Google SecOps Detections Integration Guide

Overview

The Google SecOps Detections connector allows NINA to interact with the Google SecOps Detections & Rules API and the Google SecOps Content Hub API.

Capabilities

Category	Resources	Operations
Analytics	Analytics	List analytics, list analytic values
Coverage	Coverage Details	List coverage details
Curated Rules	Curated Rule Set Categories, Curated Rules	Get/list categories, rule sets, deployments; batch-update deployments
Detection Rules	Rules, Rule Deployments, Retrohunts	CRUD, enable/disable, list revisions, list deployments, create/list retrohunts
Findings	Findings Graph, Findings Refinements	Initialize/explore graph; CRUD refinements; get/update deployment
Monitoring	Rule Execution Errors	List execution errors
Content Hub	Content Packs, Featured Dashboards, Featured Playbooks, Featured Rules, Featured Search Queries	Get/list/install/deploy/upload content

API Versions

Resource group	API version
analytics, curatedRules, curatedRuleSetCategories, findingsGraph, featuredContentPlaybooks, featuredContentSearchQueries	v1alpha
coverageDetails, findingsRefinements, ruleExecutionErrors, rules, contentPacks, featuredContentNativeDashboards, featuredContentRules	v1

Authentication Method

Google Cloud service account with a JSON key. The connector uses the golang.org/x/oauth2/google JWT flow to obtain short-lived OAuth2 access tokens automatically. No user interaction is required.

How Authentication Works

1. The connector reads the service account JSON key from the serviceAccountJson credential field.
2. It calls google.JWTConfigFromJSON to parse the key and requests the scope https://www.googleapis.com/auth/cloud-platform.
3. An OAuth2 HTTP client is created; it fetches and caches access tokens, refreshing them before they expire.
4. Every API request carries a Bearer <token> Authorization header added transparently by the HTTP client.

---

Credential Configuration

Google SecOps API Regions

region value	API base URL	Geography
us	https://us-chronicle.googleapis.com	United States
eu	https://eu-chronicle.googleapis.com	Europe
asia-southeast1	https://asia-southeast1-chronicle.googleapis.com	Singapore
asia-south1	https://asia-south1-chronicle.googleapis.com	India
northamerica-northeast2	https://northamerica-northeast2-chronicle.googleapis.com	Canada
me-west1	https://me-west1-chronicle.googleapis.com	Middle East

Note: region and location are different fields. region is the API hostname prefix (e.g. eu). location is the GCP resource location used in the resource path (e.g. europe-west2 or eu). For most instances the two share the same short value, but they can differ.

Required IAM Permissions

Assign these predefined Google SecOps IAM roles on the GCP project:

Role	Required for
roles/chronicle.viewer	All read-only operations (list, get)
roles/chronicle.editor	Write operations (create, update, patch, delete, deploy)
roles/chronicle.admin	Administrative operations (batch updates, bulk modify)

Least-privilege recommendation: grant chronicle.viewer for read-only use cases, chronicle.editor for rule management workflows.

Shared Credential with Other Google SecOps Connectors

The chronicle-detections credential uses the same five fields and the same service account as chronicle-instances, chronicle-cases, and chronicle-soar. A single service account configured with the appropriate IAM roles can be reused across all four Google SecOps connectors.

Creating a Google SecOps Detections Credential in NINA

Field	Description	Example
serviceAccountJson	Complete JSON service account key (paste entire file content)	{ "type": "service_account", ... }
region	Google SecOps API region prefix	eu
project	GCP project ID	my-project-123
location	GCP location for the Google SecOps instance	eu or europe-west2
instance	Google SecOps instance ID (UUID)	fca7f167-b9d1-43b1-9d03-0257d31dcb63

Where to find these values:

• project — GCP Console → top navigation bar → project selector → project ID.
• location — Google SecOps Console → Settings → Instance details → Location.
• instance — Google SecOps Console → Settings → Instance details → Instance ID.
• region — Google SecOps Console → Settings → Instance details → Region (use the short prefix, e.g. eu).

How to Obtain a Service Account Key

1. Open GCP Console → IAM & Admin → Service Accounts.
2. Click Create Service Account. Use a descriptive name such as nina-chronicle-detections.
3. Grant the service account the required Google SecOps IAM roles (see above).
4. Click the service account → Keys tab → Add Key → Create new key → JSON.
5. Save the downloaded JSON file. Paste its entire content as the serviceAccountJson credential value.

