Mentioned in the evidence
- Google SecOps SIEM
- Legacy chronicle-tla Google-managed BigQuery exports, datasets, and API keys
- Applied Threat Intelligence curated detection rules
- Custom rules referencing legacy IOC feeds
Official sources
- Google Cloud changelog (changelog) ↗
If you have custom rules that still reference the legacy feeds, update them to use the GTI_IOC feed.
- Google Cloud changelog (changelog) ↗
When: Decommissioning begins on October 28, 2026.
- Google Cloud changelog (changelog) ↗
What is changing: Data exports to legacy Google-managed BigQuery datasets under the chronicle-tla project are being permanently turned off, and the associated managed datasets and API keys are being decommissioned.
- Google Cloud changelog (changelog) ↗
Action required: To retain BigQuery access to Google SecOps data, configure export to a customer-managed BigQuery project (BYOBQ) or contact your account team to upgrade to Enterprise+.
This is a global change, verified against Google Cloud’s own sources. It is not an assessment of your systems or your impact.