Google Security Operations は、Google インフラストラクチャ上に特別なレイヤとして構築されるクラウド サービスであり、企業で生成された大量のセキュリティ テレメトリーとネットワーク テレメトリーを非公開で保持、分析、検索できるようにするように企業向けに設計されています。
Google SecOps は、データの正規化、インデックス付け、相互関連付け、分析を実施して、リスクのあるアクティビティが発生すると即時に分析とコンテキストを提示します。Google SecOps を使用すると、脅威を検出し、それらの脅威の範囲と原因を調査して、エンタープライズ ワークフロー、対応、オーケストレーションのプラットフォームとの事前構築された統合を使用した修復を行うことができます。
Google SecOps を使用すると、自社の集約されたセキュリティ情報を数か月以上に遡って調査できます。Google SecOps を使用して、企業内でアクセスされているすべてのドメインを検索します。特定のアセット、ドメイン、または IP アドレスに検索を絞って、侵害が起きているかどうかを判断できます。
Google SecOps プラットフォームを使用すると、セキュリティ アナリストは次の機能を使用して、ライフサイクル全体にわたってセキュリティの脅威を分析して軽減できます。
取り込み API: お客様の環境にハードウェアやソフトウェアを追加することなく、ログを Google SecOps プラットフォームに直接送信できるようにする API です。
サードパーティ統合: サードパーティの Cloud APIs と統合して、Office 365 や Azure AD といったソースなどのログを取り込むことができます。
攻撃者について
Google SecOps の分析機能は、ブラウザベースのアプリケーションとして提供されます。その機能の多くには、Read API を介してプログラマティックにアクセスすることもできます。アナリストは、疑われる脅威を発見したとき、さらに調査を進め、どのような対処が適切かを Google SecOps を利用して判断できます。
Google SecOps の機能の概要
このセクションでは、Google SecOps で利用可能な機能について説明します。
検索
UDM 検索: Google SecOps インスタンス内の統合データモデル（UDM）イベントとアラートを検索できます。
[[["わかりやすい","easyToUnderstand","thumb-up"],["問題の解決に役立った","solvedMyProblem","thumb-up"],["その他","otherUp","thumb-up"]],[["わかりにくい","hardToUnderstand","thumb-down"],["情報またはサンプルコードが不正確","incorrectInformationOrSampleCode","thumb-down"],["必要な情報 / サンプルがない","missingTheInformationSamplesINeed","thumb-down"],["翻訳に関する問題","translationIssue","thumb-down"],["その他","otherDown","thumb-down"]],["最終更新日 2025-09-02 UTC。"],[[["\u003cp\u003eGoogle Security Operations is a cloud-based service that allows enterprises to retain, analyze, and search large volumes of security and network telemetry data for threat detection, investigation, and remediation.\u003c/p\u003e\n"],["\u003cp\u003eThe platform utilizes capabilities like data collection, detection, investigation, and response to help security analysts analyze and mitigate security threats throughout their lifecycle.\u003c/p\u003e\n"],["\u003cp\u003eGoogle Security Operations offers features such as UDM Search, raw log scanning, case management, playbook design, graph investigation, dashboards, reporting, and an integrated development environment (IDE) for advanced customization.\u003c/p\u003e\n"],["\u003cp\u003eAnalysts can utilize various investigative views within Google Security Operations, including asset, IP address, hash, domain, and user views, along with procedural filtering to refine their investigations.\u003c/p\u003e\n"],["\u003cp\u003eThe Detection Engine automates the search for security issues by allowing users to define rules that monitor incoming data, and access control is managed through Identity and Access Management.\u003c/p\u003e\n"]]],[],null,["# Google SecOps overview\n======================\n\nSupported in: \nGoogle secops\n\nGoogle Security Operations is a cloud service, built as a specialized layer on\ntop of Google infrastructure, designed for enterprises to privately retain,\nanalyze, and search the large amounts of security and network telemetry they\ngenerate.\n\nGoogle SecOps normalizes, indexes, correlates, and analyzes the data to\nprovide instant analysis and context on risky activity. Google SecOps can\nbe used to detect threats, investigate the scope and cause of those threats, and\nprovide remediation using prebuilt integrations with enterprise workflow,\nresponse, and orchestration platforms.\n\nGoogle SecOps lets you examine the aggregated security\ninformation for your enterprise going back for months or longer. Use\nGoogle SecOps to search across all of the domains accessed within your\nenterprise. You can narrow your search to any specific asset, domain, or IP\naddress to determine if any compromise has taken place.\n\nThe Google SecOps platform enables security analysts to\nanalyze and mitigate a security threat throughout its lifecycle by employing the\nfollowing capabilities:\n\n- **Collection**: Data is ingested into the platform using forwarders, parsers, connectors and webhooks.\n- **Detection**: This data is aggregated, normalized using the Universal Data Model (UDM), and linked to detections and threat intelligence.\n- **Investigation** : Threats are investigated through case management, search, collaboration, and [context-aware\n analytics](/chronicle/docs/detection/context-aware-analytics).\n- **Response**: Security analysts can respond quickly and provide resolutions using automated playbooks and incident management.