---

Rate Limits and Quotas

The Google SecOps API enforces per-project rate limits. The connector handles these automatically:

• On HTTP 429 Too Many Requests: retries up to 3 times with exponential back-off (1 s → 2 s → 4 s).
• If a Retry-After header is present, that duration is used instead.
• All requests time out after 90 seconds.
• If the quota is persistently exceeded, contact Google Cloud support to increase limits.

---

Supported Operations

Resources overview

Resource	Operations	Description
analytics	list, listAnalyticValues	Query Google SecOps analytics and entity analytic values
coverageDetails	list	List detection rule coverage details
curatedRuleSetCategories	get, list, countCuratedRuleSetDetections, getCuratedRuleSet, listCuratedRuleSets, batchUpdateCuratedRuleSetDeployments, getCuratedRuleSetDeployment, updateCuratedRuleSetDeployment	Manage Google-managed curated rule sets and their deployments
curatedRules	get, list	Retrieve individual curated (Google-managed) detection rules
findingsGraph	exploreNode, initializeGraph	Explore the Google SecOps findings graph
findingsRefinements	computeActivity, create, get, list, getDeployment, update, updateDeployment	Manage findings refinements that tune detection output
ruleExecutionErrors	list	View errors that occurred during rule execution
rules	create, delete, get, list, getDeployment, listRevisions, update, updateDeployment, modifyRules, listDeployments, createRetrohunt, getRetrohunt, listRetrohunts	Full lifecycle management of YARA-L detection rules
contentPacks	get, list, add, alignPlaybooks, delete, deployConnectorInstances, deployPlaybooks, deployTestCases, download, installIntegration, markAsDeployed, upload	Manage Content Hub content packs
featuredContentNativeDashboards	get, list, install	Browse and install featured native dashboards
featuredContentPlaybooks	fetchFacets, get, list, install	Browse and install featured playbooks
featuredContentRules	list	Browse featured detection rules
featuredContentSearchQueries	get, list, install	Browse and install featured search queries

---

Operation Details

analytics

analytics.list

List all analytics available in the Google SecOps instance.

• HTTP Method: GET
• API Version: v1alpha
• Path: /v1alpha/projects/{project}/locations/{location}/instances/{instance}/analytics

Parameter	Type	Required	Description
pageSize	number	No	Maximum number of results to return
pageToken	string	No	Pagination token from a previous response
filter	string	No	Filter expression

analytics.listAnalyticValues

List analytic values computed for entities.

• HTTP Method: GET
• API Version: v1alpha
• Path: /v1alpha/projects/{project}/locations/{location}/instances/{instance}/analytics/entities/analyticValues

Parameter	Type	Required	Description
pageSize	number	No	Maximum number of results to return
pageToken	string	No	Pagination token
filter	string	No	Filter expression

---

coverageDetails

coverageDetails.list

List coverage details for detection rules.

• HTTP Method: GET
• API Version: v1
• Path: /v1/projects/{project}/locations/{location}/instances/{instance}/coverageDetails

Parameter	Type	Required	Description
pageSize	number	No	Maximum number of results to return
pageToken	string	No	Pagination token
filter	string	No	Filter expression

---

curatedRuleSetCategories

curatedRuleSetCategories.get

Retrieve a specific curated rule set category.

• HTTP Method: GET
• API Version: v1alpha
• Path: /v1alpha/projects/{project}/locations/{location}/instances/{instance}/curatedRuleSetCategories

Parameter	Type	Required	Description
name	string	Yes	Resource name of the category

curatedRuleSetCategories.list

List all curated rule set categories.

• HTTP Method: GET
• API Version: v1alpha

Parameter	Type	Required	Description
pageSize	number	No	Maximum number of results
pageToken	string	No	Pagination token

curatedRuleSetCategories.countCuratedRuleSetDetections

Count detections generated by a curated rule set.

• HTTP Method: POST
• Path: /v1alpha/.../curatedRuleSetCategories/curatedRuleSets:countCuratedRuleSetDetections

Parameter	Type	Required	Description
startTime	string	No	Start of time range (RFC3339)
endTime	string	No	End of time range (RFC3339)

curatedRuleSetCategories.getCuratedRuleSet

Retrieve a specific curated rule set.

• HTTP Method: GET
• Path: /v1alpha/.../curatedRuleSetCategories/curatedRuleSets

Parameter	Type	Required	Description
name	string	Yes	Resource name of the curated rule set

curatedRuleSetCategories.listCuratedRuleSets

List all curated rule sets.

