Chronicle

Version: 1.7
Updated: May 21, 2024

Chronicle SIEM is a cloud service, built as a specialized layer on top of core Google infrastructure, designed for enterprises to privately retain, analyze, and search the massive amounts of security and network telemetry they generate. Chronicle normalizes, indexes, correlates, and analyzes the data to provide instant analysis and context on risky activity.

Actions

• Alerts Daemon Chronicle (Daemon) - Automatically pulls information about both asset-based and user-based alerts with event.
• Get Event (Enrichment) - Returns a single event given the UID for the event.
• Get Events (Enrichment) - Returns multiple events given the UIDs for the events.
• Get Log (Enrichment) - Returns a single raw log given the UID for the event.
• List Alerts (Enrichment) - Returns information about both asset-based and user-based alerts with event timestamps within the specified time range.
• List Assets (Enrichment) - Lists all the assets that accessed the specified artifact in your enterprise within the specified time period.
• List Events (Enrichment) - Lists all the events discovered within your enterprise on a particular device within the specified time range.
• List IOCs (Enrichment) - Lists all the IoCs discovered within your enterprise within the specified time range.
• List IoC Details (Enrichment) - Returns the threat intelligence associated with an artifact. The threat intelligence information is obtained from your enterprise security systems and from IoC partners of Google.
• UDM Search (Enrichment) - UDM Search query and retrieve matches.

External Libraries

• Chronicle (Google Auth)
• Chronicle (Google API)

Configure Chronicle in Automation Service and Cloud SOAR

Before you can use this automation integration, you must configure its authentication settings so that the product you're integrating with can communicate with Sumo Logic. For general guidance, see Configure Authentication for Automation Integrations.

How to open the integration's configuration dialog

1. Access App Central and install the integration. (You can configure at installation, or after installation with the following steps.)
2. Go to the Integrations page.
   Classic UI. In the main Sumo Logic menu, select Automation and then select Integrations in the left nav bar.
   New UI. In the main Sumo Logic menu, select Automation > Integrations. You can also click the Go To... menu at the top of the screen and select Integrations.
3. Select the installed integration.
4. Hover over the resource name and click the Edit button that appears.
   

In the configuration dialog, enter information from the product you're integrating with. When done, click TEST to test the configuration, and click SAVE to save the configuration.

For information about Google Security Operations (formerly Chronicle), see Google Security Operations documentation.

Change Log

• July 30, 2021 - First upload
• July 18, 2023 (v1.1) - Updated the integration with Environmental Variables
• January 26, 2024 (v1.2)
  • Integration refactored
  • The following new actions are added:
    • Get Event
    • Get Log
    • List Alerts
    • UDM Search
• February 16, 2023 (v1.3)
  • List Alerts Action: Fix bug related to the PageSize field
• February 19, 2024 (v1.4)
  • Alerts Daemon Chronicle: Fix bug related to Last execution time
• February 19, 2024 (v1.5)
  • Added new Action: Get Events
  • Alerts Daemon Chronicle: Updated Output mappings
• March 4, 2024 (v1.6) - Updated code for compatibility with Python 3.12
• May 21, 2024 (v1.7) - Updated code for compatibility with Python 3.12