fix is now available for customers experiencing issues with Google SecOps customers using Bindplane agents configured with HTTPS. The impacted customers should update to Bindplane Collector v1.94.2 which resolves the issue by enqueuing the data retrying when 429s occur. This release is available in [GitHub](https://github.com/observIQ/bindplane-otel-collector/releases/tag/v1.94.2) and when installing the agent through the Bindplane UI.\nIf the data still exist at the log source, customers should try to recollect that data. For example: with Windows Events Source, the Start at Beginning setting in the Bindplane receiver, can be used to recollect the potentially lost events.\nWe thank you for your patience while we worked on resolving the issue.\n**Customer Symptoms**\nHow to Monitor if you are impacted:\nIf you are using Bindplane HTTPS then follow below-\n1. Go to your GCP project on the SIEM settings\n2. APIs \u0026 Services\n3. Select Chronicle APIs\n4. Select only `ImportLogs` in methods\nLook for any 429 errors in `Traffic by response code`\n**Workaround**\nNone at this time.","status":"AVAILABLE","affected_locations":[]},"status_impact":"SERVICE_DISRUPTION","severity":"medium","service_key":"FHwvkSZ6RzzDYAvDZXMM","service_name":"Google SecOps","affected_products":[{"title":"Google SecOps","id":"FHwvkSZ6RzzDYAvDZXMM"}],"uri":"incidents/K6VB74JiPnRu1gp2hYyN","currently_affected_locations":[],"previously_affected_locations":[{"title":"Mumbai (asia-south1)","id":"asia-south1"},{"title":"Doha (me-central1)","id":"me-central1"},{"title":"Multi-region: us","id":"us"}]},{"id":"cSyWjLDcqH7eL7bNDDLV","number":"6974755209664332981","begin":"2026-02-12T13:20:00+00:00","created":"2026-02-12T15:42:49+00:00","end":"2026-02-12T16:46:00+00:00","modified":"2026-02-17T21:34:01+00:00","external_desc":"The issue with Google SecOps has been resolved for all affected users as of Thursday, 2026-02-12 08:46 US/Pacific.","updates":[{"created":"2026-02-12T16:58:05+00:00","modified":"2026-02-12T16:58:20+00:00","when":"2026-02-12T16:58:05+00:00","text":"**Description**\nThe issue with Google SecOps has been resolved for all affected users as of Thursday, 2026-02-12 08:46 US/Pacific.\nWe thank you for your patience while we worked on resolving the issue..\n**Diagnosis / Customer Symptoms**\nSecOps customers may observe delay in ingestion.\n**Workaround**\nNone at this time.","status":"AVAILABLE","affected_locations":[]},{"created":"2026-02-12T15:42:49+00:00","modified":"2026-02-12T16:58:05+00:00","when":"2026-02-12T15:42:49+00:00","text":"**Description**\nMitigation work is currently underway by our engineering team.\nThe mitigation is expected to be completed by Thursday, 2026-02-12 09:00 US/Pacific.\nWe will provide an update by Thursday, 2026-02-12 09:30 US/Pacific with current details.\n**Diagnosis / Customer Symptoms**\nSecOps customers may observe delay in ingestion.\n**Workaround**\nNone at this time.","status":"SERVICE_DISRUPTION","affected_locations":[]}],"most_recent_update":{"created":"2026-02-12T16:58:05+00:00","modified":"2026-02-12T16:58:20+00:00","when":"2026-02-12T16:58:05+00:00","text":"**Description**\nThe issue with Google SecOps has been resolved for all affected users as of Thursday, 2026-02-12 08:46 US/Pacific.\nWe thank you for your patience while we worked on resolving the issue..\n**Diagnosis / Customer Symptoms**\nSecOps customers may observe delay in ingestion.\n**Workaround**\nNone at this time.","status":"AVAILABLE","affected_locations":[]},"status_impact":"SERVICE_DISRUPTION","severity":"medium","service_key":"FHwvkSZ6RzzDYAvDZXMM","service_name":"Google SecOps","affected_products":[{"title":"Google SecOps","id":"FHwvkSZ6RzzDYAvDZXMM"}],"uri":"incidents/cSyWjLDcqH7eL7bNDDLV","currently_affected_locations":[],"previously_affected_locations":[]},{"id":"nuU89kS9ifqo12fEqPJr","number":"15589965330685483994","begin":"2026-02-09T22:30:00+00:00","created":"2026-02-10T08:59:29+00:00","end":"2026-02-18T17:00:00+00:00","modified":"2026-02-18T18:31:39+00:00","external_desc":"Mandiant Digital Threat Monitoring customers experiencing issues in receiving emails or new alerts and the research tools are not returning results.","updates":[{"created":"2026-02-18T18:31:39+00:00","modified":"2026-02-18T18:31:40+00:00","when":"2026-02-18T18:31:39+00:00","text":"**Summary:**\nMandiant Digital Threat Monitoring customers may have experienced issues in receiving emails or new alerts, and may have seen HTTP 404 Not Found error when viewing alerts through the web console or API.\n**Description:**\nThe issue with Mandiant Digital Threat Monitoring has been resolved as of 2026-02-18 at 09:00 US/Pacific.\n**Customer Symptoms:**\nCustomers were unable to view alerts generated between Monday, 2026-02-09 14:30 PST and Tuesday, 2026-02-10 21:30 PST and received an HTTP 404 Not Found error.\n**Workaround:**\nAPI users were able to set the query parameter refs=false for all endpoints that allow the refs parameter.","status":"AVAILABLE","affected_locations":[]},{"created":"2026-02-18T00:31:12+00:00","modified":"2026-02-18T18:31:39+00:00","when":"2026-02-18T00:31:12+00:00","text":"**Summary:**\nMandiant Digital Threat Monitoring customers may see HTTP 404 Not Found error when viewing alerts through the web console or API.\n**Description:**\nA temporary data event in part of our system is causing Digital Threat Monitoring alerts generated between Monday, 2026-02-09 14:30 PST and Tuesday, 2026-02-10 21:30 PST to be unavailable. When a customer attempts to view one of these alerts, they may receive an HTTP 404 Not Found error.\nOur engineering team continues to actively work to restore the availability of these alerts. At this time, the majority of the previously unavailable alerts have been restored. However, customers may still receive errors when viewing the small percentage that have not yet been restored. At this time we do not have an estimated completion for restoring the remaining alerts.\nWe will provide the next update on Wednesday, 2026-02-18 17:00 PST.\n**Customer Symptoms:**\nCustomers may be unable to view alerts generated between Monday, 2026-02-09 14:30 PST and Tuesday, 2026-02-10 21:30 PST and instead will receive an HTTP 404 Not Found error.\n**Workaround:**\nAPI users can set the query parameter refs=false for all endpoints that allow the refs parameter.\nAt this stage, there is no known workaround for viewing alert details via the UI or for other API endpoints.","status":"SERVICE_INFORMATION","affected_locations":[{"title":"Global","id":"global"}]},{"created":"2026-02-17T00:19:51+00:00","modified":"2026-02-18T00:31:12+00:00","when":"2026-02-17T00:19:51+00:00","text":"**Summary:**\nMandiant Digital Threat Monitoring customers may see HTTP 404 Not Found error when viewing alerts through the web console or API.\n**Description:**\nA temporary data event in part of our system is causing Digital Threat Monitoring alerts generated between Monday, 2026-02-09 14:30 PST and Tuesday, 2026-02-10 21:30 PST to be unavailable. When a customer attempts to view one of these alerts, they may receive an HTTP 404 Not Found error.\nOur engineering team continues to actively work to restore the availability of these alerts. At this time, the majority of the previously unavailable alerts have been restored. However, customers may still receive errors when viewing the small percentage that have not yet been restored. At this time we do not have an estimated completion for restoring the remaining alerts.\nWe will provide the next update on Tuesday, 2026-02-17 17:00 PST.\n**Customer Symptoms:**\nCustomers may be unable to view alerts generated between Monday, 2026-02-09 14:30 PST and Tuesday, 2026-02-10 21:30 PST and instead will receive an HTTP 404 Not Found error.\n**Workaround:**\nAPI users can set the query parameter refs=false for all endpoints that allow the refs parameter.\nAt this stage, there is no known workaround for viewing alert details via the UI or for other API endpoints.","status":"SERVICE_INFORMATION","affected_locations":[{"title":"Global","id":"global"}]},{"created":"2026-02-15T18:17:02+00:00","modified":"2026-02-17T00:19:51+00:00","when":"2026-02-15T18:17:02+00:00","text":"### Summary:\nMandiant Digital Threat Monitoring customers may see HTTP 404 Not Found error when viewing alerts through the web console or API.\n### Description:\nA temporary data event in part of our system is causing Digital Threat Monitoring alerts generated between Monday, 2026-02-09 14:30 PST and Tuesday, 2026-02-10 21:30 PST to be unavailable. When a customer attempts to view one of these alerts, they may receive an HTTP 404 Not Found error.\nOur engineering team continues to actively work to restore the availability of these alerts. The estimated time at which all alerts will be restored is Monday, 2026-02-16 17:00 PST.\nWe will provide the next update on Monday, 2026-02-16 17:00 PST.\n### Customer Symptoms:\nCustomers may be unable to view alerts generated between Monday, 2026-02-09 14:30 PST and Tuesday, 2026-02-10 21:30 PST and instead will receive an HTTP 404 Not Found error.\n### Workaround:\nAPI users can set the query parameter refs=false for all endpoints that allow the refs parameter.\nAt this stage, there is no known workaround for viewing alert details via the UI or for other API endpoints.","status":"SERVICE_INFORMATION","affected_locations":[{"title":"Global","id":"global"}]},{"created":"2026-02-14T19:55:24+00:00","modified":"2026-02-15T18:17:02+00:00","when":"2026-02-14T19:55:24+00:00","text":"### Summary:\nMandiant Digital Threat Monitoring customers may see HTTP 404 Not Found error when viewing alerts through the web console or API.\n### Description:\nA temporary data event in part of our system is causing Digital Threat Monitoring alerts generated between Monday, 2026-02-09 14:30 PST and Tuesday, 2026-02-10 21:30 PST to be unavailable. When a customer attempts to view one of these alerts, they may receive an HTTP 404 Not Found error.\nOur engineering team continues to actively work to restore the availability of these alerts.\nWe will provide the next update on Sunday, 2026-02-15 12:00 PST.\n### Customer Symptoms:\nCustomers may be unable to view alerts generated between Monday, 2026-02-09 14:30 PST and Tuesday, 2026-02-10 21:30 PST and instead will receive an HTTP 404 Not Found error.\n### Workaround:\nAPI users can set the query parameter refs=false for all endpoints that allow the refs parameter.\nAt this stage, there is no known workaround for viewing alert details via the UI or for other API endpoints.","status":"SERVICE_INFORMATION","affected_locations":[{"title":"Global","id":"global"}]},{"created":"2026-02-10T08:59:29+00:00","modified":"2026-02-14T20:18:42+00:00","when":"2026-02-10T08:59:29+00:00","text":"### Summary:\nMandiant Digital Threat Monitoring customers may see HTTP 404 Not Found error when viewing alerts through the web console or API.\n### Description:\nA temporary data event in part of our system is causing Digital Threat Monitoring alerts generated between Monday, 2026-02-09 14:30 PST and Tuesday, 2026-02-10 21:30 PST to be unavailable. When a customer attempts to view one of these alerts, they may receive an HTTP 404 Not Found error.\nOur engineering team continues to actively work to restore the availability of these alerts.\nWe will provide the next update on Saturday, 2026-02-14 12:00 PST.\n### Customer Symptoms:\nCustomers may be unable to view alerts generated between Monday, 2026-02-09 14:30 PST and Tuesday, 2026-02-10 21:30 PST, and instead will receive an HTTP 404 Not Found error.\n### Workaround:\nNone at this time.","status":"SERVICE_DISRUPTION","affected_locations":[{"title":"Global","id":"global"}]}],"most_recent_update":{"created":"2026-02-18T18:31:39+00:00","modified":"2026-02-18T18:31:40+00:00","when":"2026-02-18T18:31:39+00:00","text":"**Summary:**\nMandiant Digital Threat Monitoring customers may have experienced issues in receiving emails or new alerts, and may have seen HTTP 404 Not Found error when viewing alerts through the web console or API.\n**Description:**\nThe issue with Mandiant Digital Threat Monitoring has been resolved as of 2026-02-18 at 09:00 US/Pacific.\n**Customer Symptoms:**\nCustomers were unable to view alerts generated between Monday, 2026-02-09 14:30 PST and Tuesday, 2026-02-10 21:30 PST and received an HTTP 404 Not Found error.\n**Workaround:**\nAPI users were able to set the query parameter refs=false for all endpoints that allow the refs parameter.","status":"AVAILABLE","affected_locations":[]},"status_impact":"SERVICE_INFORMATION","severity":"low","service_key":"dgtVvWgKSlxi01VBC8mt","service_name":"Mandiant Digital Threat Monitoring","affected_products":[{"title":"Mandiant Digital Threat Monitoring","id":"dgtVvWgKSlxi01VBC8mt"}],"uri":"incidents/nuU89kS9ifqo12fEqPJr","currently_affected_locations":[],"previously_affected_locations":[{"title":"Global","id":"global"}]},{"id":"P7rUC1F4VZVut6M5fVJC","number":"12869950950656810848","begin":"2026-02-05T23:46:00+00:00","created":"2026-02-06T14:41:41+00:00","end":"2026-02-06T15:00:00+00:00","modified":"2026-02-06T15:04:28+00:00","external_desc":"Some Google SecOps US customers may observe ingestion and detection delay for CS_ALERTS logs.","updates":[{"created":"2026-02-06T15:04:26+00:00","modified":"2026-02-06T15:04:28+00:00","when":"2026-02-06T15:04:26+00:00","text":"**Summary**\nSome Google SecOps US customers might observe ingestion and detection delay for CS_ALERTS logs.\n**Description**\nThe issue with Google SecOps has been resolved for all affected users as of Friday, 2026-02-06 07:00 PST.\nWe thank you for your patience while we worked on resolving the issue.\n**Symptoms**\nSome Google SecOps customers might have noticed an ingestion delay for CS_ALERTS logs in the US region. There might also have been some delay in detections and alerts as a consequence of the delayed ingestion.\n**Workaround**\nNone as the issue is now resolved.","status":"AVAILABLE","affected_locations":[]},{"created":"2026-02-06T14:41:41+00:00","modified":"2026-02-06T15:04:26+00:00","when":"2026-02-06T14:41:41+00:00","text":"**Summary**\nSome Google SecOps US customers may observe ingestion and detection delay for CS_ALERTS logs.\n**Description**\nWe are experiencing an issue with Google SecOps beginning on Thursday, 2026-02-05 15:46 PST.\nOur engineering team has already identified the issue and mitigation is in progress.\nWe will provide an update by Friday, 2026-02-06 07:15 PST with current details.\nWe apologize to all who are affected by the disruption.\n**Symptoms**\nSome Google SecOps customers may have noticed an ingestion delay for CS_ALERTS logs in the US region. There may also have been some delay in detections and alerts as a consequence of the delayed ingestion.\n**Workaround**\nNone at this time.","status":"SERVICE_DISRUPTION","affected_locations":[{"title":"Multi-region: us","id":"us"}]}],"most_recent_update":{"created":"2026-02-06T15:04:26+00:00","modified":"2026-02-06T15:04:28+00:00","when":"2026-02-06T15:04:26+00:00","text":"**Summary**\nSome Google SecOps US customers might observe ingestion and detection delay for CS_ALERTS logs.\n**Description**\nThe issue with Google SecOps has been resolved for all affected users as of Friday, 2026-02-06 07:00 PST.\nWe thank you for your patience while we worked on resolving the issue.\n**Symptoms**\nSome Google SecOps customers might have noticed an ingestion delay for CS_ALERTS logs in the US region. There might also have been some delay in detections and alerts as a consequence of the delayed ingestion.\n**Workaround**\nNone as the issue is now resolved.","status":"AVAILABLE","affected_locations":[]},"status_impact":"SERVICE_DISRUPTION","severity":"medium","service_key":"FHwvkSZ6RzzDYAvDZXMM","service_name":"Google SecOps","affected_products":[{"title":"Google SecOps","id":"FHwvkSZ6RzzDYAvDZXMM"}],"uri":"incidents/P7rUC1F4VZVut6M5fVJC","currently_affected_locations":[],"previously_affected_locations":[{"title":"Multi-region: us","id":"us"}]},{"id":"6RQbu9GCPnQiVoJqHBUJ","number":"13067790619221415769","begin":"2026-02-04T19:26:00+00:00","created":"2026-02-04T21:13:37+00:00","end":"2026-02-04T23:31:00+00:00","modified":"2026-02-04T23:27:06+00:00","external_desc":"Investigating an intermittent issue with Google SecOps Gemini “Generate Query” functionality in europe-west3 and US multi-region.","updates":[{"created":"2026-02-04T23:26:59+00:00","modified":"2026-02-04T23:27:06+00:00","when":"2026-02-04T23:26:59+00:00","text":"**Summary**\nGoogle SecOps Gemini “Generate Query” functionality might have experienced elevated errors in europe-west3 and US multi-region.\n**Description**\nThe issue with Google SecOps has been resolved for all affected projects as of Wednesday, 2026-02-04 15:301 PST.\nFrom preliminary analysis, the issue was triggered due to insufficient resource configuration in the impacted regions, resulting in resource exhausted errors.\nOur engineers mitigated the issue by increasing resources. We will add retries and additional notifications in advance of resource issues in the future.\nWe thank you for your patience while we worked on resolving the issue.\n**Symptoms**\nAffected customers might have experienced “Sorry, Gemini is currently unavailable. Contact support if this persists” error message when attempting to use “Generate Query” functionality.\n**Workaround**\nThis incident is now mitigated.","status":"AVAILABLE","affected_locations":[]},{"created":"2026-02-04T22:52:54+00:00","modified":"2026-02-04T23:26:59+00:00","when":"2026-02-04T22:52:54+00:00","text":"**Summary**\nGoogle SecOps Gemini “Generate Query” functionality is experiencing elevated errors in europe-west3 and US multi-region.\n**Description**\nMitigation work is currently underway by our engineering team.\nWe do not have an ETA for mitigation at this point.\nWe will provide more information by Wednesday, 2026-02-04 15:30 PST.\n**Symptoms**\nAffected customers are experiencing “Sorry, Gemini is currently unavailable. Contact support if this persists” error message when attempting to use “Generate Query” functionality.\n**Workaround**\nCustomers can retry executing the “Generate Query” functionality.","status":"SERVICE_INFORMATION","affected_locations":[{"title":"Frankfurt (europe-west3)","id":"europe-west3"},{"title":"Multi-region: us","id":"us"}]},{"created":"2026-02-04T21:13:37+00:00","modified":"2026-02-04T22:52:54+00:00","when":"2026-02-04T21:13:37+00:00","text":"**Summary:**\nInvestigating an intermittent issue with Google SecOps Gemini “Generate Query” functionality in europe-west3 and US multi-region.\n**Description:**\nWe are experiencing an intermittent issue with Google SecOps Gemini Query generation beginning on Wednesday, 2026-02-04 11:26 PST.\nOur engineering team continues to investigate the issue.\nWe will provide more information by Wednesday, 2026-02-04 14:30 PST with current details.\n**Symptoms:**\nAffected customers are experiencing “Sorry, Gemini is currently unavailable. Contact support if this persists” error message when attempting to use “Generate Query” functionality.\n**Workaround:**\nCustomers can retry executing the “Generate Query” functionality.","status":"SERVICE_INFORMATION","affected_locations":[{"title":"Frankfurt (europe-west3)","id":"europe-west3"},{"title":"Multi-region: us","id":"us"}]}],"most_recent_update":{"created":"2026-02-04T23:26:59+00:00","modified":"2026-02-04T23:27:06+00:00","when":"2026-02-04T23:26:59+00:00","text":"**Summary**\nGoogle SecOps Gemini “Generate Query” functionality might have experienced elevated errors in europe-west3 and US multi-region.\n**Description**\nThe issue with Google SecOps has been resolved for all affected projects as of Wednesday, 2026-02-04 15:301 PST.\nFrom preliminary analysis, the issue was triggered due to insufficient resource configuration in the impacted regions, resulting in resource exhausted errors.\nOur engineers mitigated the issue by increasing resources. We will add retries and additional notifications in advance of resource issues in the future.\nWe thank you for your patience while we worked on resolving the issue.\n**Symptoms**\nAffected customers might have experienced “Sorry, Gemini is currently unavailable. Contact support if this persists” error message when attempting to use “Generate Query” functionality.\n**Workaround**\nThis incident is now mitigated.","status":"AVAILABLE","affected_locations":[]},"status_impact":"SERVICE_INFORMATION","severity":"low","service_key":"FHwvkSZ6RzzDYAvDZXMM","service_name":"Google SecOps","affected_products":[{"title":"Google SecOps","id":"FHwvkSZ6RzzDYAvDZXMM"}],"uri":"incidents/6RQbu9GCPnQiVoJqHBUJ","currently_affected_locations":[],"previously_affected_locations":[{"title":"Frankfurt (europe-west3)","id":"europe-west3"},{"title":"Multi-region: us","id":"us"}]},{"id":"JLVDftY1pzg8uCmfnPsp","number":"15253767140130474155","begin":"2026-01-28T23:29:00+00:00","created":"2026-01-29T00:15:59+00:00","end":"2026-01-29T01:15:00+00:00","modified":"2026-01-29T01:37:25+00:00","external_desc":"Mandiant Managed Defense customers may have experienced SSO login redirection issues.","updates":[{"created":"2026-01-29T01:24:50+00:00","modified":"2026-01-29T01:24:50+00:00","when":"2026-01-29T01:24:50+00:00","text":"## Summary\nMandiant Managed Defense customers may have experienced SSO login redirection issues.\n## Description\nThe issue with Mandiant Managed Defense has been resolved for all affected users as of Wednesday, 2026-01-28 17:15 PST.\nOur engineering team identified the recent incorrect configuration changes causing this and mitigated the impact by rolling back these changes.\nWe thank you for your patience while we worked on resolving the issue.\n## Customer Symptoms\nImpacted customers may have experienced Mandiant SSO logins failures to login to the following:\n* md.mandiant.com\n* advantage.mandiant.com\nMandiant Advantage Threat Intelligence, Mandiant Attack Surface Management, Mandiant Digital Threat Monitoring customers that use External Identity Federation to login may have experienced login failures.\n## Workaround\nNone at this time.","status":"AVAILABLE","affected_locations":[]},{"created":"2026-01-29T01:12:30+00:00","modified":"2026-01-29T01:24:50+00:00","when":"2026-01-29T01:12:30+00:00","text":"## Summary\nMandiant Managed Defense customers are experiencing SSO login redirection issues.\n## Description\nMitigation work is currently underway by our engineering team.\nWe do not have an ETA for mitigation at this point.\nWe will provide more information by Wednesday, 2026-01-28 18:30 PST.\n## Customer Symptoms\nImpacted customers may experience Mandiant SSO logins failures to login to the following:\n* md.mandiant.com\n* advantage.mandiant.com\nMandiant Advantage Threat Intelligence, Mandiant Attack Surface Management, Mandiant Digital Threat Monitoring customers that use External Identity Federation to login may experience login failures.\n## Workaround\nNone at this time.","status":"SERVICE_DISRUPTION","affected_locations":[{"title":"Global","id":"global"}]},{"created":"2026-01-29T00:15:59+00:00","modified":"2026-01-29T01:37:25+00:00","when":"2026-01-29T00:15:59+00:00","text":"## Summary\nMandiant Managed Defense customers are experiencing SSO login redirection issues.\n## Description\nWe are experiencing an issue with Mandiant Managed Defense beginning on Wednesday, 2026-01-28 15:29 PST.\nOur engineering team continues to investigate the issue.\nWe will provide an update by Wednesday, 2026-01-28 16:45 PST with current details.\nWe apologize to all who are affected by the disruption.\n## Customer Symptoms\nImpacted customers may experience Mandiant SSO logins failures to login to the following:\n* md.mandiant.com\n* advantage.mandiant.com\n## Workaround\nNone at this time.","status":"SERVICE_DISRUPTION","affected_locations":[{"title":"Global","id":"global"}]}],"most_recent_update":{"created":"2026-01-29T01:24:50+00:00","modified":"2026-01-29T01:24:50+00:00","when":"2026-01-29T01:24:50+00:00","text":"## Summary\nMandiant Managed Defense customers may have experienced SSO login redirection issues.\n## Description\nThe issue with Mandiant Managed Defense has been resolved for all affected users as of Wednesday, 2026-01-28 17:15 PST.\nOur engineering team identified the recent incorrect configuration changes causing this and mitigated the impact by rolling back these changes.\nWe thank you for your patience while we worked on resolving the issue.\n## Customer Symptoms\nImpacted customers may have experienced Mandiant SSO logins failures to login to the following:\n* md.mandiant.com\n* advantage.mandiant.com\nMandiant Advantage Threat Intelligence, Mandiant Attack Surface Management, Mandiant Digital Threat Monitoring customers that use External Identity Federation to login may have experienced login failures.\n## Workaround\nNone at this time.","status":"AVAILABLE","affected_locations":[]},"status_impact":"SERVICE_DISRUPTION","severity":"medium","service_key":"zall","service_name":"Multiple Products","affected_products":[{"title":"Mandiant Advantage Threat Intelligence","id":"Dvtt8cwUdpUYoGMpt2Fc"},{"title":"Mandiant Attack Surface Management","id":"v7DL2fMFnZpCxNwd8KE7"},{"title":"Mandiant Digital Threat Monitoring","id":"dgtVvWgKSlxi01VBC8mt"},{"title":"Mandiant Managed Defense","id":"9aKw9s8p43AYeBmo4Gvx"}],"uri":"incidents/JLVDftY1pzg8uCmfnPsp","currently_affected_locations":[],"previously_affected_locations":[{"title":"Global","id":"global"}]},{"id":"tSD5Tz5xEX6rfntpHV4q","number":"7675257162571177894","begin":"2026-01-19T10:07:00+00:00","created":"2026-01-19T12:25:58+00:00","end":"2026-01-19T10:24:00+00:00","modified":"2026-01-19T12:36:35+00:00","external_desc":"Google SecOps SIEM customers may have experienced unavailability of Feeds, Forwarder and Parser management pages in europe-west3 region.","updates":[{"created":"2026-01-19T12:36:32+00:00","modified":"2026-01-19T12:36:35+00:00","when":"2026-01-19T12:36:32+00:00","text":"**Description**\nThe issue with Google SecOps has been resolved for all affected users. The impact lasted between Monday, 2026-01-19 02:07 to 02:54 PST.\nWe thank you for your patience while we worked on resolving the issue.\n**Symptoms**\nCustomers may have experienced unavailability of Feeds, Forwarder and Parser management pages.\nThere was an impact on the push-based ingestion RPCs in the region for europe-west-3 during the period of time.\n**Workaround**\nThe impact is now mitigated","status":"AVAILABLE","affected_locations":[]},{"created":"2026-01-19T12:25:58+00:00","modified":"2026-01-19T12:36:32+00:00","when":"2026-01-19T12:25:58+00:00","text":"**Description**\nWe experienced an issue with Google SecOps between Monday, 2026-01-19 02:07 to 02:54 PST.\nCustomers may have experienced unavailability of Feeds, Forwarder and Parser management pages.\nThere was an impact on the push-based ingestion RPCs in the region for europe-west-3 during the period of time.\nWe will provide an update by Monday, 2026-01-19 05:00 PST with current details.\nWe apologize to all who are affected by this disruption\n**Symptoms**\nCustomers may have experienced unavailability of Feeds, Forwarder and Parser management pages.\nThere was an impact on the push-based ingestion RPCs in the region for europe-west-3 during the period of time.\n**Workaround**\nThe impact is now mitigated","status":"SERVICE_DISRUPTION","affected_locations":[{"title":"Frankfurt (europe-west3)","id":"europe-west3"}]}],"most_recent_update":{"created":"2026-01-19T12:36:32+00:00","modified":"2026-01-19T12:36:35+00:00","when":"2026-01-19T12:36:32+00:00","text":"**Description**\nThe issue with Google SecOps has been resolved for all affected users. The impact lasted between Monday, 2026-01-19 02:07 to 02:54 PST.