Maintained with ☕️ by
IcePanel logo

Google SecOps is renaming Applied Threat Intelligence (ATI) rules to improve clarity and better reflect the associated UDM fields with each rule detection

Share

Services

## Change Google SecOps is renaming Applied Threat Intelligence (ATI) rules to improve clarity and better reflect the associated UDM fields with each rule detection. Currently, multiple underlying ATI rules can appear with the same name in the Google SecOps console, even though the rules apply to different UDF fields. This change modifies the `rule_name` field in the customer metadata to specify the relevant UDM field for each rule. For example: Old rule name: **ATI Active Breach Rule Match for File IoCs (SHA256)** New rule name: **ATI Active Breach Rule Match for File IoCs (about.file.sha256)** If your integrations depend on current rule names (for example, parsing the `rule_name` field in API responses or SOAR playbooks), must update them accordingly.