# Google Chronicle SIEM

Forwarding data from Apica Ascent to Google Chronicle SIEM (now part of Google Security Operations) is transitioning from legacy Docker-based forwarders to a modern OpenTelemetry (OTel) architecture. Google has officially designated OTel—specifically managed via BindPlane OP—as the primary ingestion method, with legacy forwarders set for deprecation by January 2027.

#### 1. Prerequisites in Google Chronicle

Before configuring Apica, you must establish the "landing zone" in Google Cloud:

1. Service Account: Create a Google Cloud Service Account with the Chronicle API Admin (or `roles/chroniclesm.admin`) role.
2. Generate JSON Key: Download the service account's JSON key file. This is the credential Apica will use to authenticate.
3. Capture IDs: Note your Customer ID (found in Chronicle under *Settings > Profile*) and your Project ID.
4. Identify Log Type: Determine the standard Google Chronicle `log_type` (e.g., `WINEVTLOG`, `SYSLOG`, or `CUSTOM_JSON`) for your data.

#### 2. Configuration Strategy: The Forwarder

In the Apica Flow (Ascent) UI, you will configure a target destination using the OTLP/HTTP protocol. Google’s modern ingestion path uses the DataPlane API.

| **Field**        | **Value**                                                                                                                              |
| ---------------- | -------------------------------------------------------------------------------------------------------------------------------------- |
| Destination Name | `Google_Chronicle_Forwarder`                                                                                                           |
| Endpoint         | `https://<region>-chronicle.googleapis.com/v1/projects/<project-id>/locations/<region>/instances/<customer-id>/logEntries:batchCreate` |
| Protocol         | `http/protobuf`                                                                                                                        |
| Authentication   | Google Service Account (JSON Key)                                                                                                      |

#### 3. Detailed Reference: Metadata & Mapping (OTTL)

Chronicle relies on the `chronicle_log_type` label to route data to the correct parser. If this label is missing, logs will fall back to unstructured data.

**Mandatory Mapping Logic in Apica Flow**

SQL

```
# 1. Assign the Chronicle Log Type (CRITICAL)
# This tells Chronicle which parser to apply to the raw data
set(resource.attributes["chronicle_log_type"], "APICA_SYNTHETICS")

# 2. Define the Namespace (Optional)
# Helps segment data from different environments or business units
set(resource.attributes["chronicle_namespace"], "Production")

# 3. Map the Log Body
# Ensure the raw message is in a field Chronicle can index
set(attributes["log_text"], body)
```

#### 4. Implementation Reference: Exporter Configuration

If using the Apica Fleet Agent (which manages an OTel Collector), your YAML configuration will utilize the `googlecloudlog` or a generic `otlphttp` exporter configured for Chronicle:

YAML

```
exporters:
  googlecloud/chronicle:
    project: "your-gcp-project-id"
    log_config:
      # Maps OTel attributes to Chronicle-specific ingestion labels
      log_type: "APICA_SECURITY_EVENTS"
    sending_queue:
      enabled: true

service:
  pipelines:
    logs:
      receivers: [otlp]
      processors: [batch, transform/chronicle_mapping]
      exporters: [googlecloud/chronicle]
```

***

#### 5. Key Implementation Notes

* Data Limits: Chronicle has a 1MB maximum size limit per uncompressed batch. Ensure your Apica batch processor is tuned to respect this limit.
* Encoding: Google Chronicle only supports UTF-8 encoding. Apica Flow handles this conversion automatically when using the standard OTLP ingestion.
* Smart Filtering: Since SIEM pricing is volume-sensitive, use Apica Flow to filter out routine "Success" logs. For example, only forward synthetic check failures or detected security anomalies (like prompt injections) to Chronicle.
* BindPlane Transition: If you are migrating from the legacy forwarder, you can use the BindPlane OP management console directly within Apica to manage these OTel agents across your fleet.