\nWe thank you for your patience while we worked on resolving the issue.\n**Symptoms**\nCustomers may have experienced unavailability of Feeds, Forwarder and Parser management pages.\nThere was an impact on the push-based ingestion RPCs in the region for europe-west-3 during the period of time.\n**Workaround**\nThe impact is now mitigated","status":"AVAILABLE","affected_locations":[]},"status_impact":"SERVICE_DISRUPTION","severity":"medium","service_key":"FHwvkSZ6RzzDYAvDZXMM","service_name":"Google SecOps","affected_products":[{"title":"Google SecOps","id":"FHwvkSZ6RzzDYAvDZXMM"}],"uri":"incidents/tSD5Tz5xEX6rfntpHV4q","currently_affected_locations":[],"previously_affected_locations":[{"title":"Frankfurt (europe-west3)","id":"europe-west3"}]},{"id":"LmVUwo4hbpSu1xyzVAs5","number":"7030869524572864172","begin":"2026-01-15T08:00:00+00:00","created":"2026-02-11T19:03:04+00:00","end":"2026-02-17T20:58:00+00:00","modified":"2026-02-17T21:41:46+00:00","external_desc":"[Informational] Google SecOps customers may have experienced staleness with Entity Context Graph (ECG) \"first seen\" and \"last seen\" timestamps. Only “Domain”, “file hash” and “IP address” identifiers were impacted.","updates":[{"created":"2026-02-17T21:41:46+00:00","modified":"2026-02-17T21:41:46+00:00","when":"2026-02-17T21:41:46+00:00","text":"The issue with Google SecOps has been resolved for all affected customers as of Tuesday, 2025-02-17 12:58 US/Pacific.\nWe apologize to all who are affected by the disruption.\n**Customer Symptoms**\n* Any threat detection rules that used Entity Context Graph (ECG) “first seen” or “last seen” timestamps may not have found accurate recent matches.\n* Only “Domain”, “file hash” and “IP address” identifiers were impacted.\n* Any entities that were first seen before Jan 15th, their “first seen” timestamps were still accurate.\n* Displayed search results of “first seen” and “last seen” timestamps for entities may have been stale.\n**Workaround**\nA workaround was not available.","status":"AVAILABLE","affected_locations":[]},{"created":"2026-02-12T21:12:41+00:00","modified":"2026-02-17T21:41:46+00:00","when":"2026-02-12T21:12:41+00:00","text":"We are experiencing an issue with Google SecOps, beginning on Thursday, 2026-01-15.\nMitigation work is ongoing and the mitigation is expected to complete by Friday, 2026-02-20.\nThe staleness with search and display results of “first seen” and “last seen” timestamps for entities is now resolved in asia-northeast1, asia-south1, europe-west3, europe-west6, northamerica-northeast2, southamerica-east1.\nWe will provide more information by Tuesday, 2026-02-17 14:00 US/Pacific with current details.\n**Customer Symptoms**\n* Any threat detection rules that use Entity Context Graph (ECG) “first seen” or “last seen” timestamps may not have found accurate recent matches.\n* Displayed search results of “first seen” and “last seen” timestamps for entities may be stale.\n* Only “Domain”, “file hash” and “IP address” identifiers are impacted at this time.\n* Any entities that were first seen before Jan 15th, their “first seen” timestamps are still accurate.\n**Workaround**\nNone at this time.","status":"SERVICE_INFORMATION","affected_locations":[{"title":"Johannesburg (africa-south1)","id":"africa-south1"},{"title":"Tokyo (asia-northeast1)","id":"asia-northeast1"},{"title":"Mumbai (asia-south1)","id":"asia-south1"},{"title":"Singapore (asia-southeast1)","id":"asia-southeast1"},{"title":"Jakarta (asia-southeast2)","id":"asia-southeast2"},{"title":"Sydney (australia-southeast1)","id":"australia-southeast1"},{"title":"Multi-region: europe","id":"europe"},{"title":"Warsaw (europe-central2)","id":"europe-central2"},{"title":"Turin (europe-west12)","id":"europe-west12"},{"title":"London (europe-west2)","id":"europe-west2"},{"title":"Frankfurt (europe-west3)","id":"europe-west3"},{"title":"Zurich (europe-west6)","id":"europe-west6"},{"title":"Paris (europe-west9)","id":"europe-west9"},{"title":"Doha (me-central1)","id":"me-central1"},{"title":"Dammam (me-central2)","id":"me-central2"},{"title":"Tel Aviv (me-west1)","id":"me-west1"},{"title":"Toronto (northamerica-northeast2)","id":"northamerica-northeast2"},{"title":"São Paulo (southamerica-east1)","id":"southamerica-east1"},{"title":"Multi-region: us","id":"us"}]},{"created":"2026-02-12T20:22:22+00:00","modified":"2026-02-12T21:12:41+00:00","when":"2026-02-12T20:22:22+00:00","text":"We are experiencing an issue with Google SecOps, beginning on Thursday, 2026-01-15.\nMitigation work is currently underway by our engineering team.\nWe will provide more information by Thursday, 2026-02-12 16:00 US/Pacific with current details.\nWe apologize to all who are affected by the disruption.\n**Customer Symptoms**\n* Any threat detection rules that use Entity Context Graph (ECG) “first seen” or “last seen” timestamps may not have found accurate recent matches.\n* Displayed search results of “first seen” and “last seen” timestamps for entities may be stale.\n* Only “Domain”, “file hash” and “IP address” identifiers are impacted at this time.\n* Any entities that were first seen before Jan 15th, their “first seen” timestamps are still accurate.\n**Workaround**\nNone at this time.","status":"SERVICE_INFORMATION","affected_locations":[{"title":"Johannesburg (africa-south1)","id":"africa-south1"},{"title":"Tokyo (asia-northeast1)","id":"asia-northeast1"},{"title":"Mumbai (asia-south1)","id":"asia-south1"},{"title":"Singapore (asia-southeast1)","id":"asia-southeast1"},{"title":"Jakarta (asia-southeast2)","id":"asia-southeast2"},{"title":"Sydney (australia-southeast1)","id":"australia-southeast1"},{"title":"Multi-region: europe","id":"europe"},{"title":"Warsaw (europe-central2)","id":"europe-central2"},{"title":"Turin (europe-west12)","id":"europe-west12"},{"title":"London (europe-west2)","id":"europe-west2"},{"title":"Frankfurt (europe-west3)","id":"europe-west3"},{"title":"Zurich (europe-west6)","id":"europe-west6"},{"title":"Paris (europe-west9)","id":"europe-west9"},{"title":"Doha (me-central1)","id":"me-central1"},{"title":"Dammam (me-central2)","id":"me-central2"},{"title":"Tel Aviv (me-west1)","id":"me-west1"},{"title":"Toronto (northamerica-northeast2)","id":"northamerica-northeast2"},{"title":"São Paulo (southamerica-east1)","id":"southamerica-east1"},{"title":"Multi-region: us","id":"us"}]},{"created":"2026-02-11T19:03:04+00:00","modified":"2026-02-12T20:22:22+00:00","when":"2026-02-11T19:03:04+00:00","text":"We are experiencing an issue with Google SecOps, beginning on Thursday, 2026-01-15.\nMitigation work is currently underway by our engineering team.\nWe will provide more information by Thursday, 2026-02-12 12:00 US/Pacific with current details.\nWe apologize to all who are affected by the disruption.\n**Customer Symptoms**\n* Any threat detection rules that use Entity Context Graph (ECG) “first seen” or “last seen” timestamps may not have found accurate recent matches.\n* Displayed search results of “first seen” and “last seen” timestamps for entities may be stale.\n* Only “Domain”, “file hash” and “IP address” identifiers are impacted at this time.\n* Any entities that were first seen before Jan 15th, their “first seen” timestamps are still accurate.\n**Workaround**\nNone at this time.","status":"SERVICE_INFORMATION","affected_locations":[]}],"most_recent_update":{"created":"2026-02-17T21:41:46+00:00","modified":"2026-02-17T21:41:46+00:00","when":"2026-02-17T21:41:46+00:00","text":"The issue with Google SecOps has been resolved for all affected customers as of Tuesday, 2025-02-17 12:58 US/Pacific.\nWe apologize to all who are affected by the disruption.\n**Customer Symptoms**\n* Any threat detection rules that used Entity Context Graph (ECG) “first seen” or “last seen” timestamps may not have found accurate recent matches.\n* Only “Domain”, “file hash” and “IP address” identifiers were impacted.\n* Any entities that were first seen before Jan 15th, their “first seen” timestamps were still accurate.\n* Displayed search results of “first seen” and “last seen” timestamps for entities may have been stale.\n**Workaround**\nA workaround was not available.","status":"AVAILABLE","affected_locations":[]},"status_impact":"SERVICE_INFORMATION","severity":"low","service_key":"FHwvkSZ6RzzDYAvDZXMM","service_name":"Google SecOps","affected_products":[{"title":"Google SecOps","id":"FHwvkSZ6RzzDYAvDZXMM"}],"uri":"incidents/LmVUwo4hbpSu1xyzVAs5","currently_affected_locations":[],"previously_affected_locations":[{"title":"Johannesburg (africa-south1)","id":"africa-south1"},{"title":"Tokyo (asia-northeast1)","id":"asia-northeast1"},{"title":"Mumbai (asia-south1)","id":"asia-south1"},{"title":"Singapore (asia-southeast1)","id":"asia-southeast1"},{"title":"Jakarta (asia-southeast2)","id":"asia-southeast2"},{"title":"Sydney (australia-southeast1)","id":"australia-southeast1"},{"title":"Multi-region: europe","id":"europe"},{"title":"Warsaw (europe-central2)","id":"europe-central2"},{"title":"Turin (europe-west12)","id":"europe-west12"},{"title":"London (europe-west2)","id":"europe-west2"},{"title":"Frankfurt (europe-west3)","id":"europe-west3"},{"title":"Zurich (europe-west6)","id":"europe-west6"},{"title":"Paris (europe-west9)","id":"europe-west9"},{"title":"Doha (me-central1)","id":"me-central1"},{"title":"Dammam (me-central2)","id":"me-central2"},{"title":"Tel Aviv (me-west1)","id":"me-west1"},{"title":"Toronto (northamerica-northeast2)","id":"northamerica-northeast2"},{"title":"São Paulo (southamerica-east1)","id":"southamerica-east1"},{"title":"Multi-region: us","id":"us"}]},{"id":"3mmPY7ZSZdZ8BZXdzfCr","number":"15895530595853864577","begin":"2026-01-06T03:50:00+00:00","created":"2026-01-06T05:08:54+00:00","end":"2026-01-06T17:00:00+00:00","modified":"2026-01-06T18:00:46+00:00","external_desc":"Mandiant Digital Threat Monitoring customers experienced elevated 431 errors.","updates":[{"created":"2026-01-06T17:59:29+00:00","modified":"2026-01-06T18:00:38+00:00","when":"2026-01-06T17:59:29+00:00","text":"**Summary**\nMandiant Digital Threat Monitoring customers experienced elevated 431 errors.\n**Description:**\nThe issue with Mandiant Digital Threat Monitoring has been resolved for all affected users as of Tuesday, 2025-01-06 09:00 US/Pacific.\nA recent update to the underlying hosting service caused our authentication request sizes to exceed standard platform constraints. Our engineering team resolved the issue by rolling out a fix to production.\nWe thank you for your patience while we worked on resolving the issue.\n**Symptoms:**\nAffected customers may have observed 431 errors while attempting to access Mandiant Digital Threat Monitoring through the Google Threat Intelligence UI.\n**Workaround:**\nNo workaround at this time.","status":"AVAILABLE","affected_locations":[]},{"created":"2026-01-06T09:06:56+00:00","modified":"2026-01-06T17:59:29+00:00","when":"2026-01-06T09:06:56+00:00","text":"**Summary**\nMandiant Attack Surface Management and Mandiant Digital Threat Monitoring customers observing error 431.\n**Description:**\nWe are experiencing an issue with Mandiant Attack Surface Management and Mandiant Digital Threat Monitoring, beginning on Monday, 2026-01-05 19:50 PST.\nOur engineering team continues to actively investigate the root cause and is dedicated to mitigating the issue for all customers.\nWe will provide more information by Tuesday, 2026-01-06 10:00 PST with current details.\n**Symptoms:**\nThe affected customers may observe error 431 while attempting to access Mandiant Attack Surface Management and Mandiant Digital Threat Monitoring through the Google Threat Intelligence UI.\n**Workaround:**\nNo workaround is currently available. A previously suggested step to clear cookies for advantage.mandiant.com is now believed to be ineffective for most affected customers.","status":"SERVICE_DISRUPTION","affected_locations":[{"title":"Global","id":"global"}]},{"created":"2026-01-06T08:05:33+00:00","modified":"2026-01-06T09:06:56+00:00","when":"2026-01-06T08:05:33+00:00","text":"**Summary**\nMandiant Attack Surface Management and Mandiant Digital Threat Monitoring customers observing error 4xx.\n**Description:**\nWe are experiencing an issue with Mandiant Attack Surface Management and Mandiant Digital Threat Monitoring, beginning on Monday, 2026-01-05 19:50 PST.\nOur engineering team continues to actively investigate the root cause and is dedicated to mitigating the issue for all customers.\nWe will provide more information by Tuesday, 2026-01-06 02:00 PST with current details.\n**Symptoms:**\nThe affected customers may observe error 4xx while attempting to access Mandiant Attack Surface Management and Mandiant Digital Threat Monitoring through the Google Threat Intelligence UI.\n**Workaround:**\nNo workaround is currently available. A previously suggested step to clear cookies for advantage.mandiant.com is now believed to be ineffective for most affected customers.","status":"SERVICE_DISRUPTION","affected_locations":[{"title":"Global","id":"global"}]},{"created":"2026-01-06T06:08:32+00:00","modified":"2026-01-06T08:05:33+00:00","when":"2026-01-06T06:08:32+00:00","text":"**Summary**\nMandiant Attack Surface Management and Mandiant Digital Threat Monitoring customers observing error 4xx.\n**Description:**\nWe are experiencing an issue with Mandiant Attack Surface Management and Mandiant Digital Threat Monitoring, beginning on Monday, 2026-01-05 19:50 PST.\nOur engineering team continues to actively investigate this issue and is working diligently toward a full resolution for all affected customers.\nWe will provide more information by Tuesday, 2026-01-06 01:00 PST with current details.\n**Symptoms:**\nThe affected customers may observe error 4xx while attempting to access Mandiant Attack Surface Management and Mandiant Digital Threat Monitoring through the Google Threat Intelligence UI.\n**Workaround:**\nTo temporarily restore access, affected customers can clear cookies for advantage.mandiant.com. Service degradation may still be observed.","status":"SERVICE_DISRUPTION","affected_locations":[{"title":"Global","id":"global"}]},{"created":"2026-01-06T05:27:48+00:00","modified":"2026-01-06T06:08:32+00:00","when":"2026-01-06T05:27:48+00:00","text":"**Summary**\nMandiant Attack Surface Management and Mandiant Digital Threat Monitoring customers observing error 4xx.\n**Description:**\nWe are experiencing an issue with Mandiant Attack Surface Management and Mandiant Digital Threat Monitoring, beginning on Monday, 2026-01-05 19:50 PST.\nOur engineering team continues to investigate the issue.\nWe will provide more information by Monday, 2026-01-05 23:00 PST with current details.\n**Symptoms:**\nThe impacted customers may observe **error 4xx** while attempting to access Mandiant Attack Surface Management and Mandiant Digital Threat Monitoring through the UI.\n**Workaround:**\nNone at this time.","status":"SERVICE_DISRUPTION","affected_locations":[{"title":"Global","id":"global"}]},{"created":"2026-01-06T05:08:54+00:00","modified":"2026-01-06T05:27:48+00:00","when":"2026-01-06T05:08:54+00:00","text":"We are experiencing an issue with Mandiant Attack Surface Management and Mandiant Digital Threat Monitoring, beginning on Monday, 2026-01-05 19:50 PST.\nOur engineering team continues to investigate the issue.\nWe will provide more information by Monday, 2026-01-05 22:00 PST with current details.\nWe apologize to all who are affected by the disruption.","status":"SERVICE_DISRUPTION","affected_locations":[{"title":"Global","id":"global"}]}],"most_recent_update":{"created":"2026-01-06T17:59:29+00:00","modified":"2026-01-06T18:00:38+00:00","when":"2026-01-06T17:59:29+00:00","text":"**Summary**\nMandiant Digital Threat Monitoring customers experienced elevated 431 errors.\n**Description:**\nThe issue with Mandiant Digital Threat Monitoring has been resolved for all affected users as of Tuesday, 2025-01-06 09:00 US/Pacific.\nA recent update to the underlying hosting service caused our authentication request sizes to exceed standard platform constraints. Our engineering team resolved the issue by rolling out a fix to production.\nWe thank you for your patience while we worked on resolving the issue.\n**Symptoms:**\nAffected customers may have observed 431 errors while attempting to access Mandiant Digital Threat Monitoring through the Google Threat Intelligence UI.\n**Workaround:**\nNo workaround at this time.","status":"AVAILABLE","affected_locations":[]},"status_impact":"SERVICE_DISRUPTION","severity":"medium","service_key":"zall","service_name":"Multiple Products","affected_products":[{"title":"Mandiant Attack Surface Management","id":"v7DL2fMFnZpCxNwd8KE7"},{"title":"Mandiant Digital Threat Monitoring","id":"dgtVvWgKSlxi01VBC8mt"}],"uri":"incidents/3mmPY7ZSZdZ8BZXdzfCr","currently_affected_locations":[],"previously_affected_locations":[{"title":"Global","id":"global"}]},{"id":"z1qvQvb9KivF2JYSM74c","number":"2022248043115994550","begin":"2025-12-23T14:46:00+00:00","created":"2025-12-23T16:30:54+00:00","end":"2025-12-23T16:49:00+00:00","modified":"2025-12-23T17:10:54+00:00","external_desc":"Google SecOps customers are experiencing failures in search queries in europe-west2 (UK) region.","updates":[{"created":"2025-12-23T17:08:55+00:00","modified":"2025-12-23T17:10:54+00:00","when":"2025-12-23T17:08:55+00:00","text":"**Summary**\nGoogle SecOps customers were experiencing failures in search queries in europe-west2 (UK) region.\n**Description**\nThe issue with Google SecOps has been resolved for all affected users as of Tuesday, 2025-12-23 08:49 PST.\nThe degradation in search latency was driven by a single customer executing resource-heavy, complex UDM search queries leading to high FSU consumption in the europe-west2 region.\nWe thank you for your patience while we worked on resolving the issue.\n**Symptoms**\nUsers may have observed failures in search queries via both UI and API.\n**Workaround**\nNone at this time.","status":"AVAILABLE","affected_locations":[]},{"created":"2025-12-23T16:30:54+00:00","modified":"2025-12-23T17:08:55+00:00","when":"2025-12-23T16:30:54+00:00","text":"**Summary**:\nGoogle SecOps customers are experiencing failures in search queries in europe-west2 (UK) region.\n**Description:**\nWe are experiencing an issue with Google SecOps, beginning on Tuesday, 2025-12-23 06:46 PST.\nOur engineering team continues to investigate the issue.\nWe will provide more information by Tuesday, 2025-12-23 09:30 PST with details.\nWe apologize to all who are affected by the disruption.\n**Symptoms:**\nUsers will observe failures in search queries via both UI and API.\n**Workaround:**\nNone at this time.","status":"SERVICE_DISRUPTION","affected_locations":[{"title":"London (europe-west2)","id":"europe-west2"}]}],"most_recent_update":{"created":"2025-12-23T17:08:55+00:00","modified":"2025-12-23T17:10:54+00:00","when":"2025-12-23T17:08:55+00:00","text":"**Summary**\nGoogle SecOps customers were experiencing failures in search queries in europe-west2 (UK) region.\n**Description**\nThe issue with Google SecOps has been resolved for all affected users as of Tuesday, 2025-12-23 08:49 PST.\nThe degradation in search latency was driven by a single customer executing resource-heavy, complex UDM search queries leading to high FSU consumption in the europe-west2 region.\nWe thank you for your patience while we worked on resolving the issue.\n**Symptoms**\nUsers may have observed failures in search queries via both UI and API.\n**Workaround**\nNone at this time.","status":"AVAILABLE","affected_locations":[]},"status_impact":"SERVICE_INFORMATION","severity":"low","service_key":"FHwvkSZ6RzzDYAvDZXMM","service_name":"Google SecOps","affected_products":[{"title":"Google SecOps","id":"FHwvkSZ6RzzDYAvDZXMM"}],"uri":"incidents/z1qvQvb9KivF2JYSM74c","currently_affected_locations":[],"previously_affected_locations":[{"title":"London (europe-west2)","id":"europe-west2"}]},{"id":"XGGezW6TAVtLYuX8Kww4","number":"12208880840865867193","begin":"2025-12-18T08:13:00+00:00","created":"2025-12-18T21:45:41+00:00","end":"2025-12-19T01:45:00+00:00","modified":"2025-12-19T01:51:08+00:00","external_desc":"Google SecOps is experiencing an issue with the UI and API.","updates":[{"created":"2025-12-19T01:51:08+00:00","modified":"2025-12-19T01:51:08+00:00","when":"2025-12-19T01:51:08+00:00","text":"**Summary**\nThe issue with Google SecOps UI and Chronicle API has been fully mitigated for all operations in the multi-region US.\n**Description**\nThe issue with Google SecOps UI and Chronicle API in the multi-region US has been fully mitigated as of Thursday, 2025-12-18 17:45 PST.\nFrom preliminary analysis, the issue was triggered by a malformed request to the updateFeed API call, which led to the update operations being rejected.\nOur engineering team has rolled out a fix to handle the malformed request to mitigate the impact. All services, including the updateFeed operations are now fully restored and working normally.\nWe thank you for your patience while we worked on resolving this issue.\n**Symptoms**\nCustomers in the US region might have experienced 5xx error while accessing Google SecOps UI and API.\n**Workaround**\nNone at the moment.","status":"AVAILABLE","affected_locations":[]},{"created":"2025-12-19T00:57:13+00:00","modified":"2025-12-19T01:51:08+00:00","when":"2025-12-19T00:57:13+00:00","text":"**Summary**\nThe issue with Google SecOps UI and Chronicle API has been mitigated for all operations except feed update operation in the multi-region US.\n**Description**\nThe issue with Google SecOps UI and Chronicle API that began on Thursday, 2025-12-18 12:15 PST in the multi-region US has been mitigated.\nAll UI and API services are now working normally, with the exception of the Chronicle API updateFeed operation, which has been temporarily unavailable. Our engineering team continues to investigate the root cause for the feed update operation issue. We will provide an update by Thursday, 2025-12-18 18:30 PST with current details. We apologize for the inconvenience.\n**Symptoms**\nCustomers in the US region are unable to update feeds at this time.\n**Workaround**\nNone at the moment.","status":"SERVICE_DISRUPTION","affected_locations":[{"title":"Multi-region: us","id":"us"}]},{"created":"2025-12-18T22:53:32+00:00","modified":"2025-12-19T00:57:13+00:00","when":"2025-12-18T22:53:32+00:00","text":"**Summary**\nThe issue with Google SecOps UI and Chronicle API has been mitigated for all operations except feed update operation in the multi-region US.\n**Description**\nThe issue with Google SecOps UI and Chronicle API that began on Thursday, 2025-12-18 12:15 PST in the multi-region US has been mitigated.\nAll UI and API services are now working normally, with the exception of the Chronicle API updateFeed operation, which has been temporarily unavailable. Our engineering team continues to investigate the root cause for the feed update operation issue. We will provide an update by Thursday, 2025-12-18 17:00 PST with current details. We apologize for the inconvenience.\n**Symptoms**\nCustomers in the US region are unable to update feeds at this time.\n**Workaround**\nNone at the moment.","status":"SERVICE_DISRUPTION","affected_locations":[{"title":"Multi-region: us","id":"us"}]},{"created":"2025-12-18T21:45:41+00:00","modified":"2025-12-18T22:53:32+00:00","when":"2025-12-18T21:45:41+00:00","text":"**Summary**\nGoogle SecOps is experiencing an issue with the UI and API.\n**Description**\nWe are experiencing an issue with Google SecOps UI and API beginning on Thursday, 2025-12-18 00:13 PST in the multi-region US.\nOur engineering team continues to investigate the issue.\nWe will provide an update by Thursday, 2025-12-18 14:45 PST with current details.\nWe apologize to all who are affected by the disruption.\n**Symptoms**\nCustomers in the US region would encounter 5xx error while accessing Google SecOps UI and API.\n**Workaround**\nNone at the moment.","status":"SERVICE_DISRUPTION","affected_locations":[{"title":"Multi-region: us","id":"us"}]}],"most_recent_update":{"created":"2025-12-19T01:51:08+00:00","modified":"2025-12-19T01:51:08+00:00","when":"2025-12-19T01:51:08+00:00","text":"**Summary**\nThe issue with Google SecOps UI and Chronicle API has been fully mitigated for all operations in the multi-region US.\n**Description**\nThe issue with Google SecOps UI and Chronicle API in the multi-region US has been fully mitigated as of Thursday, 2025-12-18 17:45 PST.\nFrom preliminary analysis, the issue was triggered by a malformed request to the updateFeed API call, which led to the update operations being rejected.\nOur engineering team has rolled out a fix to handle the malformed request to mitigate the impact. All services, including the updateFeed operations are now fully restored and working normally.\nWe thank you for your patience while we worked on resolving this issue.\n**Symptoms**\nCustomers in the US region might have experienced 5xx error while accessing Google SecOps UI and API.\n**Workaround**\nNone at the moment.","status":"AVAILABLE","affected_locations":[]},"status_impact":"SERVICE_DISRUPTION","severity":"medium","service_key":"FHwvkSZ6RzzDYAvDZXMM","service_name":"Google SecOps","affected_products":[{"title":"Google SecOps","id":"FHwvkSZ6RzzDYAvDZXMM"}],"uri":"incidents/XGGezW6TAVtLYuX8Kww4","currently_affected_locations":[],"previously_affected_locations":[{"title":"Multi-region: us","id":"us"}]},{"id":"oaZqH4QbPwJgUySP5vcq","number":"13518099635235281154","begin":"2025-12-15T17:00:00+00:00","created":"2025-12-17T23:42:26+00:00","end":"2025-12-22T17:00:00+00:00","modified":"2026-01-06T19:53:50+00:00","external_desc":"Mandiant Digital Threat Monitoring experienced delays in processing long running operations.","updates":[{"created":"2026-01-06T19:52:28+00:00","modified":"2026-01-06T19:53:18+00:00","when":"2026-01-06T19:52:28+00:00","text":"**Summary :**\nMandiant Digital Threat Monitoring experienced delays in processing long running operations.\n**Description :**\nThe issue with Mandiant Digital Threat Monitoring has been resolved for all affected users as of Friday, 2025-12-19 13:00 PST\nThe issue was due to a combination of database performance constraints and an unexpected increase in the volume of redundant background tasks. Our engineers have mitigated the issue by optimizing our processing queues to remove redundant tasks and reprocessing the remaining backlog.\nWe thank you for your patience while we worked on resolving the issue.\n**Customer Symptoms :**\n- Impacted customers may have experienced delays in alert backfills for newly created monitors.\n- Bulk updates and bulk deletions of alerts were delayed or cancelled.\n**Workaround :**\nNone at this time.","status":"AVAILABLE","affected_locations":[]},{"created":"2025-12-20T00:45:37+00:00","modified":"2026-01-06T19:52:28+00:00","when":"2025-12-20T00:45:37+00:00","text":"**Summary :**\nMandiant Digital Threat Monitoring is experiencing delays in processing long running operations.\n**Description :**\nOur engineering team has mitigated the slow processing delays for the new jobs which are created. We are in the process of reprocessing the backlog of the jobs which were stuck in the processing.\nWe expect this to be completed by Monday, 2025-12-22 09:00 PST.\nWe will provide an update by Monday, 2025-12-22 09:30 PST with more details.\n**Customer Symptoms :**\nImpacted customers may experience delays in alert backfills for newly created monitors. Bulk updates and bulk deletions of alerts may get delayed or cancelled.