• HTTP Method: GET

Parameter	Type	Required	Description
filter	string	No	Filter expression

curatedRuleSetCategories.batchUpdateCuratedRuleSetDeployments

Batch update the deployment state of multiple curated rule sets.

• HTTP Method: POST
• Path: /v1alpha/.../curatedRuleSetCategories/curatedRuleSets/curatedRuleSetDeployments:batchUpdate

Parameter	Type	Required	Description
requests	array	Yes	List of deployment update request objects

Warning: This operation modifies production rule deployment state. Use with caution.

curatedRuleSetCategories.getCuratedRuleSetDeployment

Retrieve the deployment state of a curated rule set.

• HTTP Method: GET

Parameter	Type	Required	Description
name	string	Yes	Resource name of the deployment

curatedRuleSetCategories.updateCuratedRuleSetDeployment

Update (enable or disable) the deployment of a curated rule set.

• HTTP Method: PATCH

Parameter	Type	Required	Description
name	string	Yes	Resource name of the deployment
enabled	boolean	No	Whether to enable or disable
updateMask	string	No	Comma-separated fields to update

---

curatedRules

curatedRules.get

Retrieve a specific curated rule.

• HTTP Method: GET
• API Version: v1alpha

Parameter	Type	Required	Description
name	string	Yes	Resource name of the curated rule

curatedRules.list

List all curated rules.

• HTTP Method: GET

Parameter	Type	Required	Description
pageSize	number	No	Maximum number of results
pageToken	string	No	Pagination token
filter	string	No	Filter expression

---

findingsGraph

findingsGraph.exploreNode

Explore a node in the findings graph to retrieve connected findings.

• HTTP Method: POST
• API Version: v1alpha
• Path: /v1alpha/.../findingsGraph:exploreNode

Parameter	Type	Required	Description
nodeId	string	Yes	ID of the node to explore
depth	number	No	Depth of exploration

findingsGraph.initializeGraph

Initialize a new findings graph for a set of findings.

• HTTP Method: POST
• Path: /v1alpha/.../findingsGraph:initializeGraph

Parameter	Type	Required	Description
findingIds	array	No	List of finding IDs to seed the graph
filter	string	No	Filter to select findings

---

findingsRefinements

Findings refinements tune detection output by filtering false positives or adjusting rule sensitivity.

findingsRefinements.computeActivity

Compute activity metrics for a findings refinement.

• HTTP Method: POST
• API Version: v1
• Path: /v1/.../findingsRefinements:computeFindingsRefinementActivity

Parameter	Type	Required	Description
name	string	Yes	Resource name of the refinement
startTime	string	No	Start of time range (RFC3339)
endTime	string	No	End of time range (RFC3339)

findingsRefinements.create

Create a new findings refinement.

• HTTP Method: POST
• Path: /v1/.../findingsRefinements

Parameter	Type	Required	Description
displayName	string	Yes	Display name for the refinement
description	string	No	Description
yaraLRule	string	No	YARA-L rule text

findingsRefinements.get

Retrieve a specific findings refinement.

• HTTP Method: GET

Parameter	Type	Required	Description
name	string	Yes	Resource name of the refinement

findingsRefinements.list

List all findings refinements.

• HTTP Method: GET

Parameter	Type	Required	Description
pageSize	number	No	Maximum number of results
pageToken	string	No	Pagination token
filter	string	No	Filter expression

findingsRefinements.getDeployment

Retrieve the deployment state of a findings refinement.

• HTTP Method: GET
• Path: /v1/.../findingsRefinements:getDeployment

Parameter	Type	Required	Description
name	string	Yes	Resource name

findingsRefinements.update

Update an existing findings refinement.

• HTTP Method: PATCH

Parameter	Type	Required	Description
name	string	Yes	Resource name
displayName	string	No	New display name
description	string	No	New description
yaraLRule	string	No	New YARA-L rule text
updateMask	string	No	Comma-separated fields to update

findingsRefinements.updateDeployment

Enable or disable the deployment of a findings refinement.

• HTTP Method: PATCH
• Path: /v1/.../findingsRefinements:updateDeployment

Parameter	Type	Required	Description
name	string	Yes	Resource name
enabled	boolean	No	Whether to enable
updateMask	string	No	Comma-separated fields to update

---

ruleExecutionErrors

ruleExecutionErrors.list

List errors that occurred during detection rule execution.

