Google Security Operations menyerap log pelanggan, menormalisasi data, dan mendeteksi pemberitahuan keamanan. SCC menyediakan fitur layanan mandiri untuk
penyerapan data, deteksi ancaman, pemberitahuan, dan pengelolaan kasus.
Google SecOps juga dapat menerima pemberitahuan dari sistem SIEM lain dan menganalisisnya.
Penyerapan log Google SecOps
Layanan penyerapan Google SecOps bertindak sebagai gateway untuk semua data.
Google SecOps menyerap data menggunakan sistem berikut:
Forwarder: Agen jarak jauh yang diinstal pada endpoint pelanggan yang mengirim data ke layanan penyerapan Google SecOps. Untuk mengetahui detail tentang cara menginstal penerus Linux dan Windows, lihat Menginstal dan mengonfigurasi penerus.
Agen Bindplane: Agen Bindplane mengumpulkan log dari berbagai sumber
dan mengirimkannya ke Google SecOps. Anda dapat mengelola agen ini menggunakan konsol Pengelolaan OP Bindplane opsional. Untuk mengetahui informasi selengkapnya, lihat Menggunakan agen BindPlane.
API Penyerapan: Google SecOps menyediakan API penyerapan publik yang memungkinkan Anda mengirim data secara langsung. Untuk mengetahui informasi selengkapnya, lihat
Ingestion API.
Google Cloud: Google SecOps mengambil data langsung dari
organisasi Google Cloud Anda. Untuk mengetahui informasi selengkapnya, lihat Menyerap Google Cloud
data ke
Google SecOps.
Feed data: Feed data mengambil data dari lokasi eksternal statis (seperti Amazon S3) dan
API pihak ketiga (seperti Okta). Feed data ini mengirim log langsung ke layanan penyerapan Google SecOps. Untuk mengetahui informasi selengkapnya, lihat dokumentasi pengelolaan feed.
Feed data mendukung baris log berukuran hingga 4 MB.
Parser mengonversi log dari sistem pelanggan menjadi Model Data Terpadu (UDM). Sistem hilir dalam
Google SecOps menggunakan UDM untuk memberikan kemampuan tambahan,
termasuk aturan dan penelusuran UDM. SecOps Google dapat memproses log dan pemberitahuan, tetapi hanya mendukung pemberitahuan satu peristiwa. Anda dapat menggunakan penelusuran UDM
untuk menemukan pemberitahuan SecOps Google bawaan dan yang di-ingest.
Memahami proses penyerapan Google SecOps
Google SecOps mendukung jenis penyerapan data berikut:
Log mentah
Google SecOps menyerap log mentah menggunakan forwarder, API penyerapan, feed data, atau langsung dari Google Cloud.
Peringatan dari sistem SIEM lain
SecOps Google dapat menyerap pemberitahuan dari sistem SIEM, EDR, atau sistem tiket lainnya, sebagai berikut:
Menerima pemberitahuan menggunakan
konektor Google SecOps
atau webhook Google SecOps.
Menyerap peristiwa yang terkait dengan setiap pemberitahuan dan membuat deteksi yang sesuai.
Memproses peristiwa dan deteksi yang di-ingest.
