Google SecOps (Chronicle)

The Google SecOps destination sends logs to Google SecOps (formerly Chronicle), Google's security analytics platform. Bindplane sends logs over either the legacy gRPC ingestion API or the HTTPS Chronicle API (previously called the DataPlane API), authenticating with a Google Cloud service account.

On July 20, 2026, Google is deprecating the legacy Backstory API and legacy Ingestion API in favor of the Chronicle API. See the deprecation announcement here.

Supported Telemetry Types

Platform	Metrics	Logs	Traces
Linux		✓
Windows		✓
macOS		✓

Prerequisites

• A Google Cloud account with access to the Google SecOps platform.
• A Google Cloud service account with access to the SecOps ingestion API and the endpoint you configure. See Getting API authentication credentials.
• Your Customer ID, found in Google SecOps under Settings -> Profile -> Organization Details.
• For the HTTPS Chronicle API, your GCP Project Number, also found under Settings -> Profile -> Organization Details.
• Bindplane OTel Collector v1.94.2 or later is recommended for the HTTPS protocol. Earlier versions may silently drop logs when the SecOps HTTPS endpoint returns transient errors (429, 502, 504).

Configuration

Logs

Parameter	Type	Default	Description
Protocol	Enum	https	Required. The protocol to use when sending logs. gRPC selects the legacy ingestion API; https selects the Chronicle API. One of gRPC, https.
Region	Enum	us	Required when protocol is https. The region to send logs to. Ingestion only succeeds for regions your credentials are provisioned for. A custom region value may be entered.
Endpoint	String	malachiteingestion-pa.googleapis.com	Required when protocol is gRPC. The endpoint to send logs to. Do not include a protocol prefix.
Endpoint	String	chronicle.googleapis.com	Required when protocol is https. The endpoint to send logs to. Do not include a protocol prefix.
Override Endpoint	Boolean	false	Available when protocol is https. If selected, the base URL is the exact value of the Endpoint field; otherwise it is built from the Region and Endpoint fields. Requires Bindplane OTel Collector v1.95.0 or later.
Authentication Method	Enum	auto	Required. The method used for authenticating to Google Cloud. One of auto, json, file.
Credentials	String		Required when auth_type is json. JSON value from a Google Service Account credential file. This value is sensitive and is stored as a secret.
Credentials File	String		Required when auth_type is file. Path to a Google Service Account credential file on the collector system. The collector's runtime user must be able to read this file.
Fallback Log Type	String		Fallback log type sent to Google SecOps. Used only when the type is not set by the Google SecOps Standardization processor. See Supported Log Types.
Customer ID	Uuid		Required. The customer ID used for sending logs. Find this in Google SecOps under Settings -> Profile -> Organization Details.
GCP Project Number	String		Required when protocol is https. The GCP Project Number used for sending logs. Find this in Google SecOps under Settings -> Profile -> Organization Details.
Send Single Field	Boolean	true	Send a single field on the log instead of the entire log.
Field to Send	Enum	Body	Required when send_single_field is enabled. The telemetry field to send. One of Attributes, Body.
Attributes Field	OTTL Field		Available when raw_base is Attributes and send_single_field is enabled. The attributes field to send. Use bracket notation for nested fields. An empty value sends all attribute fields.
Body Field	OTTL Field		Available when raw_base is Body and send_single_field is enabled. The body field to send. Use bracket notation for nested fields. An empty value sends all body fields.

Advanced

Parameter	Type	Default	Description
Ingestion Labels	Map	{}	Custom key/value ingestion labels attached to logs sent to SecOps.
Namespace	String		User-configured environment namespace identifying the data domain the logs originated from.
Compression Type	Enum	gzip	Compression type used for sending logs. One of gzip, none.
Timeout	Integer	90	Timeout, in seconds, for sending logs.
Response Header Timeout	Integer	10	Timeout (in seconds) to wait for response headers when sending logs. Increase this value in high-latency environment if timeout awaiting response headers errors are occurring. Requires Bindplane OTel Collector v1.103.0 or later.
API Version	Enum	v1alpha	Available when protocol is https. The API version to use. One of v1, v1alpha, v1beta. Requires Bindplane OTel Collector v1.95.0 or later.
Metrics Interval	Duration	5m	The interval at which to send agent metrics to GCP. Requires Bindplane OTel Collector v1.99.0 or later.
Override Default Batch Limits	Boolean	false	Enable to configure limits on log batch creation requests. Requires Bindplane OTel Collector v1.67.0 or later.
Batch Request Size Limit	Integer	4000000	Available when enable_batch_limit is enabled. Maximum size of a log batch creation request in bytes. Requests that exceed this limit are split.
Log Errored Payloads	Boolean	false	Available when protocol is https. When enabled, the agent logs payloads that SecOps rejects for ingestion. Requires Bindplane OTel Collector v1.79.0 or later. This can cause agent logs to grow rapidly.
Drop Raw Copy	Boolean	true	When enabled, the raw copy of the log stored in log.record.original is dropped.

