What is Gemini in Google SecOps used for?

Gemini in Security Operations is Google SecOps's built-in AI assistant, providing natural language search, an interactive investigation assistant, contextualized case summaries, recommended response actions, and help drafting detection rules and playbooks.

For search specifically, an analyst can type a plain-language question — like "show me failed logins from unusual locations in the last 24 hours" — and Gemini generates the underlying YARA-L or UDM search query and presents the resulting, fully mapped syntax, which lowers the barrier for analysts less fluent in the query language while still surfacing the actual generated query for review and refinement rather than hiding it entirely.

Beyond search, Gemini supports context-aware, AI-powered chat for building detections, and can generate contextualized summaries of a case or investigation, condensing what might otherwise be a lengthy manual review of alerts, entities, and enrichment data into a starting point an analyst can quickly scan and act on rather than reading everything from scratch.