Anda dapat membuat aturan mesin deteksi untuk mengidentifikasi pola dalam peristiwa yang di-ingest dan menghasilkan deteksi tambahan.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-02 UTC."],[[["\u003cp\u003eGoogle Security Operations SIEM ingests and normalizes logs from various sources, including customer endpoints, APIs, and Google Cloud, to detect security alerts.\u003c/p\u003e\n"],["\u003cp\u003eData can be ingested through multiple methods such as forwarders, BindPlane agents, Ingestion APIs, direct data pulling from Google Cloud, and data feeds from external locations and third party APIs.\u003c/p\u003e\n"],["\u003cp\u003eGoogle Security Operations SIEM can also ingest single-event alerts from other SIEM systems, EDRs, or ticketing systems through Google Security Operations SOAR connectors or webhooks.\u003c/p\u003e\n"],["\u003cp\u003eIngested data is processed by Google Security Operations SIEM parsers, converting it into a Unified Data Model (UDM) for further analysis and the application of rules for pattern identification.\u003c/p\u003e\n"],["\u003cp\u003eLarge files for ingestion, 5-10GB or larger can cause significant delays in the ingestion process, and Data feeds have a maximum log line size of 4MB.\u003c/p\u003e\n"]]],[],null,["# Google SecOps data ingestion\n============================\n\nSupported in: \nGoogle secops [SIEM](/chronicle/docs/secops/google-secops-siem-toc)\n\nGoogle Security Operations ingests customer logs, normalizes the data, and detects\nsecurity alerts. It provides self-service features for\ndata ingestion, threat detection, alerts, and case management.\nGoogle SecOps can also receive alerts from other SIEM systems and\nanalyze them.\n| **Note:** Large files (5-10 GB or larger) can significantly delay data ingestion.\n\nGoogle SecOps log ingestion\n---------------------------\n\nThe Google SecOps ingestion service acts as a gateway for all data.\n\nGoogle SecOps ingests data using the following systems:\n\n- **Forwarders** : Remote agents installed on customer\n endpoints that send data to the Google SecOps ingestion\n service. For details about how to install Linux and Windows\n forwarders, see [Install and configure the\n forwarder](/chronicle/docs/install/forwarder-linux).\n\n- **Bindplane agent** : The Bindplane agent collects logs from various sources\n and sends them to Google SecOps. You can manage this agent\n using the optional Bindplane OP Management console. For more information,\n see [Use the Bindplane\n agent](/chronicle/docs/ingestion/use-bindplane-agent).\n\n- **Ingestion APIs** : Google SecOps provides public ingestion APIs,\n that let you send data directly. For more information, see the\n [Ingestion API](/chronicle/docs/reference/ingestion-api).\n\n- **Google Cloud** : Google SecOps retrieves data directly from\n your Google Cloud organization. For more information, see [Ingest Google Cloud\n data to\n Google SecOps](/chronicle/docs/ingestion/cloud/ingest-gcp-logs).\n\n- **Data feeds** : Data feeds retrieve data from static external locations (such as Amazon S3) and\n third-party APIs (such as Okta). These data feeds send logs directly to\n the Google SecOps ingestion service. For more information,\n see the [feed management\n documentation](/chronicle/docs/administration/feed-management).\n\n Data feeds support log lines up to 4 MB in size.\n\n| **Note:** Google SecOps recommends using UTC or ISO 8601 formats for log timestamps.\n\nParsers convert logs from customer systems\ninto a Unified Data Model (UDM). Downstream systems within\nGoogle SecOps use the UDM to provide additional capabilities,\nincluding rules and UDM search. Google SecOps can ingest both\nlogs and alerts, but supports only single-event alerts. You can use UDM search\nto find both ingested and\nbuilt-in Google SecOps alerts.\n\nUnderstand Google SecOps ingestion process\n------------------------------------------\n\nGoogle SecOps supports the following types of data ingestion:\n\n### Raw logs\n\nGoogle SecOps ingests raw logs using forwarders, the ingestion\nAPI, data feeds, or directly from Google Cloud.\n\n### Alerts from other SIEM systems\n\nGoogle SecOps can ingest alerts from other SIEM systems, EDRs, or\nticketing systems, as follows:\n\n1. Receive alerts using Google SecOps [connectors](/chronicle/docs/soar/ingest/connectors/ingest-your-data-connectors) or Google SecOps [webhooks](/chronicle/docs/soar/ingest/webhooks/setting-up-a-webhook).\n2. Ingest the events associated with each alert and create a corresponding detection.\n3. Process both the ingested events and detections.\n\nYou can create detection engine rules to identify patterns in the ingested\nevents and generate additional detections.\n| **Note:** Detection engine rules don't identify patterns in alerts ingested from Google SecOps.\n\n**Need more help?** [Get answers from Community members and Google SecOps professionals.](https://security.googlecloudcommunity.com/google-security-operations-2)"]]
