Google Security Operations
by Google Cloud
Google cloud SIEM and SOAR, formerly Chronicle, with UDM search and detections.
- Category
- IT, Security & Monitoring
- Type
- SIEM & security analytics
- Interface
- REST API
- Built with
- Connect Any API
- Credentials
- Service account key, OAuth 2.0
02Data
What you can sync.
- Detections
- Alerts
- Udm events
- Rules
- Cases
Join Google Security Operations detections with assets and people data to see risk by team, system and owner.
Need more? Name any other Google Security Operations data the API returns, and the AI adds it to the connector.
03Credentials
Credentials you will need.
- A service account key
- OAuth 2.0 (client ID, client secret, refresh token)
Google Security Operations uses a service account key or OAuth 2.0 (client ID, client secret, refresh token). You add the credentials once, when the AI asks for them, and it tells you where to create them in Google Cloud if you need help.
04How it works
How it works in DataMind.
-
Pick Google Security Operations.
Open Lake, pick Google Security Operations in the source picker and name the connection. Connect Any API opens with a ready prompt that points the AI at the Google Security Operations API docs.
-
Answer a few questions.
The AI reads the Google Security Operations documentation, then asks which credentials you will use, which data to sync (for example detections and alerts), whether you want a one-time load or a recurring sync, and which accounts or filters apply.
-
Your data lands in Lake.
It builds the connector, tests it and shows you sample rows. Then Google Security Operations data loads into your Lake on your schedule, ready for the Warehouse, DataPrism BI and AI Minds.
05Related