• HTTP Method: GET
• API Version: v1

Parameter	Type	Required	Description
pageSize	number	No	Maximum number of results
pageToken	string	No	Pagination token
filter	string	No	Filter expression

---

rules

The rules resource is the core of Google SecOps detection management.

rules.create

Create a new YARA-L detection rule.

• HTTP Method: POST
• API Version: v1

Parameter	Type	Required	Description
displayName	string	Yes	Display name
text	string	Yes	YARA-L rule text

Example:

{
  "displayName": "Suspicious PowerShell Execution",
  "text": "rule suspicious_powershell {\n  meta:\n    author = \"security-team\"\n  events:\n    $e.metadata.event_type = \"PROCESS_LAUNCH\"\n    $e.principal.process.file.full_path = /powershell\.exe$/i\n  condition:\n    $e\n}"
}

rules.delete

Delete a detection rule.

• HTTP Method: DELETE

Parameter	Type	Required	Description
name	string	Yes	Resource name of the rule

Warning: Deletion is permanent and removes all rule revisions.

rules.get

Retrieve a specific detection rule.

• HTTP Method: GET

Parameter	Type	Required	Description
name	string	Yes	Resource name

rules.list

List all detection rules.

• HTTP Method: GET

Parameter	Type	Required	Description
pageSize	number	No	Maximum number of results
pageToken	string	No	Pagination token
filter	string	No	Filter (e.g. alertingEnabled=true)

rules.getDeployment

Retrieve the deployment state of a detection rule.

• HTTP Method: GET
• Path: /v1/.../rules:getDeployment

Parameter	Type	Required	Description
name	string	Yes	Resource name

rules.listRevisions

List historical revisions of a detection rule.

• HTTP Method: GET
• Path: /v1/.../rules:listRevisions

Parameter	Type	Required	Description
name	string	Yes	Resource name
pageSize	number	No	Maximum revisions to return
pageToken	string	No	Pagination token

rules.update

Update an existing detection rule.

• HTTP Method: PATCH

Parameter	Type	Required	Description
name	string	Yes	Resource name
text	string	No	New YARA-L rule text
updateMask	string	No	Comma-separated fields to update

rules.updateDeployment

Enable or disable a detection rule (live rule and/or alerting).

• HTTP Method: PATCH
• Path: /v1/.../rules:updateDeployment

Parameter	Type	Required	Description
name	string	Yes	Resource name
enabled	boolean	No	Whether to enable the rule
alertingEnabled	boolean	No	Whether alerting is enabled
updateMask	string	No	Comma-separated fields to update

rules.modifyRules

Bulk modify multiple detection rules.

• HTTP Method: POST
• API Version: v1alpha
• Path: /v1alpha/.../rules:modifyRules

Parameter	Type	Required	Description
requests	array	Yes	List of rule modification request objects

rules.listDeployments

List all rule deployments for the instance.

• HTTP Method: GET
• Path: /v1/.../rules/deployments

Parameter	Type	Required	Description
filter	string	No	Filter expression

rules.createRetrohunt

Create a retrohunt to run a detection rule over historical data.

• HTTP Method: POST
• Path: /v1/.../rules/retrohunts

Parameter	Type	Required	Description
name	string	Yes	Resource name of the rule
startTime	string	Yes	Start of historical range (RFC3339)
endTime	string	Yes	End of historical range (RFC3339)

rules.getRetrohunt

Retrieve the status and results of a retrohunt.

• HTTP Method: GET

Parameter	Type	Required	Description
name	string	Yes	Resource name of the retrohunt

rules.listRetrohunts

List all retrohunts for the instance.

• HTTP Method: GET

Parameter	Type	Required	Description
filter	string	No	Filter expression

---

contentPacks

Content packs bundle detection rules, playbooks, connector configurations, and dashboards for one-click deployment.

contentPacks.get

Retrieve a specific content pack.

• HTTP Method: GET
• API Version: v1

Parameter	Type	Required	Description
name	string	Yes	Resource name

contentPacks.list

List all available content packs.

• HTTP Method: GET

Parameter	Type	Required	Description
pageSize	number	No	Maximum number of results
pageToken	string	No	Pagination token
filter	string	No	Filter expression

contentPacks.add

Add a content pack to the Google SecOps instance.

• HTTP Method: POST
• Path: /v1/.../contentHub/contentPacks:add

Parameter	Type	Required	Description
name	string	Yes	Resource name of the content pack

contentPacks.delete

Delete a content pack from the instance.

