to_google_secops

Sends raw logs, UDM events, or entities to a Google SecOps Chronicle instance.

to_google_secops [mode=string,] project=string, region=string, instance=string,
                 [service_credentials=secret, log_type=string,
                 log_text=blob|string, log_entry_time=time,
                 collection_time=time, labels=record, forwarder=string,
                 hint=string, source_filename=string, namespace=string,
                 max_request_size=int, max_batch_events=int,
                 batch_timeout=duration, parallel=int]

Description

The to_google_secops operator ingests telemetry via the Google SecOps Chronicle import APIs:

mode="raw_log" sends raw logs to the logs.import API.
mode="udm_event" sends each input row as a UDM event to the events.import API.
mode="udm_entity" sends each input row as an entity to the entities.import API.

`mode = string`

Selects the ingestion mode. Must be raw_log, udm_event, or udm_entity.

Defaults to raw_log.

`project = string`

The Google Cloud project that owns the SecOps instance.

`region = string`

The SecOps location. This also selects the regional API host.

`instance = string`

The SecOps instance ID.

`service_credentials = secret (optional)`

Full service-account JSON to use for Google Cloud OAuth2 authentication. Use a secret value for credentials in production.

When omitted, the operator uses Google Application Default Credentials.

`log_type = string`

The raw log type or entity log type. Required when mode="raw_log" or mode="udm_entity".

For raw logs, this selects the SecOps log type in the logs.import resource path. For entities, this sets the logType field in the entities.import request. Use a context source log type accepted by your SecOps instance, such as AZURE_AD_CONTEXT for Azure AD user context. This is not the same as the UDM entity type, such as USER or ASSET.

UDM and Entity Field Names

UDM events and entities are sent as ingestion API JSON. Shape these rows with Google’s lowerCamelCase ingestion field names, such as metadata.eventType and metadata.entityType. Query field names in SecOps search and YARA-L often use snake_case, such as metadata.event_type; those are not the field names to send to the import APIs. The operator forwards each UDM or entity row as-is and does not translate field names.

`log_text = blob|string`

The raw log text. String values must contain valid UTF-8. Blob and string values are base64-encoded before they are sent to SecOps.

Required when mode="raw_log".

`log_entry_time = time`

The timestamp of the raw log entry. Required when mode="raw_log".

`collection_time = time`

The time at which the raw log entry was collected. Google requires this to be after log_entry_time. Required when mode="raw_log".

`labels = record (optional)`

A record of custom metadata labels to attach to raw logs.

String values default to rbacEnabled=false. To allow a label to be used for Google SecOps Data RBAC, use the structured form:

labels={
  env: "prod",
  tenant: {value: "acme", rbac_enabled: true},
}