Security operations centers (SOCs) face a persistent data pipeline dilemma: ingesting comprehensive endpoint telemetry is non-negotiable for defense, yet conventional delivery paths tend to raise transfer overhead and alert latency. Because attackers operate at machine speed, unnecessary friction in moving data from endpoints to the SOC can leave teams without the insight needed to respond to attacks in real time.

Addressing the problem means optimizing the data pipeline at the integration layer. Instead of routing telemetry through complex intermediary cloud buckets that demand ongoing maintenance and add costly processing delays, the argument goes, engineering teams need a streamlined delivery architecture that compresses ingest latency, lowers operational overhead, and gives analysts near-instant visibility.

Google Cloud and SentinelOne say they have tackled this scaling challenge with a fundamentally re-architected integration. SentinelOne, a Google Unified Security Recommended endpoint detection and response (EDR) partner, now pairs with Google Security Operations through direct integration and streamlined data schemas. According to the announcement, this delivers essential endpoint telemetry visibility to Google Security Operations detection and agentic SOC pipelines while significantly reducing the total cost of ownership of the integration.

What is at stake

For enterprise customers, every minute of telemetry latency can widen the blast radius of an active intrusion. When detection pipelines take half an hour to surface adversary activity, incident response shifts from active mitigation to retrospective damage control.

For the broader security community and IT leadership, inefficient ingestion pipelines can strain budgets and compute resources. Retaining bulky, unoptimized telemetry in intermediate staging environments diverts resources from strategic security initiatives and saddles engineering teams with unneeded infrastructure debt.

Technical highlights and capabilities

The re-engineered integration introduces six dedicated engineering workstreams intended to remove ingestion bottlenecks and reduce data overhead without sacrificing detection fidelity:

  • Significant event size reduction: a modernized EDR data schema greatly reduces the average event size, preserving full analytical fidelity while lowering downstream compute load for agentic workflows.
  • Direct Google API ingestion: SentinelOne streams events directly into Google Security Operations through APIs, eliminating intermediate cloud storage hops and the associated storage fees.
  • Reduced streaming latency: with no intermediate cloud storage required, data becomes available for detection, investigative, and agentic workflows in Google Security Operations in near real time.
  • Precision telemetry scoping: integrated SentinelOne Cloud Funnel filters add flexibility to customize which telemetry is sent to Google Security Operations.
  • Unified alerts API and Mandiant alignment: parsers, alert models, and SOAR playbooks were engineered alongside Mandiant Incident Response and Managed Defense teams to support automated host isolation, full-disk deep visibility scans, malware extraction, and artifact enrichment directly from Google Security Operations.
  • Industry-validated partnership: SentinelOne was named Google Threat Intelligence's Intel Partner of the Year at Google Cloud Next.

Availability

The integration is targeted for phased delivery by the end of the year, with initial rollouts prioritizing customers using Mandiant Managed Defense and Mandiant Threat Defense. The companies direct interested customers to their Google Cloud or SentinelOne account teams to evaluate their current telemetry pipeline, schedule a technical architecture review, and reserve early access for their environment.