Google Security Operations Notifications

Anzenna forwards detection notifications into your Google Security Operations (SecOps) instance as Unified Data Model (UDM) events. When a detection finds new events, Anzenna sends one UDM event you can search, write rules against, and correlate with the rest of your SecOps data.

Setup

1. Connect Google Security Operations

Before you can forward notifications, connect your SecOps instance to Anzenna. Follow the

Connect Google Security Operations

integration guide to create the webhook feed and API key.

2. Choose what to forward

Google Security Operations is a webhook destination, so it appears under Webhook Notifications with your other webhook integrations:

1. Go to Settings > Preferences and open the Detections tab.

2. In Channels, add Webhook to Channels to configure.

3. Under Webhook Notifications, check Google Security Operations.

4. Click Save changes.

To forward investigation notifications too, open the Investigations tab on the same page and select Google Security Operations as a destination when you create or edit a rule.

tip

An event is sent when the detection's stats are next recalculated, not the moment you save the configuration, so it can take a short time to appear in SecOps. SecOps search itself can lag a few minutes behind.

---

What Gets Sent

Each notification is one UDM event with these fields:

UDM field	Description
metadata.event_timestamp	When the notification fired
metadata.vendor_name	Always Anzenna
metadata.product_name	Always Anzenna
metadata.product_event_type	detection, investigation, notification (a test send) or connection_test
metadata.event_type	USER_UNCATEGORIZED when exactly one person is affected, otherwise GENERIC_EVENT
metadata.product_log_id	Unique ID of this notification
metadata.url_back_to_product	Direct link to the detection in Anzenna
principal.user.email_addresses	The affected person, when there is exactly one
about.user.email_addresses	Every affected person
security_result.summary	Detection name
security_result.description	Human-readable summary
security_result.detection_fields	detection_id, incident_count, previous_count, new_event_count and user_count

Find recent Anzenna detections with a UDM search:

metadata.vendor_name = "Anzenna" AND metadata.product_event_type = "detection"

To alert on them, use a rule like this one:

rule anzenna_detection {
  meta:
    description = "Fires on every Anzenna detection"
  events:
    $e.metadata.vendor_name = "Anzenna"
    $e.metadata.product_event_type = "detection"
  condition:
    $e
}

note

Exclude connection_test and notification events from your rules. Anzenna sends them when you connect and when you send a test notification.

---

Per-Source Overrides

You can enable or disable Google Security Operations notifications for individual detections using

per-source overrides

. This lets you forward only the detections that warrant it.

---

Need help? Contact

Anzenna Support

for assistance.