Google Security Operations SIEM 是一种云服务，作为核心 Google 基础架构之上的专用层构建，旨在让企业以私密方式保留、分析和搜索它们生成的海量安全和网络遥测数据。Google Security Operations 对数据进行归一化、编入索引、关联和分析，以提供有关有风险的活动的即时分析和背景信息。
借助 Google Security Operations，您可以检查企业过去几个月或更长时间的汇总安全信息。使用 Google Security Operations 在您的企业内部访问的所有网域中执行搜索。您可以将搜索范围缩小到任何特定的资产、网域或 IP 地址，以确定是否发生了任何入侵。
提取 API：允许将日志直接发送到 Google Security Operations 平台的 API，无需在客户环境中使用其他硬件或软件。
第三方集成：与第三方云 API 集成，以便提取日志，包括 Office 365 和 Azure AD 等来源。
数据分析
Google Security Operations 的分析功能以简单的浏览器形式提供给安全专业人员。其中许多功能也可通过 Read API 以编程方式访问。Google Security Operations 为分析师提供一种方法，当他们看到潜在威胁时，即可确定其威胁、所执行操作、重要程度以及最佳响应方式。
安全与合规性
作为在 Google 核心基础架构之上构建的专用私有层，Google Security Operations 继承了计算和存储功能以及该基础架构的安全性设计和功能。
根据其安全设计，Google SecOps 会将用户凭据（例如，您提供的凭据，以便 Google SecOps Feed 可以从第三方 API 注入日志数据）存储在 Secret Manager 中。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-21。"],[[["\u003cp\u003eGoogle Security Operations SIEM is a cloud-based service designed for enterprises to retain, analyze, and search extensive security and network telemetry data.\u003c/p\u003e\n"],["\u003cp\u003eThis platform aggregates and analyzes security data, allowing users to investigate security information over extended periods and across various domains, assets, and IP addresses.\u003c/p\u003e\n"],["\u003cp\u003eGoogle Security Operations supports data collection through forwarders, ingestion APIs, and third-party integrations like Office 365 and Azure AD, enabling seamless ingestion of security logs.\u003c/p\u003e\n"],["\u003cp\u003eThe platform offers a variety of investigative views, such as Enterprise Insights, Asset, IP Address, Hash, Domain, and User views, to facilitate in-depth security analysis.\u003c/p\u003e\n"],["\u003cp\u003eThe Detection Engine automates the search for security threats within your data, and VirusTotal can be launched from the platform for further asset, domain, or IP address investigation.\u003c/p\u003e\n"]]],[],null,["# Google Security Operations SIEM overview\n========================================\n\nSupported in: \n[SIEM](/chronicle/docs/secops/google-secops-siem-toc)\n\nGoogle Security Operations SIEM is a cloud service, built as a specialized layer on top of\ncore Google infrastructure, designed for enterprises to privately retain, analyze,\nand search the massive amounts of security and network telemetry they generate.\nGoogle Security Operations normalizes, indexes, correlates, and analyzes the data to\nprovide instant analysis and context on risky activity.\n\nGoogle Security Operations lets you to examine the aggregated security information\nfor your enterprise going back for months or longer. Use Google Security Operations to\nsearch across all of the domains accessed within your enterprise. You can narrow\nyour search to any specific asset, domain, or IP address to determine if any\ncompromise has taken place.\n\n**Google Security Operations platform overview**\n\nData collection\n---------------\n\nGoogle Security Operations can ingest numerous security telemetry types through a variety of methods, including:\n\n- Forwarder: A lightweight software component, deployed in the customer's network, that supports syslog, packet capture,\n and existing log management or security information and event management (SIEM) data repositories.\n\n- Ingestion APIs: APIs that enable logs to be sent directly to the Google Security Operations platform, eliminating the need for additional hardware or software in customer environments.\n\n- Third-party integrations: Integration with third-party cloud APIs to facilitate ingestion of logs, including sources like Office 365 and Azure AD.\n\nData analysis\n-------------\n\nThe analytical capabilities of Google Security Operations are delivered to security professionals as a simple, browser-based\napplication. Many of these capabilities are also accessible programmatically through Read APIs.\nGoogle Security Operations gives analysts a way, when they see a potential threat, to determine what it is, what it's doing,\nwhether it matters, and how best to respond.\n\nSecurity and compliance\n-----------------------\n\nAs a specialized, private layer built over core Google infrastructure, Google Security Operations inherits compute and storage\ncapabilities as well as the security design and capabilities of that infrastructure.\n\nAs part of its security design, Google SecOps stores user credentials (for example, credentials that you provide so a Google SecOps feed can ingest log data from a third-party API) in [Secret Manager](/secret-manager).\n| **Note:** Both Google SecOps and Google employees with permissions to Google SecOps can access user credentials.\n\nGoogle Security Operations features\n-----------------------------------\n\n### Search\n\n- Raw Log Scan: Search your raw unparsed logs.\n- Regular Expressions: Search your raw unparsed logs using regular expressions.\n\n### Investigative views\n\n- Asset view: Investigate assets within your enterprise and whether or not they have interacted with suspicious domains.\n- IP Address view: Investigate specific IP addresses within your enterprise and what impact they have on your assets.\n- Hash view: Search for and investigate files based on their hash value.\n- Domain view: Investigate specific domains within your enterprise and what impact they have on your assets.\n- User view: Investigate users within your enterprise who may have been impacted by security events.\n- Procedural filtering: Fine tune information about an asset, including by event type, log source, network connection status, and Top Level Domain (TLD).\n\n### Curated information\n\n- Asset insight blocks: Highlights the domains and alerts that you might want to investigate further.\n- Prevalence graph: Shows the number of domains an asset has connected to over a specified time period. ### Detection Engine You can use the Google Security Operations Detection Engine to automate the process of searching across your data for security issues. You can specify rules to search all of your incoming data and notify you when potential and known threats appear in your enterprise.\n\n### VirusTotal\n\nYou can launch VirusTotal from Google Security Operations to further investigate an asset, domain, or IP address by clicking [VT Context](/chronicle/docs/investigation/view-virustotal-information).\n\n**Need more help?** [Get answers from Community members and Google SecOps professionals.](https://security.googlecloudcommunity.com/google-security-operations-2)"]]