\n**Workaround :**\nNone at this time.","status":"SERVICE_INFORMATION","affected_locations":[{"title":"Global","id":"global"}]},{"created":"2025-12-18T17:54:41+00:00","modified":"2025-12-20T00:45:37+00:00","when":"2025-12-18T17:54:41+00:00","text":"**Summary**\nMandiant Digital Threat Monitoring is experiencing delays in processing long running operations.\n**Description**\nWe are experiencing an issue with Mandiant Digital Threat Monitoring beginning on Monday, 2025-12-15 09:00 PST.\nOur engineers have identified a path forward and are preparing to begin to take action to address the processing delays.\nWe will provide an update by Friday, 2025-12-19 10:00 PST with current details.\nWe apologize to all who are affected by the disruption.\n**Customer Symptoms**\nImpacted customers may experience delays in alert backfills for newly created monitors.\nBulk updates and bulk deletions of alerts may get delayed or cancelled.\n**Workaround**\nNone at this time.","status":"SERVICE_INFORMATION","affected_locations":[{"title":"Global","id":"global"}]},{"created":"2025-12-17T23:42:26+00:00","modified":"2025-12-18T17:54:41+00:00","when":"2025-12-17T23:42:26+00:00","text":"**Summary**\nMandiant Digital Threat Monitoring is experiencing delays in processing long running operations.\n**Description**\nWe are experiencing an issue with Mandiant Digital Threat Monitoring beginning on Monday, 2025-12-15 09:00 PST.\nOur engineering team continues to investigate the issue.\nWe will provide an update by Thursday, 2025-12-18 10:00 PST with current details.\nWe apologize to all who are affected by the disruption.\n**Customer Symptoms**\nImpacted customers may experience delays in alert backfills for newly created monitors.\nBulk updates and bulk deletions of alerts may get delayed or cancelled.\n**Workaround**\nNone at this time.","status":"SERVICE_INFORMATION","affected_locations":[{"title":"Global","id":"global"}]}],"most_recent_update":{"created":"2026-01-06T19:52:28+00:00","modified":"2026-01-06T19:53:18+00:00","when":"2026-01-06T19:52:28+00:00","text":"**Summary :**\nMandiant Digital Threat Monitoring experienced delays in processing long running operations.\n**Description :**\nThe issue with Mandiant Digital Threat Monitoring has been resolved for all affected users as of Friday, 2025-12-19 13:00 PST\nThe issue was due to a combination of database performance constraints and an unexpected increase in the volume of redundant background tasks. Our engineers have mitigated the issue by optimizing our processing queues to remove redundant tasks and reprocessing the remaining backlog.\nWe thank you for your patience while we worked on resolving the issue.\n**Customer Symptoms :**\n- Impacted customers may have experienced delays in alert backfills for newly created monitors.\n- Bulk updates and bulk deletions of alerts were delayed or cancelled.\n**Workaround :**\nNone at this time.","status":"AVAILABLE","affected_locations":[]},"status_impact":"SERVICE_INFORMATION","severity":"low","service_key":"dgtVvWgKSlxi01VBC8mt","service_name":"Mandiant Digital Threat Monitoring","affected_products":[{"title":"Mandiant Digital Threat Monitoring","id":"dgtVvWgKSlxi01VBC8mt"}],"uri":"incidents/oaZqH4QbPwJgUySP5vcq","currently_affected_locations":[],"previously_affected_locations":[{"title":"Global","id":"global"}]},{"id":"EZh8z9EAgFavVES7r6Qp","number":"1581152920751565427","begin":"2025-12-10T22:40:00+00:00","created":"2025-12-11T01:43:11+00:00","end":"2025-12-11T02:41:00+00:00","modified":"2025-12-11T02:48:18+00:00","external_desc":"Google SecOps customers may experience delayed ingestion for cloud based data sources for V1 feeds.","updates":[{"created":"2025-12-11T02:48:18+00:00","modified":"2025-12-11T02:48:19+00:00","when":"2025-12-11T02:48:18+00:00","text":"**Summary**\nGoogle SecOps customers experienced delayed ingestion for cloud based data sources for V1 feeds\n**Description**\nThe issue with Google SecOps has been resolved for all affected projects as of Wednesday, 2025-12-10 18:41 PST.\nWe thank you for your patience while we worked on resolving the issue.\n**Customer Symptoms**\nCustomers may have noticed an ingestion delay for cloud-based V1 feeds. There may also have been some delay in detections and alerts as a consequence of the delayed ingestion.\n**Workaround**\nNone at this time.","status":"AVAILABLE","affected_locations":[]},{"created":"2025-12-11T02:21:16+00:00","modified":"2025-12-11T02:48:18+00:00","when":"2025-12-11T02:21:16+00:00","text":"**Summary**\nGoogle SecOps customers may experience delayed ingestion for cloud based data sources for V1 feeds\n**Description**\nOur engineers have identified the root cause and have a mitigation in place. For storage based feeds, we are seeing near complete recovery. Queue based feeds are still improving.\nWe will provide an update on the backlog burn by Wednesday, 2025-12-10 19:30 PST with current details.\n**Customer Symptoms**\nCustomers may notice an ingestion delay for cloud-based V1 feeds. There may also be some delay in detections and alerts as a consequence of the delayed ingestion.\n**Workaround**\nNone at this time.","status":"SERVICE_DISRUPTION","affected_locations":[{"title":"Johannesburg (africa-south1)","id":"africa-south1"},{"title":"Tokyo (asia-northeast1)","id":"asia-northeast1"},{"title":"Mumbai (asia-south1)","id":"asia-south1"},{"title":"Singapore (asia-southeast1)","id":"asia-southeast1"},{"title":"Jakarta (asia-southeast2)","id":"asia-southeast2"},{"title":"Sydney (australia-southeast1)","id":"australia-southeast1"},{"title":"Multi-region: europe","id":"europe"},{"title":"Warsaw (europe-central2)","id":"europe-central2"},{"title":"Turin (europe-west12)","id":"europe-west12"},{"title":"London (europe-west2)","id":"europe-west2"},{"title":"Frankfurt (europe-west3)","id":"europe-west3"},{"title":"Zurich (europe-west6)","id":"europe-west6"},{"title":"Paris (europe-west9)","id":"europe-west9"},{"title":"Doha (me-central1)","id":"me-central1"},{"title":"Dammam (me-central2)","id":"me-central2"},{"title":"Tel Aviv (me-west1)","id":"me-west1"},{"title":"Toronto (northamerica-northeast2)","id":"northamerica-northeast2"},{"title":"São Paulo (southamerica-east1)","id":"southamerica-east1"},{"title":"Multi-region: us","id":"us"}]},{"created":"2025-12-11T01:43:11+00:00","modified":"2025-12-11T02:21:16+00:00","when":"2025-12-11T01:43:11+00:00","text":"**Summary**\nGoogle SecOps customers may experience delayed ingestion for cloud based data sources for V1 feeds\n**Description**\nWe are experiencing an issue with Google SecOps beginning on Wednesday, 2025-12-10 14:40 PST.\nOur engineering team continues to investigate the issue.\nWe will provide an update by Wednesday, 2025-12-10 18:30 PST with current details.\nWe apologize to all who are affected by the disruption.\n**Customer Symptoms**\nCustomers may notice an ingestion delay for cloud-based V1 feeds. There may also be some delay in detections and alerts as a consequence of the delayed ingestion.\n**Workaround**\nNone at this time.","status":"SERVICE_DISRUPTION","affected_locations":[]}],"most_recent_update":{"created":"2025-12-11T02:48:18+00:00","modified":"2025-12-11T02:48:19+00:00","when":"2025-12-11T02:48:18+00:00","text":"**Summary**\nGoogle SecOps customers experienced delayed ingestion for cloud based data sources for V1 feeds\n**Description**\nThe issue with Google SecOps has been resolved for all affected projects as of Wednesday, 2025-12-10 18:41 PST.\nWe thank you for your patience while we worked on resolving the issue.\n**Customer Symptoms**\nCustomers may have noticed an ingestion delay for cloud-based V1 feeds. There may also have been some delay in detections and alerts as a consequence of the delayed ingestion.\n**Workaround**\nNone at this time.","status":"AVAILABLE","affected_locations":[]},"status_impact":"SERVICE_DISRUPTION","severity":"medium","service_key":"FHwvkSZ6RzzDYAvDZXMM","service_name":"Google SecOps","affected_products":[{"title":"Google SecOps","id":"FHwvkSZ6RzzDYAvDZXMM"}],"uri":"incidents/EZh8z9EAgFavVES7r6Qp","currently_affected_locations":[],"previously_affected_locations":[{"title":"Johannesburg (africa-south1)","id":"africa-south1"},{"title":"Tokyo (asia-northeast1)","id":"asia-northeast1"},{"title":"Mumbai (asia-south1)","id":"asia-south1"},{"title":"Singapore (asia-southeast1)","id":"asia-southeast1"},{"title":"Jakarta (asia-southeast2)","id":"asia-southeast2"},{"title":"Sydney (australia-southeast1)","id":"australia-southeast1"},{"title":"Multi-region: europe","id":"europe"},{"title":"Warsaw (europe-central2)","id":"europe-central2"},{"title":"Turin (europe-west12)","id":"europe-west12"},{"title":"London (europe-west2)","id":"europe-west2"},{"title":"Frankfurt (europe-west3)","id":"europe-west3"},{"title":"Zurich (europe-west6)","id":"europe-west6"},{"title":"Paris (europe-west9)","id":"europe-west9"},{"title":"Doha (me-central1)","id":"me-central1"},{"title":"Dammam (me-central2)","id":"me-central2"},{"title":"Tel Aviv (me-west1)","id":"me-west1"},{"title":"Toronto (northamerica-northeast2)","id":"northamerica-northeast2"},{"title":"São Paulo (southamerica-east1)","id":"southamerica-east1"},{"title":"Multi-region: us","id":"us"}]},{"id":"ejDTAuB7k92Rq5CZ4j5A","number":"8294257220181135469","begin":"2025-12-09T16:51:00+00:00","created":"2025-12-09T18:52:55+00:00","end":"2025-12-10T05:54:00+00:00","modified":"2025-12-10T06:01:23+00:00","external_desc":"Google SecOps customers may experience delayed ingestion for Workspace data via native integration.","updates":[{"created":"2025-12-10T06:00:56+00:00","modified":"2025-12-10T06:01:23+00:00","when":"2025-12-10T06:00:56+00:00","text":"**Summary :** Google SecOps customers experienced delayed ingestion for Workspace data via native integration.\n**Description :**\nThe issue with Google SecOps has been resolved for all affected users as of Tuesday, 2025-12-09 21:54 PT.\nOur engineering team has root caused and applied a stable mitigation. The native workspace ingestion is active now and the ingestion backlog is cleared as well.\nWe thank you for your patience while we worked on resolving the issue.\n**Customer Symptoms :**\nThe impacted Google SecOps customers experienced delayed ingestion for Workspace data via native integration. The Workspace data through API based ingestion was not impacted.\n**Workaround :**\nNone as the issue stands resolved","status":"AVAILABLE","affected_locations":[]},{"created":"2025-12-10T04:45:12+00:00","modified":"2025-12-10T06:00:56+00:00","when":"2025-12-10T04:45:12+00:00","text":"**Summary :** Google SecOps customers may experience delayed ingestion for Workspace data via native integration.\n**Description :**\nOur engineering team has root caused and applied a stable mitigation. The native workspace ingestion feed is active now and data ingestion has resumed. Customers may still notice delays in new arriving data as we work through our backlog.\nWe have scaled up the backlog burn rate. The projected ETA for completing the backfill is Wednesday, 2025-12-10 03:30 PST.\nWe will provide an update by Wednesday, 2025-12-10 04:00 PST with current details.\n**Customer Symptoms :**\nThe impacted Google SecOps customers may experience delayed ingestion for Workspace data via native integration. The Workspace data through API based ingestion is not impacted.\n**Workaround :**\nFor immediate ingestion of WORKSPACE_ACTIVITY data one can create a Third Party API feed for WORKSPACE_ACTIVITY in parallel. https://docs.cloud.google.com/chronicle/docs/reference/feed-management-api#workspace-activity","status":"SERVICE_INFORMATION","affected_locations":[{"title":"Tokyo (asia-northeast1)","id":"asia-northeast1"},{"title":"Mumbai (asia-south1)","id":"asia-south1"},{"title":"Singapore (asia-southeast1)","id":"asia-southeast1"},{"title":"Jakarta (asia-southeast2)","id":"asia-southeast2"},{"title":"Sydney (australia-southeast1)","id":"australia-southeast1"},{"title":"Multi-region: europe","id":"europe"},{"title":"Doha (me-central1)","id":"me-central1"},{"title":"Dammam (me-central2)","id":"me-central2"},{"title":"Tel Aviv (me-west1)","id":"me-west1"},{"title":"Toronto (northamerica-northeast2)","id":"northamerica-northeast2"},{"title":"São Paulo (southamerica-east1)","id":"southamerica-east1"},{"title":"Multi-region: us","id":"us"}]},{"created":"2025-12-10T03:05:00+00:00","modified":"2025-12-10T04:45:12+00:00","when":"2025-12-10T03:05:00+00:00","text":"**Summary :** Google SecOps customers may experience delayed ingestion for Workspace data via native integration.\n**Description :**\nOur engineering team has root caused and applied a stable mitigation. The native workspace ingestion feed is active now and data ingestion has resumed. Customers may still notice delays in new arriving data as we work through our backlog.\nWe are working on scaling up the backlog burn rate and we will provide the ETA for completing the backfill by Tuesday, 2025-12-09 21:00 PST.\n**Customer Symptoms :**\nThe impacted Google SecOps customers may experience delayed ingestion for Workspace data via native integration. The Workspace data through API based ingestion is not impacted.\n**Workaround :**\nFor immediate ingestion of WORKSPACE_ACTIVITY data one can create a Third Party API feed for WORKSPACE_ACTIVITY in parallel. https://docs.cloud.google.com/chronicle/docs/reference/feed-management-api#workspace-activity","status":"SERVICE_INFORMATION","affected_locations":[{"title":"Tokyo (asia-northeast1)","id":"asia-northeast1"},{"title":"Mumbai (asia-south1)","id":"asia-south1"},{"title":"Singapore (asia-southeast1)","id":"asia-southeast1"},{"title":"Jakarta (asia-southeast2)","id":"asia-southeast2"},{"title":"Sydney (australia-southeast1)","id":"australia-southeast1"},{"title":"Multi-region: europe","id":"europe"},{"title":"Doha (me-central1)","id":"me-central1"},{"title":"Dammam (me-central2)","id":"me-central2"},{"title":"Tel Aviv (me-west1)","id":"me-west1"},{"title":"Toronto (northamerica-northeast2)","id":"northamerica-northeast2"},{"title":"São Paulo (southamerica-east1)","id":"southamerica-east1"},{"title":"Multi-region: us","id":"us"}]},{"created":"2025-12-10T02:03:35+00:00","modified":"2025-12-10T03:05:00+00:00","when":"2025-12-10T02:03:35+00:00","text":"**Summary :** Google SecOps customers may experience delayed ingestion for Workspace data via native integration.\n**Description :**\nOur engineering team is actively investigating the root cause while continuing to work on mitigating the issue.\nWe will provide an update by Tuesday, 2025-12-09 20:15 PST with current details.\n**Customer Symptoms :**\nThe impacted Google SecOps customers may experience delayed ingestion for Workspace data via native integration. The Workspace data through API based ingestion is not impacted.\n**Workaround :**\nFor immediate ingestion of WORKSPACE_ACTIVITY data one can create a Third Party API feed for WORKSPACE_ACTIVITY in parallel. https://docs.cloud.google.com/chronicle/docs/reference/feed-management-api#workspace-activity","status":"SERVICE_INFORMATION","affected_locations":[{"title":"Tokyo (asia-northeast1)","id":"asia-northeast1"},{"title":"Mumbai (asia-south1)","id":"asia-south1"},{"title":"Singapore (asia-southeast1)","id":"asia-southeast1"},{"title":"Jakarta (asia-southeast2)","id":"asia-southeast2"},{"title":"Sydney (australia-southeast1)","id":"australia-southeast1"},{"title":"Multi-region: europe","id":"europe"},{"title":"Doha (me-central1)","id":"me-central1"},{"title":"Dammam (me-central2)","id":"me-central2"},{"title":"Tel Aviv (me-west1)","id":"me-west1"},{"title":"Toronto (northamerica-northeast2)","id":"northamerica-northeast2"},{"title":"São Paulo (southamerica-east1)","id":"southamerica-east1"},{"title":"Multi-region: us","id":"us"}]},{"created":"2025-12-09T21:57:14+00:00","modified":"2025-12-10T02:03:35+00:00","when":"2025-12-09T21:57:14+00:00","text":"**Summary :** Google SecOps customers may experience delayed ingestion for Workspace data via native integration.\n**Description :**\nMitigation work is currently underway by our engineering team.\nWe will provide an update by Tuesday, 2025-12-09 18:15 PST with current details.\n**Customer Symptoms :**\nThe impacted Google SecOps customers may experience delayed ingestion for Workspace data via native integration. The Workspace data through API based ingestion is not impacted.\n**Workaround :**\nFor immediate ingestion of WORKSPACE_ACTIVITY data one can create a Third Party API feed for WORKSPACE_ACTIVITY in parallel.\nhttps://docs.cloud.google.com/chronicle/docs/reference/feed-management-api#workspace-activity","status":"SERVICE_INFORMATION","affected_locations":[{"title":"Tokyo (asia-northeast1)","id":"asia-northeast1"},{"title":"Mumbai (asia-south1)","id":"asia-south1"},{"title":"Singapore (asia-southeast1)","id":"asia-southeast1"},{"title":"Jakarta (asia-southeast2)","id":"asia-southeast2"},{"title":"Sydney (australia-southeast1)","id":"australia-southeast1"},{"title":"Multi-region: europe","id":"europe"},{"title":"Doha (me-central1)","id":"me-central1"},{"title":"Dammam (me-central2)","id":"me-central2"},{"title":"Tel Aviv (me-west1)","id":"me-west1"},{"title":"Toronto (northamerica-northeast2)","id":"northamerica-northeast2"},{"title":"São Paulo (southamerica-east1)","id":"southamerica-east1"},{"title":"Multi-region: us","id":"us"}]},{"created":"2025-12-09T20:27:46+00:00","modified":"2025-12-09T21:57:14+00:00","when":"2025-12-09T20:27:46+00:00","text":"**Summary :** Google SecOps customers may experience delayed ingestion for Workspace data via native integration.\n**Description :**\nWe are experiencing an issue with Google SecOps beginning on Tuesday, 2025-12-09 08:51 PST.\nOur engineering team continues to investigate the issue.\nWe will provide an update by Tuesday, 2025-12-09 14:00 PST with current details.\nWe apologize to all who are affected by the disruption.\n**Customer Symptoms :**\nThe impacted Google SecOps customers may experience delayed ingestion for Workspace data via native integration. The Workspace data through API based ingestion is not impacted.\n**Workaround :**\nNone at this time.","status":"SERVICE_INFORMATION","affected_locations":[{"title":"Tokyo (asia-northeast1)","id":"asia-northeast1"},{"title":"Mumbai (asia-south1)","id":"asia-south1"},{"title":"Singapore (asia-southeast1)","id":"asia-southeast1"},{"title":"Jakarta (asia-southeast2)","id":"asia-southeast2"},{"title":"Sydney (australia-southeast1)","id":"australia-southeast1"},{"title":"Multi-region: europe","id":"europe"},{"title":"Doha (me-central1)","id":"me-central1"},{"title":"Dammam (me-central2)","id":"me-central2"},{"title":"Tel Aviv (me-west1)","id":"me-west1"},{"title":"Toronto (northamerica-northeast2)","id":"northamerica-northeast2"},{"title":"São Paulo (southamerica-east1)","id":"southamerica-east1"},{"title":"Multi-region: us","id":"us"}]},{"created":"2025-12-09T19:11:02+00:00","modified":"2025-12-09T20:27:46+00:00","when":"2025-12-09T19:11:02+00:00","text":"**Summary :** Google SecOps customers may experience delayed ingestion for Workspace data via native integration.\n**Description :**\nWe are experiencing an issue with Google SecOps beginning on Tuesday, 2025-12-09 08:51 PST.\nOur engineering team continues to investigate the issue.\nWe will provide an update by Tuesday, 2025-12-09 12:30 PST with current details.\nWe apologize to all who are affected by the disruption.\n**Customer Symptoms :**\nThe impacted Google SecOps customers may experience delayed ingestion for Workspace data via native integration. The Workspace data through API based ingestion is not impacted.\n**Workaround :**\nNone at this time.","status":"SERVICE_INFORMATION","affected_locations":[{"title":"Tokyo (asia-northeast1)","id":"asia-northeast1"},{"title":"Mumbai (asia-south1)","id":"asia-south1"},{"title":"Singapore (asia-southeast1)","id":"asia-southeast1"},{"title":"Jakarta (asia-southeast2)","id":"asia-southeast2"},{"title":"Sydney (australia-southeast1)","id":"australia-southeast1"},{"title":"Multi-region: europe","id":"europe"},{"title":"Doha (me-central1)","id":"me-central1"},{"title":"Dammam (me-central2)","id":"me-central2"},{"title":"Tel Aviv (me-west1)","id":"me-west1"},{"title":"Toronto (northamerica-northeast2)","id":"northamerica-northeast2"},{"title":"São Paulo (southamerica-east1)","id":"southamerica-east1"},{"title":"Multi-region: us","id":"us"}]},{"created":"2025-12-09T18:52:55+00:00","modified":"2025-12-09T19:11:02+00:00","when":"2025-12-09T18:52:55+00:00","text":"**Summary :** Google SecOps customers may experience delayed ingestion for Workspace data via native integration.\n**Description :**\nWe are experiencing an issue with Google SecOps beginning on Tuesday, 2025-12-09 08:51 PST.\nOur engineering team continues to investigate the issue.\nWe will provide an update by Tuesday, 2025-12-09 11:15 PST with current details.\nWe apologize to all who are affected by the disruption.\n**Customer Symptoms :**\nThe impacted Google SecOps customers may experience delayed ingestion for Workspace data via native integration. The Workspace data through API based ingestion is not impacted.\n**Workaround :**\nNone at this time.","status":"SERVICE_INFORMATION","affected_locations":[{"title":"Tokyo (asia-northeast1)","id":"asia-northeast1"},{"title":"Mumbai (asia-south1)","id":"asia-south1"},{"title":"Singapore (asia-southeast1)","id":"asia-southeast1"},{"title":"Jakarta (asia-southeast2)","id":"asia-southeast2"},{"title":"Sydney (australia-southeast1)","id":"australia-southeast1"},{"title":"Multi-region: europe","id":"europe"},{"title":"Doha (me-central1)","id":"me-central1"},{"title":"Dammam (me-central2)","id":"me-central2"},{"title":"Tel Aviv (me-west1)","id":"me-west1"},{"title":"Toronto (northamerica-northeast2)","id":"northamerica-northeast2"},{"title":"São Paulo (southamerica-east1)","id":"southamerica-east1"},{"title":"Multi-region: us","id":"us"}]}],"most_recent_update":{"created":"2025-12-10T06:00:56+00:00","modified":"2025-12-10T06:01:23+00:00","when":"2025-12-10T06:00:56+00:00","text":"**Summary :** Google SecOps customers experienced delayed ingestion for Workspace data via native integration.\n**Description :**\nThe issue with Google SecOps has been resolved for all affected users as of Tuesday, 2025-12-09 21:54 PT.\nOur engineering team has root caused and applied a stable mitigation. The native workspace ingestion is active now and the ingestion backlog is cleared as well.\nWe thank you for your patience while we worked on resolving the issue.\n**Customer Symptoms :**\nThe impacted Google SecOps customers experienced delayed ingestion for Workspace data via native integration. The Workspace data through API based ingestion was not impacted.\n**Workaround :**\nNone as the issue stands resolved","status":"AVAILABLE","affected_locations":[]},"status_impact":"SERVICE_INFORMATION","severity":"low","service_key":"FHwvkSZ6RzzDYAvDZXMM","service_name":"Google SecOps","affected_products":[{"title":"Google SecOps","id":"FHwvkSZ6RzzDYAvDZXMM"}],"uri":"incidents/ejDTAuB7k92Rq5CZ4j5A","currently_affected_locations":[],"previously_affected_locations":[{"title":"Tokyo (asia-northeast1)","id":"asia-northeast1"},{"title":"Mumbai (asia-south1)","id":"asia-south1"},{"title":"Singapore (asia-southeast1)","id":"asia-southeast1"},{"title":"Jakarta (asia-southeast2)","id":"asia-southeast2"},{"title":"Sydney (australia-southeast1)","id":"australia-southeast1"},{"title":"Multi-region: europe","id":"europe"},{"title":"Doha (me-central1)","id":"me-central1"},{"title":"Dammam (me-central2)","id":"me-central2"},{"title":"Tel Aviv (me-west1)","id":"me-west1"},{"title":"Toronto (northamerica-northeast2)","id":"northamerica-northeast2"},{"title":"São Paulo (southamerica-east1)","id":"southamerica-east1"},{"title":"Multi-region: us","id":"us"}]},{"id":"kWKB2qnWpPpvogWyHwE4","number":"1371833875726655340","begin":"2025-11-17T04:27:00+00:00","created":"2025-11-17T05:50:14+00:00","end":"2025-11-17T05:38:00+00:00","modified":"2025-11-17T06:07:42+00:00","external_desc":"[Mitigated] Google SecOps customers were experiencing failures in programmatic access of udmSearch API in multiple regions.","updates":[{"created":"2025-11-17T05:56:26+00:00","modified":"2025-11-17T05:57:30+00:00","when":"2025-11-17T05:56:26+00:00","text":"**Summary:**\n[Mitigated] Google SecOps customers were experiencing failures in programmatic access of udmSearch API in multiple regions.\n**Description**\nThe issue with Google SecOps has been resolved for all affected users as of Sunday, 2025-11-16 21:38 PST.\nThis issue was due to a configuration change. Our engineers have mitigated the issue by rolling back the configuration to the previous version.\nWe thank you for your patience while we worked on resolving the issue.\n**Symptoms**\nThe customers in the impacted regions might have observed failures during programmatic access of udmSearch API.\n**Workaround**\nNone at this time.","status":"AVAILABLE","affected_locations":[]},{"created":"2025-11-17T05:50:14+00:00","modified":"2025-11-17T06:07:42+00:00","when":"2025-11-17T05:50:14+00:00","text":"**Summary:**\nGoogle SecOps customers are experiencing failures in programmatic access of udmSearch API in multiple regions.\n**Description**\nWe are experiencing an issue with Google SecOps, beginning on Sunday, 2025-11-16 20:27 PST.\nOur engineering team continues to investigate the issue.\nWe will provide more information by Sunday, 2025-11-16 22:30 PST with current details.\nWe apologize to all who are affected by the disruption.\n**Symptoms**\nThe customers in the impacted regions may observe failures during programmatic access of udmSearch API.\n**Workaround**\nNone at this time.","status":"SERVICE_DISRUPTION","affected_locations":[{"title":"Tokyo (asia-northeast1)","id":"asia-northeast1"},{"title":"Singapore (asia-southeast1)","id":"asia-southeast1"},{"title":"Sydney (australia-southeast1)","id":"australia-southeast1"},{"title":"Frankfurt (europe-west3)","id":"europe-west3"},{"title":"Zurich (europe-west6)","id":"europe-west6"},{"title":"Toronto (northamerica-northeast2)","id":"northamerica-northeast2"},{"title":"São Paulo (southamerica-east1)","id":"southamerica-east1"}]}],"most_recent_update":{"created":"2025-11-17T05:56:26+00:00","modified":"2025-11-17T05:57:30+00:00","when":"2025-11-17T05:56:26+00:00","text":"**Summary:**\n[Mitigated] Google SecOps customers were experiencing failures in programmatic access of udmSearch API in multiple regions.\n**Description**\nThe issue with Google SecOps has been resolved for all affected users as of Sunday, 2025-11-16 21:38 PST.\nThis issue was due to a configuration change. Our engineers have mitigated the issue by rolling back the configuration to the previous version.\nWe thank you for your patience while we worked on resolving the issue.\n**Symptoms**\nThe customers in the impacted regions might have observed failures during programmatic access of udmSearch API.\n**Workaround**\nNone at this time.","status":"AVAILABLE","affected_locations":[]},"status_impact":"SERVICE_DISRUPTION","severity":"medium","service_key":"FHwvkSZ6RzzDYAvDZXMM","service_name":"Google SecOps","affected_products":[{"title":"Google SecOps","id":"FHwvkSZ6RzzDYAvDZXMM"}],"uri":"incidents/kWKB2qnWpPpvogWyHwE4","currently_affected_locations":[],"previously_affected_locations":[{"title":"Tokyo (asia-northeast1)","id":"asia-northeast1"},{"title":"Singapore (asia-southeast1)","id":"asia-southeast1"},{"title":"Sydney (australia-southeast1)","id":"australia-southeast1"},{"title":"Frankfurt (europe-west3)","id":"europe-west3"},{"title":"Zurich (europe-west6)","id":"europe-west6"},{"title":"Toronto (northamerica-northeast2)","id":"northamerica-northeast2"},{"title":"São Paulo (southamerica-east1)","id":"southamerica-east1"}]},{"id":"ADpMn2nYWFLnAJyRkFrf","number":"3432521768427260599","begin":"2025-11-06T23:00:00+00:00","created":"2025-11-14T20:17:12+00:00","end":"2025-11-15T23:17:00+00:00","modified":"2025-11-15T23:33:04+00:00","external_desc":"Delay in processing single event rules in few regions","updates":[{"created":"2025-11-15T23:32:13+00:00","modified":"2025-11-15T23:33:04+00:00","when":"2025-11-15T23:32:13+00:00","text":"**Summary**\nWe have mitigated an issue related to the missed processing of single event rules.