Hi there, and welcome back to MI-One Issue #25

March is often when the direction of the year becomes clearer. In security operations, that direction is increasingly shaped by how platforms handle data, not just alerts. And when we talk about Security operations today, it’s hard to ignore the 2025 Gartner Magic Quadrant for SIEM leader, recognized for its AI-driven SecOps capabilities: Google Security Operations.

This issue is for security leaders, engineers, and technical partners looking to understand Google Security Operations’ role in today’s security stack and how its platform approach appears in real-world deployments.

A common assumption when integrating with a security operations platform is that vendors simply need to send alerts or logs into a SIEM. But modern platforms like Google Security Operations are designed to correlate security telemetry across systems such as endpoint activity, identity systems, and cloud infrastructure logs, which requires a very different integration approach.

In this issue, we’ll explore how Google Security Operations evolved as a platform, how integrations work within its ecosystem, and what product and engineering teams should consider when building integrations for the platform.

Special Announcement: Introducing MISP Threat Intelligence Forwarder for Google Security Operations

As a Google Cloud Partner, we are excited to introduce the MISP Threat Intelligence Forwarder for Google Security Operations, developed by Metron. This tool is designed to help security teams integrate open-source threat intelligence into their SecOps workflows.

The forwarder synchronizes Indicators of Compromise (IoCs) from MISP into Google Security Operations, where they can be ingested as entity context and correlated with security telemetry across the platform. This allows threat intelligence to participate directly in detection, investigation, and threat-hunting workflows.

Key Benefits

• Synchronize threat intelligence from MISP into Google Security Operations

• Correlate external threat indicators with platform data

• Enrich investigations with community-driven threat intelligence

• Enable faster threat detection through IoC matching and correlation

Deep Dive: Google Security Operations as a Data Ingestion Platform

In our experience working with product and engineering teams, there are a couple of recurring assumptions that companies have when they begin thinking about integrations with Google Security Operations.

One of these assumptions is that integrating with a security operations platform simply means sending alerts or logs into a SIEM. Many vendors, therefore, design integrations around alert forwarding, where alerts generated by their product are sent into the platform for investigation.

However, that is a misconception.

Another misconception based on these assumptions is that vendors must integrate directly with Chronicle as a standalone security tool.

In the Google ecosystem, assumptions like these can lead vendors down the wrong path. While forwarding alerts may seem like the natural integration approach, Google Security Operations is in fact optimized for security data ingestion and normalization, rather than simply collecting alerts.

A more effective way to think about integration is to view Google Security Operations as part of a broader Google security and cloud ecosystem, where telemetry can interact across multiple parts of the platform. This includes:

• Google Security Operations analytics

• Google Cloud telemetry

• Mandiant threat intelligence

• Cloud infrastructure logs

• AI-driven investigation workflows

Because of this architecture, vendors who design integrations purely as alert feeds often miss the platform’s real value. The integrations that produce the best outcomes provide structured data mapped into Google’s Unified Data Model (UDM), so signals can be correlated across systems.

It is also important to recognize that getting data into the Google Security Operations SIEM is only part of the integration process. Vendors should also leverage the platform’s SOAR capabilities so security engineers can respond to and remediate threats directly from within Google Security Operations.

Featured Integration: Google Security Operations + Operational Technology (OT) Security

In this integration, Google Security Operations acts as the ingestion and analytics layer for telemetry generated by OT security platforms across industrial environments.

OT platforms collect data such as alerts, syslog events, asset inventory, and device details from operational systems. This telemetry can be forwarded into Google Security Operations using mechanisms such as Google SecOps Forwarder, BindPlane agents, connectors, or telemetry feeds.

Depending on the deployment architecture, parsing and normalization may occur before the data reaches Google Security Operations. OT platforms or intermediate collectors can structure logs and map fields closer to Google’s Unified Data Model (UDM). This is often considered a best practice in OT environments where telemetry formats vary widely across vendors and protocols.

Once ingested, the normalized telemetry can be correlated with other signals in the platform, including identity activity, network telemetry, and cloud logs. Detection logic using YARA-L rules then analyzes these events and generates actionable alerts when suspicious activity is identified.

The value of this integration is straightforward:

• OT telemetry becomes usable within SecOps detection and investigation workflows

• Industrial activity can be correlated with enterprise security signals

• Normalized data improves investigation context and detection accuracy

This integration is just one example that reflects how Google Security Operations is designed to operate as a platform that ingests and correlates telemetry from multiple environments.

Platform Evolution: Google Security Operations Platform

Fun Fact: Did you know that Google didn’t enter security operations with a traditional SIEM?

Instead, Google’s entry into enterprise security operations emerged from its expertise in large-scale data processing, search infrastructure, and threat intelligence. Over time, these capabilities were combined with acquisitions and platform development to create what is now known as Google Security Operations.

Today, the platform brings together Chronicle security analytics, Mandiant threat intelligence, SOAR automation from Siemplify, cloud-native telemetry pipelines, and AI-assisted detection and investigation. Together, these components form a platform designed to ingest and analyze large volumes of security telemetry while integrating with the broader Google Cloud ecosystem.

This evolution into a security operations platform has been shaped by several milestones, including:

• Chronicle's launch to apply Google’s data infrastructure to large-scale security telemetry analysis.

• VirusTotal integration to strengthen malware intelligence and threat visibility.

• Siemplify acquisition to introduce SOAR automation capabilities for investigation and response workflows.

• Mandiant acquisition to integrate frontline threat intelligence and incident response expertise into the platform.

• Recent AI developments, including Gemini integration, support AI-assisted investigation and threat intelligence workflows.

