Google SecOps Events Integration Guide

Overview

The Google SecOps Events connector allows NINA to interact with the Google SecOps Events, Log Management, and Ingestion APIs. It covers the full surface of UDM event retrieval and enrichment, log type and parser management, raw log ingestion, feed configuration, forwarder and collector management, data taps, and webhook ingestion endpoints.

Capabilities

Category	Resources	Operations
Events	UDM Events, Search Sessions, Saved Search Queries	Retrieve, enrich, import UDM events; list search session results; CRUD saved queries; manage IAM policies
Log Management	Log Types, Log Type Settings, Log Type Analysis Reports, Log Processing Pipelines	CRUD log types; get/update settings; list analysis reports; manage pipelines; run analysis
Parsers	Parsers, Parser Extensions, Parser Analysis Reports, Parser Validation Reports, Parser Parsing Errors, Extension Validation Reports, Extension Parsing Errors, Parser Extension Validation Reports	Full parser lifecycle: create, activate, deactivate, copy, run analysis, validate, list errors
Raw Logs	Raw Logs	Import and list raw log entries per log type; classify log entries
Ingestion	Feeds, Feed Packs, Feed Service Accounts, Feed Source Type Schemas, Data Taps, Ingestion Log Labels, Ingestion Log Namespaces	Manage ingestion feeds; browse feed packs and schemas; manage data taps; list labels and namespaces
Infrastructure	Forwarders, Collectors, Webhooks	Manage on-premises forwarders and their collectors; create and monitor webhook ingestion endpoints

API Versions

Resource group	API version
events, logTypes, logTypeSettings, logs, parserExtensions, extensionValidationReports, extensionParsingErrors, parserExtensionValidationReports, parsers, parserValidationReports, parserParsingErrors, feeds, feedPacks, feedServiceAccounts, feedSourceTypeSchemas, ingestionLogLabels, ingestionLogNamespaces, searchQueries, forwarders (import stats)	v1
searchSessions, logProcessingPipelines, logTypes (runAnalysis, search), logTypeAnalysisReports, logs (classify), parsers (runAnalysis), parserAnalysisReports, dataTaps, feeds (create, update, scheduleTransfer), forwarders, collectors, webhooks	v1alpha

Both v1 and v1alpha operations share the same service account credential and instance resource path.

Authentication Method

Google Cloud service account with a JSON key. The connector uses the golang.org/x/oauth2/google JWT flow to obtain short-lived OAuth2 access tokens automatically. No user interaction is required.

How Authentication Works

1. The connector reads the service account JSON key from the serviceAccountJson credential field.
2. It calls google.JWTConfigFromJSON to parse the key and requests the scope https://www.googleapis.com/auth/cloud-platform.
3. An OAuth2 HTTP client is created; it fetches and caches access tokens, refreshing them before they expire.
4. Every API request carries a Bearer <token> Authorization header added transparently by the HTTP client.

---

Credential Configuration

Google SecOps API Regions

region value	API base URL	Geography
us	https://us-chronicle.googleapis.com	United States
eu	https://eu-chronicle.googleapis.com	Europe
asia-southeast1	https://asia-southeast1-chronicle.googleapis.com	Singapore
asia-south1	https://asia-south1-chronicle.googleapis.com	India
northamerica-northeast2	https://northamerica-northeast2-chronicle.googleapis.com	Canada
me-west1	https://me-west1-chronicle.googleapis.com	Middle East

Note: region and location are different fields. region is the API hostname prefix (e.g. eu). location is the GCP resource location used in the resource path (e.g. europe-west2 or eu). For most instances these share the same short value, but they can differ.

Credential Fields

Field	Type	Required	Description	Example
serviceAccountJson	string	Yes	Complete Google service account JSON key — paste the entire file content	{ "type": "service_account", ... }
region	string	Yes	Google SecOps API region prefix used to build the base URL	eu
project	string	Yes	GCP project ID	my-project-123
location	string	Yes	GCP location for the Google SecOps instance resource path	eu or europe-west2
instance	string	Yes	Google SecOps instance UUID	fca7f167-b9d1-43b1-9d03-0257d31dcb63

Where to find these values:

• project — GCP Console → top navigation bar → project selector → project ID.
• location — Google SecOps Console → Settings → Instance details → Location.
• instance — Google SecOps Console → Settings → Instance details → Instance ID.
• region — Google SecOps Console → Settings → Instance details → Region (use the short prefix, e.g. eu).

Required IAM Permissions

Assign these predefined Google SecOps IAM roles on the GCP project to the service account:

Role	Required for
roles/chronicle.viewer	All read-only operations (list, get, fetch, batchGet)
roles/chronicle.editor	Write operations (create, update, patch, import, activate, deactivate, enable, disable)
roles/chronicle.admin	Administrative operations (delete, revoke, batch modifications)

Least-privilege recommendation: grant chronicle.viewer for read-only ingestion monitoring workflows. Grant chronicle.editor for parser and feed management. Grant chronicle.admin only when forwarder deletion or webhook URL revocation is required.

Additionally, the service account needs the following GCP platform-level permissions:

Permission	Required for
iam.serviceAccounts.actAs	If the service account needs to impersonate another SA for feed ingestion
resourcemanager.projects.get	Reading project metadata

How to Obtain a Service Account Key

1. Open GCP Console → IAM & Admin → Service Accounts.
2. Click Create Service Account. Use a descriptive name such as nina-chronicle-events.
3. Grant the service account the Google SecOps IAM roles listed above on the GCP project.
4. Click the service account → Keys tab → Add Key → Create new key → JSON.
5. Save the downloaded JSON file. Paste its entire content as the serviceAccountJson credential value.