\n**Description**\nThe issue with Google SecOps, where single event rule processing was missed for some regions, has been resolved for all affected users as of Saturday, 2025-11-15 at 15:17.\nWe have successfully completed rule reprocessing between event time Thursday, 2025-11-06 15:00 PST and Friday, 2025-11-14 13:00 PST, that were previously affected by this issue.\nFrom preliminary analysis, the incident was triggered by a configuration issue that resulted in an insufficient amount of jobs to process rules.\nWe thank you for your patience while we worked on resolving the issue.\n**Symptoms**\nCustomers may have observed a delay affecting single event rules that were processed between Thursday, 2025-11-06 15:00 PST and Friday, 2025-11-14 13:00 PST.\n**Workaround**\nThe issue is now mitigated.","status":"AVAILABLE","affected_locations":[]},{"created":"2025-11-14T22:49:18+00:00","modified":"2025-11-15T23:32:13+00:00","when":"2025-11-14T22:49:18+00:00","text":"**Summary**\nMissed processing single event rules for a few regions\n**Description**\nWe are experiencing an issue with Google SecOps. Single event rule processing was missed for some regions, beginning on Thursday, 2025-11-06 at 15:00 PST.\nOur engineering team has identified and successfully mitigated the underlying issue. Single event rule processing after Friday, 2025-11-14 at 13:00 PST has resumed and will not be missed.\nWe will continue to work on reprocessing rules between Thursday, 2025-11-06 15:00 PST and Friday, 2025-11-14 13:00 PST, that were previously affected by this issue.\nWe will provide an update by Saturday, 2025-11-15 15:00 PST with details.\n**Symptoms**\nCustomers may observe a delay in processing single event rules that were processed between Thursday, 2025-11-06 15:00 PST and Friday, 2025-11-14 13:00 PST.\n**Workaround**\nCustomers can run retrohunts on specific rules as a workaround.","status":"SERVICE_DISRUPTION","affected_locations":[{"title":"Tokyo (asia-northeast1)","id":"asia-northeast1"},{"title":"Mumbai (asia-south1)","id":"asia-south1"},{"title":"Zurich (europe-west6)","id":"europe-west6"},{"title":"Toronto (northamerica-northeast2)","id":"northamerica-northeast2"}]},{"created":"2025-11-14T20:17:12+00:00","modified":"2025-11-14T22:49:18+00:00","when":"2025-11-14T20:17:12+00:00","text":"**Summary :** Delay in processing single event rules in few regions\n**Description :**\nWe are experiencing an issue with Google SecOps, while processing single event rules within certain regions, beginning on Thursday, 2025-11-06 at 18:03 PST.\nOur engineering team continues to investigate the issue. We will provide an update by Friday, 2025-11-14 14:00 PST with current details.\nWe apologize to all who are affected by the disruption.\n**Customer Symptoms :**\nCustomers may notice a delay in processing single event rules and see higher than usual detection latency.\n**Workaround :**\nCustomers can run retrohunts on specific rules as a workaround.","status":"SERVICE_DISRUPTION","affected_locations":[{"title":"Tokyo (asia-northeast1)","id":"asia-northeast1"},{"title":"Mumbai (asia-south1)","id":"asia-south1"},{"title":"Sydney (australia-southeast1)","id":"australia-southeast1"},{"title":"Frankfurt (europe-west3)","id":"europe-west3"},{"title":"Zurich (europe-west6)","id":"europe-west6"},{"title":"Toronto (northamerica-northeast2)","id":"northamerica-northeast2"},{"title":"São Paulo (southamerica-east1)","id":"southamerica-east1"}]}],"most_recent_update":{"created":"2025-11-15T23:32:13+00:00","modified":"2025-11-15T23:33:04+00:00","when":"2025-11-15T23:32:13+00:00","text":"**Summary**\nWe have mitigated an issue related to the missed processing of single event rules.\n**Description**\nThe issue with Google SecOps, where single event rule processing was missed for some regions, has been resolved for all affected users as of Saturday, 2025-11-15 at 15:17.\nWe have successfully completed rule reprocessing between event time Thursday, 2025-11-06 15:00 PST and Friday, 2025-11-14 13:00 PST, that were previously affected by this issue.\nFrom preliminary analysis, the incident was triggered by a configuration issue that resulted in an insufficient amount of jobs to process rules.\nWe thank you for your patience while we worked on resolving the issue.\n**Symptoms**\nCustomers may have observed a delay affecting single event rules that were processed between Thursday, 2025-11-06 15:00 PST and Friday, 2025-11-14 13:00 PST.\n**Workaround**\nThe issue is now mitigated.","status":"AVAILABLE","affected_locations":[]},"status_impact":"SERVICE_DISRUPTION","severity":"medium","service_key":"FHwvkSZ6RzzDYAvDZXMM","service_name":"Google SecOps","affected_products":[{"title":"Google SecOps","id":"FHwvkSZ6RzzDYAvDZXMM"}],"uri":"incidents/ADpMn2nYWFLnAJyRkFrf","currently_affected_locations":[],"previously_affected_locations":[{"title":"Tokyo (asia-northeast1)","id":"asia-northeast1"},{"title":"Mumbai (asia-south1)","id":"asia-south1"},{"title":"Zurich (europe-west6)","id":"europe-west6"},{"title":"Toronto (northamerica-northeast2)","id":"northamerica-northeast2"}]},{"id":"7WCNAQPiBAxm2cCq3rBX","number":"14716511421744837992","begin":"2025-10-30T17:00:00+00:00","created":"2025-10-30T23:51:40+00:00","end":"2025-11-07T23:00:00+00:00","modified":"2025-11-08T01:07:06+00:00","external_desc":"Some Google SecOps customers are experiencing delay in detections for Applied Threat Intelligence - Curated Prioritization rule sets.","updates":[{"created":"2025-11-08T01:06:24+00:00","modified":"2025-11-08T01:07:06+00:00","when":"2025-11-08T01:06:24+00:00","text":"**Summary**\nSome Google SecOps customers may have experienced delay in detections for Applied Threat Intelligence - Curated Prioritization rule sets.\n**Description**\nApplied Threat Intelligence - Curated Prioritization rule sets were inadvertently disabled due to defective code. The defective code has been remediated.\nWe restored the prior ‘enabled status’ and ‘alerting status’ of these rules. Reprocessing of these rules has now completed successfully.\nWe thank you for your patience while we worked on resolving the issue.","status":"AVAILABLE","affected_locations":[]},{"created":"2025-11-01T01:10:20+00:00","modified":"2025-11-08T01:06:24+00:00","when":"2025-11-01T01:10:20+00:00","text":"**Summary**\nSome Google SecOps customers experienced delay in detections for Applied Threat Intelligence - Curated Prioritization rule sets.\n**Description**\nApplied Threat Intelligence - Curated Prioritization rule sets were inadvertently disabled due to defective code. The defective code has been remediated.\nWe have restored the prior ‘enabled status’ and ‘alerting status’ of these rules. Reprocessing of these rules has also commenced and we expect this to take up to a week.\nIf you have updated your rule configuration in the interim, reprocessed events will adhere to your new configuration.\nWe will provide more information on the status of the reprocessing by Friday, 2025-11-07 17:00 PST with current details.\n**Customer Symptoms** N/A\n**Workaround**\nN/A","status":"SERVICE_DISRUPTION","affected_locations":[{"title":"Johannesburg (africa-south1)","id":"africa-south1"},{"title":"Tokyo (asia-northeast1)","id":"asia-northeast1"},{"title":"Mumbai (asia-south1)","id":"asia-south1"},{"title":"Singapore (asia-southeast1)","id":"asia-southeast1"},{"title":"Jakarta (asia-southeast2)","id":"asia-southeast2"},{"title":"Sydney (australia-southeast1)","id":"australia-southeast1"},{"title":"Multi-region: europe","id":"europe"},{"title":"Turin (europe-west12)","id":"europe-west12"},{"title":"London (europe-west2)","id":"europe-west2"},{"title":"Frankfurt (europe-west3)","id":"europe-west3"},{"title":"Zurich (europe-west6)","id":"europe-west6"},{"title":"Paris (europe-west9)","id":"europe-west9"},{"title":"Doha (me-central1)","id":"me-central1"},{"title":"Dammam (me-central2)","id":"me-central2"},{"title":"Tel Aviv (me-west1)","id":"me-west1"},{"title":"Toronto (northamerica-northeast2)","id":"northamerica-northeast2"},{"title":"São Paulo (southamerica-east1)","id":"southamerica-east1"},{"title":"Multi-region: us","id":"us"}]},{"created":"2025-11-01T00:14:29+00:00","modified":"2025-11-01T01:10:20+00:00","when":"2025-11-01T00:14:29+00:00","text":"**Summary**\nSome Google SecOps customers are experiencing delay in detections for Applied Threat Intelligence - Curated Prioritization rule sets.\n**Description**\nApplied Threat Intelligence - Curated Prioritization rule sets were inadvertently disabled due to defective code. The defective code has been remediated.\nWe are working to restore the prior ‘enabled status’ and ‘alerting status’ of these rules and anticipate that restoration to be completed sometime Friday, 2025-10-31.\nIn the meantime as a work around, customers can re-enable the rules manually to restore the operation of Applied Threat Intelligence rules.\nWe will provide more information by Friday, 2025-10-31 18:00 PDT with current details.\n**Customer Symptoms**\n* Affected customers will see that ATI rule packs are set to disabled.\n* Detections from these rules will be delayed (only visible once the issue is resolved).\n**Workaround**\nCustomers may view and update configurations for the ATI packs in their SecOps tenant.\n1. In your tenant, go to **Detections \u003e Curated Detections \u003e Rule Sets**\n2. Find the **Applied Threat Intelligence - Curated Prioritization Pack**\n3. Recommended configuration: 1. **Active Breach**, **High Priority **\u0026** Inbound Rules (5 rules):** 1. Precise: On, Alerting \u003e On 2. Broad: On, Alerting \u003e Off 2. **Medium Priority (2 Rules):** 3. Precise: Status \u003e On, Alerting \u003e Off 4. Broad: Status \u003e On, Alerting \u003e Off\nReference public documentation:\n[https://cloud.google.com/chronicle/docs/detection/ati-prioritization](https://cloud.google.com/chronicle/docs/detection/ati-prioritization)\n[https://docs.cloud.google.com/chronicle/docs/detection/curated-detections#enable-configure](https://docs.cloud.google.com/chronicle/docs/detection/curated-detections#enable-configure)\n[https://docs.cloud.google.com/chronicle/docs/detection/ati-curated-detections](https://docs.cloud.google.com/chronicle/docs/detection/ati-curated-detections)","status":"SERVICE_DISRUPTION","affected_locations":[{"title":"Johannesburg (africa-south1)","id":"africa-south1"},{"title":"Tokyo (asia-northeast1)","id":"asia-northeast1"},{"title":"Mumbai (asia-south1)","id":"asia-south1"},{"title":"Singapore (asia-southeast1)","id":"asia-southeast1"},{"title":"Jakarta (asia-southeast2)","id":"asia-southeast2"},{"title":"Sydney (australia-southeast1)","id":"australia-southeast1"},{"title":"Multi-region: europe","id":"europe"},{"title":"Turin (europe-west12)","id":"europe-west12"},{"title":"London (europe-west2)","id":"europe-west2"},{"title":"Frankfurt (europe-west3)","id":"europe-west3"},{"title":"Zurich (europe-west6)","id":"europe-west6"},{"title":"Paris (europe-west9)","id":"europe-west9"},{"title":"Doha (me-central1)","id":"me-central1"},{"title":"Dammam (me-central2)","id":"me-central2"},{"title":"Tel Aviv (me-west1)","id":"me-west1"},{"title":"Toronto (northamerica-northeast2)","id":"northamerica-northeast2"},{"title":"São Paulo (southamerica-east1)","id":"southamerica-east1"},{"title":"Multi-region: us","id":"us"}]},{"created":"2025-10-31T04:05:11+00:00","modified":"2025-11-01T00:14:29+00:00","when":"2025-10-31T04:05:11+00:00","text":"**Summary**\nSome Google SecOps customers are experiencing delay in detections for Applied Threat Intelligence - Curated Prioritization rule sets.\n**Description**\nApplied Threat Intelligence - Curated Prioritization rule sets were inadvertently disabled due to defective code. The defective code has been remediated.\nWe are working to restore the prior ‘enabled status’ and ‘alerting status’ of these rules and anticipate that restoration to be completed sometime Friday, 2025-10-31.\nIn the meantime as a work around, customers can re-enable the rules manually to restore the operation of Applied Threat Intelligence rules.\nWe will provide more information by Friday, 2025-10-31 17:00 PDT with current details.\n**Customer Symptoms**\n* Affected customers will see that ATI rule packs are set to disabled.\n* Detections from these rules will be delayed (only visible once the issue is resolved).\n**Workaround**\nCustomers may view and update configurations for the ATI packs in their SecOps tenant.\n1. In your tenant, go to **Detections \u003e Curated Detections \u003e Rule Sets**\n2. Find the **Applied Threat Intelligence - Curated Prioritization Pack**\n3. Recommended configuration: 1. **Active Breach**, **High Priority **\u0026** Inbound Rules (5 rules):** 1. Precise: On, Alerting \u003e On 2. Broad: On, Alerting \u003e Off 2. **Medium Priority (2 Rules):** 3. Precise: Status \u003e On, Alerting \u003e Off 4. Broad: Status \u003e On, Alerting \u003e Off\nReference public documentation:\n[https://cloud.google.com/chronicle/docs/detection/ati-prioritization](https://cloud.google.com/chronicle/docs/detection/ati-prioritization)\n[https://docs.cloud.google.com/chronicle/docs/detection/curated-detections#enable-configure](https://docs.cloud.google.com/chronicle/docs/detection/curated-detections#enable-configure)\n[https://docs.cloud.google.com/chronicle/docs/detection/ati-curated-detections](https://docs.cloud.google.com/chronicle/docs/detection/ati-curated-detections)","status":"SERVICE_DISRUPTION","affected_locations":[{"title":"Johannesburg (africa-south1)","id":"africa-south1"},{"title":"Tokyo (asia-northeast1)","id":"asia-northeast1"},{"title":"Mumbai (asia-south1)","id":"asia-south1"},{"title":"Singapore (asia-southeast1)","id":"asia-southeast1"},{"title":"Jakarta (asia-southeast2)","id":"asia-southeast2"},{"title":"Sydney (australia-southeast1)","id":"australia-southeast1"},{"title":"Multi-region: europe","id":"europe"},{"title":"Turin (europe-west12)","id":"europe-west12"},{"title":"London (europe-west2)","id":"europe-west2"},{"title":"Frankfurt (europe-west3)","id":"europe-west3"},{"title":"Zurich (europe-west6)","id":"europe-west6"},{"title":"Paris (europe-west9)","id":"europe-west9"},{"title":"Doha (me-central1)","id":"me-central1"},{"title":"Dammam (me-central2)","id":"me-central2"},{"title":"Tel Aviv (me-west1)","id":"me-west1"},{"title":"Toronto (northamerica-northeast2)","id":"northamerica-northeast2"},{"title":"São Paulo (southamerica-east1)","id":"southamerica-east1"},{"title":"Multi-region: us","id":"us"}]},{"created":"2025-10-31T01:16:11+00:00","modified":"2025-10-31T04:05:11+00:00","when":"2025-10-31T01:16:11+00:00","text":"**Summary**\nSome Google SecOps customers are experiencing delay in detections for Applied Threat Intelligence - Curated Prioritization rule sets.\n**Description**\nApplied Threat Intelligence - Curated Prioritization rule sets were inadvertently disabled due to defective code.\nMitigation work is currently underway by our engineering team to restore the code and is expected to be complete by Thursday, 2025-10-30 21:00 PDT.\nWe will provide more information by Thursday, 2025-10-30 21:30 PDT with current details.\n**Diagnosis / Customer Symptoms**\n* Affected customers will see that ATI rule packs are forcibly set to disabled.\n* Detections from these rules will be delayed (only visible once the issue is resolved).\n**Workaround**\nNone at this time.","status":"SERVICE_DISRUPTION","affected_locations":[{"title":"Johannesburg (africa-south1)","id":"africa-south1"},{"title":"Tokyo (asia-northeast1)","id":"asia-northeast1"},{"title":"Mumbai (asia-south1)","id":"asia-south1"},{"title":"Singapore (asia-southeast1)","id":"asia-southeast1"},{"title":"Jakarta (asia-southeast2)","id":"asia-southeast2"},{"title":"Sydney (australia-southeast1)","id":"australia-southeast1"},{"title":"Multi-region: europe","id":"europe"},{"title":"Turin (europe-west12)","id":"europe-west12"},{"title":"London (europe-west2)","id":"europe-west2"},{"title":"Frankfurt (europe-west3)","id":"europe-west3"},{"title":"Zurich (europe-west6)","id":"europe-west6"},{"title":"Paris (europe-west9)","id":"europe-west9"},{"title":"Doha (me-central1)","id":"me-central1"},{"title":"Dammam (me-central2)","id":"me-central2"},{"title":"Tel Aviv (me-west1)","id":"me-west1"},{"title":"Toronto (northamerica-northeast2)","id":"northamerica-northeast2"},{"title":"São Paulo (southamerica-east1)","id":"southamerica-east1"},{"title":"Multi-region: us","id":"us"}]},{"created":"2025-10-30T23:51:40+00:00","modified":"2025-10-31T01:16:11+00:00","when":"2025-10-30T23:51:40+00:00","text":"**Summary**\nSome Google SecOps customers are experiencing delay in detections for ATI content.\n**Description**\nWe are experiencing an issue with Google SecOps beginning at Monday, 2025-10-27 10:00 PDT\nOur engineering team continues to investigate the issue.\nWe will provide more information by Thursday, 2025-10-30 18:00 PDT with current details.\nWe apologize to all who are affected by the disruption.\n**Diagnosis / Customer Symptoms**\n* Customers will see ATI rule packs are set to disabled.\n* Detections from these rules will be delayed (only visible once they are created)\n**Workaround**\nNone at this time.","status":"SERVICE_DISRUPTION","affected_locations":[{"title":"Johannesburg (africa-south1)","id":"africa-south1"},{"title":"Tokyo (asia-northeast1)","id":"asia-northeast1"},{"title":"Mumbai (asia-south1)","id":"asia-south1"},{"title":"Singapore (asia-southeast1)","id":"asia-southeast1"},{"title":"Jakarta (asia-southeast2)","id":"asia-southeast2"},{"title":"Sydney (australia-southeast1)","id":"australia-southeast1"},{"title":"Multi-region: europe","id":"europe"},{"title":"Turin (europe-west12)","id":"europe-west12"},{"title":"London (europe-west2)","id":"europe-west2"},{"title":"Frankfurt (europe-west3)","id":"europe-west3"},{"title":"Zurich (europe-west6)","id":"europe-west6"},{"title":"Paris (europe-west9)","id":"europe-west9"},{"title":"Doha (me-central1)","id":"me-central1"},{"title":"Dammam (me-central2)","id":"me-central2"},{"title":"Tel Aviv (me-west1)","id":"me-west1"},{"title":"Toronto (northamerica-northeast2)","id":"northamerica-northeast2"},{"title":"São Paulo (southamerica-east1)","id":"southamerica-east1"},{"title":"Multi-region: us","id":"us"}]}],"most_recent_update":{"created":"2025-11-08T01:06:24+00:00","modified":"2025-11-08T01:07:06+00:00","when":"2025-11-08T01:06:24+00:00","text":"**Summary**\nSome Google SecOps customers may have experienced delay in detections for Applied Threat Intelligence - Curated Prioritization rule sets.\n**Description**\nApplied Threat Intelligence - Curated Prioritization rule sets were inadvertently disabled due to defective code. The defective code has been remediated.\nWe restored the prior ‘enabled status’ and ‘alerting status’ of these rules. Reprocessing of these rules has now completed successfully.\nWe thank you for your patience while we worked on resolving the issue.","status":"AVAILABLE","affected_locations":[]},"status_impact":"SERVICE_DISRUPTION","severity":"medium","service_key":"FHwvkSZ6RzzDYAvDZXMM","service_name":"Google SecOps","affected_products":[{"title":"Google SecOps","id":"FHwvkSZ6RzzDYAvDZXMM"}],"uri":"incidents/7WCNAQPiBAxm2cCq3rBX","currently_affected_locations":[],"previously_affected_locations":[{"title":"Johannesburg (africa-south1)","id":"africa-south1"},{"title":"Tokyo (asia-northeast1)","id":"asia-northeast1"},{"title":"Mumbai (asia-south1)","id":"asia-south1"},{"title":"Singapore (asia-southeast1)","id":"asia-southeast1"},{"title":"Jakarta (asia-southeast2)","id":"asia-southeast2"},{"title":"Sydney (australia-southeast1)","id":"australia-southeast1"},{"title":"Multi-region: europe","id":"europe"},{"title":"Turin (europe-west12)","id":"europe-west12"},{"title":"London (europe-west2)","id":"europe-west2"},{"title":"Frankfurt (europe-west3)","id":"europe-west3"},{"title":"Zurich (europe-west6)","id":"europe-west6"},{"title":"Paris (europe-west9)","id":"europe-west9"},{"title":"Doha (me-central1)","id":"me-central1"},{"title":"Dammam (me-central2)","id":"me-central2"},{"title":"Tel Aviv (me-west1)","id":"me-west1"},{"title":"Toronto (northamerica-northeast2)","id":"northamerica-northeast2"},{"title":"São Paulo (southamerica-east1)","id":"southamerica-east1"},{"title":"Multi-region: us","id":"us"}]},{"id":"8aE3AWcD4kLNFPYq8EQT","number":"2910627667866124219","begin":"2025-10-29T19:31:00+00:00","created":"2025-10-31T22:56:57+00:00","end":"2025-10-30T02:47:00+00:00","modified":"2025-11-01T02:51:34+00:00","external_desc":"Google SecOps service degradation in asia-south1 and asia-southeast2","updates":[{"created":"2025-11-01T02:51:03+00:00","modified":"2025-11-01T02:51:34+00:00","when":"2025-11-01T02:51:03+00:00","text":"**Summary**\nGoogle SecOps service degradation in asia-south1 and asia-southeast2.\n**Description**\nThe issue with Google SecOps has been resolved for all affected users as of Friday, 2025-10-31 19:47 PDT.\nWe thank you for your patience while we worked on resolving the issue.\n**Diagnosis / Customer Symptoms**\nCustomers might have experienced delays in data ingestion and observed a potential drop in ingestion volume.\n**Workaround**\nNone at this time.","status":"AVAILABLE","affected_locations":[]},{"created":"2025-10-31T22:56:57+00:00","modified":"2025-11-01T02:51:03+00:00","when":"2025-10-31T22:56:57+00:00","text":"**Summary**\nGoogle SecOps service degradation in asia-south1 and asia-southeast2.\n**Description**\nWe are experiencing an issue with Google SecOps beginning at Wesnesday, 2025-10-29 12:31 PDT\nOur engineering team continues to investigate the issue.\nWe will provide more information by Friday, 2025-10-31 20:00 PDT with current details.\nWe apologize to all who are affected by the disruption.\n**Diagnosis / Customer Symptoms**\nObserve a potential drop in ingestion volume.\n**Workaround**\nNone at this time.","status":"SERVICE_DISRUPTION","affected_locations":[{"title":"Mumbai (asia-south1)","id":"asia-south1"},{"title":"Jakarta (asia-southeast2)","id":"asia-southeast2"}]}],"most_recent_update":{"created":"2025-11-01T02:51:03+00:00","modified":"2025-11-01T02:51:34+00:00","when":"2025-11-01T02:51:03+00:00","text":"**Summary**\nGoogle SecOps service degradation in asia-south1 and asia-southeast2.\n**Description**\nThe issue with Google SecOps has been resolved for all affected users as of Friday, 2025-10-31 19:47 PDT.\nWe thank you for your patience while we worked on resolving the issue.\n**Diagnosis / Customer Symptoms**\nCustomers might have experienced delays in data ingestion and observed a potential drop in ingestion volume.\n**Workaround**\nNone at this time.","status":"AVAILABLE","affected_locations":[]},"status_impact":"SERVICE_DISRUPTION","severity":"medium","service_key":"FHwvkSZ6RzzDYAvDZXMM","service_name":"Google SecOps","affected_products":[{"title":"Google SecOps","id":"FHwvkSZ6RzzDYAvDZXMM"}],"uri":"incidents/8aE3AWcD4kLNFPYq8EQT","currently_affected_locations":[],"previously_affected_locations":[{"title":"Mumbai (asia-south1)","id":"asia-south1"},{"title":"Jakarta (asia-southeast2)","id":"asia-southeast2"}]},{"id":"yBEtUV3QGJkmVLuWp5qe","number":"13626781724391676217","begin":"2025-10-29T16:00:00+00:00","created":"2025-10-29T20:20:07+00:00","end":"2025-10-29T23:08:00+00:00","modified":"2025-10-29T23:59:24+00:00","external_desc":"[Resolved] Google SecOps products affected by the recent third-party cloud provider data feed outage have recovered.","updates":[{"created":"2025-10-29T23:58:17+00:00","modified":"2025-10-29T23:59:24+00:00","when":"2025-10-29T23:58:17+00:00","text":"**Summary:**\nWe experienced an issue with data ingestion impacting multiple Google SecOps services due to a third-party cloud provider outage beginning at approximately 09:00 PDT on Wednesday 2025-10-29.\nAfter extensive monitoring and validations, we have confirmed full recovery of the third-party data feeds on Google SecOps services as of 16:08 PDT on Wednesday 2025-10-29.\n**Symptoms:**\nCustomers may have experienced data feed failures and delayed detections associated with the data from the third party cloud provider.","status":"AVAILABLE","affected_locations":[]},{"created":"2025-10-29T21:45:48+00:00","modified":"2025-10-29T23:58:17+00:00","when":"2025-10-29T21:45:48+00:00","text":"**Summary:**\nWe experienced an issue with data ingestion impacting multiple Google SecOps services due to a third-party cloud provider outage beginning at approximately 09:00 PDT on Wednesday 2025-10-29.\nThe provider is recovering well and anticipates full mitigation by 16:20 PDT on Wednesday 2025-10-29. We are observing a recovery of the third-party data feeds on Google SecOps services at this time. However, customers may observe delayed detections related to the late ingestion of data until we achieve full recovery.\nWe will provide an update by Wednesday, 2025-10-29 17:00 PDT with current details.\n**Symptoms:**\nCustomers may have experienced data feed failures and delayed detections associated with the third party cloud provider.\n**Workaround:**\nNone at this time.","status":"SERVICE_DISRUPTION","affected_locations":[]},{"created":"2025-10-29T20:20:07+00:00","modified":"2025-10-29T21:45:48+00:00","when":"2025-10-29T20:20:07+00:00","text":"**Summary:**\nWe are experiencing an issue impacting multiple Google SecOps services due to a third-party cloud outage beginning at approximately 09:00 PDT on Wednesday 2025-10-29.\nThe third party anticipates full mitigation by 16:20 PDT on Wednesday 2025-10-29. We will be able to ascertain Google SecOps mitigation time once we have confirmed their mitigation.\nWe will provide an update by Wednesday, 2025-10-29 14:30 PDT with current details.\n**Symptoms:**\nCustomers are experiencing data feed failures associated with the third party cloud provider.\n**Workaround:**\nNone at this time.","status":"SERVICE_DISRUPTION","affected_locations":[]}],"most_recent_update":{"created":"2025-10-29T23:58:17+00:00","modified":"2025-10-29T23:59:24+00:00","when":"2025-10-29T23:58:17+00:00","text":"**Summary:**\nWe experienced an issue with data ingestion impacting multiple Google SecOps services due to a third-party cloud provider outage beginning at approximately 09:00 PDT on Wednesday 2025-10-29.\nAfter extensive monitoring and validations, we have confirmed full recovery of the third-party data feeds on Google SecOps services as of 16:08 PDT on Wednesday 2025-10-29.\n**Symptoms:**\nCustomers may have experienced data feed failures and delayed detections associated with the data from the third party cloud provider.","status":"AVAILABLE","affected_locations":[]},"status_impact":"SERVICE_DISRUPTION","severity":"medium","service_key":"FHwvkSZ6RzzDYAvDZXMM","service_name":"Google SecOps","affected_products":[{"title":"Google SecOps","id":"FHwvkSZ6RzzDYAvDZXMM"}],"uri":"incidents/yBEtUV3QGJkmVLuWp5qe","currently_affected_locations":[],"previously_affected_locations":[]},{"id":"atzycs5kTdMv3mmiQWci","number":"13447084204707249093","begin":"2025-10-09T14:59:00+00:00","created":"2025-10-09T15:34:57+00:00","end":"2025-10-09T19:30:00+00:00","modified":"2025-10-09T19:47:21+00:00","external_desc":"The issue with SecOps and Cloud Monitoring dashboard has been mitigated","updates":[{"created":"2025-10-09T19:43:00+00:00","modified":"2025-10-09T19:47:21+00:00","when":"2025-10-09T19:43:00+00:00","text":"**Description**\nThe ingestion metrics in SecOps and Cloud Monitoring dashboards are now updating as expected. Actual data ingestion to SecOps was not impacted.