Chronicle

---
name: chronicle
description: "Expert agent for Google Security Operations (Chronicle). Provides deep expertise in YARA-L 2.0 rule development, Unified Data Model normalization, Mandiant threat intelligence integration, entity graph analysis, retroactive rule matching, curated detections, and Google Cloud-native SIEM architecture. WHEN: \"Chronicle\", \"Google SecOps\", \"YARA-L\", \"UDM\", \"Mandiant\", \"curated detections\", \"entity graph\", \"Google SIEM\", \"retroactive matching\", \"Chronicle detection\"."
license: MIT
---

# Google Security Operations (Chronicle)

This skill covers Google Security Operations (formerly Chronicle). It has deep knowledge of:

- YARA-L 2.0 rule language for detection and correlation
- Unified Data Model (UDM) normalization schema
- Mandiant threat intelligence integration (native)
- Entity graph for relationship analysis
- Retroactive rule matching (hunt across 12+ months of historical data)
- Curated detections (Google-managed detection rules)
- Log ingestion and normalization pipeline
- Duet AI / Gemini assistant for natural language queries
- Context-aware analytics and risk scoring
- Google Cloud Platform integration

**Architecture note:** Chronicle is a cloud-native, multi-tenant SIEM with a unique pricing model (flat per-user pricing, not ingestion-based). This makes it attractive for high-volume environments where traditional SIEM costs are prohibitive.

## How to Approach Tasks

1. **Classify** the request:
   - **Detection engineering** -- YARA-L rule development, curated detection tuning
   - **Investigation** -- UDM search, entity graph exploration, retroactive hunting
   - **Data onboarding** -- Log type configuration, parser development, UDM mapping
   - **Architecture** -- Ingestion pipeline, GCP integration, data residency
   - **Threat intelligence** -- Mandiant TI integration, IOC management, retroactive IOC matching

2. **Gather context** -- GCP environment, existing security tooling, log sources, analyst team size

3. **Check UDM mapping** -- Detection rules require UDM-normalized data. Verify parser availability.

4. **Recommend** actionable guidance with YARA-L examples and Chronicle UI steps

## Core Expertise

### YARA-L 2.0

YARA-L 2.0 is Chronicle's detection rule language, inspired by YARA but designed for security event correlation:

```yaral
rule suspicious_powershell_download {
  meta:
    author = "SOC Team"
    description = "Detects PowerShell download cradles"
    severity = "HIGH"
    mitre_attack_tactic = "Execution"
    mitre_attack_technique = "T1059.001"

  events:
    $process.metadata.event_type = "PROCESS_LAUNCH"
    $process.target.process.file.full_path = /.*powershell\.exe$/i
    $process.target.process.command_line = /.*Net\.WebClient.*Download(String|File).*/ nocase

  condition:
    $process
}
```

**YARA-L key concepts:**

| Concept | Description | Example |
|---|---|---|
| **events** | Define event patterns to match | `$e.metadata.event_type = "NETWORK_CONNECTION"` |
| **match** | Group results by field (like GROUP BY) | `match: $e.principal.hostname over 5m` |
| **outcome** | Define output variables | `outcome: $risk_score = max(95)` |
| **condition** | Logical combination of event variables | `condition: $login and $process` |
| **placeholder** | Variable binding across events | `$user = $login.target.user.userid` |

**Multi-event correlation:**
```yaral
rule brute_force_then_success {
  meta:
    severity = "HIGH"
    description = "Multiple failed logins followed by success from same IP"

  events:
    // Failed logins
    $fail.metadata.event_type = "USER_LOGIN"
    $fail.security_result.action = "BLOCK"
    $fail.principal.ip = $src_ip

    // Successful login
    $success.metadata.event_type = "USER_LOGIN"
    $success.security_result.action = "ALLOW"
    $success.principal.ip = $src_ip
    $success.target.user.userid = $username

    // Time ordering
    $fail.metadata.event_timestamp.seconds < $success.metadata.event_timestamp.seconds

  match:
    $src_ip, $username over 30m

  outcome:
    $fail_count = count_distinct($fail.metadata.id)
    $risk_score = max(85)

  condition:
    $fail and $success and #fail > 10
}
```

**YARA-L operators and functions:**

| Category | Examples |
|---|---|
| **Comparison** | `=`, `!=`, `<`, `>`, `<=`, `>=` |
| **Regex** | `/pattern/` with `nocase` modifier |
| **String** | `strings.concat()`, `strings.to_lower()`, `re.regex()` |
| **Aggregation** | `count()`, `count_distinct()`, `sum()`, `min()`, `max()`, `array()` |
| **Time** | `timestamp.current_seconds()`, window-based matching with `over` |
| **Network** | `net.ip_in_range_cidr()` |
| **Condition** | `#event_var > N` (count of matching events), `and`, `or`, `not` |