• HTTP Method: DELETE

Parameter	Type	Required	Description
name	string	Yes	Resource name of the content pack

Warning: Deletion removes the content pack and all its deployed resources.

contentPacks.download

Download a content pack archive.

• HTTP Method: POST
• Path: /v1/.../contentHub/contentPacks:download

Parameter	Type	Required	Description
name	string	Yes	Resource name

contentPacks.upload

Upload a content pack archive to the instance.

• HTTP Method: POST
• Path: /v1/.../contentHub/contentPacks:upload

Parameter	Type	Required	Description
content	string	Yes	Base64-encoded content pack archive
displayName	string	No	Display name for the uploaded pack

contentPacks.deployPlaybooks, deployConnectorInstances, deployTestCases

Deploy specific components from a content pack.

• HTTP Method: POST

Parameter	Type	Required	Description
name	string	Yes	Resource name of the content pack

contentPacks.installIntegration

Install an integration bundled in a content pack.

Parameter	Type	Required	Description
name	string	Yes	Resource name of the content pack
integrationName	string	No	Specific integration to install

contentPacks.markAsDeployed

Mark a content pack as deployed on the instance.

Parameter	Type	Required	Description
name	string	Yes	Resource name

---

featuredContentNativeDashboards

featuredContentNativeDashboards.get / list

Get or list featured native dashboards from the Content Hub.

Parameter	Type	Required	Description
name	string	Conditional	Resource name (for get)
pageSize	number	No	Maximum results (for list)

featuredContentNativeDashboards.install

Install a featured dashboard on the instance.

• HTTP Method: POST
• Path: /v1/.../contentHub/featuredContentNativeDashboards:install

Parameter	Type	Required	Description
name	string	Yes	Resource name

---

featuredContentPlaybooks

featuredContentPlaybooks.fetchFacets

Retrieve facets for filtering featured playbooks.

• HTTP Method: GET
• API Version: v1alpha
• Path: /v1alpha/.../contentHub/featuredContentPlaybooks:fetchFacets

Parameter	Type	Required	Description
filter	string	No	Filter expression

featuredContentPlaybooks.get / list / install

Standard get, list, and install operations for featured playbooks.

---

featuredContentRules

featuredContentRules.list

List all featured detection rules from the Content Hub.

• HTTP Method: GET
• API Version: v1

Parameter	Type	Required	Description
pageSize	number	No	Maximum results
pageToken	string	No	Pagination token
filter	string	No	Filter expression

---

featuredContentSearchQueries

featuredContentSearchQueries.get / list

Get or list featured search queries.

featuredContentSearchQueries.install

Install a featured search query on the instance.

• HTTP Method: POST
• Path: /v1alpha/.../contentHub/featuredContentSearchQueries:installFeaturedContentSearchQuery

Parameter	Type	Required	Description
name	string	Yes	Resource name

---

Common Workflows

Audit Detection Rule Coverage

1. coverageDetails.list — list all coverage details to understand which MITRE ATT&CK techniques are covered.
2. curatedRuleSetCategories.list — list curated rule set categories to find gaps.
3. curatedRuleSetCategories.listCuratedRuleSets — enumerate available curated rule sets for relevant categories.
4. curatedRuleSetCategories.updateCuratedRuleSetDeployment — enable curated rule sets that cover identified gaps.

Deploy a New YARA-L Detection Rule

1. rules.create — create the rule with validated YARA-L text.
2. rules.get — verify the rule was created and get its resource name.
3. rules.updateDeployment — enable the rule (enabled=true) and optionally enable alerting (alertingEnabled=true).
4. rules.getDeployment — confirm the rule is in the expected deployment state.

Run a Retrohunt

1. rules.list — identify the rule name to retrohunt.
2. rules.createRetrohunt — create a retrohunt with desired startTime and endTime.
3. rules.getRetrohunt — poll to check completion status.

Install Content Hub Content

1. contentPacks.list — browse available content packs.
2. contentPacks.add — add the content pack to the instance.
3. contentPacks.deployPlaybooks and/or contentPacks.deployConnectorInstances — deploy components.
4. contentPacks.markAsDeployed — mark the pack as deployed.

Tune Detection with Findings Refinements

1. findingsRefinements.list — view existing refinements.
2. findingsRefinements.create — create a new refinement with a YARA-L rule.
3. findingsRefinements.computeActivity — validate the refinement activity over a time range.
4. findingsRefinements.updateDeployment — enable the refinement (enabled=true).