Security note: The JSON key is a long-lived credential. Store it using NINA's secure credential vault and never commit it to source control. Rotate keys periodically following your organisation's key management policy.

Shared Credential with Other Google SecOps Connectors

The chronicle-events credential uses the same five fields and the same service account as chronicle-instances, chronicle-cases, chronicle-soar, and chronicle-detections. A single service account configured with the appropriate IAM roles can be reused across all Google SecOps connectors.

Creating a Google SecOps Events Credential in NINA

1. Navigate to the Credentials section in NINA.
2. Click Add New Credential.
3. Select Google SecOps Events as the integration.
4. Fill in the five fields described in the table above.
5. Click Test Connection to validate the credentials against the live API.
6. Click Save.

---

API URL and Resource Path Structure

All operations are scoped to a Google SecOps instance. The connector builds URLs in the following pattern:

https://{region}-chronicle.googleapis.com
  /{apiVersion}/projects/{project}/locations/{location}/instances/{instance}
  /{resource}[/{subresource}][:{action}]

Examples:

Operation	Resolved URL
List log types	GET https://eu-chronicle.googleapis.com/v1/projects/my-project/locations/eu/instances/{uuid}/logTypes
Import UDM events	POST https://eu-chronicle.googleapis.com/v1/projects/my-project/locations/eu/instances/{uuid}/events:import
List pipelines	GET https://eu-chronicle.googleapis.com/v1alpha/projects/my-project/locations/eu/instances/{uuid}/logProcessingPipelines
Create webhook	POST https://eu-chronicle.googleapis.com/v1alpha/projects/my-project/locations/eu/instances/{uuid}/webhooks
List collectors	GET https://eu-chronicle.googleapis.com/v1alpha/projects/my-project/locations/eu/instances/{uuid}/forwarders/{id}/collectors

---

Rate Limits and Quotas

The Google SecOps API enforces per-project rate limits. The connector handles these automatically:

• On HTTP 429 Too Many Requests: retries up to 3 times with exponential back-off (1 s → 2 s → 4 s).
• If a Retry-After header is present in the response, that duration is used instead of the default back-off.
• All requests time out after 90 seconds.
• If the quota is persistently exceeded, contact Google Cloud support to request a limit increase.

---

Supported Operations

Resources Overview

Resource	Operations	Description
events	batchGet, get, fetchEnrichedEvent, import	Retrieve and import UDM events
searchSessions	listSearchedResults	List results from an existing search session
searchQueries	create, delete, get, list, update, getIamPolicy, setIamPolicy	Manage and share saved search queries
logProcessingPipelines	associateStreams, create, delete, dissociateStreams, fetchAssociatedPipeline, fetchSampleLogsByStreams, get, list, testPipeline, update	Full lifecycle management of log processing pipelines
logTypes	create, generateEventTypesSuggestions, getLogTypeSetting, legacySubmitParserExtension, list, runParser, runAnalysis, search, updateLogTypeSetting	Manage built-in and custom log types
logTypeSettings	list	List log type settings across the instance
logTypeAnalysisReports	get, list	Retrieve analysis reports for log types
logs	import, list, classify	Import raw logs, list entries, and classify unknown logs
parserExtensions	activate, create, delete, get, list	Manage custom CBN parser extensions
extensionValidationReports	get, list, listValidationErrors	Browse parser extension validation results
extensionParsingErrors	list	List parsing errors from extension validation
parserExtensionValidationReports	get	Get summary validation report for a parser extension
parsers	activate, activateReleaseCandidateParser, copy, create, deactivate, delete, fetchParserCandidates, get, list, runAnalysis, update	Full lifecycle management of CBN parsers
parserAnalysisReports	get, list	Retrieve analysis reports for parsers
parserValidationReports	get	Get the validation report for a parser
parserParsingErrors	list	List parsing errors from parser validation
dataTaps	create, delete, get, list, update	Manage data taps that capture and route log data
feedPacks	get, list	Browse bundled feed packs
feedServiceAccounts	fetchServiceAccountForCustomer	Get service account details used for feed customer authentication
feedSourceTypeSchemas	list, listLogTypeSchemas	Browse available feed source type schemas
feeds	create, delete, disable, enable, generateSecret, get, importPushLogs, list, scheduleTransfer, update	Full lifecycle management of ingestion feeds
forwarders	create, delete, generateForwarderFiles, get, importStatsEvents, list, update	Manage on-premises Google SecOps forwarders
collectors	create, delete, get, list, update	Manage log collectors attached to forwarders
ingestionLogLabels	list	List labels used in the ingestion pipeline
ingestionLogNamespaces	list	List namespaces used in the ingestion pipeline
webhooks	create, delete, exportLogs, get, getLogs, getStatistics, list, revokeUrl, update, webhookIngestion	Manage and use webhook ingestion endpoints

---

Operation Details

events

UDM events are the normalised records stored in Google SecOps. All event operations use API version v1.

events.batchGet

Retrieve multiple UDM events in a single request.

• HTTP Method: GET
• API Version: v1
• Path: /v1/projects/{project}/locations/{location}/instances/{instance}/events:batchGet

Parameter	Type	Required	Description
ids	string	Yes	Comma-separated list of event IDs to retrieve

events.get

Retrieve a single UDM event by resource name.

• HTTP Method: GET
• API Version: v1
• Path: /v1/projects/{project}/locations/{location}/instances/{instance}/events/{name}

Parameter	Type	Required	Description
name	string	Yes	Resource name of the event

events.fetchEnrichedEvent

Retrieve a UDM event with additional enrichment data (entity context, threat intelligence).

