---
id: "google-security-operations"
type: "component"
kind: "monitoring"
provider: "gcp"
category: "ops"
aliases: "Chronicle"
docs: "https://cloud.google.com/chronicle/docs/secops/secops-overview"
url: "https://localhost:3000/catalogue/components/google-security-operations"
---

# Google Security Operations

SIEM and SOAR platform with YARA-L detections over ingested security telemetry.

| | |
|---|---|
| Provider | [gcp](https://localhost:3000/catalogue?provider=gcp) |
| Kind | [Monitoring](https://localhost:3000/catalogue/kinds/monitoring) |
| Category | Operations |
| Official docs | [https://cloud.google.com/chronicle/docs/secops/secops-overview](https://cloud.google.com/chronicle/docs/secops/secops-overview) |
| Also known as | Chronicle |

## Properties

| property | type | values | required | kind default | this component |
|---|---|---|---|---|---|
| `alertGrouping` | boolean | — | no | false | inherited |
| `collectorMode` | enum | `pull`, `push` | no | "pull" | **"push"** |
| `detectionRuleLanguage` | enum | `yara-l` | no | "yara-l" | inherited |
| `independentOfMonitored` | boolean | — | no | false | inherited |
| `ingestionMethod` | enum | `forwarder`, `api-push`, `feed`, `soar-connector` | no | — | inherited |
| `managed` | boolean | — | no | false | **true** |
| `maxRetentionDays` | integer | — | no | 1825 | inherited |
| `retentionDays` | integer | — | no | — | **365** |
| `signal` | enum | `metrics`, `logs`, `traces`, `alerts`, `all` | no | "metrics" | **"all"** |
| `soar` | boolean | — | no | true | inherited |

Bold values are the ones this component pins.

## Rules that apply · 0

No rule selects this kind or its category.

