Elastic Brings Embedded SIEM and EDR to Google Distributed Cloud Air-Gapped

What Elastic and Google Cloud launched

Elastic says it has launched its next-generation Security Information and Event Management (SIEMv2) and Endpoint Detection and Response (EDRv2) architecture on Google Distributed Cloud's Operator Infrastructure Release (OIRv2). Together with Google Cloud, the company says it has embedded unified security operations directly into the platform.

Elastic describes the change as a move from periodic, human-driven assessments to continuous workload defense delivered entirely within the air-gapped environment. The company says that by unifying fragmented legacy tools into a single architecture, it reduces the burden of managing separate systems, lowers host resource overhead across infrastructure nodes, and supports a unified Zero Trust Strategy for Google Distributed Cloud.

Elastic also states that the integration is native, so sovereign customers do not have to stitch together custom log forwarders or brittle connectors.

The problem: a velocity gap in disconnected networks

Elastic frames the launch around what it calls a critical velocity gap. According to the company, threat actors increasingly use advanced automation to speed up reconnaissance, evade static signatures and carry out rapid intrusions across critical infrastructure, software supply chains and insider pathways. When attack timelines shrink from days to minutes and defenders rely on manual triage across fragmented legacy tools, defense falls behind.

For sovereign and highly regulated customers, operating in air-gapped environments is a foundational mandate for mission assurance, strict data residency and regulatory compliance, Elastic says. Isolation limits external exposure, but the company argues that these organizations still need on-premises security analytics, live telemetry correlation and continuous threat intelligence to detect supply chain compromises, advanced attackers and insider threats.

Historically, Elastic notes, security teams in disconnected environments have maintained numerous standalone tools for log management, endpoint detection, host forensics and incident tracking, which creates visibility blind spots and heavy operational toil. Google Distributed Cloud air-gapped, it says, provides local compute parity on-premises to support advanced telemetry correlation, strict data residency and continuous compliance.

The four capability areas

Elastic lists four components of the collaboration:

• SIEM: ingests, normalizes and correlates high-volume infrastructure, network and audit telemetry into a common schema. Defenders get pre-built detection rules mapped to MITRE ATT&CK, behavioral analytics and rapid investigative views from a single console.
• EDR: provides kernel-level visibility and behavioral protection through a single unified agent, intended to detect and stop advanced memory exploits, polymorphic malware and lateral movement before execution. Elastic calls the reduced resource overhead compared with numerous legacy agents a key differentiator.
• Threat Intelligence: brings curated frontline insights, indicators of compromise and adversary tactics, techniques and procedures developed by Mandiant experts to completely disconnected environments.
• SecOps Foundation: offers built-in case management, incident response plans, documentation, runbooks and standard operating procedures, paired with Mandiant service offerings to speed up deployment.

What it means for sovereign and regulated customers

Elastic says the launch is meant to help sovereign nations, defense agencies and regulated organizations move from fragmented, reactive monitoring to unified, automated defense. For these customers, the practical pitch is fewer separate tools to run inside a network that cannot lean on external services.

A demo is planned for the Google Public Sector Summit in Washington, D.C., on October 20, 2026, where Google and Elastic said they would show how Elastic Security supports Google Distributed Cloud air-gapped environments. Elastic also points interested customers to its sales team and to Google's Google Distributed Cloud Zero Trust Whitepaper.

The company adds a standard caveat: the release and timing of any features described remain at Elastic's sole discretion, and features not currently available may not be delivered on time or at all.