• HTTP Method: GET
• API Version: v1
• Path: /v1/projects/{project}/locations/{location}/instances/{instance}/events:fetchEnrichedEvent

Parameter	Type	Required	Description
id	string	Yes	ID of the event to fetch with enrichment

events.import

Import UDM events directly into the Google SecOps instance.

• HTTP Method: POST
• API Version: v1
• Path: /v1/projects/{project}/locations/{location}/instances/{instance}/events:import

Parameter	Type	Required	Description
inlineSource	object	No	Inline source object containing the UDM events to import

---

searchSessions

Search sessions represent asynchronous UDM Search executions. Results are paged separately.

searchSessions.listSearchedResults

List results from an existing search session.

• HTTP Method: GET
• API Version: v1alpha
• Path: /v1alpha/projects/{project}/locations/{location}/instances/{instance}/searchSessions/{id}/searchedResults

Parameter	Type	Required	Description
name	string	Yes	Resource name of the search session
pageSize	number	No	Maximum number of results to return
pageToken	string	No	Pagination token from a previous response

---

searchQueries

Saved search queries are user-scoped UDM query strings that can be shared via IAM policies.

searchQueries.create

Save a new UDM search query for the current user.

• HTTP Method: POST
• API Version: v1
• Path: /v1/projects/{project}/locations/{location}/instances/{instance}/users/{userId}/searchQueries

Parameter	Type	Required	Description
displayName	string	Yes	Display name for the search query
query	string	Yes	The UDM search query string
description	string	No	Description of the search query

searchQueries.delete

Delete a saved search query.

• HTTP Method: DELETE
• API Version: v1
• Path: /v1/projects/{project}/locations/{location}/instances/{instance}/users/{userId}/searchQueries/{id}

Parameter	Type	Required	Description
name	string	Yes	Resource name of the search query to delete

searchQueries.get

Retrieve a specific saved search query.

• HTTP Method: GET
• API Version: v1
• Path: /v1/projects/{project}/locations/{location}/instances/{instance}/users/{userId}/searchQueries/{id}

Parameter	Type	Required	Description
name	string	Yes	Resource name of the search query

searchQueries.list

List all saved search queries for a user.

• HTTP Method: GET
• API Version: v1
• Path: /v1/projects/{project}/locations/{location}/instances/{instance}/users/{userId}/searchQueries

Parameter	Type	Required	Description
parent	string	No	Parent resource path (e.g. users/{userId})
pageSize	number	No	Maximum number of results to return
pageToken	string	No	Pagination token from a previous response

Known limitation: This endpoint returns HTTP 404 on some Google SecOps tiers. Verify availability on your Google SecOps subscription.

searchQueries.update

Update an existing saved search query.

• HTTP Method: PATCH
• API Version: v1
• Path: /v1/projects/{project}/locations/{location}/instances/{instance}/users/{userId}/searchQueries/{id}

Parameter	Type	Required	Description
name	string	Yes	Resource name of the search query
displayName	string	No	New display name
query	string	No	New query string
updateMask	string	No	Comma-separated list of fields to update

searchQueries.getIamPolicy

Retrieve the IAM policy for a saved search query.

• HTTP Method: GET
• API Version: v1alpha
• Path: /v1alpha/projects/{project}/locations/{location}/instances/{instance}/users/{userId}/searchQueries/{id}:getIamPolicy

Parameter	Type	Required	Description
resource	string	Yes	Resource name of the search query

searchQueries.setIamPolicy

Set the IAM policy for a saved search query (used to share queries with other users).

• HTTP Method: POST
• API Version: v1alpha
• Path: /v1alpha/projects/{project}/locations/{location}/instances/{instance}/users/{userId}/searchQueries/{id}:setIamPolicy

Parameter	Type	Required	Description
resource	string	Yes	Resource name of the search query
policy	object	Yes	IAM policy object

---

logProcessingPipelines

Log processing pipelines define transformation and routing rules applied to ingested log streams before they are parsed.

logProcessingPipelines.associateStreams

Associate log streams with a processing pipeline.

• HTTP Method: POST
• API Version: v1alpha
• Path: /v1alpha/.../logProcessingPipelines/{id}:associateStreams

Parameter	Type	Required	Description
name	string	Yes	Resource name of the pipeline
streams	array	Yes	List of stream resource names to associate

logProcessingPipelines.create

Create a new log processing pipeline.

• HTTP Method: POST
• API Version: v1alpha
• Path: /v1alpha/.../logProcessingPipelines

Parameter	Type	Required	Description
displayName	string	Yes	Display name for the pipeline
config	object	No	Pipeline configuration

logProcessingPipelines.delete

Delete a log processing pipeline.

• HTTP Method: DELETE
• API Version: v1alpha
• Path: /v1alpha/.../logProcessingPipelines/{id}

Parameter	Type	Required	Description
name	string	Yes	Resource name of the pipeline

logProcessingPipelines.dissociateStreams

Remove stream associations from a processing pipeline.

• HTTP Method: POST
• API Version: v1alpha
• Path: /v1alpha/.../logProcessingPipelines/{id}:dissociateStreams

Parameter	Type	Required	Description
name	string	Yes	Resource name of the pipeline
streams	array	Yes	List of stream resource names to dissociate

logProcessingPipelines.fetchAssociatedPipeline

Fetch the pipeline currently associated with a log stream.

• HTTP Method: GET
• API Version: v1alpha
• Path: /v1alpha/.../logProcessingPipelines:fetchAssociatedPipeline

Parameter	Type	Required	Description
stream	string	Yes	Resource name of the log stream

logProcessingPipelines.fetchSampleLogsByStreams

Fetch sample log entries for specified streams to preview pipeline transformations.