\nWe appreciate your patience and support while we investigated and mitigated this issue. We apologize for any inconvenience this may have caused.\n**Customer Symptoms**\nSecOps customers globally may observe drop in ingestion metrics in SecOps and Cloud Monitoring dashboard.\n**Workaround**\nNone at this time.","status":"AVAILABLE","affected_locations":[]},{"created":"2025-10-09T15:34:57+00:00","modified":"2025-10-09T19:43:00+00:00","when":"2025-10-09T15:34:57+00:00","text":"**Summary**\nWe are experiencing an issue with SecOps and the Cloud Monitoring dashboard\n**Description**\nGoogle SecOps customers globally may observe drop in ingestion metrics in SecOps and Cloud Monitoring dashboard. Actual data ingestion to SecOps is not impacted.\nWe appreciate your patience while we continue to investigate this issue.\nWe will provide an update by Thursday, 2025-10-09 11:30 PDT with current details.\n**Customer Symptoms**\nSecOps customers globally may observe drop in ingestion metrics in SecOps and Cloud Monitoring dashboard.\n**Workaround**\nNone at this time.","status":"SERVICE_DISRUPTION","affected_locations":[{"title":"Johannesburg (africa-south1)","id":"africa-south1"},{"title":"Tokyo (asia-northeast1)","id":"asia-northeast1"},{"title":"Mumbai (asia-south1)","id":"asia-south1"},{"title":"Singapore (asia-southeast1)","id":"asia-southeast1"},{"title":"Jakarta (asia-southeast2)","id":"asia-southeast2"},{"title":"Sydney (australia-southeast1)","id":"australia-southeast1"},{"title":"Multi-region: europe","id":"europe"},{"title":"Turin (europe-west12)","id":"europe-west12"},{"title":"London (europe-west2)","id":"europe-west2"},{"title":"Frankfurt (europe-west3)","id":"europe-west3"},{"title":"Zurich (europe-west6)","id":"europe-west6"},{"title":"Paris (europe-west9)","id":"europe-west9"},{"title":"Doha (me-central1)","id":"me-central1"},{"title":"Dammam (me-central2)","id":"me-central2"},{"title":"Tel Aviv (me-west1)","id":"me-west1"},{"title":"Toronto (northamerica-northeast2)","id":"northamerica-northeast2"},{"title":"São Paulo (southamerica-east1)","id":"southamerica-east1"},{"title":"Multi-region: us","id":"us"}]}],"most_recent_update":{"created":"2025-10-09T19:43:00+00:00","modified":"2025-10-09T19:47:21+00:00","when":"2025-10-09T19:43:00+00:00","text":"**Description**\nThe ingestion metrics in SecOps and Cloud Monitoring dashboards are now updating as expected. Actual data ingestion to SecOps was not impacted.\nWe appreciate your patience and support while we investigated and mitigated this issue. We apologize for any inconvenience this may have caused.\n**Customer Symptoms**\nSecOps customers globally may observe drop in ingestion metrics in SecOps and Cloud Monitoring dashboard.\n**Workaround**\nNone at this time.","status":"AVAILABLE","affected_locations":[]},"status_impact":"SERVICE_DISRUPTION","severity":"medium","service_key":"FHwvkSZ6RzzDYAvDZXMM","service_name":"Google SecOps","affected_products":[{"title":"Google SecOps","id":"FHwvkSZ6RzzDYAvDZXMM"}],"uri":"incidents/atzycs5kTdMv3mmiQWci","currently_affected_locations":[],"previously_affected_locations":[{"title":"Johannesburg (africa-south1)","id":"africa-south1"},{"title":"Tokyo (asia-northeast1)","id":"asia-northeast1"},{"title":"Mumbai (asia-south1)","id":"asia-south1"},{"title":"Singapore (asia-southeast1)","id":"asia-southeast1"},{"title":"Jakarta (asia-southeast2)","id":"asia-southeast2"},{"title":"Sydney (australia-southeast1)","id":"australia-southeast1"},{"title":"Multi-region: europe","id":"europe"},{"title":"Turin (europe-west12)","id":"europe-west12"},{"title":"London (europe-west2)","id":"europe-west2"},{"title":"Frankfurt (europe-west3)","id":"europe-west3"},{"title":"Zurich (europe-west6)","id":"europe-west6"},{"title":"Paris (europe-west9)","id":"europe-west9"},{"title":"Doha (me-central1)","id":"me-central1"},{"title":"Dammam (me-central2)","id":"me-central2"},{"title":"Tel Aviv (me-west1)","id":"me-west1"},{"title":"Toronto (northamerica-northeast2)","id":"northamerica-northeast2"},{"title":"São Paulo (southamerica-east1)","id":"southamerica-east1"},{"title":"Multi-region: us","id":"us"}]},{"id":"J1eKogZgryLaWGatjjB2","number":"4380913690548430844","begin":"2025-10-07T05:38:00+00:00","created":"2025-10-07T07:12:02+00:00","end":"2025-10-07T08:20:00+00:00","modified":"2025-10-07T08:49:40+00:00","external_desc":"Google SecOps customers might have experienced delayed ingestion for cloud based data sources and third party API fetches globally.","updates":[{"created":"2025-10-07T08:49:40+00:00","modified":"2025-10-07T08:49:41+00:00","when":"2025-10-07T08:49:40+00:00","text":"**Summary**\nGoogle SecOps customers might have experienced delayed ingestion for cloud based data sources and third party API fetches globally.\n**Description**\nThe issue with Google SecOps has been resolved for all affected users as of Tuesday, 2025-10-07 01:20 PDT.\nFrom preliminary analysis, the issue was triggered by a problematic change in the data transport layer. This affected the Cloud to Cloud Transfer operations.\nOur engineers mitigated the issue by identifying and reverting the affected configuration.\nWe thank you for your patience while we worked on resolving the issue.\n**Customer Symptoms**\nThe impacted Google SecOps customers might have experienced delayed ingestion for cloud based data sources and third party API fetches globally.","status":"AVAILABLE","affected_locations":[]},{"created":"2025-10-07T07:37:04+00:00","modified":"2025-10-07T08:49:40+00:00","when":"2025-10-07T07:37:04+00:00","text":"**Summary**\nGoogle SecOps customers may experience delayed ingestion for cloud based data sources and third party API fetches globally\n**Description**\nWe are experiencing an issue with Google SecOps beginning at Monday, 2025-10-06 22:38 PDT.\nOur engineering team continues to investigate the issue.\nWe will provide an update by Tuesday, 2025-10-07 02:30 PDT with current details.\nWe apologize to all who are affected by the disruption.\n**Customer Symptoms**\nThe impacted Google SecOps customers may experience delayed ingestion for cloud based data sources and third party API fetches globally.\n**Workaround**\nNone at this time.","status":"SERVICE_DISRUPTION","affected_locations":[{"title":"Johannesburg (africa-south1)","id":"africa-south1"},{"title":"Tokyo (asia-northeast1)","id":"asia-northeast1"},{"title":"Mumbai (asia-south1)","id":"asia-south1"},{"title":"Singapore (asia-southeast1)","id":"asia-southeast1"},{"title":"Jakarta (asia-southeast2)","id":"asia-southeast2"},{"title":"Sydney (australia-southeast1)","id":"australia-southeast1"},{"title":"Multi-region: europe","id":"europe"},{"title":"Turin (europe-west12)","id":"europe-west12"},{"title":"London (europe-west2)","id":"europe-west2"},{"title":"Frankfurt (europe-west3)","id":"europe-west3"},{"title":"Zurich (europe-west6)","id":"europe-west6"},{"title":"Paris (europe-west9)","id":"europe-west9"},{"title":"Doha (me-central1)","id":"me-central1"},{"title":"Dammam (me-central2)","id":"me-central2"},{"title":"Tel Aviv (me-west1)","id":"me-west1"},{"title":"Toronto (northamerica-northeast2)","id":"northamerica-northeast2"},{"title":"São Paulo (southamerica-east1)","id":"southamerica-east1"},{"title":"Multi-region: us","id":"us"}]},{"created":"2025-10-07T07:12:02+00:00","modified":"2025-10-07T07:37:04+00:00","when":"2025-10-07T07:12:02+00:00","text":"**Summary**\nGoogle SecOps customers may experience delayed ingestion for cloud based data sources and third party API fetches globally\n**Description**\nWe are experiencing an issue with Google SecOps beginning at Monday, 2025-10-06 22:38 PDT.\nOur engineering team continues to investigate the issue.\nWe will provide an update by Tuesday, 2025-10-07 01:00 PDT with current details.\nWe apologize to all who are affected by the disruption.\n**Customer Symptoms**\nThe impacted Google SecOps customers may experience delayed ingestion for cloud based data sources and third party API fetches globally.\n**Workaround**\nNone at this time.","status":"SERVICE_DISRUPTION","affected_locations":[{"title":"Johannesburg (africa-south1)","id":"africa-south1"},{"title":"Tokyo (asia-northeast1)","id":"asia-northeast1"},{"title":"Mumbai (asia-south1)","id":"asia-south1"},{"title":"Singapore (asia-southeast1)","id":"asia-southeast1"},{"title":"Jakarta (asia-southeast2)","id":"asia-southeast2"},{"title":"Sydney (australia-southeast1)","id":"australia-southeast1"},{"title":"Multi-region: europe","id":"europe"},{"title":"Turin (europe-west12)","id":"europe-west12"},{"title":"London (europe-west2)","id":"europe-west2"},{"title":"Frankfurt (europe-west3)","id":"europe-west3"},{"title":"Zurich (europe-west6)","id":"europe-west6"},{"title":"Paris (europe-west9)","id":"europe-west9"},{"title":"Doha (me-central1)","id":"me-central1"},{"title":"Dammam (me-central2)","id":"me-central2"},{"title":"Tel Aviv (me-west1)","id":"me-west1"},{"title":"Toronto (northamerica-northeast2)","id":"northamerica-northeast2"},{"title":"São Paulo (southamerica-east1)","id":"southamerica-east1"},{"title":"Multi-region: us","id":"us"}]}],"most_recent_update":{"created":"2025-10-07T08:49:40+00:00","modified":"2025-10-07T08:49:41+00:00","when":"2025-10-07T08:49:40+00:00","text":"**Summary**\nGoogle SecOps customers might have experienced delayed ingestion for cloud based data sources and third party API fetches globally.\n**Description**\nThe issue with Google SecOps has been resolved for all affected users as of Tuesday, 2025-10-07 01:20 PDT.\nFrom preliminary analysis, the issue was triggered by a problematic change in the data transport layer. This affected the Cloud to Cloud Transfer operations.\nOur engineers mitigated the issue by identifying and reverting the affected configuration.\nWe thank you for your patience while we worked on resolving the issue.\n**Customer Symptoms**\nThe impacted Google SecOps customers might have experienced delayed ingestion for cloud based data sources and third party API fetches globally.","status":"AVAILABLE","affected_locations":[]},"status_impact":"SERVICE_DISRUPTION","severity":"medium","service_key":"FHwvkSZ6RzzDYAvDZXMM","service_name":"Google SecOps","affected_products":[{"title":"Google SecOps","id":"FHwvkSZ6RzzDYAvDZXMM"}],"uri":"incidents/J1eKogZgryLaWGatjjB2","currently_affected_locations":[],"previously_affected_locations":[{"title":"Johannesburg (africa-south1)","id":"africa-south1"},{"title":"Tokyo (asia-northeast1)","id":"asia-northeast1"},{"title":"Mumbai (asia-south1)","id":"asia-south1"},{"title":"Singapore (asia-southeast1)","id":"asia-southeast1"},{"title":"Jakarta (asia-southeast2)","id":"asia-southeast2"},{"title":"Sydney (australia-southeast1)","id":"australia-southeast1"},{"title":"Multi-region: europe","id":"europe"},{"title":"Turin (europe-west12)","id":"europe-west12"},{"title":"London (europe-west2)","id":"europe-west2"},{"title":"Frankfurt (europe-west3)","id":"europe-west3"},{"title":"Zurich (europe-west6)","id":"europe-west6"},{"title":"Paris (europe-west9)","id":"europe-west9"},{"title":"Doha (me-central1)","id":"me-central1"},{"title":"Dammam (me-central2)","id":"me-central2"},{"title":"Tel Aviv (me-west1)","id":"me-west1"},{"title":"Toronto (northamerica-northeast2)","id":"northamerica-northeast2"},{"title":"São Paulo (southamerica-east1)","id":"southamerica-east1"},{"title":"Multi-region: us","id":"us"}]},{"id":"KZHdkE2zxGU7PRzvczSU","number":"10950664500114280211","begin":"2025-09-30T13:18:00+00:00","created":"2025-10-01T17:22:24+00:00","end":"2025-10-01T14:40:00+00:00","modified":"2025-10-01T17:50:32+00:00","external_desc":"Google SecOps customers experienced Unified Data Model (UDM) search failures.","updates":[{"created":"2025-10-01T17:50:32+00:00","modified":"2025-10-01T17:50:32+00:00","when":"2025-10-01T17:50:32+00:00","text":"**Description:**\nBetween 06:18 PDT 30 September 2025 and 07:40 PDT 1 October 2025, Google SecOps experienced issues with Unified Data Model (UDM) searches for some customers.\nFrom preliminary analysis, the issue was caused by a recent binary rollout. Our engineers have mitigated the issue by rolling back the binary.\nWe thank you for your patience while we worked on resolving the issue.\n**Symptoms:**\nGoogle SecOps customers who were not onboarded to the Chronicle API experienced Unified Data Model (UDM) search failures. This manifested as errors in the UI when trying to perform a search.","status":"AVAILABLE","affected_locations":[]},{"created":"2025-10-01T17:22:24+00:00","modified":"2025-10-01T17:50:32+00:00","when":"2025-10-01T17:22:24+00:00","text":"**Description:**\nWe experienced an issue with Google SecOps beginning at Wednesday, 2025-10-01 07:47 PDT.\nThe issue is now resolved.\nWe will provide an update by Wednesday, 2025-10-01 10:45 PDT with more details of customer experience during the issue.\nWe apologize to all who are affected by the disruption.\n**Symptoms:**\nGoogle SecOps customers experienced Unified Data Model (UDM) search failures.\n**Workaround:**\nNone at this time.","status":"SERVICE_DISRUPTION","affected_locations":[{"title":"Johannesburg (africa-south1)","id":"africa-south1"},{"title":"Tokyo (asia-northeast1)","id":"asia-northeast1"},{"title":"Mumbai (asia-south1)","id":"asia-south1"},{"title":"Singapore (asia-southeast1)","id":"asia-southeast1"},{"title":"Jakarta (asia-southeast2)","id":"asia-southeast2"},{"title":"Sydney (australia-southeast1)","id":"australia-southeast1"},{"title":"Multi-region: europe","id":"europe"},{"title":"Turin (europe-west12)","id":"europe-west12"},{"title":"London (europe-west2)","id":"europe-west2"},{"title":"Frankfurt (europe-west3)","id":"europe-west3"},{"title":"Zurich (europe-west6)","id":"europe-west6"},{"title":"Paris (europe-west9)","id":"europe-west9"},{"title":"Doha (me-central1)","id":"me-central1"},{"title":"Dammam (me-central2)","id":"me-central2"},{"title":"Tel Aviv (me-west1)","id":"me-west1"}]}],"most_recent_update":{"created":"2025-10-01T17:50:32+00:00","modified":"2025-10-01T17:50:32+00:00","when":"2025-10-01T17:50:32+00:00","text":"**Description:**\nBetween 06:18 PDT 30 September 2025 and 07:40 PDT 1 October 2025, Google SecOps experienced issues with Unified Data Model (UDM) searches for some customers.\nFrom preliminary analysis, the issue was caused by a recent binary rollout. Our engineers have mitigated the issue by rolling back the binary.\nWe thank you for your patience while we worked on resolving the issue.\n**Symptoms:**\nGoogle SecOps customers who were not onboarded to the Chronicle API experienced Unified Data Model (UDM) search failures. This manifested as errors in the UI when trying to perform a search.","status":"AVAILABLE","affected_locations":[]},"status_impact":"SERVICE_DISRUPTION","severity":"medium","service_key":"FHwvkSZ6RzzDYAvDZXMM","service_name":"Google SecOps","affected_products":[{"title":"Google SecOps","id":"FHwvkSZ6RzzDYAvDZXMM"}],"uri":"incidents/KZHdkE2zxGU7PRzvczSU","currently_affected_locations":[],"previously_affected_locations":[{"title":"Johannesburg (africa-south1)","id":"africa-south1"},{"title":"Tokyo (asia-northeast1)","id":"asia-northeast1"},{"title":"Mumbai (asia-south1)","id":"asia-south1"},{"title":"Singapore (asia-southeast1)","id":"asia-southeast1"},{"title":"Jakarta (asia-southeast2)","id":"asia-southeast2"},{"title":"Sydney (australia-southeast1)","id":"australia-southeast1"},{"title":"Multi-region: europe","id":"europe"},{"title":"Turin (europe-west12)","id":"europe-west12"},{"title":"London (europe-west2)","id":"europe-west2"},{"title":"Frankfurt (europe-west3)","id":"europe-west3"},{"title":"Zurich (europe-west6)","id":"europe-west6"},{"title":"Paris (europe-west9)","id":"europe-west9"},{"title":"Doha (me-central1)","id":"me-central1"},{"title":"Dammam (me-central2)","id":"me-central2"},{"title":"Tel Aviv (me-west1)","id":"me-west1"}]},{"id":"T5oHvSQGpfW2dkmFN7UU","number":"17260447698575361060","begin":"2025-09-29T02:46:00+00:00","created":"2025-10-05T17:11:30+00:00","end":"2025-10-05T21:42:00+00:00","modified":"2025-10-06T18:51:18+00:00","external_desc":"Google SecOps customers experiencing issues where Palo Alto Cortex XDR Alerts logs are not being ingested","updates":[{"created":"2025-10-06T18:51:18+00:00","modified":"2025-10-06T18:51:19+00:00","when":"2025-10-06T18:51:18+00:00","text":"**Summary:**\nResolved: An issue with Google SecOps and Palo Alto Cortex XDR Alerts log ingestion in multiple regions.\n**Description:**\nThe issue affecting Google SecOps customers has been resolved for all affected users as of Sunday, 2025-10-05 14:42 US/Pacific. We apologize for the inconvenience this incident caused.\nFrom preliminary analysis, the issue was triggered by a recent software update intended to improve the processing of Palo Alto Cortex XDR alerts.\nThe problematic update was identified, and the issue was mitigated by rolling back the change to restore normal service. All logs that were not ingested during this period are being backfilled.\nWe anticipate the backfill to complete by the end of day 13 October 2025 or sooner. If you have any questions regarding the data backfill, please open a support case with us and we will assist you accordingly.","status":"AVAILABLE","affected_locations":[]},{"created":"2025-10-05T21:21:21+00:00","modified":"2025-10-06T18:51:18+00:00","when":"2025-10-05T21:21:21+00:00","text":"**Summary:**\nGoogle SecOps customers experiencing issue where Palo Alto Cortex XDR Alerts logs are not being ingested\n**Description:**\nOur engineering team has mitigated the issue by rolling out the fix to production and has initiated a backfill of all logs that were not ingested during the period of impact.\nWe do not have an ETA for completion of the backfill at this time.\nWe will provide another update by Friday, 2025-10-10 17:00 US/Pacific.\n**Symptoms:**\nImpacted customers will see a gap in Palo Alto Cortex XDR Alerts data until a backfill is performed. Customers may not see data in Unified Data Model (UDM) Search, and may have delayed rule detections.\n**Workaround:**\nNone at this time.","status":"SERVICE_INFORMATION","affected_locations":[{"title":"Johannesburg (africa-south1)","id":"africa-south1"},{"title":"Tokyo (asia-northeast1)","id":"asia-northeast1"},{"title":"Mumbai (asia-south1)","id":"asia-south1"},{"title":"Singapore (asia-southeast1)","id":"asia-southeast1"},{"title":"Jakarta (asia-southeast2)","id":"asia-southeast2"},{"title":"Sydney (australia-southeast1)","id":"australia-southeast1"},{"title":"Multi-region: europe","id":"europe"},{"title":"Turin (europe-west12)","id":"europe-west12"},{"title":"London (europe-west2)","id":"europe-west2"},{"title":"Frankfurt (europe-west3)","id":"europe-west3"},{"title":"Zurich (europe-west6)","id":"europe-west6"},{"title":"Paris (europe-west9)","id":"europe-west9"},{"title":"Doha (me-central1)","id":"me-central1"},{"title":"Dammam (me-central2)","id":"me-central2"},{"title":"Tel Aviv (me-west1)","id":"me-west1"},{"title":"Toronto (northamerica-northeast2)","id":"northamerica-northeast2"},{"title":"São Paulo (southamerica-east1)","id":"southamerica-east1"},{"title":"Multi-region: us","id":"us"}]},{"created":"2025-10-05T18:22:27+00:00","modified":"2025-10-05T21:21:21+00:00","when":"2025-10-05T18:22:27+00:00","text":"Mitigation work is currently underway by our engineering team.\nOur engineering team has identified that the issue was caused by a recent change. A fix has been tested and is currently being rolled out to production.\nThe rollout is progressing, and the mitigation is expected to be completed by Sunday, 2025-10-05 14:00 US/Pacific.\nWe will provide another update by Sunday, 2025-10-05 14:30 US/Pacific.\n**Diagnosis / Customer Symptoms:**\n- Impacted customers will see a gap in Palo Alto Cortex XDR Alerts data until a backfill is performed. Customers may not see data in Unified Data Model (UDM) Search, and may have delayed rule detections.","status":"SERVICE_INFORMATION","affected_locations":[{"title":"Johannesburg (africa-south1)","id":"africa-south1"},{"title":"Tokyo (asia-northeast1)","id":"asia-northeast1"},{"title":"Mumbai (asia-south1)","id":"asia-south1"},{"title":"Singapore (asia-southeast1)","id":"asia-southeast1"},{"title":"Jakarta (asia-southeast2)","id":"asia-southeast2"},{"title":"Sydney (australia-southeast1)","id":"australia-southeast1"},{"title":"Multi-region: europe","id":"europe"},{"title":"Turin (europe-west12)","id":"europe-west12"},{"title":"London (europe-west2)","id":"europe-west2"},{"title":"Frankfurt (europe-west3)","id":"europe-west3"},{"title":"Zurich (europe-west6)","id":"europe-west6"},{"title":"Paris (europe-west9)","id":"europe-west9"},{"title":"Doha (me-central1)","id":"me-central1"},{"title":"Dammam (me-central2)","id":"me-central2"},{"title":"Tel Aviv (me-west1)","id":"me-west1"},{"title":"Toronto (northamerica-northeast2)","id":"northamerica-northeast2"},{"title":"São Paulo (southamerica-east1)","id":"southamerica-east1"},{"title":"Multi-region: us","id":"us"}]},{"created":"2025-10-05T17:11:30+00:00","modified":"2025-10-05T18:22:27+00:00","when":"2025-10-05T17:11:30+00:00","text":"We've received a report of an issue with Google SecOps as of Sunday, 2025-10-05 07:57 US/Pacific.\nThe Palo Alto Cortex XDR Alerts log type has not been ingested correctly in some regions beginning on 2025-09-28 19:46 US/Pacific. We have identified the problem and are verifying the solution. We expect the situation to be fully mitigated by 2025-10-05 12:00 US/Pacific.\nWe will provide more information by Sunday, 2025-10-05 11:30 US/Pacific.\n**Diagnosis / Customer Symptoms:**\n- Impacted customers will see a gap in Palo Alto Cortex XDR Alerts data until a backfill is performed. Customers may not see data in Unified Data Model (UDM) Search, and may have delayed rule detections. .","status":"SERVICE_INFORMATION","affected_locations":[{"title":"Johannesburg (africa-south1)","id":"africa-south1"},{"title":"Tokyo (asia-northeast1)","id":"asia-northeast1"},{"title":"Mumbai (asia-south1)","id":"asia-south1"},{"title":"Singapore (asia-southeast1)","id":"asia-southeast1"},{"title":"Jakarta (asia-southeast2)","id":"asia-southeast2"},{"title":"Sydney (australia-southeast1)","id":"australia-southeast1"},{"title":"Multi-region: europe","id":"europe"},{"title":"Turin (europe-west12)","id":"europe-west12"},{"title":"London (europe-west2)","id":"europe-west2"},{"title":"Frankfurt (europe-west3)","id":"europe-west3"},{"title":"Zurich (europe-west6)","id":"europe-west6"},{"title":"Paris (europe-west9)","id":"europe-west9"},{"title":"Doha (me-central1)","id":"me-central1"},{"title":"Dammam (me-central2)","id":"me-central2"},{"title":"Tel Aviv (me-west1)","id":"me-west1"},{"title":"Toronto (northamerica-northeast2)","id":"northamerica-northeast2"},{"title":"São Paulo (southamerica-east1)","id":"southamerica-east1"},{"title":"Multi-region: us","id":"us"}]}],"most_recent_update":{"created":"2025-10-06T18:51:18+00:00","modified":"2025-10-06T18:51:19+00:00","when":"2025-10-06T18:51:18+00:00","text":"**Summary:**\nResolved: An issue with Google SecOps and Palo Alto Cortex XDR Alerts log ingestion in multiple regions.\n**Description:**\nThe issue affecting Google SecOps customers has been resolved for all affected users as of Sunday, 2025-10-05 14:42 US/Pacific. We apologize for the inconvenience this incident caused.\nFrom preliminary analysis, the issue was triggered by a recent software update intended to improve the processing of Palo Alto Cortex XDR alerts.\nThe problematic update was identified, and the issue was mitigated by rolling back the change to restore normal service. All logs that were not ingested during this period are being backfilled.\nWe anticipate the backfill to complete by the end of day 13 October 2025 or sooner. If you have any questions regarding the data backfill, please open a support case with us and we will assist you accordingly.","status":"AVAILABLE","affected_locations":[]},"status_impact":"SERVICE_INFORMATION","severity":"low","service_key":"FHwvkSZ6RzzDYAvDZXMM","service_name":"Google SecOps","affected_products":[{"title":"Google SecOps","id":"FHwvkSZ6RzzDYAvDZXMM"}],"uri":"incidents/T5oHvSQGpfW2dkmFN7UU","currently_affected_locations":[],"previously_affected_locations":[{"title":"Johannesburg (africa-south1)","id":"africa-south1"},{"title":"Tokyo (asia-northeast1)","id":"asia-northeast1"},{"title":"Mumbai (asia-south1)","id":"asia-south1"},{"title":"Singapore (asia-southeast1)","id":"asia-southeast1"},{"title":"Jakarta (asia-southeast2)","id":"asia-southeast2"},{"title":"Sydney (australia-southeast1)","id":"australia-southeast1"},{"title":"Multi-region: europe","id":"europe"},{"title":"Turin (europe-west12)","id":"europe-west12"},{"title":"London (europe-west2)","id":"europe-west2"},{"title":"Frankfurt (europe-west3)","id":"europe-west3"},{"title":"Zurich (europe-west6)","id":"europe-west6"},{"title":"Paris (europe-west9)","id":"europe-west9"},{"title":"Doha (me-central1)","id":"me-central1"},{"title":"Dammam (me-central2)","id":"me-central2"},{"title":"Tel Aviv (me-west1)","id":"me-west1"},{"title":"Toronto (northamerica-northeast2)","id":"northamerica-northeast2"},{"title":"São Paulo (southamerica-east1)","id":"southamerica-east1"},{"title":"Multi-region: us","id":"us"}]},{"id":"V9hHLm5GWywgjQFk33UG","number":"9858427179076291028","begin":"2025-09-17T01:00:00+00:00","created":"2025-09-17T16:47:55+00:00","end":"2025-09-23T23:00:00+00:00","modified":"2025-09-25T18:28:22+00:00","external_desc":"A small number of Mandiant Digital Threat Monitoring customers were unable to access the monitors and alerts.","updates":[{"created":"2025-09-25T18:28:07+00:00","modified":"2025-09-25T18:28:22+00:00","when":"2025-09-25T18:28:07+00:00","text":"The issue with Alert and Monitor data has been resolved as of September 23rd at 16:00 PDT. The engineering team has confirmed that no data has been lost and the system is operating normally.\nWe are aware that some customers are experiencing some duplicate Alerts, which may impact Alert analytics. Please reach out to your customer support team if you are experiencing this issue or have any questions.","status":"AVAILABLE","affected_locations":[]},{"created":"2025-09-24T17:01:01+00:00","modified":"2025-09-25T18:28:07+00:00","when":"2025-09-24T17:01:01+00:00","text":"Alert regeneration is now complete. We are still investigating cases where duplicate Alerts were generated prior to September 23rd at 16:00 PDT.\nWe will provide an update by Thursday, 2025-09-25 11:00 PDT or sooner.","status":"SERVICE_DISRUPTION","affected_locations":[{"title":"Global","id":"global"}]},{"created":"2025-09-23T15:37:19+00:00","modified":"2025-09-24T17:01:01+00:00","when":"2025-09-23T15:37:19+00:00","text":"We are continuing to reprocess monitor data from the impacted period. Impacted customers may continue to receive Alerts at an increased rate and could receive duplicate Alerts.\nWe will provide an update on the status of the data reprocessing by Wednesday, 2025-09-24 11:00 PDT or sooner.","status":"SERVICE_DISRUPTION","affected_locations":[{"title":"Global","id":"global"}]},{"created":"2025-09-22T18:44:23+00:00","modified":"2025-09-23T15:37:19+00:00","when":"2025-09-22T18:44:23+00:00","text":"We are still reprocessing monitor data from the impacted period. Impacted customers may continue to receive Alerts at an increased rate and could receive duplicate Alerts.