Google releases SIEM and SOAR updates for Chronicle Security Operations Platform

Google has announced an upgraded version of its Chronicle Security Operations (SecOps) platform, which combines SIEM and SOAR capabilities. Users of the SecOps platform can now preview the natural language query and summarization abilities of Duet AI. Google Cloud has announced the availability of the upgraded version of the Chronicle Security Operations platform. This upgrade unifies security information and event management with security orchestration, automation, and response, and includes application threat intelligence tools. The preview version also features the chatbot Duet AI. Additionally, Mandiant has provided new attack surface management services for Chronicle Security Operations. Chronicle Security Operations is a subscription service with pricing based on demand. What are the new features in the Chronicle Security Operations update? Google has integrated SIEM and SOAR into Chronicle Security Operations to help security operations teams analyze the large amount of data they receive. Software companies have been striving to go beyond just collecting data and effectively utilize it since the advent of modern big data collection. Security teams need to be able to view interconnected unified data in an intuitive and practical way and know which data or alerts to prioritize action on. In the current preview version of Chronicle, the application automatically groups alerts into cases, each of which includes related alerts and rich information. Google states that this feature will help security teams make decisions faster. "We have highly integrated threat intelligence capabilities on the Chronicle platform," said Bashar Abouseido, Chief Information Security Officer at Charles Schwab, in a news release by Google. "We like being able to enrich data and provide orchestration capabilities with additional context for our SOC and analysts to better prioritize their work." Application threat intelligence tool collects information about threats Application threat intelligence is a new feature in Chronicle Security Operations, now available for preview alongside the unified upgrade of SIEM/SOAR. It gathers threat intelligence from Google Cloud, Mandiant, and VirusTotal, and applies this threat intelligence to events listed in Chronicle Security Operations to enrich and provide context to the events. Artificial intelligence and machine learning determine how threats should be prioritized based on the specific needs of each security team. If an event matches known threat indicators, application threat intelligence adds context about threat actors, threat activities, or malicious software families. Security researchers can then use custom searches or detections to learn more from the additional information provided by application threat intelligence. Essentially, Google aims to leverage the capabilities of its search engine to enable similar searches for security incidents. Duet AI engages in conversational communication with Chronicle Security Operations The Duet AI chatbot assistant is built on the Vertex AI platform, allowing security researchers to ask questions in natural language and receive case summaries and guidance. With Duet AI, SecOps personnel will be able to search for threats, responses, and case statuses in Chronicle Security Operations. The integration of Duet AI is now available for preview. "Duet AI in Chronicle is able to instantly translate natural language queries into complex searches, which helps new people in the security field get up to speed faster and makes experts more efficient," said Eric Doerr, Vice President of Cloud Security Engineering at Google Cloud. Google's Mandiant product expands attack surface management Google has now added Mandiant attack surface management to Chronicle Security Operations. Mandiant attack surface management can identify and validate exploitable entry points. Like other updates to Chronicle Security Operations, it aims to help SecOps teams determine which risks are most impactful and should be mitigated first. Google acquired Mandiant in September 2022. Competitors of Google Cloud's Chronicle Security Operations Alternative options to Chronicle Security Operations include Microsoft Sentinel, Splunk Enterprise (for data analysis and search), IBM Security QRadar, Datadog (for SIEM), Devo Technology, and Oracle Cloud's Oracle Security Monitoring and Analytics.