SIEM Google Security Operations adalah layanan cloud, yang dibangun sebagai lapisan khusus di atas infrastruktur inti Google, yang dirancang bagi perusahaan untuk menyimpan, menganalisis, dan menelusuri secara pribadi sejumlah besar telemetri keamanan dan jaringan yang mereka hasilkan.
Google Security Operations menormalisasi, mengindeks, menghubungkan, dan menganalisis data untuk memberikan analisis dan konteks instan tentang aktivitas yang berisiko.
Operasi Keamanan Google memungkinkan Anda memeriksa informasi keamanan gabungan untuk perusahaan Anda selama beberapa bulan atau lebih. Gunakan Google Security Operations untuk menelusuri semua domain yang diakses dalam perusahaan Anda. Anda dapat mempersempit penelusuran ke aset, domain, atau alamat IP tertentu untuk menentukan apakah telah terjadi kompromi.
Ringkasan platform Google Security Operations
Pengumpulan data
Google Security Operations dapat menyerap berbagai jenis telemetri keamanan melalui berbagai metode, termasuk:
Forwarder: Komponen software ringan, yang di-deploy di jaringan pelanggan, yang mendukung syslog, pengambilan paket, dan repositori data manajemen log atau informasi keamanan dan pengelolaan peristiwa (SIEM) yang ada.
API Penyerapan: API yang memungkinkan log dikirim langsung ke platform Google Security Operations, sehingga tidak memerlukan hardware atau software tambahan di lingkungan pelanggan.
Integrasi pihak ketiga: Integrasi dengan API cloud pihak ketiga untuk memfasilitasi penyerapan log, termasuk sumber seperti Office 365 dan Azure AD.
Analisis data
Kemampuan analisis Google Security Operations diberikan kepada profesional keamanan sebagai aplikasi berbasis browser yang sederhana. Banyak kemampuan ini juga dapat diakses secara terprogram melalui Read API.
Google Security Operations memberi analis cara, saat mereka melihat potensi ancaman, untuk menentukan apa itu, apa yang dilakukannya, apakah itu penting, dan cara terbaik untuk meresponsnya.
Keamanan dan kepatuhan
Sebagai lapisan pribadi khusus yang dibangun di atas infrastruktur inti Google, Google Security Operations mewarisi kemampuan komputasi dan penyimpanan, serta desain dan kemampuan keamanan infrastruktur tersebut.
Sebagai bagian dari desain keamanannya, Google SecOps menyimpan kredensial pengguna (misalnya, kredensial yang Anda berikan agar feed Google SecOps dapat menyerap data log dari API pihak ketiga) di Secret Manager.
Fitur Google Security Operations
Telusuri
Pemindaian Log Raw: Menelusuri log raw yang tidak diuraikan.
Ekspresi Reguler: Telusuri log mentah yang tidak diuraikan menggunakan ekspresi reguler.
Tampilan investigasi
Tampilan aset: Selidiki aset dalam perusahaan Anda dan apakah aset tersebut berinteraksi dengan domain mencurigakan atau tidak.
Tampilan Alamat IP: Selidiki alamat IP tertentu dalam perusahaan Anda dan dampaknya terhadap aset Anda.
Tampilan hash: Menelusuri dan menyelidiki file berdasarkan nilai hash-nya.
Tampilan domain: Selidiki domain tertentu dalam perusahaan Anda dan dampaknya terhadap aset Anda.
Tampilan pengguna: Selidiki pengguna dalam perusahaan Anda yang mungkin terpengaruh oleh peristiwa keamanan.
Pemfilteran prosedural: Sesuaikan informasi tentang aset, termasuk menurut jenis peristiwa, sumber log, status koneksi jaringan, dan Domain Level Teratas (TLD).
Informasi hasil seleksi
Blok insight aset: Menyoroti domain dan pemberitahuan yang mungkin ingin Anda selidiki lebih lanjut.
Grafik prevalensi: Menampilkan jumlah domain yang telah dihubungkan aset selama jangka waktu tertentu.
### Mesin Deteksi
Anda dapat menggunakan Mesin Deteksi Google Security Operations untuk mengotomatiskan proses penelusuran data Anda untuk menemukan masalah keamanan. Anda dapat menentukan aturan untuk menelusuri semua data masuk dan memberi tahu Anda saat potensi ancaman dan ancaman yang diketahui muncul di perusahaan Anda.
