Autonomous defense at cloud speed with SentinelOne and Google Security Operations

Security operations centers often struggle with slow data pipelines that delay threat detection, as telemetry routed through intermediary storage layers introduces latency and overhead. Google Cloud and SentinelOne addressed this by eliminating intermediate cloud buckets, allowing endpoint data to stream directly into Google Security Operations via APIs. This change reduces the time between data collection and detection, enabling faster response to active intrusions. The shift also lowers compute and storage costs by removing redundant staging environments.

The collaboration introduces a modernized EDR data schema that compresses event sizes without sacrificing analytical detail, further reducing downstream processing demands. SentinelOne’s Cloud Funnel feature enables customization of telemetry sent to Google Security Operations, allowing teams to prioritize relevant data. Direct API ingestion ensures near real-time availability of events for detection and investigative workflows, addressing a critical gap in conventional SOC architectures.

Engineering teams aligned parsers, alert models, and SOAR playbooks with Mandiant Incident Response to support automated responses like host isolation and malware extraction. The integration prioritizes customers using Mandiant Managed Defense and Mandiant Threat Defense for initial rollouts, with phased delivery targeted by year-end. This approach aims to reduce the operational burden on security teams while improving threat visibility.

The partnership was recognized as Google Threat Intelligence’s Intel Partner of the Year at Google Cloud Next, underscoring the industry validation of the collaboration. Enterprises are encouraged to contact their Google Cloud or SentinelOne account teams to assess their telemetry pipelines and reserve early access for their environments.