• HTTP Method: GET
• API Version: v1alpha
• Path: /v1alpha/.../logProcessingPipelines:fetchSampleLogsByStreams

Parameter	Type	Required	Description
streams	string	Yes	Comma-separated list of stream resource names
maxLogs	number	No	Maximum number of sample logs to return

logProcessingPipelines.get

Retrieve a specific log processing pipeline.

• HTTP Method: GET
• API Version: v1alpha
• Path: /v1alpha/.../logProcessingPipelines/{id}

Parameter	Type	Required	Description
name	string	Yes	Resource name of the pipeline

logProcessingPipelines.list

List all log processing pipelines.

• HTTP Method: GET
• API Version: v1alpha
• Path: /v1alpha/.../logProcessingPipelines

Parameter	Type	Required	Description
pageSize	number	No	Maximum number of results to return
pageToken	string	No	Pagination token from a previous response

logProcessingPipelines.testPipeline

Test a pipeline configuration against sample log entries without committing changes.

• HTTP Method: POST
• API Version: v1alpha
• Path: /v1alpha/.../logProcessingPipelines/{id}:testPipeline

Parameter	Type	Required	Description
name	string	Yes	Resource name of the pipeline
sampleLogs	array	No	Sample log entries to test

logProcessingPipelines.update

Update an existing log processing pipeline.

• HTTP Method: PATCH
• API Version: v1alpha
• Path: /v1alpha/.../logProcessingPipelines/{id}

Parameter	Type	Required	Description
name	string	Yes	Resource name of the pipeline
config	object	No	Updated pipeline configuration
updateMask	string	No	Comma-separated list of fields to update

---

logTypes

Log types define how Google SecOps ingests and parses a category of logs. Includes built-in types (e.g. WINDOWS_DNS) and custom types.

logTypes.create

Create a new custom log type.

• HTTP Method: POST
• API Version: v1
• Path: /v1/.../logTypes

Parameter	Type	Required	Description
logType	string	Yes	Identifier for the new log type
displayName	string	No	Display name for the log type
description	string	No	Description of the log type

logTypes.generateEventTypesSuggestions

Generate UDM event type suggestions for a log type based on sample log entries.

• HTTP Method: POST
• API Version: v1
• Path: /v1/.../logTypes:generateEventTypesSuggestions

Parameter	Type	Required	Description
logTypeId	string	Yes	ID of the log type
sampleLogs	array	No	Sample raw log entries

logTypes.getLogTypeSetting

Retrieve settings for a specific log type.

• HTTP Method: GET
• API Version: v1
• Path: /v1/.../logTypes:getLogTypeSetting

Parameter	Type	Required	Description
logTypeId	string	Yes	ID of the log type

Known limitation: Returns HTTP 404 on some Google SecOps tiers. Verify availability on your Google SecOps subscription.

logTypes.legacySubmitParserExtension

Submit a parser extension using the legacy submission endpoint.

• HTTP Method: POST
• API Version: v1
• Path: /v1/.../logTypes:legacySubmitParserExtension

Parameter	Type	Required	Description
logTypeId	string	Yes	ID of the log type
parserExtension	string	Yes	Parser extension content (CBN format)

logTypes.list

List all available log types in the Google SecOps instance.

• HTTP Method: GET
• API Version: v1
• Path: /v1/.../logTypes

Parameter	Type	Required	Description
pageSize	number	No	Maximum number of results to return
pageToken	string	No	Pagination token from a previous response
filter	string	No	Filter expression

logTypes.runParser

Run the log type parser against a sample raw log entry to preview parsing output.

• HTTP Method: POST
• API Version: v1
• Path: /v1/.../logTypes:runParser

Parameter	Type	Required	Description
logTypeId	string	Yes	ID of the log type
sampleLog	string	Yes	Raw log entry to parse

logTypes.runAnalysis

Run analysis on a log type to evaluate parser coverage and quality.

• HTTP Method: POST
• API Version: v1alpha
• Path: /v1alpha/.../logTypes:runAnalysis

Parameter	Type	Required	Description
logTypeId	string	Yes	ID of the log type

logTypes.search

Search for log types matching specific criteria.

• HTTP Method: POST
• API Version: v1alpha
• Path: /v1alpha/.../logTypes:search

Parameter	Type	Required	Description
query	string	No	Search query string
pageSize	number	No	Maximum number of results to return
pageToken	string	No	Pagination token from a previous response

logTypes.updateLogTypeSetting

Update settings for a specific log type.

• HTTP Method: PATCH
• API Version: v1
• Path: /v1/.../logTypes:updateLogTypeSetting

Parameter	Type	Required	Description
logTypeId	string	Yes	ID of the log type
setting	object	Yes	Updated log type setting object
updateMask	string	No	Comma-separated list of fields to update

---

logTypeSettings

logTypeSettings.list

List settings for all log types in the Google SecOps instance.

• HTTP Method: GET
• API Version: v1
• Path: /v1/.../logTypes/logTypeSettings

Parameter	Type	Required	Description
pageSize	number	No	Maximum number of results to return
pageToken	string	No	Pagination token from a previous response

Known limitation: Returns HTTP 404 on some Google SecOps tiers. Verify availability on your Google SecOps subscription.

---

logTypeAnalysisReports

Analysis reports are generated asynchronously after calling logTypes.runAnalysis.

logTypeAnalysisReports.get

Retrieve a specific log type analysis report.

• HTTP Method: GET
• API Version: v1alpha
• Path: /v1alpha/.../logTypes/{logTypeId}/analysisReports/{reportId}

Parameter	Type	Required	Description
name	string	Yes	Resource name of the analysis report

logTypeAnalysisReports.list

List analysis reports for a log type.

