---
url: https://docs.realmsec.info/integration/google_secops.md
---

# Google SecOps (Chronicle)

Realm Security integrates with Google SecOps (formerly Chronicle), enabling intelligent routing and forwarding of security event logs to your SecOps instance. Follow these steps to configure log forwarding from Realm Security Data Fabric to Google SecOps.

## Prerequisites

* A licensed Google SecOps instance (separate from GCP — see note below)
* Administrative access to your GCP console
* Your Google SecOps **Customer ID**

> **Note:** Google SecOps is a separately licensed product and is not included with a standard GCP subscription. Contact Google Cloud sales if you have not yet licensed SecOps.

***

## Overview

1. GCP Console: Create a service account and credentials
2. GCP Console: Grant the service account access to SecOps
3. Realm Console: Setup Google SecOps output feed

***

## 1. GCP: Create a Service Account and Credentials

Realm uses a GCP service account to authenticate with the Google SecOps ingestion API. **Note**: Realm does not support the legacy P12 secret, please ensure you are creating a JSON GCP Service Account Key.

1. Log in to the [GCP Console](https://console.cloud.google.com).
2. Navigate to **IAM & Admin > Service Accounts**.
3. Click **Create Service Account**.
4. Give the service account a name (e.g. `realm-secops-ingest`) and click **Create and Continue**.
5. Skip the optional role assignment steps for now — you will assign the role in Step 2.
6. Click **Done**.
7. Navigate to the newly created service account and select the **Keys** tab.
8. Click **Add Key > Create new key**, select **JSON**, and click **Create**.
9. A JSON key file will be downloaded to your machine. **Store this securely** — it will be used to configure the Realm output feed.

***

## 2. GCP: Grant the Service Account Access to SecOps

The service account needs permission to ingest logs into your SecOps instance.

1. In the GCP Console, navigate to **IAM & Admin > IAM**.
2. Click **Grant Access**.
3. In the **New principals** field, enter the email address of the service account you created in Step 1 (e.g. `realm-secops-ingest@your-project.iam.gserviceaccount.com`).
4. Assign the role **Chronicle API Editor** (`roles/chronicle.editor`). This role provides the global permissions necessary to push logs using Google SecOps ingestion endpoints.
5. Click **Save**.

***

## 3. Realm: Setup Google SecOps Output Feed

### Find Your Customer ID

Your SecOps **Customer ID** is a UUID that identifies your Google SecOps instance. To find it:

1. Log in to your Google SecOps instance.
2. Navigate to **SIEM Settings > Profile**.
3. Copy the **Customer ID** value located within the **Organization Details** section (formatted as a UUID, e.g. `c8c65bfa-5f2c-42d4-9189-64bb7b939f2c`).

### Configure the Output Feed

1. Go to **Destinations** and select a destination of type **SIEM**.
2. Click **Add Output Feed**.
3. Select type: **Google SecOps**.
4. Give the output feed a name and description of your choosing.
5. Configure the following fields:

| Field | Description |
|---|---|
| **Google Service Account Key** | Upload or paste the contents of the JSON key file downloaded in Step 1. |
| **Customer ID** | Your SecOps Customer ID UUID (e.g. `c8c65bfa-5f2c-42d4-9189-64bb7b939f2c`). |
| **Region** | The region where your SecOps instance is deployed. Must match the region selected when your SecOps instance was provisioned. See [supported regions](#supported-regions) below. |
| **Namespace** | *(Optional)* A label to segment logs within your SecOps instance by data domain (e.g. `production`, `staging`). Useful if you are sending logs from multiple environments to the same SecOps instance. Leave blank if not needed. |

6. Click **Add** to save the output feed.

It takes about a minute to deploy the fabric update, after which data should start flowing to Google SecOps.

***

## Supported Regions

Select the region that matches where your Google SecOps instance is deployed.

| Region | Description |
|---|---|
| `us` | United States (multi-region) |
| `eu` | Europe (multi-region) |
| `asia` | Asia Pacific (multi-region, same as Singapore — retained for backwards compatibility) |
| `canada` | Canada |
| `dammam` | Dammam, Saudi Arabia |
| `doha` | Doha, Qatar |
| `frankfurt` | Frankfurt, Germany |
| `london` | London, United Kingdom |
| `mumbai` | Mumbai, India |
| `paris` | Paris, France |
| `singapore` | Singapore |
| `sydney` | Sydney, Australia |
| `sao_paulo` | São Paulo, Brazil |
| `tel_aviv` | Tel Aviv, Israel |
| `tokyo` | Tokyo, Japan |
| `turin` | Turin, Italy |
| `zurich` | Zurich, Switzerland |

***

## Troubleshooting

**Authentication errors**

Verify that:

* The JSON key file is valid and has not expired or been revoked
* The service account has been granted the `Chronicle API Editor` role as described in Step 2
* The GCP project associated with the service account is the same project linked to your SecOps instance

**Data not appearing in SecOps**

* Confirm the **Customer ID** is correct — an incorrect UUID will result in silent ingestion failures
* Confirm the **Region** matches the region your SecOps instance is deployed in — a region mismatch will cause requests to fail or be silently dropped

**Wrong region selected**

If you are unsure which region your SecOps instance is in, log in to your SecOps instance and check **SIEM Settings > Profile**, or contact your Google SecOps administrator.

***

## Resources

* [Google SecOps Ingestion API Documentation](https://cloud.google.com/chronicle/docs/reference/ingestion-api)