SIEM table of contents
Click
at the top of each SIEM document to return to this table of contents.
Get started
Gemini in Google SecOps overview
Administer
Set up an instance
Configure a Google Cloud project
Link an instance to Google Cloud
Permissions for the Chronicle API
Configure authentication
Configure Google Cloud identity
Configure third-party identity
Configure data access
Manage RBAC impact
Control access to reference lists
Configure instance settings
Google Analytics in Google SecOps
Upgrade and migrate
Migrate to a Google Cloud project
Migrate to Google Cloud authentication
Migrate from legacy RBAC to feature RBAC
Migrate an instance to a BYOP project
Upgrade Cloud Storage data feeds to v2
Migrate from legacy SIEM APIs to Chronicle API
Migrate from legacy SIEM API to Chronicle API
Migrate Chronicle API versions
Ingest
Prepare for data ingestion
Ingestion methods and data types
Data enrichment and aliasing overview
Collect data
Create an Azure Event Hub feed
Ingest data with API connectors
Chronicle API ingestion methods
Ingest data with the Ingestion API
Deploy the Bindplane agent for collection
Ingest logs with Cloud Run functions
Buffering and retry configurations
Collect data using legacy forwarders
Install and configure the forwarder
Configure forwarders in the platform
Manage forwarder configurations manually
Install Windows forwarder executable
Install Carbon Black Event Forwarder
Configure log types and parsers
Default parsers and log types overview
List of default parser configuration guides
Request prebuilt and create custom log types
Support policy for standard parsers
Process and normalize data
Manage data processing pipelines
Re-parse historical data (Log Replay)
Manage self-service parser options
Map parser data to key UDM fields
Implement community parsers in GitHub
Bypass log validation for parser extensions and custom parsers
Enrich and alias data
Monitor and troubleshoot ingestion
Analyze ingestion with Cloud Monitoring
Configure silent-host monitoring
Troubleshoot common Linux forwarder issues
Analyze feed activity with Cloud Logging
Detect
Prepare for threat detection
Transition from SPL to YARA-L 2.0
Context-enriched data in rules
Apply YARA-L rule best practices
Review potential security issues
Single and multiple event rules in YARA-L
Author rules
Construct composite detection rules
Create context-aware analytics
Incorporate Sensitive Data Protection data
Integrate BYOL Threat Intelligence
Applied Threat Intelligence fusion feed
Define YARA-L rule structure and syntax
Expressions, operators, and other constructs
Use OR syntax in the condition section
Use N OF syntax with event variables
Use reference lists and data tables in YARA-L 2.0
Apply YARA-L 2.0 windowing logic
Analyze risk with UEBA
Identify unusual behavior and entity risk
Analyze risks using the dashboard
Specify entity risk score in rules
Use metric functions for Risk Analytics rules
Deploy curated detections
Manage third-party vendor alerts
Verify data ingestion with test rules
Review curated detection categories
Applied Threat Intelligence curated detections
Non-prioritized IoC Matching threats
Manage and monitor rules
Understand the rules dashboard
Detect threats with unified rules
Manage unified rules with Rules API
Edit rules in the Rules editor
Monitor threat coverage (MITRE)
Run and optimize rules
Run a rule against historical data
Manage rule scheduling
Understand rule run scheduling
Configure customized schedules for rules
Understand rule replays and MTTD
Understand rule detection delays
Control noisy alerts
Analyze and respond
Prepare for investigation
Investigate alerts
Investigate alerts and entity context
Search by data source
Search telemetry and raw logs
Use context-enriched data in search
Investigate detections in search
Search entities and context
Conduct entity context searches
Investigate an entity using UDM search
Filter data in investigative views
Filter data in IP Address view
Analyze and refine results
Use conditions in search and dashboards
Analyze search data with statistics
Use aggregations in YARA-L 2.0 queries
Control columns with select and unselect keywords
UDM search compared with rule results
Apply joins in search and dashboards
Implement joins without a match section
Correlate data using outer joins
Search with GoogleSQL
Translate YARA-L 2.0 search queries to GoogleSQL
GoogleSQL query performance best practices
Analyze threats with AI
Answer Threat Intelligence questions with Gemini
Generate search queries with Gemini
Understand Threat Intelligence
Applied Threat Intelligence overview
Applied Threat Intelligence prioritization overview
Integrate your own threat intelligence feeds
Monitor and troubleshoot
Monitor platform health
Monitor health of data sources
Troubleshoot system issues
View and troubleshoot rule errors
Manage dashboards and reporting
Manage and configure dashboards
Visualize data flows with Sankey charts
Curated dashboard queries by data source
YARA-L 2.0 dashboard query library
View UDM and datatable queries
PCI curated dashboards overview
Legacy SIEM dashboards
Legacy SIEM dashboard overview
Analyze reports with context-enriched data
Manage data export
Export to a Google-managed BigQuery project
Export raw logs to a self-managed Cloud Storage bucket