• HTTP Method: GET
• API Version: v1alpha
• Path: /v1alpha/.../logTypes/{logTypeId}/analysisReports

Parameter	Type	Required	Description
parent	string	Yes	Resource name of the log type
pageSize	number	No	Maximum number of results to return
pageToken	string	No	Pagination token from a previous response

---

logs

Raw log operations allow direct import and retrieval of unprocessed log entries associated with a specific log type.

logs.import

Import raw log entries for a specific log type.

• HTTP Method: POST
• API Version: v1
• Path: /v1/.../logTypes/{logTypeId}/logs:import

Parameter	Type	Required	Description
logType	string	Yes	ID of the log type
entries	array	Yes	List of raw log entry strings

logs.list

List raw log entries for a specific log type within a time window.

• HTTP Method: GET
• API Version: v1
• Path: /v1/.../logTypes/{logTypeId}/logs

Parameter	Type	Required	Description
logType	string	Yes	ID of the log type
startTime	string	No	Start of the time range (RFC3339 format, e.g. 2024-01-01T00:00:00Z)
endTime	string	No	End of the time range (RFC3339 format)
pageSize	number	No	Maximum number of results to return
pageToken	string	No	Pagination token from a previous response

logs.classify

Classify raw log entries to automatically determine their log type.

• HTTP Method: POST
• API Version: v1alpha
• Path: /v1alpha/.../logs:classify

Parameter	Type	Required	Description
entries	array	Yes	List of raw log entry strings to classify

---

parserExtensions

Parser extensions supplement built-in parsers with custom Google SecOps Border Network (CBN) parsing logic.

parserExtensions.activate

Activate a parser extension for a log type.

• HTTP Method: POST
• API Version: v1
• Path: /v1/.../logTypes/{logTypeId}/parserExtensions/{id}:activate

Parameter	Type	Required	Description
name	string	Yes	Resource name of the parser extension

parserExtensions.create

Create a new parser extension for a log type.

• HTTP Method: POST
• API Version: v1
• Path: /v1/.../logTypes/{logTypeId}/parserExtensions

Parameter	Type	Required	Description
logTypeId	string	Yes	ID of the log type
parserExtension	string	Yes	Parser extension content in CBN format

parserExtensions.delete

Delete a parser extension.

• HTTP Method: DELETE
• API Version: v1
• Path: /v1/.../logTypes/{logTypeId}/parserExtensions/{id}

Parameter	Type	Required	Description
name	string	Yes	Resource name of the parser extension

parserExtensions.get

Retrieve a specific parser extension.

• HTTP Method: GET
• API Version: v1
• Path: /v1/.../logTypes/{logTypeId}/parserExtensions/{id}

Parameter	Type	Required	Description
name	string	Yes	Resource name of the parser extension

parserExtensions.list

List all parser extensions for a log type.

• HTTP Method: GET
• API Version: v1
• Path: /v1/.../logTypes/{logTypeId}/parserExtensions

Parameter	Type	Required	Description
parent	string	Yes	Resource name of the log type
pageSize	number	No	Maximum number of results to return
pageToken	string	No	Pagination token from a previous response

---

extensionValidationReports

Validation reports are generated when a parser extension is submitted or activated.

extensionValidationReports.get

Retrieve a specific extension validation report.

• HTTP Method: GET
• API Version: v1
• Path: /v1/.../logTypes/{logTypeId}/parserExtensions/{extId}/extensionValidationReports/{reportId}

Parameter	Type	Required	Description
name	string	Yes	Resource name of the validation report

extensionValidationReports.list

List validation reports for a parser extension.

• HTTP Method: GET
• API Version: v1
• Path: /v1/.../logTypes/{logTypeId}/parserExtensions/{extId}/extensionValidationReports

Parameter	Type	Required	Description
parent	string	Yes	Resource name of the parser extension
pageSize	number	No	Maximum number of results to return
pageToken	string	No	Pagination token from a previous response

extensionValidationReports.listValidationErrors

List individual validation errors from a specific extension validation report.

• HTTP Method: GET
• API Version: v1
• Path: /v1/.../logTypes/{logTypeId}/parserExtensions/{extId}/extensionValidationReports/{reportId}/validationErrors

Parameter	Type	Required	Description
parent	string	Yes	Resource name of the validation report
pageSize	number	No	Maximum number of results to return
pageToken	string	No	Pagination token from a previous response

---

extensionParsingErrors

extensionParsingErrors.list

List parsing errors from a parser extension validation report.

• HTTP Method: GET
• API Version: v1
• Path: /v1/.../logTypes/{logTypeId}/parserExtensions/{extId}/validationReports/{reportId}/parsingErrors

Parameter	Type	Required	Description
parent	string	Yes	Resource name of the validation report
pageSize	number	No	Maximum number of results to return
pageToken	string	No	Pagination token from a previous response

---

parserExtensionValidationReports

parserExtensionValidationReports.get

Retrieve the summary validation report for a parser extension.

• HTTP Method: GET
• API Version: v1
• Path: /v1/.../logTypes/{logTypeId}/parserExtensions/{extId}/validationReports/{reportId}

Parameter	Type	Required	Description
name	string	Yes	Resource name of the validation report

---

parsers

Parsers convert raw log entries into Google SecOps UDM events using CBN (Google SecOps Border Network) rules.

parsers.activate

Activate a custom parser for a log type.

• HTTP Method: POST
• API Version: v1
• Path: /v1/.../logTypes/{logTypeId}/parsers/{id}:activate

Parameter	Type	Required	Description
name	string	Yes	Resource name of the parser

parsers.activateReleaseCandidateParser

Promote the release candidate parser to active for a log type.