\nWe will provide an update on the status of the data reprocessing by Tuesday, 2025-09-23 11:00 PDT or sooner.","status":"SERVICE_DISRUPTION","affected_locations":[{"title":"Global","id":"global"}]},{"created":"2025-09-21T17:00:32+00:00","modified":"2025-09-22T18:44:23+00:00","when":"2025-09-21T17:00:32+00:00","text":"Processing of the restored Alerts is still in progress. Impacted customers may continue to receive Alerts at an increased rate and could receive duplicate Alerts.\nWe will provide an update on the status of the data reprocessing by Monday, 2025-09-22 11:00 PDT or sooner.","status":"SERVICE_DISRUPTION","affected_locations":[{"title":"Global","id":"global"}]},{"created":"2025-09-20T16:34:43+00:00","modified":"2025-09-21T17:00:32+00:00","when":"2025-09-20T16:34:43+00:00","text":"Impacted customers will soon start seeing restored Alert data from the affected period as new Alerts in the platform, and may experience a temporary increased Alert rate. Some customers may see some duplicate Alerts.\nUntil the full Monitor data is reprocessed, some of the affected customers may still see gaps in Alerts.\nWe will provide an update on the status of the data reprocessing by Sunday, 2025-09-21 11:00 PDT or sooner.","status":"SERVICE_DISRUPTION","affected_locations":[{"title":"Global","id":"global"}]},{"created":"2025-09-19T17:44:07+00:00","modified":"2025-09-20T16:34:43+00:00","when":"2025-09-19T17:44:07+00:00","text":"By 12:00 PDT on 18 September, [Alert History](https://gtidocs.virustotal.com/docs/alerts-guide#view-history-of-an-alert) was restored for Alerts created prior to the incident.\nStarting at 04:50 PDT on 19 September, restored Monitors are now operating normally.\nOur team is continuing the work on reprocessing the Monitor data from the time of the issue so that the corresponding Alerts can be regenerated.\nUntil the full Monitor data is reprocessed, some of the affected customers may still see gaps in Alerts.\nWe will provide an update on the status of the data reprocessing by Saturday, 2025-09-20 11:00 PDT or sooner.","status":"SERVICE_DISRUPTION","affected_locations":[{"title":"Global","id":"global"}]},{"created":"2025-09-18T18:06:53+00:00","modified":"2025-09-19T17:44:07+00:00","when":"2025-09-18T18:06:53+00:00","text":"Between 16 September 18:00 PDT and 17 September 09:30 PDT, a subset of Mandiant Digital Threat Monitoring customers experienced access issues with [Monitors](https://gtidocs.virustotal.com/docs/monitors-guide) and [Alerts](https://gtidocs.virustotal.com/docs/alerts-guide).\nBy 09:30 PDT on 17 September, our engineers mitigated the issue thereby restoring access to existing Monitors and new Alerts.\nBy 02:00 PDT on 18 September, we completed the backfill of the alerts from the time of the issue.\nWe are in the process of restoring [Alert History](https://gtidocs.virustotal.com/docs/alerts-guide#view-history-of-an-alert).\nWe are also working on reprocessing the Monitor data from the time of the issue so that the corresponding Alerts can be regenerated.\nUntil the full monitor data is reprocessed, some of the affected customers may still see gaps in Alerts.\nWe will provide an update on the status of the data reprocessing by Friday, 2025-09-19 11:00 PDT or sooner.","status":"SERVICE_DISRUPTION","affected_locations":[{"title":"Global","id":"global"}]},{"created":"2025-09-17T22:50:34+00:00","modified":"2025-09-18T18:06:53+00:00","when":"2025-09-17T22:50:34+00:00","text":"Alert backfill is progressing under our close supervision. We will provide an update on the status of the backfill by Thursday, 2025-09-18 10:00 PDT.","status":"SERVICE_DISRUPTION","affected_locations":[{"title":"Global","id":"global"}]},{"created":"2025-09-17T19:58:43+00:00","modified":"2025-09-17T22:50:34+00:00","when":"2025-09-17T19:58:43+00:00","text":"Alert backfilling is in progress. The latest alerts have been prioritized for the backfill and customers should start seeing some of the alerts from the time of the issue available. We expect the backfill to complete in the next couple of hours. We will provide another update by Wednesday, 2025-09-17 16:00 PDT with more details.","status":"SERVICE_DISRUPTION","affected_locations":[{"title":"Global","id":"global"}]},{"created":"2025-09-17T16:47:55+00:00","modified":"2025-09-17T19:58:43+00:00","when":"2025-09-17T16:47:55+00:00","text":"Starting at 18:00 PDT on 16 September 2025, a small number of Mandiant Digital Threat Monitoring customers have experienced issues accessing the monitors and alerts.\nOur engineers identified the cause and applied appropriate mitigations by 09:30 PDT on 17 September 2025. Monitors and alerts after 09:30 PDT should be accessible to the customers. Existing monitors and new alerts should now be available. Historical alerts from the time of the issue are being backfilled by our engineering team.\nWe expect the backfill to take a few hours and we will provide an update by Wednesday, 2025-09-17 13:00 PDT with current details.","status":"SERVICE_DISRUPTION","affected_locations":[{"title":"Global","id":"global"}]}],"most_recent_update":{"created":"2025-09-25T18:28:07+00:00","modified":"2025-09-25T18:28:22+00:00","when":"2025-09-25T18:28:07+00:00","text":"The issue with Alert and Monitor data has been resolved as of September 23rd at 16:00 PDT. The engineering team has confirmed that no data has been lost and the system is operating normally.\nWe are aware that some customers are experiencing some duplicate Alerts, which may impact Alert analytics. Please reach out to your customer support team if you are experiencing this issue or have any questions.","status":"AVAILABLE","affected_locations":[]},"status_impact":"SERVICE_INFORMATION","severity":"low","service_key":"dgtVvWgKSlxi01VBC8mt","service_name":"Mandiant Digital Threat Monitoring","affected_products":[{"title":"Mandiant Digital Threat Monitoring","id":"dgtVvWgKSlxi01VBC8mt"}],"uri":"incidents/V9hHLm5GWywgjQFk33UG","currently_affected_locations":[],"previously_affected_locations":[{"title":"Global","id":"global"}]},{"id":"4mfvqbRkNHNrMFrJeX5M","number":"11820501377950145868","begin":"2025-08-27T17:10:00+00:00","created":"2025-08-27T22:28:49+00:00","end":"2025-08-27T23:30:00+00:00","modified":"2025-08-27T23:38:29+00:00","external_desc":"SecOps SIEM customers are experiencing a disruption to multi-event rule processing.","updates":[{"created":"2025-08-27T23:34:01+00:00","modified":"2025-08-27T23:38:29+00:00","when":"2025-08-27T23:34:01+00:00","text":"**Summary:**\nSecOps SIEM customers experienced a disruption to multi-event rule processing.\n**Description:**\nThe issue with Google Secops has been resolved for all affected users as of Wednesday, 2025-08-27 16:30 PDT\nThe issue was due to a failed software update. Our engineers have mitigated the issue by fully rolling back to the previous version.\nNo customer action is required.\nWe thank you for your patience while we worked on resolving the issue.\n**Diagnosis / Customer Symptoms:**\nMulti Event Rules were not active.\n**Workaround:**\nNone at this time.","status":"AVAILABLE","affected_locations":[]},{"created":"2025-08-27T22:28:49+00:00","modified":"2025-08-27T23:34:01+00:00","when":"2025-08-27T22:28:49+00:00","text":"**Summary:**\nSecOps SIEM customers are experiencing a disruption to multi-event rule processing.\n**Description:**\nWe are experiencing an issue with Google Secops beginning at Wednesday, 2025-08-27 10:10 PDT\nOur engineering team continues to investigate the issue.\nWe will provide more information by Wednesday, 2025-08-27 16:30 PDTwith current details.\nWe apologize to all who are affected by the disruption.\n**Diagnosis / Customer Symptoms:**\nMulti Event Rules are not currently running.\n**Workaround:**\nNone at this time.","status":"SERVICE_INFORMATION","affected_locations":[{"title":"Multi-region: europe","id":"europe"}]}],"most_recent_update":{"created":"2025-08-27T23:34:01+00:00","modified":"2025-08-27T23:38:29+00:00","when":"2025-08-27T23:34:01+00:00","text":"**Summary:**\nSecOps SIEM customers experienced a disruption to multi-event rule processing.\n**Description:**\nThe issue with Google Secops has been resolved for all affected users as of Wednesday, 2025-08-27 16:30 PDT\nThe issue was due to a failed software update. Our engineers have mitigated the issue by fully rolling back to the previous version.\nNo customer action is required.\nWe thank you for your patience while we worked on resolving the issue.\n**Diagnosis / Customer Symptoms:**\nMulti Event Rules were not active.\n**Workaround:**\nNone at this time.","status":"AVAILABLE","affected_locations":[]},"status_impact":"SERVICE_INFORMATION","severity":"low","service_key":"FHwvkSZ6RzzDYAvDZXMM","service_name":"Google SecOps","affected_products":[{"title":"Google SecOps","id":"FHwvkSZ6RzzDYAvDZXMM"}],"uri":"incidents/4mfvqbRkNHNrMFrJeX5M","currently_affected_locations":[],"previously_affected_locations":[{"title":"Multi-region: europe","id":"europe"}]},{"id":"7r776Bdk3rqELvuRTN1u","number":"12449139647977293117","begin":"2025-08-25T19:37:00+00:00","created":"2025-08-25T19:50:37+00:00","end":"2025-08-25T21:01:00+00:00","modified":"2025-08-25T21:14:12+00:00","external_desc":"Mandiant Managed Defense customers may have experienced elevated errors","updates":[{"created":"2025-08-25T21:13:26+00:00","modified":"2025-08-25T21:14:12+00:00","when":"2025-08-25T21:13:26+00:00","text":"The issue with Mandiant Managed Defense has been resolved for all affected users as of Monday, 2025-08-25 14:01 PDT.\nWe thank you for your patience while we worked on resolving the issue.\nCustomer Symptoms:\n* Customers may have experienced elevated HTTP 500 errors for events from Chronicle Curated Detection Alerts.\n* Customers may have not been able to view details or report alerts.\n* Customers may have experienced errors accessing events from Chronicle Curated Detections.","status":"AVAILABLE","affected_locations":[]},{"created":"2025-08-25T20:56:35+00:00","modified":"2025-08-25T21:13:26+00:00","when":"2025-08-25T20:56:35+00:00","text":"We are experiencing an issue with Mandiant Managed Defense beginning at Monday, 2025-08-25 12:37 PDT.\nOur engineering team has identified the underlying cause of the issue and is currently working on the mitigation.\nWe will provide an update by Monday, 2025-08-25 15:30 PDT with current details.\nCustomer Symptoms:\n* Customer may experience elevated HTTP 500 errors for events from Chronicle Curated Detection Alerts.\n* Customers may not be able to view details or report alerts.\n* Customer may experience errors accessing events from Chronicle Curated Detections.","status":"SERVICE_INFORMATION","affected_locations":[{"title":"Global","id":"global"}]},{"created":"2025-08-25T20:03:02+00:00","modified":"2025-08-25T20:56:35+00:00","when":"2025-08-25T20:03:02+00:00","text":"We are experiencing an issue with Mandiant Managed Defense beginning at Monday, 2025-08-25 12:37 PDT.\nOur engineering team continues to investigate the issue.\nWe will provide an update by Monday, 2025-08-25 14:00 PDT with current details.\nCustomer Symptoms:\n* Customer may experience elevated HTTP 500 errors for events from Chronicle Curated Detection Alerts.\n* Customers may not be able to view details or report alerts.\n* Customer may experience errors accessing events from Chronicle Curated Detections.","status":"SERVICE_INFORMATION","affected_locations":[{"title":"Global","id":"global"}]},{"created":"2025-08-25T19:50:37+00:00","modified":"2025-08-25T20:03:02+00:00","when":"2025-08-25T19:50:37+00:00","text":"We are experiencing an issue with Mandiant Managed Defense beginning at Monday, 2025-08-25 12:37 PDT.\nOur engineering team continues to investigate the issue.\nWe will provide an update by Monday, 2025-08-25 13:20 PDT with current details.\nWe apologize to all who are affected by the disruption.","status":"SERVICE_INFORMATION","affected_locations":[{"title":"Global","id":"global"}]}],"most_recent_update":{"created":"2025-08-25T21:13:26+00:00","modified":"2025-08-25T21:14:12+00:00","when":"2025-08-25T21:13:26+00:00","text":"The issue with Mandiant Managed Defense has been resolved for all affected users as of Monday, 2025-08-25 14:01 PDT.\nWe thank you for your patience while we worked on resolving the issue.\nCustomer Symptoms:\n* Customers may have experienced elevated HTTP 500 errors for events from Chronicle Curated Detection Alerts.\n* Customers may have not been able to view details or report alerts.\n* Customers may have experienced errors accessing events from Chronicle Curated Detections.","status":"AVAILABLE","affected_locations":[]},"status_impact":"SERVICE_INFORMATION","severity":"low","service_key":"9aKw9s8p43AYeBmo4Gvx","service_name":"Mandiant Managed Defense","affected_products":[{"title":"Mandiant Managed Defense","id":"9aKw9s8p43AYeBmo4Gvx"}],"uri":"incidents/7r776Bdk3rqELvuRTN1u","currently_affected_locations":[],"previously_affected_locations":[{"title":"Global","id":"global"}]},{"id":"RVkA9s8jQC3YTXQozPfm","number":"16439225233627318922","begin":"2025-08-20T13:15:00+00:00","created":"2025-08-20T18:38:36+00:00","end":"2025-08-20T21:10:00+00:00","modified":"2025-08-20T21:16:13+00:00","external_desc":"Some Google SecOps customers are experiencing delays in the event indexing","updates":[{"created":"2025-08-20T21:16:13+00:00","modified":"2025-08-20T21:16:13+00:00","when":"2025-08-20T21:16:13+00:00","text":"The issue with Google SecOps has been resolved for all affected projects as of Wednesday, 2025-08-20 14:10 PDT.\nWe thank you for your patience while we worked on resolving the issue.","status":"AVAILABLE","affected_locations":[]},{"created":"2025-08-20T20:23:34+00:00","modified":"2025-08-20T21:16:13+00:00","when":"2025-08-20T20:23:34+00:00","text":"**Description :**\nMitigation is currently in progress. We do not have an ETA on the completion of mitigation steps.\nInternal monitoring indicates an improvement in latency, and continuous monitoring by our Google Engineering team is underway to ensure complete mitigation.\nWe will provide more information by Wednesday, 2025-08-20 14:30 US/Pacific with current details.\nWe apologize to all who are affected by the disruption.\n**Customer Symptoms :**\nSome Google SecOps customers are experiencing delays in the event indexing\n**Workaround :**\nNone at this time","status":"SERVICE_INFORMATION","affected_locations":[{"title":"Multi-region: us","id":"us"}]},{"created":"2025-08-20T19:17:48+00:00","modified":"2025-08-20T20:23:34+00:00","when":"2025-08-20T19:17:48+00:00","text":"**Description :**\nWe are experiencing an issue with Google SecOps beginning at 06:15 US/Pacific.\nOur engineering team continues to investigate the issue.\nWe will provide more information by Wednesday 2025-08-20 13:30 US/Pacific with current details.\nWe apologize to all who are affected by the disruption.\n**Customer Symptoms :**\nSome Google SecOps customers are experiencing delays in the event indexing\n**Workaround :**\nNone at this time","status":"SERVICE_INFORMATION","affected_locations":[{"title":"Multi-region: us","id":"us"}]},{"created":"2025-08-20T18:38:36+00:00","modified":"2025-08-20T19:17:48+00:00","when":"2025-08-20T18:38:36+00:00","text":"**Description :**\nWe are experiencing an issue with Google SecOps beginning at 06:15 US/Pacific.\nOur engineering team continues to investigate the issue.\nWe will provide more information by Wednesday 2025-08-20 12:30 US/Pacific with current details.\nWe apologize to all who are affected by the disruption.\n**Customer Symptoms :**\nSome Google SecOps customers are experiencing delays in the event indexing\n**Workaround :**\nNone at this time","status":"SERVICE_INFORMATION","affected_locations":[{"title":"Multi-region: us","id":"us"}]}],"most_recent_update":{"created":"2025-08-20T21:16:13+00:00","modified":"2025-08-20T21:16:13+00:00","when":"2025-08-20T21:16:13+00:00","text":"The issue with Google SecOps has been resolved for all affected projects as of Wednesday, 2025-08-20 14:10 PDT.\nWe thank you for your patience while we worked on resolving the issue.","status":"AVAILABLE","affected_locations":[]},"status_impact":"SERVICE_INFORMATION","severity":"low","service_key":"FHwvkSZ6RzzDYAvDZXMM","service_name":"Google SecOps","affected_products":[{"title":"Google SecOps","id":"FHwvkSZ6RzzDYAvDZXMM"}],"uri":"incidents/RVkA9s8jQC3YTXQozPfm","currently_affected_locations":[],"previously_affected_locations":[{"title":"Multi-region: us","id":"us"}]},{"id":"fg2VTDNvALBzoetYqNvE","number":"12938421250796660822","begin":"2025-08-19T01:55:00+00:00","created":"2025-08-19T02:40:05+00:00","end":"2025-08-19T03:30:00+00:00","modified":"2025-08-19T03:50:42+00:00","external_desc":"Google Threat Intelligence customers are experiencing an issue with failed searches with Smart Search.","updates":[{"created":"2025-08-19T03:50:22+00:00","modified":"2025-08-19T03:50:42+00:00","when":"2025-08-19T03:50:22+00:00","text":"**Summary**:\nGoogle Threat Intelligence customers were experiencing failed searches while using Smart Search functionality.\n**Description**:\nThe issue with Google Threat Intelligence has been resolved for all affected users as of Monday, 2025-08-18 20:30 PDT.\nWe thank you for your patience while we worked on resolving the issue.","status":"AVAILABLE","affected_locations":[]},{"created":"2025-08-19T02:40:05+00:00","modified":"2025-08-19T03:50:22+00:00","when":"2025-08-19T02:40:05+00:00","text":"**Summary**:\nGoogle Threat Intelligence customers are experiencing an issue with failed searches with Smart Search.\n**Description**:\nWe are experiencing an issue with Google Threat Intelligence beginning on Monday, 2025-08-18 18:55 PDT.\nOur engineering team continues to investigate the issue.\nWe will provide more information by Monday, 2025-08-18 21:00 PDT with current details.\nWe apologize to all who are affected by the disruption.\n**Diagnosis / Customer Symptoms**:\nSome users are experiencing failed searches when using Smart Search.\n**Workaround**:\nImpacted customers might try to search again.","status":"SERVICE_INFORMATION","affected_locations":[{"title":"Global","id":"global"}]}],"most_recent_update":{"created":"2025-08-19T03:50:22+00:00","modified":"2025-08-19T03:50:42+00:00","when":"2025-08-19T03:50:22+00:00","text":"**Summary**:\nGoogle Threat Intelligence customers were experiencing failed searches while using Smart Search functionality.\n**Description**:\nThe issue with Google Threat Intelligence has been resolved for all affected users as of Monday, 2025-08-18 20:30 PDT.\nWe thank you for your patience while we worked on resolving the issue.","status":"AVAILABLE","affected_locations":[]},"status_impact":"SERVICE_INFORMATION","severity":"low","service_key":"gdThxsn27IlqPf7hKvHT","service_name":"Google Threat Intelligence","affected_products":[{"title":"Google Threat Intelligence","id":"gdThxsn27IlqPf7hKvHT"}],"uri":"incidents/fg2VTDNvALBzoetYqNvE","currently_affected_locations":[],"previously_affected_locations":[{"title":"Global","id":"global"}]},{"id":"UHSBVcYPUw21V9AuT9a5","number":"5087812622209198894","begin":"2025-08-11T13:55:00+00:00","created":"2025-08-11T17:04:46+00:00","end":"2025-08-11T23:00:00+00:00","modified":"2025-08-11T23:40:37+00:00","external_desc":"Google SecOps customers are experiencing delays in log normalization in US and Europe Multi-regions","updates":[{"created":"2025-08-11T23:40:37+00:00","modified":"2025-08-11T23:40:37+00:00","when":"2025-08-11T23:40:37+00:00","text":"The issue with Google SecOps has been resolved for all affected users as of Monday, 2025-08-11 16:00 PDT\nFrom preliminary analysis, the root cause of the issue is a recent binary rollout on the backend database. Our engineers have mitigated the issue by rolling back the binary to the previous version.\nWe thank you for your patience while we worked on resolving the issue.","status":"AVAILABLE","affected_locations":[]},{"created":"2025-08-11T22:22:00+00:00","modified":"2025-08-11T23:40:37+00:00","when":"2025-08-11T22:22:00+00:00","text":"**Description**\nOur engineering team is actively working on mitigation efforts.\nAt this time, real time ingestion has recovered for both US and Europe Multi-regions.\nEngineers are continuing to work through the backlog of events.\nWe will provide an update by Monday, 2025-08-11 17:00 PDT with current details.\n**Symptoms**\nGoogle SecOps customers are experiencing delays in log normalization in US and Europe Multi-regions, which will delay data availability for search and detections.\n**Workaround**\nNone at this time.","status":"SERVICE_DISRUPTION","affected_locations":[{"title":"Multi-region: europe","id":"europe"},{"title":"Multi-region: us","id":"us"}]},{"created":"2025-08-11T20:13:46+00:00","modified":"2025-08-11T22:23:24+00:00","when":"2025-08-11T20:13:46+00:00","text":"**Description**\nMitigation work remains underway by our engineering team.\nAt this time, real time ingestion has recovered for both US and Europe Multi-regions.\nEngineers are continuing to work through the backlog of events.\nWe will provide an update by Monday, 2025-08-11 15:30 PDT with current details.\n**Symptoms**\nGoogle SecOps customers are experiencing delays in log normalization in US and Europe Multi-regions, which will delay data availability for search and detections.\n**Workaround**\nNone at this time.","status":"SERVICE_DISRUPTION","affected_locations":[{"title":"Multi-region: europe","id":"europe"},{"title":"Multi-region: us","id":"us"}]},{"created":"2025-08-11T18:54:22+00:00","modified":"2025-08-11T22:24:19+00:00","when":"2025-08-11T18:54:22+00:00","text":"**Description**\nMitigation work is underway by our engineering team. We expect normalization services to begin to recover in the next few hours.\nWe will provide an update by Monday, 2025-08-11 13:30 PDT with current details.\n**Symptoms**\nGoogle SecOps customers are experiencing delays in log normalization in US and Europe Multi-regions, which will delay data availability for search and detections.\n**Workaround**\nNone at this time.","status":"SERVICE_DISRUPTION","affected_locations":[{"title":"Multi-region: europe","id":"europe"},{"title":"Multi-region: us","id":"us"}]},{"created":"2025-08-11T18:06:15+00:00","modified":"2025-08-11T18:54:22+00:00","when":"2025-08-11T18:06:15+00:00","text":"**Description**\nWe are experiencing an issue with Google SecOps beginning at Monday, 2025-08-11 06:55 PDT.\nMitigation work is underway by our engineering team. We expect normalization services to begin to recover in the next few hours.\nWe will provide an update by Monday, 2025-08-11 12:00 PDT with current details.\nWe apologize to all who are affected by the disruption.\n**Symptoms**\nGoogle SecOps customers are experiencing delays in log normalization in US and Europe Multi-regions, which will delay data availability for search and detections.\n**Workaround**\nNone at this time.","status":"SERVICE_DISRUPTION","affected_locations":[{"title":"Multi-region: europe","id":"europe"},{"title":"Multi-region: us","id":"us"}]},{"created":"2025-08-11T17:04:46+00:00","modified":"2025-08-11T18:06:15+00:00","when":"2025-08-11T17:04:46+00:00","text":"**Description**\nWe are experiencing an issue with Google SecOps beginning at Monday, 2025-08-11 06:55 PDT.\nOur engineering team continues to investigate the issue.\nWe will provide an update by Monday, 2025-08-11 11:00 PDT with current details.\nWe apologize to all who are affected by the disruption.\n**Symptoms**\nGoogle SecOps customers are experiencing delays in log normalization in US and Europe Multi-regions, which will delay data availability for search and detections.\n**Workaround**\nNone at this time.","status":"SERVICE_DISRUPTION","affected_locations":[]}],"most_recent_update":{"created":"2025-08-11T23:40:37+00:00","modified":"2025-08-11T23:40:37+00:00","when":"2025-08-11T23:40:37+00:00","text":"The issue with Google SecOps has been resolved for all affected users as of Monday, 2025-08-11 16:00 PDT\nFrom preliminary analysis, the root cause of the issue is a recent binary rollout on the backend database. Our engineers have mitigated the issue by rolling back the binary to the previous version.\nWe thank you for your patience while we worked on resolving the issue.","status":"AVAILABLE","affected_locations":[]},"status_impact":"SERVICE_DISRUPTION","severity":"medium","service_key":"FHwvkSZ6RzzDYAvDZXMM","service_name":"Google SecOps","affected_products":[{"title":"Google SecOps","id":"FHwvkSZ6RzzDYAvDZXMM"}],"uri":"incidents/UHSBVcYPUw21V9AuT9a5","currently_affected_locations":[],"previously_affected_locations":[{"title":"Multi-region: europe","id":"europe"},{"title":"Multi-region: us","id":"us"}]},{"id":"yVxWZR7GEgDyNU4nonyt","number":"15470345732239300988","begin":"2025-08-01T03:00:00+00:00","created":"2025-09-09T19:45:46+00:00","end":"2025-08-19T21:00:00+00:00","modified":"2025-09-09T19:51:19+00:00","external_desc":"Some Google SecOps customers in the US may be experiencing some inconsistencies in detections including duplicate and delayed detections.","updates":[{"created":"2025-09-09T19:51:19+00:00","modified":"2025-09-09T19:51:19+00:00","when":"2025-09-09T19:51:19+00:00","text":"**Summary:**\nSome Google SecOps customers in the US may have experienced some inconsistencies in detections including duplicate and delayed detections.\n**Description:**\nThe issue with Google SecOps began on Thursday, 2025-07-31 20:00 PDT and was mitigated for all affected customers as of Tuesday, 2025-08-19 14:00 PDT.\nFrom preliminary analysis, we have identified that the issue was triggered by a misconfiguration in SecOps batch pipelines.\nOur engineers have mitigated the issue by fixing the misconfiguration and adding validations to prevent future misconfigurations. Engineers initiated a backfill that will fix the data inconsistencies once completed.\nWe thank you for your patience while we worked on resolving the issue.\n**Symptoms:**\nAffected customers may have experienced some inconsistencies in detections including duplicate and delayed detections.\n**Workaround:**\nNone at this time.","status":"AVAILABLE","affected_locations":[]},{"created":"2025-09-09T19:45:46+00:00","modified":"2025-09-09T19:51:19+00:00","when":"2025-09-09T19:45:46+00:00","text":"**Summary:**\nSome Google SecOps customers in the US may be experiencing some inconsistencies in detections including duplicate and delayed detections.\n**Description:**\nWe are experiencing an issue with Google SecOps beginning on Tuesday, 2025-08-18 12:14 PDT.\nOur engineering team continues to investigate the issue.\nWe will provide an update by Tuesday, 2025-09-09 13:00 PDT with current details.\nWe apologize to all who are affected by the disruption.\n**Symptoms:**\nAffected customers experienced some inconsistencies in detections including duplicate and delayed detections.\n**Workaround:**\nNone at this time.","status":"SERVICE_INFORMATION","affected_locations":[{"title":"Multi-region: us","id":"us"}]}],"most_recent_update":{"created":"2025-09-09T19:51:19+00:00","modified":"2025-09-09T19:51:19+00:00","when":"2025-09-09T19:51:19+00:00","text":"**Summary:**\nSome Google SecOps customers in the US may have experienced some inconsistencies in detections including duplicate and delayed detections.\n**Description:**\nThe issue with Google SecOps began on Thursday, 2025-07-31 20:00 PDT and was mitigated for all affected customers as of Tuesday, 2025-08-19 14:00 PDT.\nFrom preliminary analysis, we have identified that the issue was triggered by a misconfiguration in SecOps batch pipelines.\nOur engineers have mitigated the issue by fixing the misconfiguration and adding validations to prevent future misconfigurations. Engineers initiated a backfill that will fix the data inconsistencies once completed.\nWe thank you for your patience while we worked on resolving the issue.