\n\nData collection\n---------------\n\nGoogle SecOps can ingest numerous security telemetry types through a\nvariety of methods, including the following:\n\n- **Forwarder**: A lightweight software component, deployed in the customer's\n network, that supports syslog, packet capture, and existing log management\n or security information and event management (SIEM) data repositories.\n\n- **Ingestion APIs**: APIs that enable logs to be sent directly to the\n Google SecOps platform, eliminating the need for additional\n hardware or software in customer environments.\n\n- **Third-party integrations**: Integration with third-party cloud APIs to\n facilitate ingestion of logs, including sources like Office 365 and Azure\n AD.\n\nThreat analysis\n---------------\n\nThe analytical capabilities of Google SecOps are delivered as a\nbrowser-based application. Many of these\ncapabilities are also accessible programmatically through Read APIs.\nGoogle SecOps gives analysts a way, when they see a potential threat, to\ninvestigate further and determine how best to respond.\n\nSummary of Google SecOps features\n---------------------------------\n\nThis section describes some of the features available in\nGoogle SecOps.\n\n### Search\n\n- **UDM Search**: Lets you to find Unified Data Model (UDM) events and alerts within your Google SecOps instance.\n- **Raw Log Scan**: Search your raw unparsed logs.\n- **Regular Expressions**: Search your raw unparsed logs using regular expressions.\n\n### Case management\n\nGroup related alerts into cases, sort and filter cases queue for triage and\nprioritization, assign cases, collaborate on every case, case audit and\nreporting.\n\n### Playbook designer\n\nBuild playbooks by selecting predefined actions and dragging and dropping them\ninto the playbook canvas without additional coding. Playbooks also enable you to\ncreate dedicated views for each alert type and each SOC role. Case management\npresents only the data relevant to a specific alert type and user role.\n\n### Graph investigator\n\nVisualize the who, what, and when of an attack, identify opportunities for\nthreat hunting, capture the full picture and take action.\n\n### Dashboard and reporting\n\nEffectively measure and manage operations, demonstrate value to stakeholders,\ntrack real-time SOC metrics and KPIs. You can use built-in dashboards and\nreports or build your own.\n\n### Integrated development environment (IDE)\n\nSecurity teams with coding skills can modify and enhance existing playbook\nactions, debug code, build new actions for existing integrations, and create\nintegrations that are not available in the Google Security Operations SOAR Marketplace.\n\n### Investigative views\n\n- **Asset view**: Investigate assets within your enterprise and whether or not they have interacted with suspicious domains.\n- **IP Address view**: Investigate specific IP addresses within your enterprise and what impact they have on your assets.\n- **Hash view**: Search for and investigate files based on their hash value.\n- **Domain view**: Investigate specific domains within your enterprise and what impact they have on your assets.\n- **User view**: Investigate users within your enterprise who may have been impacted by security events.\n- **Procedural filtering**: Fine tune information about an asset, including by event type, log source, network connection status, and Top Level Domain (TLD).\n\n### Highlighted information\n\n- Asset insight blocks highlights the domains and alerts that you might want to investigate further.\n- Prevalence graph shows the number of domains an asset has connected to over a specified time period.\n- Alerts from other popular security products.\n\n### Detection engine\n\nYou can use the Google SecOps Detection Engine to automate the process of\nsearching across your data for security issues. You can specify rules to search\nall of your incoming data and notify you when potential and known threats appear\nin your enterprise.\n\n### Access control\n\nYou can both employ predefined roles and configure new roles to control access\nto classes of data, alerts, and events stored within your Google SecOps\ninstance. [Identity and Access Management](/iam/docs) provides access control for\nGoogle SecOps.\n\n**Need more help?** [Get answers from Community members and Google SecOps professionals.](https://security.googlecloudcommunity.com/google-security-operations-2)"]]