• HTTP Method: POST
• API Version: v1
• Path: /v1/.../logTypes/{logTypeId}/parsers:activateReleaseCandidateParser

Parameter	Type	Required	Description
logTypeId	string	Yes	ID of the log type

parsers.copy

Copy an existing parser to create a new one, optionally targeting a different log type.

• HTTP Method: POST
• API Version: v1
• Path: /v1/.../logTypes/{logTypeId}/parsers/{id}:copy

Parameter	Type	Required	Description
name	string	Yes	Resource name of the parser to copy
targetLogTypeId	string	No	Target log type ID for the copied parser

parsers.create

Create a new custom parser for a log type.

• HTTP Method: POST
• API Version: v1
• Path: /v1/.../logTypes/{logTypeId}/parsers

Parameter	Type	Required	Description
logTypeId	string	Yes	ID of the log type
text	string	Yes	Parser content in CBN format

parsers.deactivate

Deactivate an active custom parser (reverts to the default Google SecOps parser).

• HTTP Method: POST
• API Version: v1
• Path: /v1/.../logTypes/{logTypeId}/parsers/{id}:deactivate

Parameter	Type	Required	Description
name	string	Yes	Resource name of the parser

parsers.delete

Delete a custom parser.

• HTTP Method: DELETE
• API Version: v1
• Path: /v1/.../logTypes/{logTypeId}/parsers/{id}

Parameter	Type	Required	Description
name	string	Yes	Resource name of the parser

parsers.fetchParserCandidates

Fetch candidate parsers suggested for a log type.

• HTTP Method: GET
• API Version: v1
• Path: /v1/.../logTypes/{logTypeId}/parsers:fetchParserCandidates

Parameter	Type	Required	Description
logTypeId	string	Yes	ID of the log type

parsers.get

Retrieve a specific parser.

• HTTP Method: GET
• API Version: v1
• Path: /v1/.../logTypes/{logTypeId}/parsers/{id}

Parameter	Type	Required	Description
name	string	Yes	Resource name of the parser

parsers.list

List all parsers for a log type.

• HTTP Method: GET
• API Version: v1
• Path: /v1/.../logTypes/{logTypeId}/parsers

Parameter	Type	Required	Description
parent	string	Yes	Resource name of the log type
pageSize	number	No	Maximum number of results to return
pageToken	string	No	Pagination token from a previous response

Known limitation: Requires a valid log type resource path segment. Returns HTTP 404 if the log type ID is not provided correctly.

parsers.runAnalysis

Run analysis on a parser to evaluate its quality and coverage.

• HTTP Method: POST
• API Version: v1alpha
• Path: /v1alpha/.../logTypes/{logTypeId}/parsers/{id}:runAnalysis

Parameter	Type	Required	Description
name	string	Yes	Resource name of the parser

parsers.update

Update an existing parser's content.

• HTTP Method: PATCH
• API Version: v1
• Path: /v1/.../logTypes/{logTypeId}/parsers/{id}

Parameter	Type	Required	Description
name	string	Yes	Resource name of the parser
text	string	No	Updated parser content (CBN format)
updateMask	string	No	Comma-separated list of fields to update

---

parserAnalysisReports

parserAnalysisReports.get

Retrieve a specific parser analysis report.

• HTTP Method: GET
• API Version: v1alpha
• Path: /v1alpha/.../logTypes/{logTypeId}/parsers/{parserId}/analysisReports/{reportId}

Parameter	Type	Required	Description
name	string	Yes	Resource name of the analysis report

parserAnalysisReports.list

List analysis reports for a parser.

• HTTP Method: GET
• API Version: v1alpha
• Path: /v1alpha/.../logTypes/{logTypeId}/parsers/{parserId}/analysisReports

Parameter	Type	Required	Description
parent	string	Yes	Resource name of the parser
pageSize	number	No	Maximum number of results to return
pageToken	string	No	Pagination token from a previous response

---

parserValidationReports

parserValidationReports.get

Retrieve the validation report for a parser.

• HTTP Method: GET
• API Version: v1
• Path: /v1/.../logTypes/{logTypeId}/parsers/{parserId}/validationReports/{reportId}

Parameter	Type	Required	Description
name	string	Yes	Resource name of the validation report

---

parserParsingErrors

parserParsingErrors.list

List parsing errors from a parser validation report.

• HTTP Method: GET
• API Version: v1
• Path: /v1/.../logTypes/{logTypeId}/parsers/{parserId}/validationReports/{reportId}/parsingErrors

Parameter	Type	Required	Description
parent	string	Yes	Resource name of the validation report
pageSize	number	No	Maximum number of results to return
pageToken	string	No	Pagination token from a previous response

---

dataTaps

Data taps capture log data at a specific point in the ingestion pipeline and route it to an alternate destination.

dataTaps.create

Create a new data tap.

• HTTP Method: POST
• API Version: v1alpha
• Path: /v1alpha/.../dataTaps

Parameter	Type	Required	Description
displayName	string	Yes	Display name for the data tap
config	object	No	Data tap configuration

dataTaps.delete

Delete a data tap.

• HTTP Method: DELETE
• API Version: v1alpha
• Path: /v1alpha/.../dataTaps/{id}

Parameter	Type	Required	Description
name	string	Yes	Resource name of the data tap

dataTaps.get

Retrieve a specific data tap.

• HTTP Method: GET
• API Version: v1alpha
• Path: /v1alpha/.../dataTaps/{id}

Parameter	Type	Required	Description
name	string	Yes	Resource name of the data tap

dataTaps.list

List all data taps.

