Connect Google Security Operations to Anzenna
Anzenna pushes detection notifications into your Google Security Operations (SecOps) instance through a webhook feed. Each notification arrives as a Unified Data Model (UDM) event, so you can search it, write rules against it, and correlate it with the rest of your SecOps data without writing a parser.
This is a one-way push: Anzenna can only send events to the one feed you create. It never reads from your SecOps instance.
Prerequisites
A Google SecOps (SIEM) instance, and permission to create feeds in it.
Access to the Google Cloud project your SecOps instance is linked to, with permission to create API keys.
Administrator access to the Anzenna platform.
Step-by-Step Instructions
Part 1: Create a webhook feed in SecOps
In Google SecOps, open Settings > Feeds and click Add New Feed.
Name the feed (for example, "Anzenna").
Set Source type to Webhook.
Set Log type to UDM. Anzenna sends events already in UDM format, so no parser is needed. Any other log type leaves the events unparsed.
Click Next, leave the optional input parameters empty, click Next again, and then Submit.
Open the new feed from the Feeds list, go to its Secret Key tab, and click Generate Secret Key.
Click the eye icon to view the secret and copy it. SecOps shows it only while this window is open. Generating a new one later replaces the old one, and you will need to reconnect Anzenna with it.
On the Details tab, copy the endpoint URL from Endpoint Information.
https://us-chronicle.googleapis.com/v1alpha/projects/<project>/locations/us/instances/<instance-id>/feeds/<feed-id>:importPushLogs
Part 2: Create an API key in Google Cloud
In the Google Cloud console, select the project your SecOps instance is linked to and go to APIs & Services > Credentials.
Click Create credentials > API key.
Edit the new key. Under API restrictions, choose Restrict key, select Chronicle API, and save. The key's Restrictions column then shows Chronicle API.
Click Show key and copy it.
Part 3: Connect in Anzenna
In Anzenna, go to Settings > Integrations.
Toggle on the Google Security Operations card to open the Connect dialog.
Enter the three values you collected:
Feed Endpoint URL: the endpoint URL from Part 1, exactly as SecOps shows it.
API Key: the key from Part 2.
Feed Secret Key: the secret from Part 1.
Click Save.
Anzenna sends one test event to check the values. When it is accepted, the card shows Connected to followed by your SecOps instance ID. If a value is wrong, the card shows a message that names what to fix (see Troubleshooting below).
Verify
In SecOps, run this UDM search over the last hour. The connection test event ("Anzenna connection test. Safe to ignore.") should appear within a few minutes:
metadata.vendor_name = "Anzenna"
Troubleshooting
| Symptom | What to fix |
|---|---|
| "google secops says the API key is not valid" | Copy the whole key again from Google Cloud, and check it has not been deleted |
| "google secops rejected the feed secret" | Paste the feed's current secret key, and check the API key is restricted to the Chronicle API |
| "google secops could not find this feed" | Check the endpoint URL, and that the feed still exists and is enabled |
| "google secops feed URL must ..." | Paste the endpoint URL exactly as SecOps shows it, with no query string or user name |
| "google secops is already connected for this instance" | This SecOps instance is already connected. Disconnect it before connecting again |
| The card turns Failed after working | The key or secret changed. Reconnect with the current values, then select SecOps again in your notification settings |
| Events do not appear in search | SecOps search can lag a few minutes; check the time range, and that the feed's log type is UDM |
While the connection is failed, detections that fire are not sent to SecOps, and they are not resent after you reconnect.