> For the complete documentation index, see [llms.txt](https://docs.bindplane.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.bindplane.com/integrations/destinations/google-secops-chronicle.md). # Google SecOps (Chronicle) The Google SecOps destination sends logs to [Google SecOps](https://cloud.google.com/chronicle/docs) (formerly Chronicle), Google's security analytics platform. Bindplane sends logs over either the legacy gRPC ingestion API or the HTTPS DataPlane API, authenticating with a Google Cloud service account. {% hint style="warning" %} On July 20, 2026, Google is deprecating the legacy Backstory API and legacy Ingestion API in favor of the Chronicle API. [See the deprecation announcement here](https://docs.cloud.google.com/chronicle/docs/deprecations). {% endhint %} ### Supported Telemetry Types | Platform | Metrics | Logs | Traces | | -------- | ------- | ---- | ------ | | Linux | | ✓ | | | Windows | | ✓ | | | macOS | | ✓ | | ### Prerequisites * A Google Cloud account with access to the [Google SecOps](https://cloud.google.com/chronicle/docs) platform. * A Google Cloud service account with access to the SecOps ingestion API and the endpoint you configure. See [Getting API authentication credentials](https://cloud.google.com/chronicle/docs/reference/ingestion-api#getting_api_authentication_credentials). * Your **Customer ID**, found in Google SecOps under **Settings -> Profile -> Organization Details**. * For the HTTPS DataPlane API, your **GCP Project Number**, also found under **Settings -> Profile -> Organization Details**. * Bindplane OTel Collector v1.94.2 or later is recommended for the HTTPS protocol. Earlier versions may silently drop logs when the SecOps HTTPS endpoint returns transient errors (429, 502, 504). ### Configuration
Bindplane docs - Google SecOps (Chronicle) - image 1
#### Logs | Parameter | Type | Default | Description | | --------------------- | ---------- | -------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Protocol | Enum | `https` | Required. The protocol to use when sending logs. `gRPC` selects the legacy ingestion API; `https` selects the DataPlane API. One of `gRPC`, `https`. | | Region | Enum | `us` | Required when `protocol` is `https`. The region to send logs to. Ingestion only succeeds for regions your credentials are provisioned for. A custom region value may be entered. | | Endpoint | String | `malachiteingestion-pa.googleapis.com` | Required when `protocol` is `gRPC`. The endpoint to send logs to. Do not include a protocol prefix. | | Endpoint | String | `chronicle.googleapis.com` | Required when `protocol` is `https`. The endpoint to send logs to. Do not include a protocol prefix. | | Override Endpoint | Boolean | `false` | Available when `protocol` is `https`. If selected, the base URL is the exact value of the Endpoint field; otherwise it is built from the Region and Endpoint fields. Requires Bindplane OTel Collector v1.95.0 or later. | | Authentication Method | Enum | `auto` | Required. The method used for authenticating to Google Cloud. One of `auto`, `json`, `file`. | | Credentials | String | | Required when `auth_type` is `json`. JSON value from a Google Service Account credential file. This value is sensitive and is stored as a secret. | | Credentials File | String | | Required when `auth_type` is `file`. Path to a Google Service Account credential file on the collector system. The collector's runtime user must be able to read this file. | | Fallback Log Type | String | | Fallback log type sent to Google SecOps. Used only when the type is not set by the [Google SecOps Standardization processor](/integrations/processors/google-secops-standardization.md). See [Supported Log Types](https://cloud.google.com/chronicle/docs/ingestion/parser-list/supported-default-parsers). | | Customer ID | Uuid | | Required. The customer ID used for sending logs. Find this in Google SecOps under Settings -> Profile -> Organization Details. | | GCP Project Number | String | | Required when `protocol` is `https`. The GCP Project Number used for sending logs. Find this in Google SecOps under Settings -> Profile -> Organization Details. | | Send Single Field | Boolean | `true` | Send a single field on the log instead of the entire log. | | Field to Send | Enum | `Body` | Required when `send_single_field` is enabled. The telemetry field to send. One of `Attributes`, `Body`. | | Attributes Field | OTTL Field | | Available when `raw_base` is `Attributes` and `send_single_field` is enabled. The attributes field to send. Use bracket notation for nested fields. An empty value sends all attribute fields. | | Body Field | OTTL Field | | Available when `raw_base` is `Body` and `send_single_field` is enabled. The body field to send. Use bracket notation for nested fields. An empty value sends all body fields. | #### Advanced | Parameter | Type | Default | Description | | ----------------------------- | -------- | --------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Ingestion Labels | Map | `{}` | Custom key/value ingestion labels attached to logs sent to SecOps. | | Namespace | String | | User-configured environment namespace identifying the data domain the logs originated from. | | Compression Type | Enum | `gzip` | Compression type used for sending logs. One of `gzip`, `none`. | | Timeout | Integer | `90` | Timeout, in seconds, for sending logs. | | Response Header Timeout | Integer | `10` |

Timeout (in seconds) to wait for response headers when sending logs.

