Realm.Security Documentation

Appearance

Google SecOps (Chronicle) ​

Realm Security integrates with Google SecOps (formerly Chronicle), enabling intelligent routing and forwarding of security event logs to your SecOps instance. Follow these steps to configure log forwarding from Realm Security Data Fabric to Google SecOps.

Prerequisites ​

  • A licensed Google SecOps instance (separate from GCP — see note below)
  • Administrative access to your GCP console
  • Your Google SecOps Customer ID

Note: Google SecOps is a separately licensed product and is not included with a standard GCP subscription. Contact Google Cloud sales if you have not yet licensed SecOps.

Overview ​

  1. GCP Console: Create a service account and credentials
  2. GCP Console: Grant the service account access to SecOps
  3. Realm Console: Setup Google SecOps output feed

1. GCP: Create a Service Account and Credentials ​

Realm uses a GCP service account to authenticate with the Google SecOps ingestion API. Note: Realm does not support the legacy P12 secret, please ensure you are creating a JSON GCP Service Account Key.

  1. Log in to the GCP Console.
  2. Navigate to IAM & Admin > Service Accounts.
  3. Click Create Service Account.
  4. Give the service account a name (e.g. realm-secops-ingest) and click Create and Continue.
  5. Skip the optional role assignment steps for now — you will assign the role in Step 2.
  6. Click Done.
  7. Navigate to the newly created service account and select the Keys tab.
  8. Click Add Key > Create new key, select JSON, and click Create.
  9. A JSON key file will be downloaded to your machine. Store this securely — it will be used to configure the Realm output feed.

2. GCP: Grant the Service Account Access to SecOps ​

The service account needs permission to ingest logs into your SecOps instance.

  1. In the GCP Console, navigate to IAM & Admin > IAM.
  2. Click Grant Access.
  3. In the New principals field, enter the email address of the service account you created in Step 1 (e.g. realm-secops-ingest@your-project.iam.gserviceaccount.com).
  4. Assign the role Chronicle API Editor (roles/chronicle.editor). This role provides the global permissions necessary to push logs using Google SecOps ingestion endpoints.
  5. Click Save.

3. Realm: Setup Google SecOps Output Feed ​

Find Your Customer ID ​

Your SecOps Customer ID is a UUID that identifies your Google SecOps instance. To find it:

  1. Log in to your Google SecOps instance.
  2. Navigate to SIEM Settings > Profile.
  3. Copy the Customer ID value located within the Organization Details section (formatted as a UUID, e.g. c8c65bfa-5f2c-42d4-9189-64bb7b939f2c).

Configure the Output Feed ​

  1. Go to Destinations and select a destination of type SIEM.
  2. Click Add Output Feed.
  3. Select type: Google SecOps.
  4. Give the output feed a name and description of your choosing.
  5. Configure the following fields:
FieldDescription
Google Service Account KeyUpload or paste the contents of the JSON key file downloaded in Step 1.
Customer IDYour SecOps Customer ID UUID (e.g. c8c65bfa-5f2c-42d4-9189-64bb7b939f2c).
RegionThe region where your SecOps instance is deployed. Must match the region selected when your SecOps instance was provisioned. See supported regions below.
Namespace(Optional) A label to segment logs within your SecOps instance by data domain (e.g. production, staging). Useful if you are sending logs from multiple environments to the same SecOps instance. Leave blank if not needed.
  1. Click Add to save the output feed.

It takes about a minute to deploy the fabric update, after which data should start flowing to Google SecOps.

Supported Regions ​

Select the region that matches where your Google SecOps instance is deployed.

RegionDescription
usUnited States (multi-region)
euEurope (multi-region)
asiaAsia Pacific (multi-region, same as Singapore — retained for backwards compatibility)
canadaCanada
dammamDammam, Saudi Arabia
dohaDoha, Qatar
frankfurtFrankfurt, Germany
londonLondon, United Kingdom
mumbaiMumbai, India
parisParis, France
singaporeSingapore
sydneySydney, Australia
sao_pauloSão Paulo, Brazil
tel_avivTel Aviv, Israel
tokyoTokyo, Japan
turinTurin, Italy
zurichZurich, Switzerland

Troubleshooting ​

Authentication errors

Verify that:

  • The JSON key file is valid and has not expired or been revoked
  • The service account has been granted the Chronicle API Editor role as described in Step 2
  • The GCP project associated with the service account is the same project linked to your SecOps instance

Data not appearing in SecOps

  • Confirm the Customer ID is correct — an incorrect UUID will result in silent ingestion failures
  • Confirm the Region matches the region your SecOps instance is deployed in — a region mismatch will cause requests to fail or be silently dropped

Wrong region selected

If you are unsure which region your SecOps instance is in, log in to your SecOps instance and check SIEM Settings > Profile, or contact your Google SecOps administrator.

Resources ​