## Other products of the same kind · 174

- [ActionTrail](https://localhost:3000/catalogue/components/alibaba-actiontrail.md) `alibaba-actiontrail` — alibabacloud
- [Application Real-Time Monitoring Service](https://localhost:3000/catalogue/components/alibaba-arms.md) `alibaba-arms` — alibabacloud
- [CloudMonitor](https://localhost:3000/catalogue/components/alibaba-cloud-monitor.md) `alibaba-cloud-monitor` — alibabacloud
- [Database Autonomy Service](https://localhost:3000/catalogue/components/alibaba-das.md) `alibaba-das` — alibabacloud
- [Simple Log Service](https://localhost:3000/catalogue/components/alibaba-log-service.md) `alibaba-log-service` — alibabacloud
- [Security Center](https://localhost:3000/catalogue/components/alibaba-security-center.md) `alibaba-security-center` — alibabacloud
- [Amazon CloudWatch investigations](https://localhost:3000/catalogue/components/aws-aiops.md) `aws-aiops` — aws
- [AWS Audit Manager](https://localhost:3000/catalogue/components/aws-audit-manager.md) `aws-audit-manager` — aws
- [AWS CloudTrail](https://localhost:3000/catalogue/components/aws-cloudtrail.md) `aws-cloudtrail` — aws
- [AWS CloudTrail Lake](https://localhost:3000/catalogue/components/aws-cloudtrail-lake.md) `aws-cloudtrail-lake` — aws
- [Amazon CloudWatch Application Insights](https://localhost:3000/catalogue/components/aws-cloudwatch-application-insights.md) `aws-cloudwatch-application-insights` — aws
- [Amazon CloudWatch Application Signals](https://localhost:3000/catalogue/components/aws-cloudwatch-application-signals.md) `aws-cloudwatch-application-signals` — aws
- [Amazon CloudWatch Internet Monitor](https://localhost:3000/catalogue/components/aws-cloudwatch-internet-monitor.md) `aws-cloudwatch-internet-monitor` — aws
- [Amazon CloudWatch Logs](https://localhost:3000/catalogue/components/aws-cloudwatch-logs.md) `aws-cloudwatch-logs` — aws
- [Amazon CloudWatch Network Flow Monitor](https://localhost:3000/catalogue/components/aws-cloudwatch-network-flow-monitor.md) `aws-cloudwatch-network-flow-monitor` — aws
- [Amazon CloudWatch Network Monitor](https://localhost:3000/catalogue/components/aws-cloudwatch-network-monitor.md) `aws-cloudwatch-network-monitor` — aws
- [Amazon CloudWatch RUM](https://localhost:3000/catalogue/components/aws-cloudwatch-rum.md) `aws-cloudwatch-rum` — aws
- [Amazon CloudWatch Synthetics](https://localhost:3000/catalogue/components/aws-cloudwatch-synthetics.md) `aws-cloudwatch-synthetics` — aws
- [Amazon CodeGuru Profiler](https://localhost:3000/catalogue/components/aws-codeguru-profiler.md) `aws-codeguru-profiler` — aws
- [AWS Compute Optimizer](https://localhost:3000/catalogue/components/aws-compute-optimizer.md) `aws-compute-optimizer` — aws
- [Amazon Detective](https://localhost:3000/catalogue/components/aws-detective.md) `aws-detective` — aws
- [Amazon DevOps Guru](https://localhost:3000/catalogue/components/aws-devops-guru.md) `aws-devops-guru` — aws
- [Amazon GuardDuty](https://localhost:3000/catalogue/components/aws-guardduty.md) `aws-guardduty` — aws
- [Amazon Inspector](https://localhost:3000/catalogue/components/aws-inspector.md) `aws-inspector` — aws
- [AWS IoT Device Defender](https://localhost:3000/catalogue/components/aws-iot-device-defender.md) `aws-iot-device-defender` — aws
- [Amazon Macie](https://localhost:3000/catalogue/components/aws-macie.md) `aws-macie` — aws
- [Amazon Managed Grafana](https://localhost:3000/catalogue/components/aws-managed-grafana.md) `aws-managed-grafana` — aws
- [Amazon Managed Service for Prometheus](https://localhost:3000/catalogue/components/aws-managed-prometheus.md) `aws-managed-prometheus` — aws
- [AWS Migration Hub](https://localhost:3000/catalogue/components/aws-migration-hub.md) `aws-migration-hub` — aws
- [AWS Resilience Hub](https://localhost:3000/catalogue/components/aws-resilience-hub.md) `aws-resilience-hub` — aws
- [AWS Security Hub CSPM](https://localhost:3000/catalogue/components/aws-security-hub.md) `aws-security-hub` — aws
- [AWS Security Incident Response](https://localhost:3000/catalogue/components/aws-security-incident-response.md) `aws-security-incident-response` — aws
- [AWS Trusted Advisor](https://localhost:3000/catalogue/components/aws-trusted-advisor.md) `aws-trusted-advisor` — aws
- [AWS X-Ray](https://localhost:3000/catalogue/components/aws-xray.md) `aws-xray` — aws
- [Amazon CloudWatch](https://localhost:3000/catalogue/components/cloudwatch.md) `cloudwatch` — aws
- [Azure Advisor](https://localhost:3000/catalogue/components/azure-advisor.md) `azure-advisor` — azure
- [Application Insights](https://localhost:3000/catalogue/components/azure-application-insights.md) `azure-application-insights` — azure
- [Microsoft Defender External Attack Surface Management](https://localhost:3000/catalogue/components/azure-defender-easm.md) `azure-defender-easm` — azure
- [Microsoft Defender for Cloud](https://localhost:3000/catalogue/components/azure-defender-for-cloud.md) `azure-defender-for-cloud` — azure
- [Microsoft Defender for IoT](https://localhost:3000/catalogue/components/azure-defender-for-iot.md) `azure-defender-for-iot` — azure
- and 134 more: https://localhost:3000/catalogue/kinds/monitoring.md

## Use it in a design

```yaml
nodes:
  - { id: "google-security-operations", component: "google-security-operations" }
```

## Source (`component` YAML, verbatim)

```yaml
# yaml-language-server: $schema=../../schema/component.schema.json
# Google Security Operations (Chronicle): SIEM and SOAR over ingested telemetry, with YARA-L
# detection rules. Per "Configure SIEM data retention" Google retains 12 months of data by default
# and the period can be extended to five years; per the SecOps overview data arrives through
# forwarders, push APIs, cloud feeds and SOAR connectors.
schemaVersion: "1"
type: "component"
id: "google-security-operations"
kind: "monitoring"
provider: "gcp"
docs: "https://cloud.google.com/chronicle/docs/secops/secops-overview"
aliases: ["Chronicle"]
defaults:
  signal: "all"
  collectorMode: "push"
  retentionDays: 365
  managed: true
properties:
  detectionRuleLanguage:
    type: "enum"
    values: ["yara-l"]
    default: "yara-l"
  ingestionMethod:
    type: "enum"
    values: ["forwarder", "api-push", "feed", "soar-connector"]
  maxRetentionDays:
    type: "integer"
    default: 1825
  soar:
    type: "boolean"
    default: true
```

Human page: https://localhost:3000/catalogue/components/google-security-operations