Google SecOps Chronicle

This guide explains how to integrate Google Security Operations (Chronicle) with RedCarbon using the Chronicle REST API.

Overview

The Google SecOps Chronicle integration allows RedCarbon to ingest Cases, Alert Cards, and Alert Events from your Chronicle environment, and to close cases directly from the RedCarbon platform.

RedCarbon communicates with the Chronicle REST API (https://chronicle.googleapis.com) using a Google Cloud service account. You will need to create a service account in your GCP project, grant it access to your Chronicle instance, and provide RedCarbon with its JSON key.

• Vendor Documentation: Chronicle REST API reference
• Vendor Documentation: Migrate to the Chronicle API

Prerequisites

• A Google Cloud project that owns your Chronicle instance
• Permission to create and manage IAM service accounts in that project
• The Project ID, location, and instance ID of your Chronicle instance

Find your Chronicle instance details

Field	Where to find it
Project ID	GCP Console → top project selector, or the URL console.cloud.google.com/home/dashboard?project=<PROJECT_ID>
Location	Chronicle console → Settings → SIEM Settings (e.g. us, eu, asia-southeast1)
Instance ID	Chronicle console → Settings → SIEM Settings — listed as "Customer ID" or "Instance ID" (UUID format)

Configuration

Step 1: Create a service account

1. Go to GCP Console → IAM & Admin → Service Accounts.

2. Select the project that owns your Chronicle instance.

3. Click Create service account.

4. Enter a name (e.g. redcarbon-chronicle) and click Create and continue.

5. In the Grant this service account access to project step, assign the role:

   • Chronicle API User — grants read access to cases and write access for case closure

   If the Chronicle API User role is not available in the list, search for Chronicle or contact your GCP administrator to ensure the Chronicle API is enabled on the project.

6. Click Done.

   The Chronicle API User role should already cover the permissions RedCarbon needs. If your organization uses a custom role instead, make sure it includes at least:

   IAM permission	Used for
   chronicle.legacySearches.searchCases	Fetching the case list
   chronicle.cases.get	Fetching case detail
   chronicle.connectorEvents.list	Fetching alert events for a case
   chronicle.cases.executeBulkClose	Closing cases from RedCarbon

   chronicle.legacySearches.searchCases and chronicle.cases.get are confirmed against Chronicle's REST API behavior. chronicle.connectorEvents.list and chronicle.cases.executeBulkClose follow Google's chronicle.{resource}.{verb} naming convention but aren't explicitly documented — verify them in IAM if you hit a 403 Forbidden on alert events or case closure specifically.

Step 2: Create a JSON key for the service account

1. In the service accounts list, click on the service account you just created.
2. Go to the Keys tab.
3. Click Add key → Create new key.
4. Select JSON and click Create.
5. A JSON file is downloaded automatically — keep it safe, it cannot be retrieved again.

The file looks like this:

{
  "type": "service_account",
  "project_id": "your-project-id",
  "private_key_id": "...",
  "private_key": "-----BEGIN RSA PRIVATE KEY-----\n...",
  "client_email": "redcarbon-chronicle@your-project-id.iam.gserviceaccount.com",
  ...
}

Step 3: Configure RedCarbon

1. Log in to the RedCarbon Dashboard.

2. Navigate to the customer's Integrations page.

3. Select Google SecOps Chronicle.

4. Enter the following fields:

   Field	Value
   Project ID	Your GCP project ID (e.g. my-gcp-project)
   Location	Your Chronicle instance location (e.g. us, eu)
   Instance ID	Your Chronicle instance UUID
   Service Account JSON	The full contents of the JSON key file downloaded in Step 2

5. Click Save and then Test to verify the connection.

What RedCarbon ingests

Data type	Description
Cases	Security cases within the selected time window, with priority, stage, and SLA information
Alert Cards	Alerts attached to each case, including rule generator, device vendor, and product
Alert Events	Raw events linked to each alert card, including field groups and source system details

Case closure

When a RedCarbon analyst closes an incident that originated from Google SecOps Chronicle, the platform automatically closes the corresponding case in Chronicle with:

• Root cause: Case closed via Redcarbon platform
• Close comment: the notes entered by the analyst in RedCarbon

Severity mapping

Google SecOps Priority	RedCarbon Score
Informative	0
Low	40
Medium	60
High	80
Critical	100

Troubleshooting

Symptom	Likely cause	Fix
401 Unauthorized	Service account key is invalid or revoked	Regenerate the JSON key in GCP IAM and update the integration
403 Forbidden	Service account lacks Chronicle API User role, or a custom role is missing one of the required chronicle.* permissions listed in Step 1	Add the role (or the missing permission) in GCP IAM and re-test
404 Not Found	Wrong Project ID, Location, or Instance ID	Double-check all three fields against the Chronicle console
No incidents ingested	Chronicle API is not enabled on the project	Enable the Chronicle API in GCP Console → APIs & Services