SIEM Integration Overview: Google SecOps

Install From GitHub

The GreyNoise integration for Chronicle is a pre-built scrpt that leverages the GreyNoise GNQL Query API to pull GreyNoise indicators and to submit the to the Google SecOps SIEM ingestion API.

The code and installation instructions can be found: https://github.com/GreyNoise-Intelligence/greynoise-chronicle-siem

📘

Integration in BETA

Please note that this integraiton is still in BETA testing. We are open to suggestions and improvements for how to improve this integration. Please submit feedback to [email protected]

Configure an Instance of the GreyNoise Integration

Follow the information included on the GitHub page to create and manage the external script.

Internet Scanner Indicators in Google SecOps

Each IPv4 internet scanner IP address will exist within Google SecOps in Raw Log format with identified UDM fields.

Dashboard

The GitHub repo includes an indicator dashboard that can be imported into Google SecOps to help identify the indicators created by the integration.