Key takeaways
- Elastic Security has natively integrated its SIEMv2 and EDRv2 architectures into Google Distributed Cloud (GDC) air-gapped infrastructure via Operator Infrastructure Release (OIRv2).
- The embedded deployment provides on-premises telemetry normalization, kernel-level behavioral prevention, and Mandiant threat intelligence without external network connectivity.
- The platform consolidation eliminates custom log forwarders and replaces multi-agent sprawl with a single kernel sensor to reduce host resource consumption across sovereign nodes.
Elastic and Google Cloud have announced the native integration of Elastic Security into Google Distributed Cloud (GDC) air-gapped environments. Delivered through GDC’s Operator Infrastructure Release (OIRv2), the release embeds next-generation Security Information and Event Management (SIEMv2) and Endpoint Detection and Response (EDRv2) architectures directly into the platform layer. The joint deployment enables defense agencies, intelligence operators, and regulated public sector enterprises to run real-time telemetry correlation and kernel-level endpoint prevention entirely on-premises without internet connectivity. Announced on October 16, 2026, by Google Cloud’s TJ Banasik and Elastic’s Mike Nichols, the unified architecture eliminates custom log forwarders, lowers host agent resource strain, and upholds on-premises Zero Trust mandates.
Native SIEM and EDR embedding on GDC Operator Infrastructure Release
In isolated public sector and sovereign cloud architectures, security operations have long faced severe tooling fragmentation. Operators managing air-gapped infrastructure typically deploy separate software stacks for security log ingestion, host forensics, endpoint detection, and incident ticket routing. In disconnected environments where nodes cannot reach external software repositories or cloud-hosted control planes, maintaining separate pipelines requires manual agent maintenance, custom scripts, and brittle log forwarding utilities.
The integration on Google Distributed Cloud’s Operator Infrastructure Release (OIRv2) addresses this operational friction by embedding Elastic Security directly into the underlying platform fabric. Rather than requiring administrators to stitch together custom connectors, Elastic SIEMv2 and EDRv2 run natively within the local GDC compute layer. SIEMv2 ingests, normalizes, and correlates high-volume infrastructure logs, network flows, and audit records into an open common schema on-premises. Security analysts query this data from a consolidated interface with pre-built detection rules mapped to the MITRE ATT&CK matrix.
Concurrently, EDRv2 introduces a unified kernel-level sensor that handles both host visibility and threat prevention. Disconnected hosts frequently face performance degradation when forced to run multiple monitoring agents for antivirus, behavioral monitoring, and compliance logging. Elastic’s consolidated agent enforces active behavioral blocking against polymorphic malware, memory exploitation, and unauthorized lateral movement before code executes, lowering CPU and memory overhead across host infrastructure nodes.
| Capability | Legacy Disconnected Operations | Embedded Elastic on GDC (OIRv2) |
|---|---|---|
| Telemetry Ingestion | Disparate log collectors and custom forwarding scripts | Native ingestion normalized to a common schema on-premises |
| Endpoint Defense | Multiple independent agents causing high host resource overhead | Single unified kernel-level sensor for detection and prevention |
| Threat Intelligence | Stale manual indicator imports and fragmented vendor updates | Curated Mandiant frontline TTPs and IOC feeds for isolated networks |
| Incident Workflows | Manual triage across disconnected tools and spreadsheets | Built-in SecOps case management, runbooks, and SOP execution |
Closing the detection velocity gap across sovereign nodes
The technical necessity for native on-premises analytics stems from what defense planners describe as an expanding velocity gap. Modern threat actors increasingly leverage automated reconnaissance, evasion tooling, and rapid lateral propagation to execute intrusions in minutes rather than days. Air-gapped networks remain protected from direct external internet compromise, but they are not impervious to local ingress vectors, including infected removable media, compromised maintenance hardware, software supply chain compromises, and rogue insider actions.
When an intrusion occurs within an isolated network, relying on periodic human-driven audits or delayed log exports guarantees that defenders lag behind automated adversaries. Google Distributed Cloud provides local compute parity on-premises, allowing Elastic to execute live analytical queries and behavioral correlations directly against live telemetry streams without transmitting data across jurisdictional or network boundaries. This architecture upholds Google’s documented Zero Trust strategy for air-gapped infrastructure, which assumes that network perimeter isolation alone cannot substitute for continuous workload verification and least-privilege telemetry inspection.
This sovereign approach reflects broader shifts in enterprise infrastructure security, where organizations demand rigorous local encryption, deterministic control over cryptographic keys, and native protection across isolated workloads. Similar operational priorities were highlighted when Elastic expanded encryption at rest with multi-cloud Bring Your Own Key (BYOK) capabilities to ensure cryptographic sovereignty across distributed enterprise deployments. In the GDC air-gapped implementation, data residency is strictly maintained on local physical nodes, ensuring that mission-critical logs, indicators, and audit trails never leave sovereign custody.
Operational implications for defense and regulated SecOps teams
For IT directors and security operations leaders, the primary advantage of the OIRv2 integration lies in operational consolidation. Deploying disparate commercial tools into isolated classified enclaves typically demands dedicated personnel to manage connector health, parse format changes, and manually package detection rule updates. Unifying SIEM and EDR workflows into a single platform reduces the administrative burden on security staff, who can focus on proactive threat hunting rather than infrastructure upkeep.
To address the absence of live cloud-based threat intelligence, the deployment incorporates frontline insights, indicators of compromise (IOCs), and adversary tactics, techniques, and procedures (TTPs) developed by Mandiant. Disconnected analysts receive structured Mandiant intelligence packages formatted for on-premises hunting, allowing teams to identify sophisticated intrusion attempts without connecting to public feed endpoints. Furthermore, the embedded SecOps foundation supplies pre-packaged incident response plans, operational runbooks, and standard operating procedures (SOPs) paired with Mandiant service offerings to accelerate SOC maturity.
Enterprise architects must nevertheless account for the operational boundaries inherent in air-gapped deployments. While the integration eliminates custom forwarders, it does not remove the procedural complexity of air-gapped software lifecycle management. Administrators remain responsible for governing local storage retention, capacity planning for high-volume telemetry indexing, and managing secure physical media transfers for routine Mandiant rule updates and platform maintenance.
What happens next
Google Cloud and Elastic plan to demonstrate the SIEMv2 and EDRv2 integration on Google Distributed Cloud at the Google Public Sector Summit in Washington, D.C., on October 20, 2026. The technical demonstration will showcase live kernel-level threat blocking, on-premises behavioral analytics, and native workflow automation running in an air-gapped environment.
Both vendors noted that feature release schedules and availability remain subject to change at vendor discretion. Public sector IT leaders and enterprise architects planning sovereign infrastructure deployments can evaluate their current GDC hardware footprints and consult official Elastic Security and Google Distributed Cloud documentation to prepare for OIRv2 platform updates.
