Google Secops

[yasinmnk]

Hi, my customer currently stores all their workspace logs in BigQuery on Google Cloud Platform (GCP). They would like to forward all logs from BigQuery directly to Google’s Security Operations (SecOps) solutions. Is this possible? If so, what would be the best approach to achieve this? Also, could you point me to any relevant documentation for this process?
@cmmartin_google 

[cmmartin_google · Accepted solution]

The best approach would be use the native integration from Google SecOps which can read Workspace logs directly and does not require an export to BigQuery - https://cloud.google.com/chronicle/docs/ingestion/cloud/workspace-to-chronicle

Collection of Workspace logs from BigQuery would be a custom integration, e.g., a cloud function to query BQ and export the results to GCS, or post directly to the Chronicle SIEM Ingestion API, and then it would require a custom parser.

Technically possible, but I would highly recommend the first option as not only do they then not need todo any custom ingestion pipeline, parser management, but also our Curated Detection content will work out of the box with Workspace too.

[stein1]

Are there any plans to make this direct log ingestion solution available to Google Workspace domains with Education Plus licensing? Currently it is only available to Enterprise Standard or Enterprise Plus Workspace editions.

I've been waiting on this since this was announced last November 2023. For all the reasons you list, I'd rather use this solution than do something custom.

[samryanturner]

We have some data in BQ we'd like to ingest for contextual enrichment. Is a cloud function still required or can we route to a log sink and export that way to SIEM?