Google Security Operations

Overview

Google Security Operations (formerly Chronicle) is Google Cloud's security analytics platform for threat detection and response. It ingests and analyzes security telemetry at scale, providing threat hunting, investigation, and detection capabilities powered by Google's infrastructure.

DataStream provides native integration through the gcpsecops target, enabling direct log forwarding with automatic format conversion and regional endpoint selection.

Deprecated

The gcpsecops target uses the legacy SecOps Ingestion API, which SecOps instances created after 26 Oct 2026 cannot use and which Google removes on 20 Jul 2027. The target still works and is not removed, but it logs a deprecation warning once when it starts. Use the Google Chronicle target with api: chronicle instead. It accepts the same send_events_as and udm_type keys and values, so a secops config moves over by changing the target type and its addressing (project_id, instance_id, region), plus the settings that target requires where this one does not: namespace, default_log_type for UDM entities, and service account authentication in place of an API key. See Migrating to the Chronicle API on the Google Chronicle page.

Key Benefits

• 22 Regional Endpoints - Deploy to the region closest to your data residency requirements, including US, Europe, Asia-Pacific, Middle East, and Africa
• Automatic UDM Normalization - Convert ECS-formatted logs to Google's Unified Data Model without manual field mapping
• Pre-built Pipeline Templates - 13 ready-to-use pipelines for Windows, Linux, and Syslog sources with vendor-specific parsing
• Flexible Authentication - Service account credentials with environment variable support for secure credential management

Unified Data Model (UDM)

Google SecOps uses the Unified Data Model (UDM) to standardize security telemetry across different log sources. DataStream supports two ingestion modes:

Mode	Description	Use Case
Unstructured	Raw log data with a log type identifier	Default mode, SecOps handles parsing
UDM	Pre-normalized data in UDM format	When DataStream handles normalization

When using UDM mode with send_events_as: udm, DataStream automatically maps ECS fields to UDM equivalents. Key mappings include:

ECS Field	UDM Field
source.*	principal.*
destination.*	target.*
network.*	network.*
file.*	target.file.*

Supported ASIM Schemas

DataStream supports automatic ASIM-to-UDM translation for: NetworkSession, WebSession, DnsActivity, Authentication, FileEvent, ProcessEvent, RegistryEvent, AuditEvent, DhcpEvent, and UserManagement schemas.

Quick Start

Create a target configuration with your SecOps customer ID and region:

Target Configuration

name: my-secops-target
type: gcpsecops
properties:
  customer_id: your-customer-id
  region: us
  default_log_type: WINEVTLOG
  authentication_method: credentials
  service_account_credentials: |
    { "type": "service_account", ... }

Connect the target to a device through a route:

Route Configuration

name: windows-to-secops
device: windows-events
pipeline: gcp_secops_windows_security
target: my-secops-target

Configuration Reference

For complete configuration options including all authentication methods, regional endpoints, and advanced settings:

• Google SecOps Target - Legacy SecOps Ingestion API (v1/v2), deprecated
• Google Chronicle Target - Legacy Chronicle Ingestion API by default, or the Chronicle API with api: chronicle

Pipeline Templates

DataStream includes pre-built pipelines optimized for Google SecOps ingestion:

Template	Purpose
gcp_secops_windows	Windows event logs
gcp_secops_windows_security	Windows Security logs
gcp_secops_windows_dns	Windows DNS Server logs
gcp_secops_windows_firewall	Windows Firewall logs
gcp_secops_linux	Linux system logs
gcp_secops_syslog	Standard syslog

See Content Hub for the full list of 13 available SecOps templates.

Finding SecOps Templates

In Content Hub, set the Target filter to Google SecOps to browse available templates. Each template shows the processors used, example log transformations, and license details.

Automation and Normalization Pack

The Google Security Operations Automation and Normalization Pack in Content Hub provides a complete solution for processing and routing logs to Google SecOps, with intelligent multi-tier distribution capabilities.

Multi-Tier Routing

The pack supports simultaneous routing to multiple destinations from a single pipeline:

Destination	Purpose
Google SecOps	Advanced threat detection with UDM-normalized data
Data Lake	Mid-term retention in platform-native tables
Object Storage	Raw log archival (S3, Azure Blob, Google Cloud Storage)

Cost Optimization

Use smart routing to send high-value security events to Google SecOps while routing verbose logs to cost-effective object storage. The pack includes sampling and filtering options to further reduce ingestion volume.

Vendor Support

The pack includes specialized parsers for 30+ security vendors, including:

• Firewalls: Fortinet, Palo Alto Networks, Check Point, Cisco, SonicWall
• Windows: Event logs, Security logs, DNS, Firewall
• Syslog: Standard syslog, CEF, and LEEF formats

Smart Routing

Configuration-based routing automatically distributes data based on flags:

Parameter	Function
use_smart_routing	Master switch for selective routing
use_google_secops	Enable Google SecOps destination
use_lake	Enable Data Lake destination
use_object_storage	Enable Object Storage archival
allowed_asim_tables	Filter specific ASIM tables for ingestion

Quick Routes default

A Quick Route with no route configuration runs with use_smart_routing: false — the pack's target_for_* names are unset there, so smart routing would otherwise reroute to targets that do not exist and drop the original. Set a route configuration with use_smart_routing: true and the matching target_for_* keys to enable it.

Correlation Tracking

Enable append_correlationid to add unique correlation IDs to each message, providing event lineage tracking across all destinations.