### Unified Data Model (UDM)

UDM is Chronicle's normalization schema:

```json
{
  "metadata": {
    "event_type": "NETWORK_CONNECTION",
    "product_name": "Palo Alto Firewall",
    "vendor_name": "Palo Alto Networks",
    "event_timestamp": "2026-04-08T12:00:00Z"
  },
  "principal": {
    "ip": ["10.0.0.50"],
    "hostname": "WORKSTATION-01",
    "user": {
      "userid": "jsmith",
      "email_addresses": ["jsmith@company.com"]
    }
  },
  "target": {
    "ip": ["203.0.113.10"],
    "port": 443,
    "hostname": "suspicious-domain.com"
  },
  "network": {
    "application_protocol": "HTTPS",
    "direction": "OUTBOUND",
    "sent_bytes": 1024,
    "received_bytes": 52480
  },
  "security_result": [{
    "action": ["ALLOW"],
    "severity": "LOW",
    "category_details": ["web-browsing"]
  }]
}
```

**UDM key entities:**
- `principal` -- The actor/source of the event (user, host, process)
- `target` -- The destination or object being acted upon
- `src` -- Network source (for network events)
- `observer` -- The device that observed/logged the event
- `intermediary` -- Intermediate devices (proxies, load balancers)
- `about` -- Additional context entities
- `security_result` -- Security verdicts (action, severity, threat details)

**UDM event types:**
- `USER_LOGIN` / `USER_LOGOUT` -- Authentication events
- `PROCESS_LAUNCH` / `PROCESS_TERMINATION` -- Process events
- `NETWORK_CONNECTION` / `NETWORK_HTTP` -- Network events
- `FILE_CREATION` / `FILE_MODIFICATION` / `FILE_DELETION` -- File events
- `REGISTRY_CREATION` / `REGISTRY_MODIFICATION` -- Registry events
- `GENERIC_EVENT` -- Events that don't fit specific types

### Retroactive Rule Matching

Chronicle's defining feature -- apply new rules to historical data:

- **Historical search** -- Search across 12+ months of retained data
- **Retroactive rules** -- When you create a new rule, it automatically evaluates against all historical data
- **IOC retroactive matching** -- New threat intelligence IOCs are checked against all retained data
- **Use case** -- Discover if a newly-identified threat actor was in your environment 6 months ago

This is possible because Chronicle uses Google's infrastructure for storage and search, making it economically viable to retain and search large volumes.

### Curated Detections

Google-managed detection rules maintained by Google's security team:

- **Pre-built rule sets** -- Covering common attack techniques, cloud threats, insider threats
- **Mandiant intelligence-driven** -- Rules based on Mandiant's incident response experience
- **Automatically updated** -- Google pushes updates without customer action
- **Tunable** -- Customers can suppress false positives and adjust severity
- **Categories** -- Windows threats, Linux threats, Cloud threats, Network threats, Credential threats

### Mandiant Threat Intelligence

Native integration with Mandiant's threat intelligence:

- **IOC matching** -- Automatic matching of Mandiant IOCs against all ingested data
- **Threat actor profiles** -- Context about threat groups targeting your industry
- **Vulnerability intelligence** -- CVE context and exploitation likelihood
- **Retroactive matching** -- New IOCs automatically checked against historical data
- **Priority intelligence** -- Mandiant-curated intelligence focused on the most relevant threats

### Entity Graph

Visual relationship analysis for investigation:

- **Entity relationships** -- See connections between users, hosts, IPs, domains, files
- **Timeline view** -- Chronological activity for any entity
- **Prevalence data** -- How common is this entity across your environment?
- **First/last seen** -- When was this entity first and last observed?
- **Associated alerts** -- All detections related to an entity

### AI Assistant (Gemini)

Natural language interface for security operations:

- **Natural language search** -- "Show me all failed logins from Russia in the last 24 hours"
- **Rule generation** -- "Create a YARA-L rule to detect lateral movement via PsExec"
- **Investigation assistance** -- "Summarize the activity of user jsmith in the last week"
- **UDM query translation** -- Convert natural language to UDM search queries

## Common Pitfalls

1. **UDM parser gaps** -- Not all log sources have pre-built parsers. Custom parser development is needed for proprietary applications.
2. **YARA-L learning curve** -- YARA-L syntax is unique. Analysts from SPL/KQL backgrounds need training.
3. **GCP dependency** -- Chronicle is tightly integrated with GCP. Non-GCP environments require additional data forwarding infrastructure.
4. **Curated detection noise** -- Curated detections are not tuned for your environment. Expect false positives initially; create suppression rules.
5. **Flat pricing model** -- Per-user pricing is attractive for high-volume environments but expensive if you have many users with low log volume.
6. **Limited SOAR** -- Chronicle's built-in SOAR capabilities are less mature than dedicated SOAR platforms. May need supplemental SOAR tooling.
7. **Regex performance in YARA-L** -- Complex regex patterns across high-volume data can be slow. Use UDM field matching before regex refinement.