Skip to content

Google SecOps (Chronicle) integration

Connect DXDT to Google SecOps (Chronicle) using a read-only service-account JSON key so DXDT can query detection rules, data feeds, and IoC matches to feed the security pillar.
Setup time ~15 minutes
Difficulty Advanced

Access required: GCP project access to create a service account and JSON key, plus Chronicle/SecOps admin access to grant it a read-only Chronicle API role.

Prerequisites

  • A Google SecOps (Chronicle) instance.
  • The GCP project bound to your SecOps instance, and its Instance ID (GUID).
  • Rights to create a service account and download its JSON key.

Setup

1. Create a service account

In the GCP Console → IAM & Admin → Service Accounts → Create service account (in the project bound to your SecOps instance), name it dxdt-secops-readonly and create it. Copy the GCP Project ID for project_id.

2. Grant read-only Chronicle/SecOps API access

Assign the service account a read-only Chronicle/SecOps API role (for example a Chronicle API Viewer-level role) so it can call the v1alpha API. Do not grant editor/admin roles.

Note

SecOps authorization may also require mapping the SA in your SecOps feature/RBAC settings; grant view-only access there as well.

3. Download the JSON key

On the service account, open Keys → Add key → Create new key → JSON and download the file. Keep it secret — it grants token access.

  • Copy the Instance ID (GUID) from your SecOps settings → instance_id.
  • Note the SecOps region (for example us, eu, asia-southeast1) → region.

4. Enter the configuration in DXDT

Open the googlesecops plugin and fill GCP Project ID (project_id), SecOps Instance ID (instance_id), and Region (region, defaults to us). Paste the entire downloaded key into Service Account JSON Key (service_account_json) — this is a textarea, so paste the whole JSON object verbatim. On save, DXDT exchanges the SA for an OAuth2 token to validate.

Configuration fields

Field Where to find it
GCP Project ID (project_id) The GCP project bound to your SecOps instance (GCP Console).
SecOps Instance ID (GUID) (instance_id) Your Google SecOps instance settings → the instance GUID.
Region (region) Your SecOps data region (for example us, eu, asia-southeast1); optional, defaults to us.
Service Account JSON Key (service_account_json) The full JSON key downloaded from Service Accounts → Keys → Create new key → JSON, pasted whole into the textarea.

Verify the connection

After saving, open the plugin Status view (or run the ping command). A healthy connection completes the SA → token exchange and can list rules without an API error.

Security

DXDT performs only read-only SecOps/Chronicle API calls on a stateless service. Grant the service account the least-privilege read/viewer role only — never editor or admin. The JSON key is pasted whole into a secret textarea and stored encrypted; rotate it per your policy.

Troubleshooting

ping fails / token exchange error

The service_account_json is malformed, truncated, or the key was disabled. Re-download the JSON key and paste the complete object into the textarea; ensure no characters were lost on copy.

403 PERMISSION_DENIED on list rules/list feeds

The service account lacks a Chronicle/SecOps API read role, or SecOps RBAC has not been granted. Assign a read-only Chronicle API role to the SA and grant it view access in your SecOps RBAC settings.

404 or wrong-instance errors

Incorrect instance_id or region. Re-copy the instance GUID from SecOps settings and set the matching region (for example eu).

Auth works but no data appears

The SecOps API surface differs by instance/version. Confirm the instance region and that data (rules/feeds/IoCs) exists; DXDT surfaces the raw API error to help tune the query per tenant.

Vendor documentation: https://cloud.google.com/chronicle/docs/reference/rest