\n**Symptoms:**\nAffected customers may have experienced some inconsistencies in detections including duplicate and delayed detections.\n**Workaround:**\nNone at this time.","status":"AVAILABLE","affected_locations":[]},"status_impact":"SERVICE_INFORMATION","severity":"low","service_key":"FHwvkSZ6RzzDYAvDZXMM","service_name":"Google SecOps","affected_products":[{"title":"Google SecOps","id":"FHwvkSZ6RzzDYAvDZXMM"}],"uri":"incidents/yVxWZR7GEgDyNU4nonyt","currently_affected_locations":[],"previously_affected_locations":[{"title":"Toronto (northamerica-northeast2)","id":"northamerica-northeast2"},{"title":"São Paulo (southamerica-east1)","id":"southamerica-east1"}]},{"id":"EDPsWgZYNGUxWHHVXyRK","number":"4481773729045120681","begin":"2025-07-18T14:06:00+00:00","created":"2025-07-18T16:31:23+00:00","end":"2025-07-18T16:40:00+00:00","modified":"2025-07-22T14:47:14+00:00","external_desc":"We are investigating elevated error rates with multiple products in us-east1","updates":[{"created":"2025-07-22T14:47:14+00:00","modified":"2025-07-22T14:47:14+00:00","when":"2025-07-22T14:47:14+00:00","text":"The Incident Report is now available on the https://status.cloud.google.com/incidents/8cY8jdUpEGGbsSMSQk7J\n[Google Cloud Service Health Dashboard] while we prepare a full Issue Summary Report.","status":"AVAILABLE","affected_locations":[]},{"created":"2025-07-18T22:35:50+00:00","modified":"2025-07-22T14:47:14+00:00","when":"2025-07-18T22:35:50+00:00","text":"The Mini Incident Report is available on the https://status.cloud.google.com/incidents/8cY8jdUpEGGbsSMSQk7J (Google Cloud Service Health Dashboard) while we prepare a full Incident Summary Report.","status":"AVAILABLE","affected_locations":[]},{"created":"2025-07-18T16:49:37+00:00","modified":"2025-07-18T22:35:50+00:00","when":"2025-07-18T16:49:37+00:00","text":"The issue with Google Secops products has been resolved for all affected users as of 2025-07-18 09:40 US/Pacific.\nThe issue was due to networking hardware failure. Our engineers have mitigated the issue by recovering the failed hardware\nWe will publish analysis of this incident once we have completed our internal investigation.\nWe truly appreciate your patience and understanding while we worked to restore service.","status":"SERVICE_DISRUPTION","affected_locations":[{"title":"Multi-region: us","id":"us"},{"title":"South Carolina (us-east1)","id":"us-east1"}]},{"created":"2025-07-18T16:31:23+00:00","modified":"2025-07-18T16:49:37+00:00","when":"2025-07-18T16:31:23+00:00","text":"Our engineers have confirmed that us-east1-b is partially affected. All other zones in us-east1 are currently operating normally.\nOur engineers have recovered the failed hardware and are currently recovering the network control plane in the affected zones.\nWe'll provide another update by 10:00 AM US/Pacific, July 18, 2025.","status":"SERVICE_DISRUPTION","affected_locations":[{"title":"Multi-region: us","id":"us"},{"title":"South Carolina (us-east1)","id":"us-east1"}]}],"most_recent_update":{"created":"2025-07-22T14:47:14+00:00","modified":"2025-07-22T14:47:14+00:00","when":"2025-07-22T14:47:14+00:00","text":"The Incident Report is now available on the https://status.cloud.google.com/incidents/8cY8jdUpEGGbsSMSQk7J\n[Google Cloud Service Health Dashboard] while we prepare a full Issue Summary Report.","status":"AVAILABLE","affected_locations":[]},"status_impact":"SERVICE_DISRUPTION","severity":"medium","service_key":"zall","service_name":"Multiple Products","affected_products":[{"title":"Google SecOps","id":"FHwvkSZ6RzzDYAvDZXMM"},{"title":"Google SecOps SOAR","id":"GTT16Lf72XZKWArC9VxA"}],"uri":"incidents/EDPsWgZYNGUxWHHVXyRK","currently_affected_locations":[],"previously_affected_locations":[{"title":"Multi-region: us","id":"us"},{"title":"South Carolina (us-east1)","id":"us-east1"}]},{"id":"HBDNoxVo6gZVKyGoExQD","number":"6963867285201056837","begin":"2025-07-17T14:24:00+00:00","created":"2025-07-17T16:06:50+00:00","end":"2025-07-17T16:15:00+00:00","modified":"2025-07-17T17:02:36+00:00","external_desc":"Google Secops UDM Search customers are experiencing elevated latency in their queries","updates":[{"created":"2025-07-17T17:02:34+00:00","modified":"2025-07-17T17:02:36+00:00","when":"2025-07-17T17:02:34+00:00","text":"The issue with Google SecOps has been resolved for all affected users as of Thursday, 2025-07-17 09:15 PDT,\nFrom preliminary analysis, the root cause of the issue is an overload on our query processing systems, our engineers have mitigated the issue by prioritizing the query processing traffic.\nWe thank you for your patience while we worked on resolving the issue.","status":"AVAILABLE","affected_locations":[]},{"created":"2025-07-17T16:06:50+00:00","modified":"2025-07-17T17:02:34+00:00","when":"2025-07-17T16:06:50+00:00","text":"**Description:**\nWe are experiencing an issue with Google SecOps beginning at Thursday, 2025-07-17 07:24 PDT.\nOur engineering team continues to investigate the issue.\nWe will provide an update by Thursday, 2025-07-17 09:45 PDT with current details.\nWe apologize to all who are affected by the disruption.\n**Symptoms:**\nGoogle SecOps customers using UDM Search and Dashboards may experience errors and heightened latency in their queries. Some rule executions may be delayed.\n**Workaround:**\nNone at this time.","status":"SERVICE_INFORMATION","affected_locations":[{"title":"Multi-region: us","id":"us"}]}],"most_recent_update":{"created":"2025-07-17T17:02:34+00:00","modified":"2025-07-17T17:02:36+00:00","when":"2025-07-17T17:02:34+00:00","text":"The issue with Google SecOps has been resolved for all affected users as of Thursday, 2025-07-17 09:15 PDT,\nFrom preliminary analysis, the root cause of the issue is an overload on our query processing systems, our engineers have mitigated the issue by prioritizing the query processing traffic.\nWe thank you for your patience while we worked on resolving the issue.","status":"AVAILABLE","affected_locations":[]},"status_impact":"SERVICE_INFORMATION","severity":"low","service_key":"FHwvkSZ6RzzDYAvDZXMM","service_name":"Google SecOps","affected_products":[{"title":"Google SecOps","id":"FHwvkSZ6RzzDYAvDZXMM"}],"uri":"incidents/HBDNoxVo6gZVKyGoExQD","currently_affected_locations":[],"previously_affected_locations":[{"title":"Multi-region: us","id":"us"}]},{"id":"Ls7arFK2h9Foz97uVF3c","number":"13544322332470693694","begin":"2025-07-08T12:40:00+00:00","created":"2025-07-08T17:49:17+00:00","end":"2025-07-08T17:38:00+00:00","modified":"2025-07-08T17:53:44+00:00","external_desc":"Google SecOps customers experienced intermittent permissions errors when performing searches.","updates":[{"created":"2025-07-08T17:49:17+00:00","modified":"2025-07-08T17:53:44+00:00","when":"2025-07-08T17:49:17+00:00","text":"**Title**\nGoogle SecOps customers experienced intermittent errors when performing searches.\n**Description**\nWe experienced an issue with Google SecOps beginning at Tuesday, 2025-07-08 05:40 PDT.\nThe issue has been mitigated as of Tuesday, 2025-07-08 10:38 PDT.\nWe apologize to all who were affected by the disruption.\n**Symptoms**\nGoogle SecOps customers may experience intermittent errors when performing searches.\n**Workaround**\nNone at this time.","status":"AVAILABLE","affected_locations":[]}],"most_recent_update":{"created":"2025-07-08T17:49:17+00:00","modified":"2025-07-08T17:53:44+00:00","when":"2025-07-08T17:49:17+00:00","text":"**Title**\nGoogle SecOps customers experienced intermittent errors when performing searches.\n**Description**\nWe experienced an issue with Google SecOps beginning at Tuesday, 2025-07-08 05:40 PDT.\nThe issue has been mitigated as of Tuesday, 2025-07-08 10:38 PDT.\nWe apologize to all who were affected by the disruption.\n**Symptoms**\nGoogle SecOps customers may experience intermittent errors when performing searches.\n**Workaround**\nNone at this time.","status":"AVAILABLE","affected_locations":[]},"status_impact":"SERVICE_INFORMATION","severity":"low","service_key":"FHwvkSZ6RzzDYAvDZXMM","service_name":"Google SecOps","affected_products":[{"title":"Google SecOps","id":"FHwvkSZ6RzzDYAvDZXMM"}],"uri":"incidents/Ls7arFK2h9Foz97uVF3c","currently_affected_locations":[],"previously_affected_locations":[]},{"id":"pAscPvTiicGA68Xf8t6H","number":"16713343951301990802","begin":"2025-07-03T14:28:00+00:00","created":"2025-07-03T16:02:14+00:00","end":"2025-07-03T16:35:00+00:00","modified":"2025-07-03T16:55:13+00:00","external_desc":"Google SecOps customers are experiencing UDM (Unified Data Model) search errors","updates":[{"created":"2025-07-03T16:54:51+00:00","modified":"2025-07-03T16:55:13+00:00","when":"2025-07-03T16:54:51+00:00","text":"The issue with Google SecOps has been resolved for all affected projects as of Thursday, 2025-07-03 09:35 PDT.\nFrom our preliminary analysis, the impact was caused due to an inadvertent change resulting in an incorrect dependency for the search query engine. Our engineering team mitigated the impact by removing that dependency\nWe thank you for your patience while we worked on resolving the issue.","status":"AVAILABLE","affected_locations":[]},{"created":"2025-07-03T16:35:33+00:00","modified":"2025-07-03T16:54:51+00:00","when":"2025-07-03T16:35:33+00:00","text":"**Description :**\nMitigation work is currently underway by our engineering team and has been completed for the following regions :\n- Multi-regions us\n- Multi-regions europe\n- asia-southeast1\n- europe-west2\n- europe-west3\n- europe-west6\n- europe-west9\n- me-west1\n- me-central1\nWe are continuing to apply the mitigation for the remaining impacted regions.\nThe mitigation is expected to be completed by Thursday, 2025-07-03 09:45 PDT.\nWe will provide more information by Thursday, 2025-07-03 10:00 PDT.\n**Customer Symptoms :** Customers may experience errors stating “Search has encountered and error and could not load data”\n**Workaround :** None at this time","status":"SERVICE_INFORMATION","affected_locations":[{"title":"Johannesburg (africa-south1)","id":"africa-south1"},{"title":"Tokyo (asia-northeast1)","id":"asia-northeast1"},{"title":"Mumbai (asia-south1)","id":"asia-south1"},{"title":"Singapore (asia-southeast1)","id":"asia-southeast1"},{"title":"Jakarta (asia-southeast2)","id":"asia-southeast2"},{"title":"Sydney (australia-southeast1)","id":"australia-southeast1"},{"title":"Multi-region: europe","id":"europe"},{"title":"Turin (europe-west12)","id":"europe-west12"},{"title":"London (europe-west2)","id":"europe-west2"},{"title":"Frankfurt (europe-west3)","id":"europe-west3"},{"title":"Zurich (europe-west6)","id":"europe-west6"},{"title":"Paris (europe-west9)","id":"europe-west9"},{"title":"Doha (me-central1)","id":"me-central1"},{"title":"Dammam (me-central2)","id":"me-central2"},{"title":"Tel Aviv (me-west1)","id":"me-west1"},{"title":"Toronto (northamerica-northeast2)","id":"northamerica-northeast2"},{"title":"São Paulo (southamerica-east1)","id":"southamerica-east1"},{"title":"Multi-region: us","id":"us"}]},{"created":"2025-07-03T16:02:14+00:00","modified":"2025-07-03T16:35:33+00:00","when":"2025-07-03T16:02:14+00:00","text":"**Description :**\nWe are experiencing an issue with Google SecOps beginning on Thursday, 2025-07-03 07:08 PDT.\nOur engineering team continues to investigate the issue.\nWe will provide an update by Thursday, 2025-07-03 10:00 PDT with current details.\n**Customer Symptoms :** Customers may experience errors stating “Search has encountered and error and could not load data”\n**Workaround :** None at this time","status":"SERVICE_INFORMATION","affected_locations":[{"title":"Johannesburg (africa-south1)","id":"africa-south1"},{"title":"Tokyo (asia-northeast1)","id":"asia-northeast1"},{"title":"Mumbai (asia-south1)","id":"asia-south1"},{"title":"Singapore (asia-southeast1)","id":"asia-southeast1"},{"title":"Jakarta (asia-southeast2)","id":"asia-southeast2"},{"title":"Sydney (australia-southeast1)","id":"australia-southeast1"},{"title":"Multi-region: europe","id":"europe"},{"title":"Turin (europe-west12)","id":"europe-west12"},{"title":"London (europe-west2)","id":"europe-west2"},{"title":"Frankfurt (europe-west3)","id":"europe-west3"},{"title":"Zurich (europe-west6)","id":"europe-west6"},{"title":"Paris (europe-west9)","id":"europe-west9"},{"title":"Doha (me-central1)","id":"me-central1"},{"title":"Dammam (me-central2)","id":"me-central2"},{"title":"Tel Aviv (me-west1)","id":"me-west1"},{"title":"Toronto (northamerica-northeast2)","id":"northamerica-northeast2"},{"title":"São Paulo (southamerica-east1)","id":"southamerica-east1"},{"title":"Multi-region: us","id":"us"}]}],"most_recent_update":{"created":"2025-07-03T16:54:51+00:00","modified":"2025-07-03T16:55:13+00:00","when":"2025-07-03T16:54:51+00:00","text":"The issue with Google SecOps has been resolved for all affected projects as of Thursday, 2025-07-03 09:35 PDT.\nFrom our preliminary analysis, the impact was caused due to an inadvertent change resulting in an incorrect dependency for the search query engine. Our engineering team mitigated the impact by removing that dependency\nWe thank you for your patience while we worked on resolving the issue.","status":"AVAILABLE","affected_locations":[]},"status_impact":"SERVICE_DISRUPTION","severity":"medium","service_key":"FHwvkSZ6RzzDYAvDZXMM","service_name":"Google SecOps","affected_products":[{"title":"Google SecOps","id":"FHwvkSZ6RzzDYAvDZXMM"}],"uri":"incidents/pAscPvTiicGA68Xf8t6H","currently_affected_locations":[],"previously_affected_locations":[{"title":"Johannesburg (africa-south1)","id":"africa-south1"},{"title":"Tokyo (asia-northeast1)","id":"asia-northeast1"},{"title":"Mumbai (asia-south1)","id":"asia-south1"},{"title":"Singapore (asia-southeast1)","id":"asia-southeast1"},{"title":"Jakarta (asia-southeast2)","id":"asia-southeast2"},{"title":"Sydney (australia-southeast1)","id":"australia-southeast1"},{"title":"Multi-region: europe","id":"europe"},{"title":"Turin (europe-west12)","id":"europe-west12"},{"title":"London (europe-west2)","id":"europe-west2"},{"title":"Frankfurt (europe-west3)","id":"europe-west3"},{"title":"Zurich (europe-west6)","id":"europe-west6"},{"title":"Paris (europe-west9)","id":"europe-west9"},{"title":"Doha (me-central1)","id":"me-central1"},{"title":"Dammam (me-central2)","id":"me-central2"},{"title":"Tel Aviv (me-west1)","id":"me-west1"},{"title":"Toronto (northamerica-northeast2)","id":"northamerica-northeast2"},{"title":"São Paulo (southamerica-east1)","id":"southamerica-east1"},{"title":"Multi-region: us","id":"us"}]},{"id":"C62B3DWoKpstxcur2p1M","number":"5789068925852766507","begin":"2025-07-02T10:46:00+00:00","created":"2025-07-02T12:22:06+00:00","end":"2025-07-02T13:09:00+00:00","modified":"2025-07-02T13:21:06+00:00","external_desc":"Mandiant Advantage Threat Intelligence may experience errors when performing a search via UI or API or accessing vulnerabilities.","updates":[{"created":"2025-07-02T13:21:04+00:00","modified":"2025-07-02T13:21:06+00:00","when":"2025-07-02T13:21:04+00:00","text":"The issue with Mandiant Advantage Threat Intelligence has been resolved for all affected users as of Wednesday, 2025-07-02 06:09 PDT.\nWe thank you for your patience while we worked on resolving the issue.","status":"AVAILABLE","affected_locations":[]},{"created":"2025-07-02T12:22:06+00:00","modified":"2025-07-02T13:21:04+00:00","when":"2025-07-02T12:22:06+00:00","text":"**Description**\nWe are experiencing an issue with Mandiant Advantage Threat Intelligence beginning on Wednesday, 2025-07-02 03:46 PDT.\nOur engineering team continues to investigate the issue.\nWe will provide an update by Wednesday, 2025-07-02 06:30 PDT\nwith current details.\nWe apologize to all who are affected by the disruption.\n**Symptoms**\nUsers may experience errors when performing a search via UI or API or accessing vulnerabilities.\n**Workaround**\nNone at this time.","status":"SERVICE_INFORMATION","affected_locations":[{"title":"Global","id":"global"}]}],"most_recent_update":{"created":"2025-07-02T13:21:04+00:00","modified":"2025-07-02T13:21:06+00:00","when":"2025-07-02T13:21:04+00:00","text":"The issue with Mandiant Advantage Threat Intelligence has been resolved for all affected users as of Wednesday, 2025-07-02 06:09 PDT.\nWe thank you for your patience while we worked on resolving the issue.","status":"AVAILABLE","affected_locations":[]},"status_impact":"SERVICE_INFORMATION","severity":"low","service_key":"Dvtt8cwUdpUYoGMpt2Fc","service_name":"Mandiant Advantage Threat Intelligence","affected_products":[{"title":"Mandiant Advantage Threat Intelligence","id":"Dvtt8cwUdpUYoGMpt2Fc"}],"uri":"incidents/C62B3DWoKpstxcur2p1M","currently_affected_locations":[],"previously_affected_locations":[{"title":"Global","id":"global"}]},{"id":"fxkY2SGdNRNHYrNWCktJ","number":"14441693826887081663","begin":"2025-07-01T19:23:00+00:00","created":"2025-07-01T19:50:49+00:00","end":"2025-07-03T15:55:00+00:00","modified":"2025-07-03T16:15:19+00:00","external_desc":"Mandiant Attack Surface Management customers may experience issues with Azure integrations.","updates":[{"created":"2025-07-03T16:15:03+00:00","modified":"2025-07-03T16:15:19+00:00","when":"2025-07-03T16:15:03+00:00","text":"The issue with Mandiant Attack Surface Management has been resolved for all affected projects as of Thursday, 2025-07-03 08:55 PDT.\nWe thank you for your patience while we worked on resolving the issue.","status":"AVAILABLE","affected_locations":[]},{"created":"2025-07-02T22:20:09+00:00","modified":"2025-07-03T16:15:03+00:00","when":"2025-07-02T22:20:09+00:00","text":"**Description**\nWe are experiencing an issue with Mandiant Attack Surface Management .\nMitigation work remains underway by our engineering team. We do not have an ETA for mitigation at this point.\nWe will provide an update by Thursday, 2025-07-03 10:00 PDT.\n**Symptoms**\nASM Customers Collections who have Azure Integrations will fail to run. Customers will see that they have no found Entities in Azure.\n**Workaround**\nNone at this time.","status":"SERVICE_INFORMATION","affected_locations":[{"title":"Global","id":"global"}]},{"created":"2025-07-02T16:54:55+00:00","modified":"2025-07-02T22:20:09+00:00","when":"2025-07-02T16:54:55+00:00","text":"**Description**\nWe are experiencing an issue with Mandiant Attack Surface Management .\nMitigation work remains underway by our engineering team. We do not have an ETA for mitigation at this point.\nWe will provide an update by Wednesday, 2025-07-02 16:00 PDT with current details.\n**Symptoms**\nASM Customers Collections who have Azure Integrations will fail to run. Customers will see that they have no found Entities in Azure.\n**Workaround**\nNone at this time.","status":"SERVICE_INFORMATION","affected_locations":[{"title":"Global","id":"global"}]},{"created":"2025-07-02T01:14:00+00:00","modified":"2025-07-02T16:54:55+00:00","when":"2025-07-02T01:14:00+00:00","text":"**Description**\nWe are experiencing an issue with Mandiant Attack Surface Management .\nMitigation work is currently underway by our engineering team. We do not have an ETA for mitigation at this point.\nWe will provide an update by Wednesday, 2025-07-02 10:00 PDT with current details.\n**Symptoms**\nASM Customers Collections who have Azure Integrations will fail to run. Customers will see that they have no found Entities in Azure.\n**Workaround**\nNone at this time.","status":"SERVICE_INFORMATION","affected_locations":[{"title":"Global","id":"global"}]},{"created":"2025-07-01T22:51:48+00:00","modified":"2025-07-02T01:14:00+00:00","when":"2025-07-01T22:51:48+00:00","text":"**Description**\nWe are experiencing an issue with Mandiant Attack Surface Management .\nMitigation work is currently underway by our engineering team. We do not have an ETA for mitigation at this point.\nWe will provide an update by Tuesday, 2025-07-01 20:00 PDT with current details.\n**Symptoms**\nASM Customers Collections who have Azure Integrations will fail to run. Customers will see that they have no found Entities in Azure.\n**Workaround**\nNone at this time.","status":"SERVICE_INFORMATION","affected_locations":[{"title":"Global","id":"global"}]},{"created":"2025-07-01T19:50:49+00:00","modified":"2025-07-01T22:51:48+00:00","when":"2025-07-01T19:50:49+00:00","text":"**Description**\nWe are experiencing an issue with Mandiant Attack Surface Management .\nOur engineering team continues to investigate the issue.\nWe will provide an update by Tuesday, 2025-07-01 14:00 PDT with current details.\nWe apologize to all who are affected by the disruption.\n**Symptoms**\nASM Customers Collections who have Azure Integrations will fail to run. Customers will see that they have no found Entities in Azure.\n**Workaround**\nNone at this time.","status":"SERVICE_INFORMATION","affected_locations":[{"title":"Global","id":"global"}]}],"most_recent_update":{"created":"2025-07-03T16:15:03+00:00","modified":"2025-07-03T16:15:19+00:00","when":"2025-07-03T16:15:03+00:00","text":"The issue with Mandiant Attack Surface Management has been resolved for all affected projects as of Thursday, 2025-07-03 08:55 PDT.\nWe thank you for your patience while we worked on resolving the issue.","status":"AVAILABLE","affected_locations":[]},"status_impact":"SERVICE_INFORMATION","severity":"low","service_key":"v7DL2fMFnZpCxNwd8KE7","service_name":"Mandiant Attack Surface Management","affected_products":[{"title":"Mandiant Attack Surface Management","id":"v7DL2fMFnZpCxNwd8KE7"}],"uri":"incidents/fxkY2SGdNRNHYrNWCktJ","currently_affected_locations":[],"previously_affected_locations":[{"title":"Global","id":"global"}]},{"id":"szf4sSoAHSQ8ZNtNPUra","number":"17977745399466175195","begin":"2025-07-01T07:58:00+00:00","created":"2025-07-01T08:56:12+00:00","end":"2025-07-01T09:01:00+00:00","modified":"2025-07-01T09:12:50+00:00","external_desc":"Customers signing in in these region would be getting a 500 error","updates":[{"created":"2025-07-01T08:56:12+00:00","modified":"2025-07-01T09:12:50+00:00","when":"2025-07-01T08:56:12+00:00","text":"Customers signing in in these region would be getting a 500 error for the regions: Europe , Europe west 12, Europe west 2, Europe west 3, Europe west 6, Me central 1, Me central 2, Me west 1","status":"AVAILABLE","affected_locations":[]}],"most_recent_update":{"created":"2025-07-01T08:56:12+00:00","modified":"2025-07-01T09:12:50+00:00","when":"2025-07-01T08:56:12+00:00","text":"Customers signing in in these region would be getting a 500 error for the regions: Europe , Europe west 12, Europe west 2, Europe west 3, Europe west 6, Me central 1, Me central 2, Me west 1","status":"AVAILABLE","affected_locations":[]},"status_impact":"SERVICE_DISRUPTION","severity":"medium","service_key":"FHwvkSZ6RzzDYAvDZXMM","service_name":"Google SecOps","affected_products":[{"title":"Google SecOps","id":"FHwvkSZ6RzzDYAvDZXMM"}],"uri":"incidents/szf4sSoAHSQ8ZNtNPUra","currently_affected_locations":[],"previously_affected_locations":[{"title":"Multi-region: europe","id":"europe"},{"title":"Turin (europe-west12)","id":"europe-west12"},{"title":"London (europe-west2)","id":"europe-west2"},{"title":"Frankfurt (europe-west3)","id":"europe-west3"},{"title":"Zurich (europe-west6)","id":"europe-west6"},{"title":"Doha (me-central1)","id":"me-central1"},{"title":"Dammam (me-central2)","id":"me-central2"},{"title":"Tel Aviv (me-west1)","id":"me-west1"}]},{"id":"3S5arVXS7MRmVcMx2AMy","number":"11897741004515472911","begin":"2025-06-19T14:04:00+00:00","created":"2025-06-25T17:11:46+00:00","end":"2025-06-26T11:30:00+00:00","modified":"2025-06-26T12:36:12+00:00","external_desc":"Google Mandiant Digital Threat Monitoring customers may experience a backlog of old alerts resurfacing","updates":[{"created":"2025-06-26T12:36:08+00:00","modified":"2025-06-26T12:36:12+00:00","when":"2025-06-26T12:36:08+00:00","text":"The issue with Google Mandiant Digital Threat Monitoring has been resolved for all affected\nusers as of Thursday, 2025-06-26 04:30 US/Pacific.\nAlerts from 2025-06-19, 04:08 US/Pacific to 2025-06-23, 22:00 US/Pacific may show up over the next day.\nWe thank you for your patience while we worked on resolving the issue.","status":"AVAILABLE","affected_locations":[]},{"created":"2025-06-25T17:11:46+00:00","modified":"2025-06-26T12:36:08+00:00","when":"2025-06-25T17:11:46+00:00","text":"**Summary**\nGoogle Mandiant Digital Threat Monitoring customers may experience a backlog of old alerts resurfacing\n**Description**\nAn issue was identified with Google Mandiant Digital Threat Monitoring beginning on Thursday, 2025-06-19 04:08 US/Pacific where a delay in alerts being surfaced to customers was identified.\nEngineering has mitigated the issue and is working through the backlog alert processing.\nWe will provide another update by Thursday, 2025-06-26 08:00 US/Pacific\n**Customer Symptoms**\nUsers may see old alerts surfaced from Thursday, 2025-06-19 04:08 US/Pacific\nthrough Wednesday, 2025-06-25 09:05 US/Pacific, new alerts are processing in real time.\n**Workaround**\nNone at this time.","status":"SERVICE_INFORMATION","affected_locations":[{"title":"Global","id":"global"}]}],"most_recent_update":{"created":"2025-06-26T12:36:08+00:00","modified":"2025-06-26T12:36:12+00:00","when":"2025-06-26T12:36:08+00:00","text":"The issue with Google Mandiant Digital Threat Monitoring has been resolved for all affected\nusers as of Thursday, 2025-06-26 04:30 US/Pacific.\nAlerts from 2025-06-19, 04:08 US/Pacific to 2025-06-23, 22:00 US/Pacific may show up over the next day.\nWe thank you for your patience while we worked on resolving the issue.","status":"AVAILABLE","affected_locations":[]},"status_impact":"SERVICE_INFORMATION","severity":"low","service_key":"dgtVvWgKSlxi01VBC8mt","service_name":"Mandiant Digital Threat Monitoring","affected_products":[{"title":"Mandiant Digital Threat Monitoring","id":"dgtVvWgKSlxi01VBC8mt"}],"uri":"incidents/3S5arVXS7MRmVcMx2AMy","currently_affected_locations":[],"previously_affected_locations":[{"title":"Global","id":"global"}]},{"id":"yRSgKSjhxbQNjJQURM7E","number":"15072280596468221234","begin":"2025-06-12T17:51:00+00:00","created":"2025-06-12T19:16:40+00:00","end":"2025-06-12T20:45:00+00:00","modified":"2025-06-14T00:08:05+00:00","external_desc":"Multiple Google SecOps products are experiencing Service issues with API requests","updates":[{"created":"2025-06-14T00:00:02+00:00","modified":"2025-06-14T00:08:05+00:00","when":"2025-06-14T00:00:02+00:00","text":"The detailed Incident Report is now available on the Google Cloud Service Health Dashboard at https://status.cloud.google.com/incidents/ow5i3PPK96RduMcb1SsW","status":"AVAILABLE","affected_locations":[]},{"created":"2025-06-12T22:22:50+00:00","modified":"2025-06-14T00:00:02+00:00","when":"2025-06-12T22:22:50+00:00","text":"The Google Security products have fully recovered from the previous outage.\nSome SecOps ingestion may have been affected. Data may need to be reingested from the outage period from 12 June 2025 10:51 PDT to 13:45 PDT.\nPlease check for failures as described in https://cloud.google.com/chronicle/docs/administration/feed-management#troubleshooting","status":"SERVICE_INFORMATION","affected_locations":[{"title":"Tokyo (asia-northeast1)","id":"asia-northeast1"},{"title":"Mumbai (asia-south1)","id":"asia-south1"},{"title":"Singapore (asia-southeast1)","id":"asia-southeast1"},{"title":"Sydney (australia-southeast1)","id":"australia-southeast1"},{"title":"Multi-region: europe","id":"europe"},{"title":"Turin (europe-west12)","id":"europe-west12"},{"title":"London (europe-west2)","id":"europe-west2"},{"title":"Frankfurt (europe-west3)","id":"europe-west3"},{"title":"Zurich (europe-west6)","id":"europe-west6"},{"title":"Paris (europe-west9)","id":"europe-west9"},{"title":"Doha (me-central1)","id":"me-central1"},{"title":"Dammam (me-central2)","id":"me-central2"},{"title":"Tel Aviv (me-west1)","id":"me-west1"},{"title":"Toronto (northamerica-northeast2)","id":"northamerica-northeast2"},{"title":"São Paulo (southamerica-east1)","id":"southamerica-east1"},{"title":"Multi-region: us","id":"us"}]},{"created":"2025-06-12T21:30:37+00:00","modified":"2025-06-12T22:22:50+00:00","when":"2025-06-12T21:30:37+00:00","text":"Most of the Google Security products have fully recovered from the previous outage.