Data ingestion to Google SecOps

Supported in:

Google secops SIEM

The following diagram illustrates how your security data flows into Google SecOps and how the system processes that data for analysis in the interface.

Note: Large files (5-10 GB or larger) can significantly delay data ingestion.

Note: See Understand data availability for search for full details of the data ingestion lifecycle, including end-to-end data flow and latency, and how these factors impact the availability of recently ingested data for querying and analysis.

Process customer security data in Google SecOps

Google SecOps processes your security data as follows:

1. Retrieves security data from cloud services like Amazon S3 or the Google Cloud. Google SecOps encrypts this data in transit.

2. Separates and stores your encrypted security data in your account. Access is limited to you and a small number of Google personnel for product support, development, and maintenance.

3. Parses and validates raw security data, making it easier to process and view.

4. Indexes the data for quick searches.

5. Stores the parsed and indexed data within your account.

6. Offers secure access for users to search and review their security data.

7. Compares your security data with the VirusTotal malware database to identify matches. In a Google SecOps event view, such as the Asset view, click VT Context to see VirusTotal information. Google SecOps doesn't share your security data with VirusTotal.

Need more help? Get answers from Community members and Google SecOps professionals.