Google SecOps
Cloud-native SIEM and SOAR platform, formerly Google Chronicle, with retro-hunting over year-long retention.
Technical Architecture & Overview
Google SecOps, the product line formerly known as Chronicle, includes one year of security telemetry retention in its packages, and YARA-L retrohunts run detection rules against that historical data. Detection uses YARA-L rules, and UDM normalization maps vendor logs to a common schema. Chronicle began as an Alphabet X project, joined Google Cloud in 2019, and is now branded Google Security Operations.
Targeted Technical Use Cases
Teams that value long-term searchable telemetry and retro-hunts.
Evaluation & Trade-offs
Core Strengths
- +Packages include 12 months of hot data retention.
- +More than 700 parsers normalize vendor logs into UDM for cross-vendor queries.
- +SOAR is included, with integrations for more than 300 tools.
Trade-Offs & Limitations
- -Custom detections must be written in YARA-L.
- -Pricing is set by package and ingestion volume.
Defensive Security Application
Hunting and detection over normalized, long-retention security telemetry.
Frequently Asked Questions
What is Google SecOps?→
Google SecOps, the product line formerly known as Chronicle, includes one year of security telemetry retention in its packages, and YARA-L retrohunts run detection rules against that historical data. Detection uses YARA-L rules, and UDM normalization maps vendor logs to a common schema. Chronicle began as an Alphabet X project, joined Google Cloud in 2019, and is now branded Google Security Operations.
What is Google SecOps used for?→
Teams that value long-term searchable telemetry and retro-hunts.
What are the strengths of Google SecOps?→
- +Packages include 12 months of hot data retention.
- +More than 700 parsers normalize vendor logs into UDM for cross-vendor queries.
- +SOAR is included, with integrations for more than 300 tools.
What are the limitations of Google SecOps?→
- +Custom detections must be written in YARA-L.
- +Pricing is set by package and ingestion volume.
How is Google SecOps used defensively?→
Hunting and detection over normalized, long-retention security telemetry.