Skip to main content

GCP Chronicle

Google Cloud Platform (GCP) Chronicle is Google's cloud-native security information and event management (SIEM) and security analytics platform designed for threat detection, investigation, and response at enterprise scale. Chronicle provides organizations with the ability to store, analyze, and investigate massive volumes of security telemetry data, enabling security operations centers (SOC) and security teams to identify threats, investigate incidents, and hunt for sophisticated attacks across their entire IT infrastructure.

CategorySIEM
DirectionQuery source
Sign-inGCP Service Account
Query languagesSTIX
Websitegoogle.com

Before you start​

Huntbase signs in to GCP Chronicle with GCP Service Account. Create the credential in GCP Chronicle first, then keep it to hand for the Connect step.

  1. Ask your Google Security Operations representative for a Google Developer Service Account Credential for the Detection Engine API. It is delivered as a JSON key file.
  2. Open the JSON file and copy the client_email and private_key values.
Watch out for
  • Google has deprecated the Backstory Detection Engine API and will discontinue it on July 20, 2027.
  • Each query is run as a detection rule with a retrohunt. Rules can't be deleted from the Rules Editor, and the Delete Rule API isn't available to every customer, so saved rules can accumulate in your instance.

For the vendor's own instructions, see Google SecOps Detection Engine API documentation.

tip

Use a dedicated, read-only credential for Huntbase where the product allows it. Huntbase only needs to read.

Connect GCP Chronicle​

  1. Go to Connections and click New connection, or click New connection on the GCP Chronicle product page.
  2. On Product, pick GCP Chronicle and choose the Owner.
  3. On Details, give the connection a Name and, optionally, a Description.
  4. On Connect, fill in the settings and credentials described below.
  5. On Verify, review the summary and click Create & check.

For everything else on the setup page — saving a draft, I'll do this later, and what each check result means — see Connections.

Settings​

Where your GCP Chronicle lives:

FieldRequiredNotes
Server AddressYesThe Detection Engine API endpoint for your region, without https://, such as backstory.googleapis.com in the US or europe-backstory.googleapis.com for the Europe multi-region.

Credentials​

The only Method is GCP Service Account. Enter a Credential label (for example Production), then fill in:

FieldRequiredNotes
Client EmailYesClient email address required for data source authentication. Secret — not shown again after you save it.
Private KeyYesThe full private_key value from the JSON file, including the -----BEGIN PRIVATE KEY----- and -----END PRIVATE KEY----- lines. Secret — not shown again after you save it.

Query it​

Once connected, GCP Chronicle can serve these languages in a query tab, and Scout can use it when you ask in Auto:

LanguageUse it for
STIXSTIX patterns for indicator sweeps, translated into the product's native search.

Next steps​