Send Logs to Google SecOps using the HTTPS Protocol

Collector v1.94.2 or later required for HTTPS

Collectors running earlier versions may silently drop logs when the SecOps HTTPS endpoint returns transient errors (429, 502, 504).

See Resolve Intermittent Ingestion Drop for Google SecOps HTTPS Endpoints for details and upgrade instructions.

The Google SecOps destination can send logs over two protocols:

• https - Uses the Chronicle API

• gRPC - Uses the legacy Ingestion API.

Google has deprecated the legacy Ingestion API (end of life July 20, 2027), with the https protocol now being the recommended approach.

This guide explains step-by-step how to set up the required Google Cloud resources for configuring Google SecOps destinations to use the https protocol.

1. Create a Role

   1. Add Permissions

2. Create a Service Account

   1. Assign Roles

3. Create an API Key

   1. Download API Key

4. Configure the Google SecOps Destination

   1. Verify Setup

Create a Role

We will first need to create a role for our service account to have the Least Privileged User possible. In IAM & Admin within Google Cloud, go to the "Roles" section in the sidebar and click "Create Role".

For the sake of this walkthrough we can use Bindplane_Secops for both our Title and ID. This will make easy to identify the role later.

Add Permissions

Next we will add the permissions required to export logs to Google SecOps. Use the "Filter" search bar to quickly find the specific permissions as shown in the screenshot below.

Required Permissions

chronicle.logs.import

Optional Permissions

In order for the Google SecOps Exporter to natively import Agent Metrics into your GCP project (enabled by default), you will also need the following permission:

chronicle.forwarders.importStatsEvents

Create a Service Account

With the role created, go to the "Service Accounts" section of the sidebar.

Click the "Create Service Account" button at the top of the page. Give the service account a name, and description. Then click "Create and Continue".

Assign Roles

The next section of the page will allow you to assign roles to the service account. We can use the new Role we just created for this purpose: Bindplane_SecOps

Create an API Key

With that user created, on the "Service Accounts" page, click the 3 dots next to the new Service Account. Click "Manage Keys".

Click the "Add Key" drop-down and then the "Create New Key" button. You will want this in JSON.

This will download the key to your workstation, we will use it in Bindplane next.

Enable the API

Navigate to the "API's & Services" section of Google Cloud and click the "Enable APIs and Services" button at the top of the screen.

Find "Chronicle API" using the search bar. Click the result and enable it if it is not already. Once enabled, it should look like the below screenshot.

Configure the Google SecOps Destination

Now in Bindplane we can create a Google SecOps destination.

Follow the documentation above and in Bindplane to correctly configure the destination. Ensure the protocol is set to https.

Verify Setup

Now that your destination has been added, you can check for telemetry in Google SecOps. If you do not see any you may want to add a 'Bindplane Collector' source so you can see your agents log and look for potential errors. Please open a support ticket if you run into problems.