• HTTP Method: GET
• API Version: v1alpha
• Path: /v1alpha/.../dataTaps

Parameter	Type	Required	Description
pageSize	number	No	Maximum number of results to return
pageToken	string	No	Pagination token from a previous response

dataTaps.update

Update an existing data tap.

• HTTP Method: PATCH
• API Version: v1alpha
• Path: /v1alpha/.../dataTaps/{id}

Parameter	Type	Required	Description
name	string	Yes	Resource name of the data tap
config	object	No	Updated data tap configuration
updateMask	string	No	Comma-separated list of fields to update

---

feedPacks

Feed packs are curated bundles of pre-configured feeds. They are read-only in the API; you browse them and then deploy individual feeds from a pack.

feedPacks.get

Retrieve a specific feed pack.

• HTTP Method: GET
• API Version: v1
• Path: /v1/.../feedPacks/{id}

Parameter	Type	Required	Description
name	string	Yes	Resource name of the feed pack

feedPacks.list

List all available feed packs.

• HTTP Method: GET
• API Version: v1
• Path: /v1/.../feedPacks

Parameter	Type	Required	Description
pageSize	number	No	Maximum number of results to return
pageToken	string	No	Pagination token from a previous response

---

feedServiceAccounts

feedServiceAccounts.fetchServiceAccountForCustomer

Fetch the service account details used for feed customer authentication. This is the SA that Google SecOps uses to pull data from external sources on your behalf; grant it read access to your data source (e.g. S3 bucket, GCS bucket).

• HTTP Method: GET
• API Version: v1
• Path: /v1/.../feedServiceAccounts:fetchServiceAccountForCustomer

No parameters required.

---

feedSourceTypeSchemas

Feed source type schemas describe the configuration fields available for each Google SecOps feed type.

feedSourceTypeSchemas.list

List all available feed source type schemas.

• HTTP Method: GET
• API Version: v1
• Path: /v1/.../feedSourceTypeSchemas

Parameter	Type	Required	Description
pageSize	number	No	Maximum number of results to return
pageToken	string	No	Pagination token from a previous response

feedSourceTypeSchemas.listLogTypeSchemas

List log type schemas for a specific feed source type.

• HTTP Method: GET
• API Version: v1
• Path: /v1/.../feedSourceTypeSchemas/{sourceTypeId}/logTypeSchemas

Parameter	Type	Required	Description
parent	string	Yes	Resource name of the feed source type schema
pageSize	number	No	Maximum number of results to return
pageToken	string	No	Pagination token from a previous response

---

feeds

Feeds are configured pull or push ingestion channels. Google SecOps polls external sources (cloud storage, APIs, SIEMs) or receives pushed data on a schedule.

feeds.create

Create a new ingestion feed.

• HTTP Method: POST
• API Version: v1alpha
• Path: /v1alpha/.../feeds

Parameter	Type	Required	Description
displayName	string	Yes	Display name for the feed
feedSourceType	string	Yes	Source type identifier (use feedSourceTypeSchemas.list to discover values)
config	object	No	Feed configuration object — structure depends on feedSourceType

feeds.delete

Delete an ingestion feed.

• HTTP Method: DELETE
• API Version: v1
• Path: /v1/.../feeds/{id}

Parameter	Type	Required	Description
name	string	Yes	Resource name of the feed

feeds.disable

Disable an active feed without deleting it.

• HTTP Method: DELETE
• API Version: v1
• Path: /v1/.../feeds/{id}:disable

Parameter	Type	Required	Description
name	string	Yes	Resource name of the feed

feeds.enable

Enable a previously disabled feed.

• HTTP Method: POST
• API Version: v1
• Path: /v1/.../feeds/{id}:enable

Parameter	Type	Required	Description
name	string	Yes	Resource name of the feed

feeds.generateSecret

Generate a new ingestion secret for a push-type feed. The secret is used by external systems to authenticate when pushing logs.

• HTTP Method: POST
• API Version: v1
• Path: /v1/.../feeds/{id}:generateSecret

Parameter	Type	Required	Description
name	string	Yes	Resource name of the feed

feeds.get

Retrieve a specific feed configuration.

• HTTP Method: GET
• API Version: v1
• Path: /v1/.../feeds/{id}

Parameter	Type	Required	Description
name	string	Yes	Resource name of the feed

feeds.importPushLogs

Push log data directly to Google SecOps through a push-type feed.

• HTTP Method: POST
• API Version: v1
• Path: /v1/.../feeds/{id}:importPushLogs

Parameter	Type	Required	Description
name	string	Yes	Resource name of the feed
logs	array	Yes	Log entries to import

feeds.list

List all ingestion feeds.

• HTTP Method: GET
• API Version: v1
• Path: /v1/.../feeds

Parameter	Type	Required	Description
pageSize	number	No	Maximum number of results to return
pageToken	string	No	Pagination token from a previous response

feeds.scheduleTransfer

Schedule a data transfer for a feed.

• HTTP Method: POST
• API Version: v1alpha
• Path: /v1alpha/.../feeds/{id}:scheduleTransfer

Parameter	Type	Required	Description
name	string	Yes	Resource name of the feed

feeds.update

Update the configuration of an existing feed.

• HTTP Method: PATCH
• API Version: v1alpha
• Path: /v1alpha/.../feeds/{id}

Parameter	Type	Required	Description
name	string	Yes	Resource name of the feed
config	object	No	Updated feed configuration
updateMask	string	No	Comma-separated list of fields to update

---

forwarders

Forwarders are Google SecOps software agents deployed on-premises or in cloud VMs that collect logs and relay them to Google SecOps.

forwarders.create

Create a new Google SecOps forwarder.