---

Best Practices

1. Use updateMask: When calling update or updateDeployment, always specify the updateMask field. This ensures only the intended fields are modified and prevents accidental overwrites.
2. Test rules before enabling: Use rules.create followed by rules.createRetrohunt to validate a rule on historical data before calling rules.updateDeployment to enable it live.
3. Export before modifying: For curated rule set deployments, call getCuratedRuleSetDeployment before updateCuratedRuleSetDeployment so you know the current state.
4. Paginate large collections: Always provide pageSize and handle nextPageToken in responses for resources that can have many items (rules, content packs).
5. IAM least privilege: Use separate service accounts for read-only monitoring (chronicle.viewer) and rule management (chronicle.editor). Do not use chronicle.admin for routine automation.
6. Avoid hardcoding instance values: Store project, location, and instance in credential fields — never hardcode them in playbook logic.
7. Check ruleExecutionErrors: Periodically poll ruleExecutionErrors.list to detect YARA-L syntax or logic issues that surface only at runtime.
8. Retrohunts have time limits: The Google SecOps API limits retrohunt time ranges. For long historical analysis, submit multiple retrohunts with overlapping but bounded windows.
9. Content pack downloads are large: The contentPacks.download response may be large. Ensure the NINA execution context has sufficient memory and timeout margins.
10. Token refresh is automatic: The OAuth2 client handles token expiry transparently. Do not cache or pass tokens between executions.

---

Troubleshooting

Error	Likely Cause	Resolution
PERMISSION_DENIED	Service account lacks the required Google SecOps IAM role	Add roles/chronicle.viewer or roles/chronicle.editor to the service account
INVALID_ARGUMENT: Unknown name "pageSize"	Endpoint does not support pageSize query parameter	Remove pageSize from the call; some sub-collection endpoints (e.g. rules/deployments) do not accept pagination params
NOT_FOUND on analytics/entities/analyticValues	Endpoint not available on this instance tier	This v1alpha endpoint may not be enabled for all Google SecOps instances
UNAUTHENTICATED	Service account JSON is invalid or expired	Regenerate the service account key in GCP Console
INVALID_ARGUMENT: field 'text' required	Missing YARA-L rule text in rules.create	Include the text field with a valid YARA-L rule
HTTP 429 Too Many Requests	Rate limit exceeded	The connector retries automatically; reduce call frequency if persistent
HTTP 500 or INTERNAL	Transient Google SecOps API error	Retry after a short delay; check the Google SecOps status page
failed to parse service account JSON	serviceAccountJson field content is invalid	Ensure the full JSON is pasted, not just a path or partial content
Connection timeout	Network issue or Google SecOps API overloaded	All requests have a 90-second timeout; check connectivity and retry
RESOURCE_EXHAUSTED	Quota exceeded	Request a quota increase via Google Cloud Console
INVALID_ARGUMENT on rule text	YARA-L syntax error	Validate the rule text using the Google SecOps Rule Editor before submitting via API

Verifying Credentials Manually

SA_JSON='<paste service account JSON>'
TOKEN=$(python3 -c "
import json, time
import urllib.request, urllib.parse

sa = json.loads('''$SA_JSON''')
# Use oauth2client or google-auth to obtain a token
print('Use google-auth library or gcloud auth')
")

curl -s -H "Authorization: Bearer $(gcloud auth print-access-token)" \
  "https://eu-chronicle.googleapis.com/v1/projects/MY_PROJECT/locations/eu/instances/MY_INSTANCE/rules?pageSize=1"

Running the Integration Tests

export CHRONICLE_SERVICE_ACCOUNT_JSON="$(cat sa-key.json)"
export CHRONICLE_REGION=eu
export CHRONICLE_PROJECT=my-project-123
export CHRONICLE_LOCATION=eu
export CHRONICLE_INSTANCE=fca7f167-b9d1-43b1-9d03-0257d31dcb63

go test -v -count=1 -timeout 120s ./internal/integrations/chronicle-detections/...

Generating an Evidence Report

./scripts/generate-evidence.sh chronicle-detections

The report is written to evidence/chronicle-detections/<date>-chronicle-detections-report.md.

---

Support

When reporting issues with the Google SecOps Detections connector, include:

• The resource and operation name (e.g. rules.list)
• The full error message returned
• The Google SecOps region, project, and instance (never share the service account JSON)
• Whether the error is consistent or intermittent

Reference documentation:

• Google SecOps Detection Engine API
• Google SecOps Content Hub API
• Google SecOps IAM roles
• Service Account Key Management

Updated: 2026-07-27