VirusTotal
Anda dapat meluncurkan VirusTotal dari Google Security Operations untuk menyelidiki lebih lanjut aset, domain, atau alamat IP dengan mengklik Konteks VT.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-08-21 UTC."],[[["\u003cp\u003eGoogle Security Operations SIEM is a cloud-based service designed for enterprises to retain, analyze, and search extensive security and network telemetry data.\u003c/p\u003e\n"],["\u003cp\u003eThis platform aggregates and analyzes security data, allowing users to investigate security information over extended periods and across various domains, assets, and IP addresses.\u003c/p\u003e\n"],["\u003cp\u003eGoogle Security Operations supports data collection through forwarders, ingestion APIs, and third-party integrations like Office 365 and Azure AD, enabling seamless ingestion of security logs.\u003c/p\u003e\n"],["\u003cp\u003eThe platform offers a variety of investigative views, such as Enterprise Insights, Asset, IP Address, Hash, Domain, and User views, to facilitate in-depth security analysis.\u003c/p\u003e\n"],["\u003cp\u003eThe Detection Engine automates the search for security threats within your data, and VirusTotal can be launched from the platform for further asset, domain, or IP address investigation.\u003c/p\u003e\n"]]],[],null,["# Google Security Operations SIEM overview\n========================================\n\nSupported in: \n[SIEM](/chronicle/docs/secops/google-secops-siem-toc)\n\nGoogle Security Operations SIEM is a cloud service, built as a specialized layer on top of\ncore Google infrastructure, designed for enterprises to privately retain, analyze,\nand search the massive amounts of security and network telemetry they generate.\nGoogle Security Operations normalizes, indexes, correlates, and analyzes the data to\nprovide instant analysis and context on risky activity.\n\nGoogle Security Operations lets you to examine the aggregated security information\nfor your enterprise going back for months or longer. Use Google Security Operations to\nsearch across all of the domains accessed within your enterprise. You can narrow\nyour search to any specific asset, domain, or IP address to determine if any\ncompromise has taken place.\n\n**Google Security Operations platform overview**\n\nData collection\n---------------\n\nGoogle Security Operations can ingest numerous security telemetry types through a variety of methods, including:\n\n- Forwarder: A lightweight software component, deployed in the customer's network, that supports syslog, packet capture,\n and existing log management or security information and event management (SIEM) data repositories.\n\n- Ingestion APIs: APIs that enable logs to be sent directly to the Google Security Operations platform, eliminating the need for additional hardware or software in customer environments.\n\n- Third-party integrations: Integration with third-party cloud APIs to facilitate ingestion of logs, including sources like Office 365 and Azure AD.\n\nData analysis\n-------------\n\nThe analytical capabilities of Google Security Operations are delivered to security professionals as a simple, browser-based\napplication. Many of these capabilities are also accessible programmatically through Read APIs.\nGoogle Security Operations gives analysts a way, when they see a potential threat, to determine what it is, what it's doing,\nwhether it matters, and how best to respond.\n\nSecurity and compliance\n-----------------------\n\nAs a specialized, private layer built over core Google infrastructure, Google Security Operations inherits compute and storage\ncapabilities as well as the security design and capabilities of that infrastructure.\n\nAs part of its security design, Google SecOps stores user credentials (for example, credentials that you provide so a Google SecOps feed can ingest log data from a third-party API) in [Secret Manager](/secret-manager).\n| **Note:** Both Google SecOps and Google employees with permissions to Google SecOps can access user credentials.\n\nGoogle Security Operations features\n-----------------------------------\n\n### Search\n\n- Raw Log Scan: Search your raw unparsed logs.\n- Regular Expressions: Search your raw unparsed logs using regular expressions.\n\n### Investigative views\n\n- Asset view: Investigate assets within your enterprise and whether or not they have interacted with suspicious domains.\n- IP Address view: Investigate specific IP addresses within your enterprise and what impact they have on your assets.\n- Hash view: Search for and investigate files based on their hash value.\n- Domain view: Investigate specific domains within your enterprise and what impact they have on your assets.\n- User view: Investigate users within your enterprise who may have been impacted by security events.\n- Procedural filtering: Fine tune information about an asset, including by event type, log source, network connection status, and Top Level Domain (TLD).\n\n### Curated information\n\n- Asset insight blocks: Highlights the domains and alerts that you might want to investigate further.\n- Prevalence graph: Shows the number of domains an asset has connected to over a specified time period. ### Detection Engine You can use the Google Security Operations Detection Engine to automate the process of searching across your data for security issues. You can specify rules to search all of your incoming data and notify you when potential and known threats appear in your enterprise.\n\n### VirusTotal\n\nYou can launch VirusTotal from Google Security Operations to further investigate an asset, domain, or IP address by clicking [VT Context](/chronicle/docs/investigation/view-virustotal-information).\n\n**Need more help?** [Get answers from Community members and Google SecOps professionals.](https://security.googlecloudcommunity.com/google-security-operations-2)"]]
