Google SecOps Forwarder Deprecation: Migrate to Bindplane and OpenTelemetry
Google Cloud Security Operations is deprecating the legacy SecOps Forwarder by January 2027. Going forward, SecOps will rely on OpenTelemetry collectors with Bindplane as the officially supported ingestion model — offering a more scalable, secure, and flexible way to collect SIEM logs. Bindplane's OTel collector is available right away and will remain the default ingestion model. A Google-built OTel collector, fully compatible with Bindplane, will be available in January 2026. This workshop will guide you through the entire migration path.
Google Cloud Security Operations is deprecating the legacy SecOps Forwarder by January 2027
Going forward, SecOps will rely on OpenTelemetry collectors with Bindplane as the officially supported ingestion model — offering a more scalable, secure, and flexible way to collect SIEM logs.
Bindplane's OTel collector is available right away and will remain the default ingestion model. A Google-built OTel collector, fully compatible with Bindplane, will be available in January 2026.
This workshop will guide you through the entire migration path.
What You’ll Learn
- Why the SecOps Forwarder is being deprecated
- How Bindplane replaces the Forwarder with a more robust OTel collector
- Deployment options: Windows service, Linux package, containers
- How to migrate existing log sources and forwarder configs
- How to build and test your first Bindplane + SecOps pipeline
- Troubleshooting and best practices
Why Bindplane?
Bindplane is the official ingestion method for Google SecOps, built on open standard and the OpenTelemetry Collector, designed for secure and scalable log delivery. It gives you configuration management and rollouts, automatic updates, visual pipeline building, and zero vendor lock-in.