\nSome SecOps ingestion may have been affected. Data may need to be reingested from the outage period from\n12 June 2025 10:51 PDT to 13:45 PDT\nWe will provide an update by Thursday, 2025-06-12 16:30 PDT with current details.","status":"SERVICE_OUTAGE","affected_locations":[{"title":"Tokyo (asia-northeast1)","id":"asia-northeast1"},{"title":"Mumbai (asia-south1)","id":"asia-south1"},{"title":"Singapore (asia-southeast1)","id":"asia-southeast1"},{"title":"Sydney (australia-southeast1)","id":"australia-southeast1"},{"title":"Multi-region: europe","id":"europe"},{"title":"Turin (europe-west12)","id":"europe-west12"},{"title":"London (europe-west2)","id":"europe-west2"},{"title":"Frankfurt (europe-west3)","id":"europe-west3"},{"title":"Zurich (europe-west6)","id":"europe-west6"},{"title":"Paris (europe-west9)","id":"europe-west9"},{"title":"Global","id":"global"},{"title":"Doha (me-central1)","id":"me-central1"},{"title":"Dammam (me-central2)","id":"me-central2"},{"title":"Tel Aviv (me-west1)","id":"me-west1"},{"title":"Toronto (northamerica-northeast2)","id":"northamerica-northeast2"},{"title":"São Paulo (southamerica-east1)","id":"southamerica-east1"},{"title":"Multi-region: us","id":"us"}]},{"created":"2025-06-12T19:48:11+00:00","modified":"2025-06-12T21:30:37+00:00","when":"2025-06-12T19:48:11+00:00","text":"We have implemented mitigation for the issue in us-central1 and multi-region/us and we are seeing signs of recovery.\nWe have received confirmation from our internal monitoring and customers that the Google Cloud products are also seeing recovery in multiple regions and are also seeing signs of some recovery in us-central1 and mutli-region/us.\nWe expect the recovery to complete in less than an hour.\nWe will provide an update by Thursday, 2025-06-12 15:00 PDT with current details.","status":"SERVICE_OUTAGE","affected_locations":[{"title":"Tokyo (asia-northeast1)","id":"asia-northeast1"},{"title":"Mumbai (asia-south1)","id":"asia-south1"},{"title":"Singapore (asia-southeast1)","id":"asia-southeast1"},{"title":"Sydney (australia-southeast1)","id":"australia-southeast1"},{"title":"Multi-region: europe","id":"europe"},{"title":"Belgium (europe-west1)","id":"europe-west1"},{"title":"Turin (europe-west12)","id":"europe-west12"},{"title":"London (europe-west2)","id":"europe-west2"},{"title":"Frankfurt (europe-west3)","id":"europe-west3"},{"title":"Netherlands (europe-west4)","id":"europe-west4"},{"title":"Zurich (europe-west6)","id":"europe-west6"},{"title":"Paris (europe-west9)","id":"europe-west9"},{"title":"Global","id":"global"},{"title":"Doha (me-central1)","id":"me-central1"},{"title":"Dammam (me-central2)","id":"me-central2"},{"title":"Tel Aviv (me-west1)","id":"me-west1"},{"title":"Toronto (northamerica-northeast2)","id":"northamerica-northeast2"},{"title":"São Paulo (southamerica-east1)","id":"southamerica-east1"},{"title":"Multi-region: us","id":"us"},{"title":"Iowa (us-central1)","id":"us-central1"},{"title":"South Carolina (us-east1)","id":"us-east1"}]},{"created":"2025-06-12T19:16:40+00:00","modified":"2025-06-12T19:49:13+00:00","when":"2025-06-12T19:16:40+00:00","text":"**Summary:**\nMultiple Google SecOps products are experiencing Service issues with API requests\n**Description**\nWe are experiencing service issues with multiple Google SecOps products beginning at Thursday, 2025-06-12 10:51 PDT.\nOur engineers are continuing to mitigate the issue and we have confirmation that the issue is recovered in some locations.\nWe do not have an ETA on full mitigation at this point.\nWe will provide an update by Thursday, 2025-06-12 12:45 PDT with current details.\nWe apologize to all who are affected by the disruption.\n**Symptoms:**\nMultiple Google SecOps products are experiencing varying level of service impacts with API requests.\n**Workaround:**\nNone at this time.","status":"SERVICE_OUTAGE","affected_locations":[{"title":"Tokyo (asia-northeast1)","id":"asia-northeast1"},{"title":"Mumbai (asia-south1)","id":"asia-south1"},{"title":"Singapore (asia-southeast1)","id":"asia-southeast1"},{"title":"Sydney (australia-southeast1)","id":"australia-southeast1"},{"title":"Multi-region: europe","id":"europe"},{"title":"Belgium (europe-west1)","id":"europe-west1"},{"title":"Turin (europe-west12)","id":"europe-west12"},{"title":"London (europe-west2)","id":"europe-west2"},{"title":"Frankfurt (europe-west3)","id":"europe-west3"},{"title":"Netherlands (europe-west4)","id":"europe-west4"},{"title":"Zurich (europe-west6)","id":"europe-west6"},{"title":"Paris (europe-west9)","id":"europe-west9"},{"title":"Global","id":"global"},{"title":"Doha (me-central1)","id":"me-central1"},{"title":"Dammam (me-central2)","id":"me-central2"},{"title":"Tel Aviv (me-west1)","id":"me-west1"},{"title":"Toronto (northamerica-northeast2)","id":"northamerica-northeast2"},{"title":"São Paulo (southamerica-east1)","id":"southamerica-east1"},{"title":"Multi-region: us","id":"us"},{"title":"Iowa (us-central1)","id":"us-central1"},{"title":"South Carolina (us-east1)","id":"us-east1"}]}],"most_recent_update":{"created":"2025-06-14T00:00:02+00:00","modified":"2025-06-14T00:08:05+00:00","when":"2025-06-14T00:00:02+00:00","text":"The detailed Incident Report is now available on the Google Cloud Service Health Dashboard at https://status.cloud.google.com/incidents/ow5i3PPK96RduMcb1SsW","status":"AVAILABLE","affected_locations":[]},"status_impact":"SERVICE_OUTAGE","severity":"high","service_key":"zall","service_name":"Multiple Products","affected_products":[{"title":"Google SecOps","id":"FHwvkSZ6RzzDYAvDZXMM"},{"title":"Google SecOps SOAR","id":"GTT16Lf72XZKWArC9VxA"},{"title":"Google Threat Intelligence","id":"gdThxsn27IlqPf7hKvHT"},{"title":"Mandiant Advantage Threat Intelligence","id":"Dvtt8cwUdpUYoGMpt2Fc"},{"title":"Mandiant Attack Surface Management","id":"v7DL2fMFnZpCxNwd8KE7"},{"title":"Mandiant Digital Threat Monitoring","id":"dgtVvWgKSlxi01VBC8mt"},{"title":"Mandiant Hunt","id":"uomxopvCRv8y7bvrA1tK"},{"title":"Mandiant Managed Defense","id":"9aKw9s8p43AYeBmo4Gvx"}],"uri":"incidents/yRSgKSjhxbQNjJQURM7E","currently_affected_locations":[],"previously_affected_locations":[{"title":"Tokyo (asia-northeast1)","id":"asia-northeast1"},{"title":"Mumbai (asia-south1)","id":"asia-south1"},{"title":"Singapore (asia-southeast1)","id":"asia-southeast1"},{"title":"Sydney (australia-southeast1)","id":"australia-southeast1"},{"title":"Multi-region: europe","id":"europe"},{"title":"Belgium (europe-west1)","id":"europe-west1"},{"title":"Turin (europe-west12)","id":"europe-west12"},{"title":"London (europe-west2)","id":"europe-west2"},{"title":"Frankfurt (europe-west3)","id":"europe-west3"},{"title":"Netherlands (europe-west4)","id":"europe-west4"},{"title":"Zurich (europe-west6)","id":"europe-west6"},{"title":"Paris (europe-west9)","id":"europe-west9"},{"title":"Global","id":"global"},{"title":"Doha (me-central1)","id":"me-central1"},{"title":"Dammam (me-central2)","id":"me-central2"},{"title":"Tel Aviv (me-west1)","id":"me-west1"},{"title":"Toronto (northamerica-northeast2)","id":"northamerica-northeast2"},{"title":"São Paulo (southamerica-east1)","id":"southamerica-east1"},{"title":"Multi-region: us","id":"us"},{"title":"Iowa (us-central1)","id":"us-central1"},{"title":"South Carolina (us-east1)","id":"us-east1"}]},{"id":"GfDrxgSaoSf5Uu92NSFL","number":"18231661797705825424","begin":"2025-05-29T18:29:00+00:00","created":"2025-06-02T23:19:56+00:00","end":"2025-06-02T23:37:00+00:00","modified":"2025-06-04T00:23:12+00:00","external_desc":"Google SecOps customers may experience degradation of certain detection views for a subset of alerts.","updates":[{"created":"2025-06-04T00:23:12+00:00","modified":"2025-06-04T00:23:13+00:00","when":"2025-06-04T00:23:12+00:00","text":"**Summary**\nGoogle SecOps customers may experience missing alerts in alert views for a subset of alerts. SOAR case views are not affected.\n**Description**\nThe root cause for the missing alerts for Google SecOps alert views has been identified and resolved as of 2025-06-02 16:37 PDT.\nThough the new alert detections are working as expected, the engineering team continues to work on backfilling the missing alert data for some of the impacted customers as per the mitigation plan.\nThe impacted customers will be communicated with the further progress on backfilling separately via support cases.\nIf you have questions or are impacted, please open a case with the Support Team and we will work with you until this issue is resolved.","status":"AVAILABLE","affected_locations":[]},{"created":"2025-06-03T18:37:26+00:00","modified":"2025-06-04T00:23:12+00:00","when":"2025-06-03T18:37:26+00:00","text":"**Summary**\nGoogle SecOps customers may experience degradation of certain detection views for a subset of alerts.\n**Description**\nMitigation work is currently underway by our engineering team.\nThe team has identified and resolved the root cause, which resolves the issue for new-arriving detections as of 2025-06-02 16:37 PDT. Additional data backfill will be required to mitigate the impact for existing detections. Engineering is currently creating a plan for these backfill steps.\nWe do not have an ETA for complete mitigation at this point.\nWe will provide an update by Tuesday, 2025-06-03 18:00 PDT with current details.\n**Symptoms**\nImpacted customers may experience missing alerts in certain alert views while using Google SecOps.\n**Workaround**\nDetections are visible under the /ruleDetections view accessible from the Rules Dashboard. SOAR customers will also see these alerts on the case page.\nRules of particular concern can be copied into a new rule and run as a retrohunt.","status":"SERVICE_INFORMATION","affected_locations":[{"title":"Frankfurt (europe-west3)","id":"europe-west3"},{"title":"Multi-region: us","id":"us"}]},{"created":"2025-06-03T04:23:26+00:00","modified":"2025-06-03T18:37:26+00:00","when":"2025-06-03T04:23:26+00:00","text":"**Summary**\nGoogle SecOps customers may experience degradation of certain detection views for a subset of alerts.\n**Description**\nMitigation work is currently underway by our engineering team.\nThe team has identified and resolved the root cause, which resolves the issue for new-arriving detections as of 2025-06-02 16:37 PDT. Additional data backfill will be required to mitigate the impact for existing detections. Engineering is currently creating a plan for these backfill steps.\nWe do not have an ETA for complete mitigation at this point.\nWe will provide an update by Tuesday, 2025-06-03 12:00 PDT with current details.\n**Symptoms**\nImpacted customers may experience missing alerts in certain alert views while using Google SecOps.\n**Workaround**\nDetections are visible under the /ruleDetections view accessible from the Rules Dashboard. SOAR customers will also see these alerts on the case page.\nRules of particular concern can be copied into a new rule and run as a retrohunt.","status":"SERVICE_INFORMATION","affected_locations":[{"title":"Frankfurt (europe-west3)","id":"europe-west3"},{"title":"Multi-region: us","id":"us"}]},{"created":"2025-06-03T00:46:59+00:00","modified":"2025-06-03T04:23:26+00:00","when":"2025-06-03T00:46:59+00:00","text":"**Summary**\nGoogle SecOps customers may experience degradation of certain detection views for a subset of alerts.\n**Description**\nMitigation work is currently underway by our engineering team.\nThe team has identified and resolved the root cause, which resolves the issue for new-arriving detections as of 2025-06-02 16:37 US/Pacific.\nAdditional data backfill will be required to mitigate customer impact for detections created during the impact period.\nEngineering is currently creating a plan for these backfill steps.\nWe do not have an ETA for complete mitigation at this point.\nWe will provide an update by Monday 2025-06-02 22:00:00 US/Pacific with current details.\n**Symptoms**\nImpacted customers will experience a degradation of certain detection views for a subset of alerts\n**Workaround**\nDetections are visible under the /ruleDetections view accessible from the Rules Dashboard","status":"SERVICE_INFORMATION","affected_locations":[{"title":"Frankfurt (europe-west3)","id":"europe-west3"},{"title":"Multi-region: us","id":"us"}]},{"created":"2025-06-02T23:19:56+00:00","modified":"2025-06-03T00:46:59+00:00","when":"2025-06-02T23:19:56+00:00","text":"**Summary**\nGoogle SecOps customers may experience degradation of certain detection views for a subset of alerts.\n**Description**\nWe are experiencing an issue with Google SecOps Thursday 2025-05-29 11:29:00 US/Pacific\nOur engineering team continues to investigate the issue.\nWe will provide more information by Monday 2025-06-02 18:00:00 US/Pacific with current details.\nWe apologize to all who are affected by the disruption.\n**Diagnosis / Customer Symptoms**\nImpacted customers may experience missing alerts in certain alerts views\n**Workaround**\nDetections are visible under the /ruleDetections view accessible from the Rules Dashboard","status":"SERVICE_INFORMATION","affected_locations":[{"title":"Frankfurt (europe-west3)","id":"europe-west3"},{"title":"Toronto (northamerica-northeast2)","id":"northamerica-northeast2"},{"title":"São Paulo (southamerica-east1)","id":"southamerica-east1"},{"title":"Iowa (us-central1)","id":"us-central1"},{"title":"South Carolina (us-east1)","id":"us-east1"}]}],"most_recent_update":{"created":"2025-06-04T00:23:12+00:00","modified":"2025-06-04T00:23:13+00:00","when":"2025-06-04T00:23:12+00:00","text":"**Summary**\nGoogle SecOps customers may experience missing alerts in alert views for a subset of alerts. SOAR case views are not affected.\n**Description**\nThe root cause for the missing alerts for Google SecOps alert views has been identified and resolved as of 2025-06-02 16:37 PDT.\nThough the new alert detections are working as expected, the engineering team continues to work on backfilling the missing alert data for some of the impacted customers as per the mitigation plan.\nThe impacted customers will be communicated with the further progress on backfilling separately via support cases.\nIf you have questions or are impacted, please open a case with the Support Team and we will work with you until this issue is resolved.","status":"AVAILABLE","affected_locations":[]},"status_impact":"SERVICE_INFORMATION","severity":"low","service_key":"FHwvkSZ6RzzDYAvDZXMM","service_name":"Google SecOps","affected_products":[{"title":"Google SecOps","id":"FHwvkSZ6RzzDYAvDZXMM"}],"uri":"incidents/GfDrxgSaoSf5Uu92NSFL","currently_affected_locations":[],"previously_affected_locations":[{"title":"Frankfurt (europe-west3)","id":"europe-west3"},{"title":"Multi-region: us","id":"us"}]},{"id":"R1DTrUx9p7UFp6Hsk8D8","number":"514106079635057065","begin":"2025-05-12T19:00:00+00:00","created":"2025-05-12T23:10:32+00:00","end":"2025-05-13T00:00:00+00:00","modified":"2025-05-13T00:32:02+00:00","external_desc":"Google Secops customers may experience elevated latencies or timeouts in Search API.","updates":[{"created":"2025-05-13T00:32:02+00:00","modified":"2025-05-13T00:32:03+00:00","when":"2025-05-13T00:32:02+00:00","text":"**Summary**\nGoogle Secops customers experienced elevated latencies or timeouts in Search API.\n**Description**\nThe issue with Chronicle Security has been resolved for all affected customers as of Monday, 2025-05-12 17:00 US/Pacific.\nFrom preliminary analysis, we have identified that the issue was triggered due to service overload and the engineering team updated throttling configurations to mitigate the impact.\nWe thank you for your patience while we worked on resolving the issue.","status":"AVAILABLE","affected_locations":[]},{"created":"2025-05-12T23:10:32+00:00","modified":"2025-05-13T00:32:02+00:00","when":"2025-05-12T23:10:32+00:00","text":"**Summary**\nGoogle Secops customers may experience elevated latencies or timeouts in Search API.\n**Description**\nWe are experiencing an issue with Chronicle Security beginning on Monday, 2025-05-12 12:00 US/Pacific.\nOur engineering team continues to investigate the issue.\nWe will provide an update by Monday, 2025-05-12 18:30 US/Pacific with current details.\nWe apologize to all who are affected by the disruption.\n**Customer Symptoms**\nImpacted customers may experience 503 errors or latencies while performing API searches.\n**Workaround**\nNone at this time.","status":"SERVICE_DISRUPTION","affected_locations":[{"title":"Multi-region: us","id":"us"}]}],"most_recent_update":{"created":"2025-05-13T00:32:02+00:00","modified":"2025-05-13T00:32:03+00:00","when":"2025-05-13T00:32:02+00:00","text":"**Summary**\nGoogle Secops customers experienced elevated latencies or timeouts in Search API.\n**Description**\nThe issue with Chronicle Security has been resolved for all affected customers as of Monday, 2025-05-12 17:00 US/Pacific.\nFrom preliminary analysis, we have identified that the issue was triggered due to service overload and the engineering team updated throttling configurations to mitigate the impact.\nWe thank you for your patience while we worked on resolving the issue.","status":"AVAILABLE","affected_locations":[]},"status_impact":"SERVICE_DISRUPTION","severity":"medium","service_key":"FHwvkSZ6RzzDYAvDZXMM","service_name":"Google SecOps","affected_products":[{"title":"Google SecOps","id":"FHwvkSZ6RzzDYAvDZXMM"}],"uri":"incidents/R1DTrUx9p7UFp6Hsk8D8","currently_affected_locations":[],"previously_affected_locations":[{"title":"Multi-region: us","id":"us"}]},{"id":"Ay6BtSp81X1cQJU25Eww","number":"9584455078169303264","begin":"2025-04-22T17:00:00+00:00","created":"2025-05-12T19:15:50+00:00","end":"2025-05-15T14:30:00+00:00","modified":"2025-05-15T16:46:19+00:00","external_desc":"Rules that were enabled with real-time run frequency were not processed for a period of time.","updates":[{"created":"2025-05-15T16:45:45+00:00","modified":"2025-05-15T16:46:19+00:00","when":"2025-05-15T16:45:45+00:00","text":"**Summary :** Reprocessing to create missed detections has completed\n**Description :**\nOur Engineering team has completed the rule reprocessing for all affected rules in all regions as of Thursday, 2025-05-15 07:30 US/Pacific.\nAny detections that were missed have been created by our engineering teams.\nWe thank you for your patience while working on resolving the issue.","status":"AVAILABLE","affected_locations":[]},{"created":"2025-05-14T18:58:52+00:00","modified":"2025-05-15T16:45:45+00:00","when":"2025-05-14T18:58:52+00:00","text":"**Summary :** Reprocessing to create missed detections has been launched - Interim Update\n**Description :**\nOur Engineering team has completed the rule reprocessing for all affected rules, in the following regions : me-central1, europe-west2, europe-west12, asia-south1, southamerica-east1, northamerica-northeast2, australia-southeast1, me-west1, me-central2, europe-west6, europe-west3, asia-southeast1, asia-northeast1\nAny detections that were missed have been created by our engineering teams.\nReprocessing to create missed detections in the US and Europe regions, is still in progress.\nThe revised ETA for the mitigation on US and Europe regions is, Thursday 2025-05-15 12:00 US/Pacific\nWe will provide more information by Thursday, 2025-05-15 12:30 US/Pacific.\n**Customer Symptoms :**\nIf the customer's tenant is in the US or Europe regions, processing for affected rules was skipped for 3 days - between Tuesday 22 April 2025 to Friday 25 April 2025.\nIf the customers’ tenant is any other region (e.g. europe-west2, europe-west3, europe-west6, europe-west9, europe-west12, or any non-europe region like asia-southeast1), processing was skipped for up to 15 days - between Tuesday 22 April 2025 to Wednesday 07 May 2025.\nThe missed detections have now been created as mentioned above.\n**Workaround :**\nCustomers can also manually launch retrohunts over the affected time range for rules that meet the criteria mentioned above to regenerate detections now.","status":"SERVICE_INFORMATION","affected_locations":[{"title":"Tokyo (asia-northeast1)","id":"asia-northeast1"},{"title":"Mumbai (asia-south1)","id":"asia-south1"},{"title":"Singapore (asia-southeast1)","id":"asia-southeast1"},{"title":"Sydney (australia-southeast1)","id":"australia-southeast1"},{"title":"Multi-region: europe","id":"europe"},{"title":"Turin (europe-west12)","id":"europe-west12"},{"title":"London (europe-west2)","id":"europe-west2"},{"title":"Frankfurt (europe-west3)","id":"europe-west3"},{"title":"Zurich (europe-west6)","id":"europe-west6"},{"title":"Paris (europe-west9)","id":"europe-west9"},{"title":"Doha (me-central1)","id":"me-central1"},{"title":"Dammam (me-central2)","id":"me-central2"},{"title":"Tel Aviv (me-west1)","id":"me-west1"},{"title":"Toronto (northamerica-northeast2)","id":"northamerica-northeast2"},{"title":"São Paulo (southamerica-east1)","id":"southamerica-east1"},{"title":"Multi-region: us","id":"us"}]},{"created":"2025-05-13T18:38:28+00:00","modified":"2025-05-14T18:58:52+00:00","when":"2025-05-13T18:38:28+00:00","text":"**Summary :** Reprocessing to create missed detections has been launched.\n**Description :**\nOur engineering team has launched the reprocessing for all affected rules in all affected regions, to create missing detections.\nETA for reprocessing to complete is as follows:\n- europe-west12: Friday, May 16 12:00 US/Pacific\n- All other regions: Wednesday, May 14 12:00 US/Pacific\nWe will provide more information by Wednesday, 2025-05-14 12:30 US/Pacific.\n**Customer Symptoms :**\nIf the customer's tenant is in the US or Europe regions, processing for affected rules was skipped for 3 days - between Tuesday 22 April 2025 to Friday 25 April 2025.\nIf the customers’ tenant is any other region (e.g. europe-west2, europe-west3, europe-west6, europe-west9, europe-west12, or any non-europe region like asia-southeast1), processing was skipped for up to 15 days - between Tuesday 22 April 2025 to Wednesday 07 May 2025.\n**Workaround :**\nCustomers can also manually launch retrohunts over the affected time range for rules that meet the criteria mentioned above to regenerate detections now.","status":"SERVICE_INFORMATION","affected_locations":[{"title":"Tokyo (asia-northeast1)","id":"asia-northeast1"},{"title":"Mumbai (asia-south1)","id":"asia-south1"},{"title":"Singapore (asia-southeast1)","id":"asia-southeast1"},{"title":"Sydney (australia-southeast1)","id":"australia-southeast1"},{"title":"Multi-region: europe","id":"europe"},{"title":"Turin (europe-west12)","id":"europe-west12"},{"title":"London (europe-west2)","id":"europe-west2"},{"title":"Frankfurt (europe-west3)","id":"europe-west3"},{"title":"Zurich (europe-west6)","id":"europe-west6"},{"title":"Paris (europe-west9)","id":"europe-west9"},{"title":"Doha (me-central1)","id":"me-central1"},{"title":"Dammam (me-central2)","id":"me-central2"},{"title":"Tel Aviv (me-west1)","id":"me-west1"},{"title":"Toronto (northamerica-northeast2)","id":"northamerica-northeast2"},{"title":"São Paulo (southamerica-east1)","id":"southamerica-east1"},{"title":"Multi-region: us","id":"us"}]},{"created":"2025-05-12T19:15:50+00:00","modified":"2025-05-13T18:38:28+00:00","when":"2025-05-12T19:15:50+00:00","text":"**Summary :** Rules that were enabled with real-time run frequency were not processed for a period of time.\n**Description :**\nDue to a configuration issue, Rules that were enabled with real-time run frequency prior to the start of the impact time range were not processed, beginning on Tuesday, 22 April 2025 at 10:00 US/Pacific.\nAffected rules have resumed generating detections and the issue was fixed as of Wednesday 07 May 2025 at 15:00 US/Pacific.\nOur engineering team is working on reprocessing all affected rules to generate the missed detections from within that time range, and will follow up when reprocessing is complete.\nWe will provide more information by Tuesday, 2025-05-13 12:00 US/Pacific.\n**Customer Symptoms :**\nIf the customer's tenant is in the US or Europe regions, processing for affected rules was skipped for 3 days - between Tuesday 22 April 2025 to Friday 25 April 2025.\nIf the customers’ tenant is any other region (e.g. europe-west2, europe-west3, europe-west6, europe-west9, europe-west12, or any non-europe region like asia-southeast1), processing was skipped for up to 15 days - between Tuesday 22 April 2025 to Wednesday 07 May 2025.\n**Workaround :**\nCustomers can also manually launch retrohunts over the affected time range for rules that meet the criteria mentioned above to regenerate detections now.","status":"SERVICE_DISRUPTION","affected_locations":[{"title":"Tokyo (asia-northeast1)","id":"asia-northeast1"},{"title":"Mumbai (asia-south1)","id":"asia-south1"},{"title":"Singapore (asia-southeast1)","id":"asia-southeast1"},{"title":"Sydney (australia-southeast1)","id":"australia-southeast1"},{"title":"Multi-region: europe","id":"europe"},{"title":"Turin (europe-west12)","id":"europe-west12"},{"title":"London (europe-west2)","id":"europe-west2"},{"title":"Frankfurt (europe-west3)","id":"europe-west3"},{"title":"Zurich (europe-west6)","id":"europe-west6"},{"title":"Paris (europe-west9)","id":"europe-west9"},{"title":"Doha (me-central1)","id":"me-central1"},{"title":"Dammam (me-central2)","id":"me-central2"},{"title":"Tel Aviv (me-west1)","id":"me-west1"},{"title":"Toronto (northamerica-northeast2)","id":"northamerica-northeast2"},{"title":"São Paulo (southamerica-east1)","id":"southamerica-east1"},{"title":"Multi-region: us","id":"us"}]}],"most_recent_update":{"created":"2025-05-15T16:45:45+00:00","modified":"2025-05-15T16:46:19+00:00","when":"2025-05-15T16:45:45+00:00","text":"**Summary :** Reprocessing to create missed detections has completed\n**Description :**\nOur Engineering team has completed the rule reprocessing for all affected rules in all regions as of Thursday, 2025-05-15 07:30 US/Pacific.\nAny detections that were missed have been created by our engineering teams.\nWe thank you for your patience while working on resolving the issue.","status":"AVAILABLE","affected_locations":[]},"status_impact":"SERVICE_INFORMATION","severity":"low","service_key":"FHwvkSZ6RzzDYAvDZXMM","service_name":"Google SecOps","affected_products":[{"title":"Google SecOps","id":"FHwvkSZ6RzzDYAvDZXMM"}],"uri":"incidents/Ay6BtSp81X1cQJU25Eww","currently_affected_locations":[],"previously_affected_locations":[{"title":"Tokyo (asia-northeast1)","id":"asia-northeast1"},{"title":"Mumbai (asia-south1)","id":"asia-south1"},{"title":"Singapore (asia-southeast1)","id":"asia-southeast1"},{"title":"Sydney (australia-southeast1)","id":"australia-southeast1"},{"title":"Multi-region: europe","id":"europe"},{"title":"Turin (europe-west12)","id":"europe-west12"},{"title":"London (europe-west2)","id":"europe-west2"},{"title":"Frankfurt (europe-west3)","id":"europe-west3"},{"title":"Zurich (europe-west6)","id":"europe-west6"},{"title":"Paris (europe-west9)","id":"europe-west9"},{"title":"Doha (me-central1)","id":"me-central1"},{"title":"Dammam (me-central2)","id":"me-central2"},{"title":"Tel Aviv (me-west1)","id":"me-west1"},{"title":"Toronto (northamerica-northeast2)","id":"northamerica-northeast2"},{"title":"São Paulo (southamerica-east1)","id":"southamerica-east1"},{"title":"Multi-region: us","id":"us"}]}]