[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-21。"],[[["\u003cp\u003eGoogle Security Operations is a cloud-based service that allows enterprises to retain, analyze, and search large volumes of security and network telemetry data for threat detection, investigation, and remediation.\u003c/p\u003e\n"],["\u003cp\u003eThe platform utilizes capabilities like data collection, detection, investigation, and response to help security analysts analyze and mitigate security threats throughout their lifecycle.\u003c/p\u003e\n"],["\u003cp\u003eGoogle Security Operations offers features such as UDM Search, raw log scanning, case management, playbook design, graph investigation, dashboards, reporting, and an integrated development environment (IDE) for advanced customization.\u003c/p\u003e\n"],["\u003cp\u003eAnalysts can utilize various investigative views within Google Security Operations, including asset, IP address, hash, domain, and user views, along with procedural filtering to refine their investigations.\u003c/p\u003e\n"],["\u003cp\u003eThe Detection Engine automates the search for security issues by allowing users to define rules that monitor incoming data, and access control is managed through Identity and Access Management.\u003c/p\u003e\n"]]],[],null,["# Google SecOps overview\n======================\n\nSupported in: \nGoogle secops\n\nGoogle Security Operations is a cloud service, built as a specialized layer on\ntop of Google infrastructure, designed for enterprises to privately retain,\nanalyze, and search the large amounts of security and network telemetry they\ngenerate.\n\nGoogle SecOps normalizes, indexes, correlates, and analyzes the data to\nprovide instant analysis and context on risky activity. Google SecOps can\nbe used to detect threats, investigate the scope and cause of those threats, and\nprovide remediation using prebuilt integrations with enterprise workflow,\nresponse, and orchestration platforms.\n\nGoogle SecOps lets you examine the aggregated security\ninformation for your enterprise going back for months or longer. Use\nGoogle SecOps to search across all of the domains accessed within your\nenterprise. You can narrow your search to any specific asset, domain, or IP\naddress to determine if any compromise has taken place.\n\nThe Google SecOps platform enables security analysts to\nanalyze and mitigate a security threat throughout its lifecycle by employing the\nfollowing capabilities:\n\n- **Collection**: Data is ingested into the platform using forwarders, parsers, connectors and webhooks.\n- **Detection**: This data is aggregated, normalized using the Universal Data Model (UDM), and linked to detections and threat intelligence.\n- **Investigation** : Threats are investigated through case management, search, collaboration, and [context-aware\n analytics](/chronicle/docs/detection/context-aware-analytics).\n- **Response**: Security analysts can respond quickly and provide resolutions using automated playbooks and incident management.\n\nData collection\n---------------\n\nGoogle SecOps can ingest numerous security telemetry types through a\nvariety of methods, including the following:\n\n- **Forwarder**: A lightweight software component, deployed in the customer's\n network, that supports syslog, packet capture, and existing log management\n or security information and event management (SIEM) data repositories.\n\n- **Ingestion APIs**: APIs that enable logs to be sent directly to the\n Google SecOps platform, eliminating the need for additional\n hardware or software in customer environments.\n\n- **Third-party integrations**: Integration with third-party cloud APIs to\n facilitate ingestion of logs, including sources like Office 365 and Azure\n AD.\n\nThreat analysis\n---------------\n\nThe analytical capabilities of Google SecOps are delivered as a\nbrowser-based application. Many of these\ncapabilities are also accessible programmatically through Read APIs.\nGoogle SecOps gives analysts a way, when they see a potential threat, to\ninvestigate further and determine how best to respond.\n\nSummary of Google SecOps features\n---------------------------------\n\nThis section describes some of the features available in\nGoogle SecOps.\n\n### Search\n\n- **UDM Search**: Lets you to find Unified Data Model (UDM) events and alerts within your Google SecOps instance.\n- **Raw Log Scan**: Search your raw unparsed logs.\n- **Regular Expressions**: Search your raw unparsed logs using regular expressions.\n\n### Case management\n\nGroup related alerts into cases, sort and filter cases queue for triage and\nprioritization, assign cases, collaborate on every case, case audit and\nreporting.\n\n### Playbook designer\n\nBuild playbooks by selecting predefined actions and dragging and dropping them\ninto the playbook canvas without additional coding. Playbooks also enable you to\ncreate dedicated views for each alert type and each SOC role. Case management\npresents only the data relevant to a specific alert type and user role.\n\n### Graph investigator\n\nVisualize the who, what, and when of an attack, identify opportunities for\nthreat hunting, capture the full picture and take action.\n\n### Dashboard and reporting\n\nEffectively measure and manage operations, demonstrate value to stakeholders,\ntrack real-time SOC metrics and KPIs. You can use built-in dashboards and\nreports or build your own.\n\n### Integrated development environment (IDE)\n\nSecurity teams with coding skills can modify and enhance existing playbook\nactions, debug code, build new actions for existing integrations, and create\nintegrations that are not available in the Google Security Operations SOAR Marketplace.\n\n### Investigative views\n\n- **Asset view**: Investigate assets within your enterprise and whether or not they have interacted with suspicious domains.\n- **IP Address view**: Investigate specific IP addresses within your enterprise and what impact they have on your assets.\n- **Hash view**: Search for and investigate files based on their hash value.\n- **Domain view**: Investigate specific domains within your enterprise and what impact they have on your assets.\n- **User view**: Investigate users within your enterprise who may have been impacted by security events.\n- **Procedural filtering**: Fine tune information about an asset, including by event type, log source, network connection status, and Top Level Domain (TLD).\n\n### Highlighted information\n\n- Asset insight blocks highlights the domains and alerts that you might want to investigate further.\n- Prevalence graph shows the number of domains an asset has connected to over a specified time period.\n- Alerts from other popular security products.\n\n### Detection engine\n\nYou can use the Google SecOps Detection Engine to automate the process of\nsearching across your data for security issues. You can specify rules to search\nall of your incoming data and notify you when potential and known threats appear\nin your enterprise.\n\n### Access control\n\nYou can both employ predefined roles and configure new roles to control access\nto classes of data, alerts, and events stored within your Google SecOps\ninstance. [Identity and Access Management](/iam/docs) provides access control for\nGoogle SecOps.\n\n**Need more help?** [Get answers from Community members and Google SecOps professionals.](https://security.googlecloudcommunity.com/google-security-operations-2)"]]
