借助 Google Security Operations，您可以将统一数据模型 (UDM) 数据导出到您拥有和管理的自管理项目中。您可以将自己的 Google Cloud 项目关联到 Google SecOps 实例，并独立管理 IAM 权限，而无需依赖 Google 管理的设置。您还可以选择 SIEM 设置>数据导出，以启用和配置 Bring Your Own BigQuery (BYOBQ) 功能。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-02。"],[[["\u003cp\u003eGoogle Security Operations allows exporting Unified Data Model (UDM) data to a self-managed Google Cloud project, enabling independent IAM permission configuration without Google's direct involvement.\u003c/p\u003e\n"],["\u003cp\u003eData exported to BigQuery includes log data, aggregated events, entity graph information, rule detections, and IOC matches.\u003c/p\u003e\n"],["\u003cp\u003eThe retention period for BigQuery data export is configurable per data source, with the option for indefinite retention by creating custom policies in the Cloud Storage bucket.\u003c/p\u003e\n"],["\u003cp\u003eExisting customer data is not migrated to the new self-managed project, meaning that you must complete actions such as running queries that join data across both projects to query data that includes before and after the self-managed project activation date.\u003c/p\u003e\n"],["\u003cp\u003eTo access BigQuery data, users must have the BigQuery Data Viewer, BigQuery Job User, and Storage Object Viewer IAM roles.\u003c/p\u003e\n"]]],[],null,["# Configure data export to BigQuery in a self-managed Google Cloud project\n========================================================================\n\nGoogle Security Operations lets you export Unified Data Model (UDM) data to a self-managed project\nthat you own and manage. You can link your own Google Cloud project to your\nGoogle SecOps instance and independently manage IAM\npermissions with no dependency on Google-managed settings. You can also enable and\nconfigure the **Bring Your Own BigQuery** (BYOBQ) feature by selecting **SIEM Settings**\n\\\u003e **Data Export**.\n| **Note:** Enabling BYOBQ on your **Bring your own project** (BYOP) project may incur additional storage and compute costs.\n| **Note:** BYOBQ is not available for Google SecOps Enterprise Plus customers.\n\nGoogle SecOps exports the following categories of data to your\nBigQuery project:\n\n- `udm_events`: log data normalized into the UDM schema.\n- `udm_events_aggregates`: aggregated data that is summarized by each hour of normalized events.\n- `entity_graph`: There are three dimensions (contextual data, derived data, and global context) to the entity graph. All of contextual data and derived data, as well as part of global context data is data written and stored as UDM.\n- `rule_detections`: detections that are returned by rules run in Google SecOps.\n- `ioc_matches`: IOC matches that are found against UDM events.\n- `ingestion_metrics`: metrics related to the ingestion and normalization pipeline (exported by default).\n- `udm_enum_value_to_name_mapping`: maps enum values to UDM field names (exported by default).\n- `entity_enum_value_to_name_mapping`: maps enum values to entity field names (exported by default).\n\nRetention period\n----------------\n\nIf you're an existing customer, the retention period you set defines how long the\nexported data for your BigQuery stays in your Google-managed project.\n\nThe retention period begins from the date of the earliest exported record. You can\nconfigure a separate retention period for each data source, up to a maximum that\nmatches the default log retention period in Google SecOps.\n\nIf no retention period is specified, the default behavior is to keep exporting\ndata without any cleanup or purging, to limit the retention period.\n\nIn this case, you can set the retention period to **Unlimited**:\n\n- Click **SIEM Settings** \\\u003e **Data Export**.\n- In the **Retention Period** column of the **Data Export** table, select **Unlimited** from the list for the relevant data type.\n\nYou can then set up an [object lifecycle rule](/storage/docs/lifecycle)\nin your Google Cloud storage bucket to delete objects as needed.\n\n### Data migration for existing customers\n\nIf you're an existing customer, your data from the existing Google-managed\nproject isn't migrated to the self-managed project. Because data isn't migrated, your data is\nlocated in two separate projects. To query the data across a time range that\nincludes the self-managed project activation date, you need to complete one of\nthe following actions:\n\n- Use a single query that joins data across both projects.\n- Run two separate queries on the respective projects, one for data before the self-managed project activation date and one for data after. When the retention period for your Google-managed project expires, that data is deleted. You can only query data that is within your Google Cloud project after that point.\n\nPermissions required to export data\n-----------------------------------\n\nTo access your BigQuery data, run your queries within BigQuery\nitself. Assign the following IAM roles to any user who needs access:\n\n- [BigQuery Data Viewer](/iam/docs/understanding-roles#bigquery.dataViewer) (`roles/bigquery.dataViewer`)\n- [BigQuery Job User](/iam/docs/understanding-roles#bigquery.jobUser) (`roles/bigquery.jobUser`)\n- [Storage Object Viewer](/iam/docs/understanding-roles#storage.objectViewer) (`roles/storage.objectViewer`) You can also assign roles at the dataset level. For more information, see [BigQuery IAM roles and permissions](/bigquery/docs/access-control).\n\nInitiate BigQuery data export to your self-managed project\n----------------------------------------------------------\n\n1. Create a Google Cloud project where you want your data to be exported.\n For more information, see [Configure a Google Cloud project for Google SecOps](/chronicle/docs/onboard/configure-cloud-project).\n\n | **Note:** The self-managed project must be linked to the Google SecOps instance. Once this capability is enabled, you can't revert to a Google-managed project.\n2. Link your self-managed project to your Google SecOps instance\n to establish a connection between Google SecOps and your self-managed\n project. For more information, see [Link Google Security Operations to Google Cloud services](/chronicle/docs/onboard/link-chronicle-cloud).\n You can also enable and configure the **Bring Your Own BigQuery** (BYOBQ) feature\n by selecting **SIEM Settings** \\\u003e **Data Export**.\n\n3. To validate that the data is exported to your self-managed project, check the\n tables under the `datalake` dataset in BigQuery.\n\nYou can write ad-hoc queries against Google SecOps data stored\nin BigQuery tables. You can also create more advanced analytics using\nother third-party tools that integrate with BigQuery.\n\nAll the resources created in the your self-managed Google Cloud project to enable\nexports, including Cloud Storage bucket and BigQuery tables, are in the same\nregion as Google SecOps.\n\nIf you get an error like `Unrecognized name: \u003cfield_name\u003e at [\u003csome_number\u003e:\u003csome_number\u003e]`\nwhen querying BigQuery, it means the field you're trying to access isn't\nin your dataset and because your schema is dynamically generated\nduring the export process.\n\nFor more information about Google SecOps data in BigQuery,\nsee [Google SecOps data in BigQuery](/chronicle/docs/reports/overview-chronicle-bigquery).\n\n**Need more help?** [Get answers from Community members and Google SecOps professionals.](https://security.googlecloudcommunity.com/google-security-operations-2)"]]
