That's the problem threat intelligence exists to solve, and it's usually slower than anyone wants it to be. A new indicator of compromise gets published somewhere, and the question that actually matters is whether it was already sitting in your environment, and for how long. Answering that by hand means a manual hunt across months of logs. Most teams don't have the hours to spare.
In August 2026, Human Managed's operations team sat through a hands-on Google Security Operations (SecOps, formerly Chronicle) workshop led by Shubhangi Gaur, Technology Solutions Consultant at Google. The session moved through four areas: applied threat intelligence, dashboards, AI-assisted investigation, and parser extensions built with Gemini. As Carter, one of our analysts, summed up the scope afterward: "Leverage Google SecOps and Gemini AI to enhance emerging threat detection, IOC investigation, SIEM visibility, ingestion monitoring, firewall monitoring, and network threat assessments." Here's what the team took away, area by area.
Threat intelligence works backward, not just forward
The moment a new indicator of compromise is published, Google SecOps checks it against the previous 12 months of ingested data automatically. A full year of historical exposure gets surfaced without anyone running a manual threat hunt.
There's a distinction worth sitting with, though. A match confirms the indicator was observed somewhere in the environment. An alert is a higher bar: it needs multiple events observed, plus enough prevalence elsewhere for the indicator to look like a real pattern rather than a one-off.
As Satya, who attended the session, put it: "An IOC match is not the same as an alert... No alert does not mean no match." That's an easy detail to lose under pressure, and it's exactly the kind of distinction that decides whether something gets escalated or quietly missed.
Dashboards and detection rules speak the same language
Google SecOps ships with more than 60 curated dashboards out of the box, covering everything from data ingestion health to cloud security posture, and they're built to be duplicated and customized rather than treated as fixed reports.
What's less obvious until you're building one yourself: dashboard queries are written in YARA-L, the same language behind the platform's detection rules. There's no separate reporting syntax sitting next to the one already used to write detections. Satya's note from the session captured it in one line: "Dashboards and detection rules share one language."
Marc, from our data engineering team, saw the practical upside of that overlap: "The platform's AI capabilities, including natural language query generation and the Triage & Investigation Agent, help accelerate analysis and dashboard creation, enabling teams to derive insights from security data with less manual effort and faster time to value."
A 60-second verdict still needs a second opinion
The workshop's most hands-on segment covered the Triage and Investigation Agent, which the team started calling TINA on the spot. Given an alert, it builds the process tree, reads the command-line activity, pulls in threat intelligence context, and returns a verdict with a confidence rating attached, in about 60 seconds.
It doesn't ask you to take that verdict on faith, either. The interface states plainly that the model can make mistakes, and it asks the analyst directly: do you agree with the verdict?
Satya's takeaway from watching it work matched that framing: "AI triage is a functional first pass... Analyst validation is still required." The tool compresses the time it takes to reach a first read. It doesn't remove the person deciding whether that read holds up.
Onboarding a new log source stopped being specialist work
Getting a new log source into the platform's Unified Data Model used to require someone who already knew the parsing language. In the workshop, Gemini generated a working parser extension from a raw log sample and a plain-language description of which fields mattered, no parsing expertise needed to get a first working draft.
Satya's summary of the shift was direct: it "significantly lowers the effort of onboarding a new log source." That's not a small thing for a team that's constantly absorbing new tools, new vendors, and new log formats from clients.
The thread underneath all four
Every one of these sessions pointed at the same underlying shift: AI is compressing the distance between a raw signal and a usable answer, whether that answer is whether an indicator has been seen before, whether an alert is real, or what a new log source actually means. None of it removes the person on the other end of the decision. It just gets them there faster, with more of the groundwork already done.
That's the same principle Human Managed builds around: intelligence only matters when it's tied to a decision someone can actually make. Tools like this make the first draft of that decision faster to reach. Getting it right still takes a person who understands the environment well enough to know when to agree with the verdict, and when not to.
If you're weighing how much of this to build in-house versus lean on platform tooling like this, that's a conversation our team is glad to have.