Increase this value in high-latency environment if timeout awaiting response headers errors are occurring.

Requires Bindplane OTel Collector v1.103.0 or later.

| | API Version | Enum | `v1alpha` | Available when `protocol` is `https`. The API version to use. One of `v1alpha`, `v1beta`. Requires Bindplane OTel Collector v1.95.0 or later. | | Metrics Interval | Duration | `5m` | The interval at which to send agent metrics to GCP. Requires Bindplane OTel Collector v1.99.0 or later. | | Override Default Batch Limits | Boolean | `false` | Enable to configure limits on log batch creation requests. Requires Bindplane OTel Collector v1.67.0 or later. | | Batch Request Size Limit | Integer | `4000000` | Available when `enable_batch_limit` is enabled. Maximum size of a log batch creation request in bytes. Requests that exceed this limit are split. | | Log Errored Payloads | Boolean | `false` | Available when `protocol` is `https`. When enabled, the agent logs payloads that SecOps rejects for ingestion. Requires Bindplane OTel Collector v1.79.0 or later. This can cause agent logs to grow rapidly. | | Drop Raw Copy | Boolean | `true` | When enabled, the raw copy of the log stored in `log.record.original` is dropped. | #### Retry on Failure | Parameter | Type | Default | Description | | ----------------------- | ------- | ------- | ------------------------------------------------------------------------------------------------------------- | | Enable Retry on Failure | Boolean | `true` | Attempt to resend logs that have failed to be transmitted to the destination. | | Initial Interval | Integer | `5` | Available when retry is enabled. Time, in seconds, to wait after the first failure before retrying. | | Max Interval | Integer | `30` | Available when retry is enabled. The upper bound, in seconds, on backoff. | | Max Elapsed Time | Integer | `300` | Available when retry is enabled. The maximum time, in seconds, spent trying to send a batch before giving up. | #### Sending Queue | Parameter | Type | Default | Description | | ------------------------- | --------- | -------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Enable Sending Queue | Boolean | `true` | Buffer logs temporarily before sending to help ensure data is not lost during a temporary network outage. | | Number of Consumers | Integer | `40` | Available when the sending queue is enabled. Number of consumers that dequeue batches. | | Queue Size | Integer | `5000` | Available when the sending queue is enabled. Maximum number of batches kept in memory before dropping. | | Enable Persistent Queuing | Boolean | `true` | Available when the sending queue is enabled. Buffer telemetry data to disk before sending to help ensure data is not lost during network outages or collector restarts. | | Persistent Queue Storage | Extension | file\_storage\_persistent\_queue | Available when the sending and persistent queues are enabled. The storage to use for the persistent queue. | ### Example Configuration #### Standalone Destination ```yaml apiVersion: bindplane.observiq.com/v1 kind: Destination metadata: id: chronicle name: chronicle spec: type: chronicle parameters: - name: protocol value: 'https' - name: region value: 'us' - name: https_endpoint value: 'chronicle.googleapis.com' - name: auth_type value: 'json' - name: credentials value: '{ "type": "service_account", "project_id": "my-project", ... }' - name: customer_id value: '00000000-0000-0000-0000-000000000000' - name: project value: '123456789012' - name: log_type value: 'WINEVTLOG' ``` ### Configuration Tips #### Choosing a protocol * `gRPC` uses the legacy ingestion API and the malachite endpoints (`malachiteingestion-pa.googleapis.com` by default, plus [regional endpoints](https://cloud.google.com/chronicle/docs/reference/ingestion-api#regional_endpoints)). * `https` uses the DataPlane API and requires the **GCP Project Number** in addition to the **Customer ID**. See [Configuring the HTTPS DataPlane API protocol](https://docs.bindplane.com/how-to-guides/google-secops/google-secops-configuring-the-https-dataplane-api-protocol). * Some region-specific endpoints are not enabled for all SecOps tenants. If ingestion returns a 403, try a multi-region endpoint instead. #### Log type handling * Google SecOps uses the `log_type` ingestion label to select the SecOps parser applied to logs. Set it explicitly with the [Google SecOps Standardization processor](/integrations/processors/google-secops-standardization.md) for best results. * Bindplane automatically maps the `log_type` label for some sources (for example, Windows Events to `WINEVTLOG` and SQL Server to `MICROSOFT_SQL`). An explicitly set `log_type` takes precedence over automatic mapping. * `log_type` (the **Fallback Log Type** parameter) is used only when the type was not set by the processor and could not be mapped automatically. For collector v1.63.0 or older, the Fallback Log Type is required. #### Supported sources * Google SecOps expects raw, unstructured logs. Use raw-log sources such as Windows Events (with Advanced -> Raw Logs enabled), Microsoft SQL Server, Common Event Format, CSV, File, HTTP, TCP, or UDP. #### Batch size limits * The default batch request size limit is 4,000,000 bytes (4 MB). Requests that exceed the limit are recursively split before sending. Do not raise `batch_request_size_limit` above the SecOps backend limit, or oversized requests will be rejected and dropped. Adjust only with guidance from your Google SecOps or Bindplane representative. ### Troubleshooting **Symptom:** Ingestion returns a 403 error for a configured region. **Solution:** Confirm your service account is provisioned for that region. Some region-specific endpoints are not enabled for all SecOps tenants. Try a multi-region endpoint instead. **Symptom:** Logs are ingested but the wrong SecOps parser is applied, or logs are not parsed. **Solution:** Set the `log_type` ingestion label with the [Google SecOps Standardization processor](/integrations/processors/google-secops-standardization.md), or set the **Fallback Log Type** parameter. An explicitly set `log_type` takes precedence over automatic mapping. **Symptom:** Logs are dropped intermittently when using the HTTPS protocol. **Solution:** Upgrade to Bindplane OTel Collector v1.94.2 or later. Earlier versions may silently drop logs when the SecOps HTTPS endpoint returns transient errors (429, 502, 504). See [Resolve Intermittent Ingestion Drop for Google SecOps HTTPS Endpoints](https://docs.bindplane.com/how-to-guides/google-secops/resolve-intermittent-ingestion-drop-for-google-secops-https-endpoints). ### Related Resources * [Google SecOps documentation](https://cloud.google.com/chronicle/docs) * [Google SecOps ingestion API authentication](https://cloud.google.com/chronicle/docs/reference/ingestion-api#getting_api_authentication_credentials) * [Google SecOps supported log types](https://cloud.google.com/chronicle/docs/ingestion/parser-list/supported-default-parsers) * [Configuring the HTTPS DataPlane API protocol](https://docs.bindplane.com/how-to-guides/google-secops/google-secops-configuring-the-https-dataplane-api-protocol) * [Google SecOps Standardization processor](/integrations/processors/google-secops-standardization.md) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.bindplane.com/integrations/destinations/google-secops-chronicle.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.