These developments reflect Google’s transition from internal cybersecurity telemetry analysis to a unified AI-assisted security operations platform.

Trending Google Security Operations Integrations

For Product Managers & Engineering Teams: Why the Google Security Ecosystem Makes Integration Easier 

For product managers and engineering teams building integrations with Google Security Operations, understanding how telemetry is ingested, normalized, and analyzed is essential. The platform is designed to process large volumes of security data and correlate signals across systems. The table below highlights key architectural concepts, common integration mistakes, and the core principle that shapes effective integrations.

Tips & Tricks: Building Google Security Operations Integrations 

When designing integrations for Google Security Operations, a few practical considerations can help ensure integrations align with the platform’s architecture.

• Align event schemas with UDM entities: Map telemetry fields to the Unified Data Model (UDM) so events can be consistently correlated across users, hosts, IPs, processes, and authentication activity.

• Provide telemetry at sufficient granularity: Send detailed event-level data rather than only summarized alerts. Rich telemetry provides the context needed for accurate detections, investigations, and AI-assisted analysis.

• Support scalable ingestion pipelines: Use streaming mechanisms such as forwarders, connectors, or telemetry pipelines to reliably ingest large volumes of security data into the platform.

• Validate telemetry using Chronicle search: Test and verify ingested data through Chronicle search queries to ensure fields are parsed correctly and usable for detections and investigations.

What's New with Google Security Operations?

Google SecOps introduced enhanced rule observability to improve detection transparency and troubleshooting. Key highlights of this update include:

• Detection and alert objects now include metadata indicating whether they were generated during a primary rule run or rule replay.

• New fields, such as detectionTimingDetails and latencyMetrics record timestamps for event ingestion and processing.

• A new Detection Health dashboard visualizes rule performance and replay activity.

• Alerts now display visual indicators and filter facets for detection timing details, and the same indicators appear in SOAR case views.

Google SecOps released new v2 storage connectors to improve scalable telemetry ingestion (General Availability). Key highlights of this release include:

• v2 connectors using Google Storage Transfer Service (STS) are now generally available.

• Supported connectors include Google Cloud Storage v2, Amazon S3 v2, Azure Blobstore v2, and Amazon SQS v2.

• An event-driven Google Cloud Storage connector is also available for ingestion workflows.

Google SecOps deprecated legacy SOAR IAM roles as a part of its migration to Cloud IAM. Key highlights of this update include:

• Roles chronicle.soarAnalyst, chronicle.soarViewer, and chronicle.soarEngineer are being deprecated.

• SOAR permission groups can be converted into custom IAM roles through migration tools.

• Updated predefined Google SecOps roles are now available in Cloud IAM.

Google SecOps announced the public preview of the Alert Triage and Investigation Agent to accelerate AI-driven security operations. Key highlights of this release include:

• An AI investigation agent embedded in Google Security Operations for automated alert triage.

• The agent gathers telemetry and evidence to build investigation summaries and verdicts.

• Investigation workflows use integrated telemetry and threat intelligence context during analysis.

Industry Shift: Security Operations as a Data Platform and the Foundation of AI-Driven Security

Security operations are increasingly evolving from traditional SIEM and log management systems into data platforms designed to process security telemetry at scale. As cloud environments, identity systems, and distributed infrastructure expanded, the volume of telemetry grew faster than traditional alert-centric workflows could handle.

Today, the focus is shifting from alert collection to data interpretation. Modern SecOps platforms ingest large volumes of telemetry across identity, endpoint, network, cloud, and application environments and analyze that data within a shared analytics layer.

Across the industry, vendors are building architectures around security data pipelines, unified schemas, and large-scale analytics engines. Instead of analyzing alerts after they are generated, platforms normalize telemetry first and apply detection logic directly on structured event data, enabling cross-system correlation and more effective investigations.

Recent developments highlight this shift. Microsoft introduced Sentinel Data Lake to analyze large volumes of security telemetry across SIEM and XDR workflows. Bitdefender launched a Security Data Lake architecture within GravityZone, while vendors like Splunk and Cisco are investing in data fabrics and telemetry platforms that treat security and operational data as a shared analytics layer.

Platforms such as Google Security Operations follow the same model. Using the Unified Data Model (UDM), telemetry from multiple tools can be normalized and correlated to support detection analytics, AI-assisted investigation workflows, and automated response through SOAR capabilities.

For vendors building integrations, the most effective approach is to:

• Map telemetry to normalized entities such as users, hosts, IPs, processes, and authentication events

• Provide structured event data enriched with contextual metadata

• Support automation-ready signals that trigger response workflows

This pattern is consistent across major platforms that rely on normalized schemas to power AI-driven analytics. Google Security Operations uses UDM for Gemini-assisted investigations, Microsoft Sentinel uses ASIM for Security Copilot analysis, Palo Alto Networks Cortex relies on CDM for XSIAM correlation, and Splunk Enterprise Security uses CIM for AI-assisted detections.

As AI becomes embedded in security operations, the differentiator is no longer how many alerts a platform collects, but how effectively it can ingest, normalize, and analyze security telemetry to turn data into actionable insight.

Want to Learn More?

We've built a resource hub covering the integrations, architectures, and platforms that matter most to security and IT ops teams. Each blog draws from hands-on experience implementing these systems at scale. 

Explore more Google Security Operations topics we've covered:

• MISP and Google Security Operations Integration Architecture Guide

• How to Normalize Cybersecurity Data with Google SecOps UDM

Meet Us in Person:

Join us at the RSA Conference in San Francisco, March 23-26, 2026. We'd love to connect and discuss how we can support your security journey.