---
title: Google SecOps Chronicle
section: Integrations
---

# Google SecOps Chronicle

This guide explains how to integrate Google Security Operations (Chronicle) with RedCarbon using the Chronicle REST API.

## Overview

The Google SecOps Chronicle integration allows RedCarbon to ingest Cases, Alert Cards, and Alert Events from your Chronicle environment, and to close cases directly from the RedCarbon platform.

RedCarbon communicates with the **Chronicle REST API** (`https://chronicle.googleapis.com`) using a Google Cloud service account. You will need to create a service account in your GCP project, grant it access to your Chronicle instance, and provide RedCarbon with its JSON key.

- **Vendor Documentation:** [Chronicle REST API reference](https://docs.cloud.google.com/chronicle/docs/reference/rest)
- **Vendor Documentation:** [Migrate to the Chronicle API](https://docs.cloud.google.com/chronicle/docs/soar/admin-tasks/advanced/api-migration-guide)

## Prerequisites

- A Google Cloud project that owns your Chronicle instance
- Permission to create and manage IAM service accounts in that project
- The **Project ID**, **location**, and **instance ID** of your Chronicle instance

### Find your Chronicle instance details

| Field | Where to find it |
|---|---|
| **Project ID** | GCP Console → top project selector, or the URL `console.cloud.google.com/home/dashboard?project=<PROJECT_ID>` |
| **Location** | Chronicle console → Settings → SIEM Settings (e.g. `us`, `eu`, `asia-southeast1`) |
| **Instance ID** | Chronicle console → Settings → SIEM Settings — listed as "Customer ID" or "Instance ID" (UUID format) |

## Configuration

### Step 1: Create a service account

1. Go to [GCP Console → IAM & Admin → Service Accounts](https://console.cloud.google.com/iam-admin/serviceaccounts).
2. Select the project that owns your Chronicle instance.
3. Click **Create service account**.
4. Enter a name (e.g. `redcarbon-chronicle`) and click **Create and continue**.
5. In the **Grant this service account access to project** step, assign the role:
   - **Chronicle API User** — grants read access to cases and write access for case closure

   > If the Chronicle API User role is not available in the list, search for `Chronicle` or contact your GCP administrator to ensure the Chronicle API is enabled on the project.

6. Click **Done**.

   The **Chronicle API User** role should already cover the permissions RedCarbon needs. If your organization uses a custom role instead, make sure it includes at least:

   | IAM permission | Used for |
   |---|---|
   | `chronicle.legacySearches.searchCases` | Fetching the case list |
   | `chronicle.cases.get` | Fetching case detail |
   | `chronicle.connectorEvents.list` | Fetching alert events for a case |
   | `chronicle.cases.executeBulkClose` | Closing cases from RedCarbon |

   > `chronicle.legacySearches.searchCases` and `chronicle.cases.get` are confirmed against Chronicle's REST API behavior. `chronicle.connectorEvents.list` and `chronicle.cases.executeBulkClose` follow Google's `chronicle.{resource}.{verb}` naming convention but aren't explicitly documented — verify them in IAM if you hit a `403 Forbidden` on alert events or case closure specifically.

### Step 2: Create a JSON key for the service account

1. In the service accounts list, click on the service account you just created.
2. Go to the **Keys** tab.
3. Click **Add key** → **Create new key**.
4. Select **JSON** and click **Create**.
5. A JSON file is downloaded automatically — **keep it safe, it cannot be retrieved again**.

The file looks like this:

```json
{
  "type": "service_account",
  "project_id": "your-project-id",
  "private_key_id": "...",
  "private_key": "-----BEGIN RSA PRIVATE KEY-----\n...",
  "client_email": "redcarbon-chronicle@your-project-id.iam.gserviceaccount.com",
  ...
}
```

### Step 3: Configure RedCarbon

1. Log in to the RedCarbon Dashboard.
2. Navigate to the customer's **Integrations** page.
3. Select **Google SecOps Chronicle**.
4. Enter the following fields:

   | Field | Value |
   |---|---|
   | **Project ID** | Your GCP project ID (e.g. `my-gcp-project`) |
   | **Location** | Your Chronicle instance location (e.g. `us`, `eu`) |
   | **Instance ID** | Your Chronicle instance UUID |
   | **Service Account JSON** | The full contents of the JSON key file downloaded in Step 2 |

5. Click **Save** and then **Test** to verify the connection.

## What RedCarbon ingests

| Data type    | Description |
|---|---|
| Cases        | Security cases within the selected time window, with priority, stage, and SLA information |
| Alert Cards  | Alerts attached to each case, including rule generator, device vendor, and product |
| Alert Events | Raw events linked to each alert card, including field groups and source system details |

## Case closure

When a RedCarbon analyst closes an incident that originated from Google SecOps Chronicle, the platform automatically closes the corresponding case in Chronicle with:

- **Root cause:** `Case closed via Redcarbon platform`
- **Close comment:** the notes entered by the analyst in RedCarbon

## Severity mapping

| Google SecOps Priority | RedCarbon Score |
|---|---|
| Informative            | 0               |
| Low                    | 40              |
| Medium                 | 60              |
| High                   | 80              |
| Critical               | 100             |

## Troubleshooting

| Symptom | Likely cause | Fix |
|---|---|---|
| `401 Unauthorized` | Service account key is invalid or revoked | Regenerate the JSON key in GCP IAM and update the integration |
| `403 Forbidden` | Service account lacks Chronicle API User role, or a custom role is missing one of the required `chronicle.*` permissions listed in Step 1 | Add the role (or the missing permission) in GCP IAM and re-test |
| `404 Not Found` | Wrong Project ID, Location, or Instance ID | Double-check all three fields against the Chronicle console |
| No incidents ingested | Chronicle API is not enabled on the project | Enable the Chronicle API in GCP Console → APIs & Services |