Security analytics
platform overview

2Security analytics challenges
Security operations spanning detection, investigation,and response face a common set of challenges
around cost (TCO), scale, performance, visibility, andanalyst productivity. Data volumes are an order ofmagnitude higher than they were just a few years ago
due to growing infrastructure, more applications, andmore security tools. Beyond storage costs, today’ssecurity data volumes require a significant
infrastructure investment to enable scalable andperformant analysis. Without this, key security
metrics such as “time to investigate” or “time toremediate” suffer. Additionally, prevailing security
analytics or SIEM pricing models are primarily basedon data volume or number of monitored devices andthereby create a disincentive to capture and analyze
all security-relevant information.
As enterprise infrastructure evolves from captive
on-premise to IaaS/PaaS/SaaS platforms, coverageand visibility have also emerged as critical barriers tosecurity operations. Some cloud providers focus
primarily on delivering security monitoring for theirown stack. Such siloed coverage limits visibility intomodern attacks that commonly span on-premiseand hybrid cloud infrastructure. But perhaps thesingle biggest challenge that security teams face isa shortage of talent. Proprietary analyticalframeworks and complex search syntaxes imposedby legacy security analytics providers significantly
increase the dependency on highly experienced andexpensive Tier 2 or 3 analysts, even for triage ofcommonplace attacks like phishing. Not surprisingly,
many organizations have turned to managed security
services to augment the shortage of in-housesecurity staff. For the most part, this has simply
shifted the same set of key challenges to a third
party without a real gain in analyst efficiency
or productivity.

Modern security analytics requirements
Lower and predictable TCO
Petabyte scalability
Google search speed
On-premise and hybrid cloud visibility
SOC productivity multipliers

3

Chronicle overview
Chronicle is a cloud service, built as a specialized layer on top of core Google infrastructure, designed forenterprises to privately retain, analyze, and search the massive amounts of security and network
telemetry they generate. Chronicle normalizes, indexes, correlates, and analyzes the data to provide
instant analysis and context on risky activity.

Incident investigation

Threat hunting

Detection

Third-party apps

Telemetry aggregation platform
Private container
DNS
VT Metadata
DHCP

Endpoint
SIEM
AlertsYour telemetry

YourCorp

Proprietary signals

Third-party verdicts/IoCs

DNS resolutions
File hashes
Curated indicators

Third-party intelligence

Curated intelligence4

Data collection
Chronicle can ingest numerous security telemetry types
through a variety of methods including:Forwarder
A lightweight software component, deployed in thecustomer’s network, that supports syslog, packet capture,and existing log management / SIEM data repositories

Ingestion APIs
APIs that enable logs to be sent directly to the Chronicle
platform, eliminating the need for additional hardware orsoftware in customer environments

Third-party integrations
Integration with third-party cloud APIs to facilitate
ingestion of logs, including sources like Office 365 andAzure AD

Data analysis
The analytical capabilities of Chronicle are delivered tosecurity professionals as a simple, browser-based
application. Many of these capabilities are also accessible
programmatically via Read APIs. At its core, the purposeof Chronicle is to give analysts a way, when they see a
potential threat, to determine what it is, what it’s doing,whether it matters, and how best to respond.

5

What is the threat?

Does it matter?

Here’s an example: If a threat feed just informed
Chronicle about a new APT network domain,
Chronicle will instantly surface every hostname thataccessed that domain going back a full year,
regardless of the data volume. Similarly, Chronicle
continuously enriches the incoming event stream bycorrelating IPs to hostnames so that analysts havefull information, instantly – without the need to write
complex queries.

Security telemetry alone rarely provides the fullpicture needed to hunt, investigate, or detect threats.
Each curated view in Chronicle provides relevant
context and insights to aid the investigation or hunt.
This context is critical to giving analysts the ability toprioritize real threats and dismiss false positives.

What is it doing?
Modern threats lie at the intersection of targeted
assets, users, and threat campaign infrastructure(domains, URLs hosted on specific external IP
addresses, and malicious files deployed from there).
In Chronicle, curated views for assets, users, and IoCtypes operate on a Unified Data Model and enable
analysts to quickly and intuitively investigate what athreat is doing.

Security and compliance
As a specialized, private layer built over core Google
infrastructure, Chronicle inherits compute and storage
capabilities as well as the security design and capabilitiesof that infrastructure (Chronicle’s “Core Infrastructure”).
The underlying design of our Core Infrastructure is
described in more detail in a Google whitepaper.

How to respond?
Large organizations with mature SOCs havedocumented playbooks for investigation andremediation of threats. SOAR or Orchestration
technologies that automate these playbooks are now
growing in adoption. Chronicle’s Read APIs expose
its analytical capabilities and enable enterprises (aswell as managed security service providers) tointegrate Chronicle findings into downstream
security playbook technologies such as ticketingsystems or SOC reporting tools.

6Summary of capabilities and benefits
FeatureDescriptionBenefits

Continuous
enrichment

Automated IP to host correlation

Faster time to investigate

Automated, continuous, retroactive
IoC enrichment

Greater analyst productivity

Context and insights(threat / IoC,vulnerability, asset,user, file/process)Embedded threat intelligence sources 		(Proofpoint, DHS AIS, OSInt, Avast, ESET)

Faster time to investigate
Greater analyst productivity

Customer-provided threat
intelligence sources
Asset, vulnerability, and user context
Derived insights
High performance APIs that expose
functionality to downstream
enterprise and MSSP SOC playbook
stages and tools (ticketing,orchestration, dashboarding)

Automation of SOC playbooks

Ingest APIs andUnified Data ModelHigh throughput APIs that enable sending
data directly to the Chronicle data
pipeline without the need for a forwarder

Faster time to value

Raw Log Scan

Access to all unparsed fields

Faster onboarding of
all security telemetry

Read APIs

Search any raw security telemetry

Security & compliance

Adherence to Google Cloud
common controls
SOC 2 and SOC 3
ISO/IEC 27001
HIPAA BAA

Integration with MSSP portals
Faster time to remediation

Zero deployment footprint

Documented, stringentcontrols to protect yourdata at every layer
Key attestations
and certifications