Retry on Failure

Parameter	Type	Default	Description
Enable Retry on Failure	Boolean	true	Attempt to resend logs that have failed to be transmitted to the destination.
Initial Interval	Integer	5	Available when retry is enabled. Time, in seconds, to wait after the first failure before retrying.
Max Interval	Integer	30	Available when retry is enabled. The upper bound, in seconds, on backoff.
Max Elapsed Time	Integer	300	Available when retry is enabled. The maximum time, in seconds, spent trying to send a batch before giving up.

Sending Queue

Parameter	Type	Default	Description
Enable Sending Queue	Boolean	true	Buffer logs temporarily before sending to help ensure data is not lost during a temporary network outage.
Number of Consumers	Integer	40	Available when the sending queue is enabled. Number of consumers that dequeue batches.
Queue Size	Integer	5000	Available when the sending queue is enabled. Maximum number of batches kept in memory before dropping.
Enable Persistent Queuing	Boolean	true	Available when the sending queue is enabled. Buffer telemetry data to disk before sending to help ensure data is not lost during network outages or collector restarts.
Persistent Queue Storage	Extension	file_storage_persistent_queue	Available when the sending and persistent queues are enabled. The storage to use for the persistent queue.

Example Configuration

Standalone Destination

apiVersion: bindplane.observiq.com/v1
kind: Destination
metadata:
  id: chronicle
  name: chronicle
spec:
  type: chronicle
  parameters:
    - name: protocol
      value: 'https'
    - name: api_version
      value: 'v1'
    - name: region
      value: 'us'
    - name: https_endpoint
      value: 'chronicle.googleapis.com'
    - name: auth_type
      value: 'json'
    - name: credentials
      value: '{ "type": "service_account", "project_id": "my-project", ... }'
    - name: customer_id
      value: '00000000-0000-0000-0000-000000000000'
    - name: project
      value: '123456789012'
    - name: log_type
      value: 'WINEVTLOG'

Configuration Tips

Choosing a protocol

• gRPC uses the legacy ingestion API and the malachite endpoints (malachiteingestion-pa.googleapis.com by default, plus regional endpoints).
• https uses the Chronicle API and requires the GCP Project Number in addition to the Customer ID. See Configuring the HTTPS Chronicle API protocol.
• Some region-specific endpoints are not enabled for all SecOps tenants. If ingestion returns a 403, try a multi-region endpoint instead.

Log type handling

• Google SecOps uses the log_type ingestion label to select the SecOps parser applied to logs. Set it explicitly with the Google SecOps Standardization processor for best results.
• Bindplane automatically maps the log_type label for some sources (for example, Windows Events to WINEVTLOG and SQL Server to MICROSOFT_SQL). An explicitly set log_type takes precedence over automatic mapping.
• log_type (the Fallback Log Type parameter) is used only when the type was not set by the processor and could not be mapped automatically. For collector v1.63.0 or older, the Fallback Log Type is required.

Supported sources

• Google SecOps expects raw, unstructured logs. Use raw-log sources such as Windows Events (with Advanced -> Raw Logs enabled), Microsoft SQL Server, Common Event Format, CSV, File, HTTP, TCP, or UDP.

Batch size limits

• The default batch request size limit is 4,000,000 bytes (4 MB). Requests that exceed the limit are recursively split before sending. Do not raise batch_request_size_limit above the SecOps backend limit, or oversized requests will be rejected and dropped. Adjust only with guidance from your Google SecOps or Bindplane representative.

Troubleshooting

Symptom: Ingestion returns a 403 error for a configured region. Solution: Confirm your service account is provisioned for that region. Some region-specific endpoints are not enabled for all SecOps tenants. Try a multi-region endpoint instead.

Symptom: Logs are ingested but the wrong SecOps parser is applied, or logs are not parsed. Solution: Set the log_type ingestion label with the Google SecOps Standardization processor, or set the Fallback Log Type parameter. An explicitly set log_type takes precedence over automatic mapping.

Symptom: Logs are dropped intermittently when using the HTTPS protocol. Solution: Upgrade to Bindplane OTel Collector v1.94.2 or later. Earlier versions may silently drop logs when the SecOps HTTPS endpoint returns transient errors (429, 502, 504). See Resolve Intermittent Ingestion Drop for Google SecOps HTTPS Endpoints.

Related Resources

• Google SecOps documentation
• Google SecOps ingestion API authentication
• Google SecOps supported log types
• Configuring the HTTPS Chronicle API protocol
• Google SecOps Standardization processor