• HTTP Method: POST
• API Version: v1alpha
• Path: /v1alpha/.../forwarders

Parameter	Type	Required	Description
displayName	string	Yes	Display name for the forwarder
config	object	No	Forwarder configuration

forwarders.delete

Delete a forwarder.

• HTTP Method: DELETE
• API Version: v1alpha
• Path: /v1alpha/.../forwarders/{id}

Parameter	Type	Required	Description
name	string	Yes	Resource name of the forwarder

forwarders.generateForwarderFiles

Generate the configuration files (YAML/binary) needed to deploy a forwarder agent.

• HTTP Method: POST
• API Version: v1alpha
• Path: /v1alpha/.../forwarders/{id}:generateForwarderFiles

Parameter	Type	Required	Description
name	string	Yes	Resource name of the forwarder

forwarders.get

Retrieve a specific forwarder.

• HTTP Method: GET
• API Version: v1alpha
• Path: /v1alpha/.../forwarders/{id}

Parameter	Type	Required	Description
name	string	Yes	Resource name of the forwarder

forwarders.importStatsEvents

Import telemetry and stats events from a forwarder.

• HTTP Method: POST
• API Version: v1
• Path: /v1/.../forwarders/{id}:importStatsEvents

Parameter	Type	Required	Description
name	string	Yes	Resource name of the forwarder
events	array	Yes	Stats event entries

forwarders.list

List all forwarders.

• HTTP Method: GET
• API Version: v1alpha
• Path: /v1alpha/.../forwarders

Parameter	Type	Required	Description
pageSize	number	No	Maximum number of results to return
pageToken	string	No	Pagination token from a previous response

forwarders.update

Update an existing forwarder configuration.

• HTTP Method: PATCH
• API Version: v1alpha
• Path: /v1alpha/.../forwarders/{id}

Parameter	Type	Required	Description
name	string	Yes	Resource name of the forwarder
config	object	No	Updated forwarder configuration
updateMask	string	No	Comma-separated list of fields to update

---

collectors

Collectors are sub-resources of forwarders. Each collector defines a specific log source (syslog port, file path, Kafka topic, etc.) and its associated log type.

collectors.create

Create a new collector on a forwarder.

• HTTP Method: POST
• API Version: v1alpha
• Path: /v1alpha/.../forwarders/{forwarderId}/collectors

Parameter	Type	Required	Description
parent	string	Yes	Resource name of the parent forwarder
displayName	string	Yes	Display name for the collector
config	object	No	Collector configuration (source type, log type, port/path, etc.)

collectors.delete

Delete a collector from a forwarder.

• HTTP Method: DELETE
• API Version: v1alpha
• Path: /v1alpha/.../forwarders/{forwarderId}/collectors/{id}

Parameter	Type	Required	Description
name	string	Yes	Resource name of the collector

collectors.get

Retrieve a specific collector.

• HTTP Method: GET
• API Version: v1alpha
• Path: /v1alpha/.../forwarders/{forwarderId}/collectors/{id}

Parameter	Type	Required	Description
name	string	Yes	Resource name of the collector

collectors.list

List all collectors for a forwarder.

• HTTP Method: GET
• API Version: v1alpha
• Path: /v1alpha/.../forwarders/{forwarderId}/collectors

Parameter	Type	Required	Description
parent	string	Yes	Resource name of the parent forwarder
pageSize	number	No	Maximum number of results to return
pageToken	string	No	Pagination token from a previous response

collectors.update

Update an existing collector.

• HTTP Method: PATCH
• API Version: v1alpha
• Path: /v1alpha/.../forwarders/{forwarderId}/collectors/{id}

Parameter	Type	Required	Description
name	string	Yes	Resource name of the collector
config	object	No	Updated collector configuration
updateMask	string	No	Comma-separated list of fields to update

---

ingestionLogLabels

ingestionLogLabels.list

List all ingestion log labels used in the Google SecOps ingestion pipeline.

• HTTP Method: GET
• API Version: v1
• Path: /v1/.../ingestionLogLabels

Parameter	Type	Required	Description
pageSize	number	No	Maximum number of results to return
pageToken	string	No	Pagination token from a previous response

Known limitation: This endpoint rejects standard pageSize query parameters on some Google SecOps instances. Omit pageSize if you receive INVALID_ARGUMENT errors.

---

ingestionLogNamespaces

ingestionLogNamespaces.list

List all namespaces used in the Google SecOps ingestion pipeline.

• HTTP Method: GET
• API Version: v1
• Path: /v1/.../ingestionLogNamespaces

Parameter	Type	Required	Description
pageSize	number	No	Maximum number of results to return
pageToken	string	No	Pagination token from a previous response

---

webhooks

Webhooks provide push ingestion endpoints — external systems POST log data to a Google SecOps-hosted URL, and Google SecOps ingests it immediately.

webhooks.webhookIngestion

Send log data to Google SecOps via a webhook ingestion endpoint.

• HTTP Method: POST
• API Version: v1alpha
• Path: /v1alpha/.../webhooks/{id}:WebhookIngestion

Parameter	Type	Required	Description
name	string	Yes	Resource name of the webhook
data	string	Yes	Base64-encoded or raw log payload

webhooks.create

Create a new webhook ingestion endpoint.

• HTTP Method: POST
• API Version: v1alpha
• Path: /v1alpha/.../webhooks

Parameter	Type	Required	Description
displayName	string	Yes	Display name for the webhook
logType	string	No	Log type to associate with this webhook

webhooks.delete

Delete a webhook.

• HTTP Method: DELETE
• API Version: v1alpha
• Path: /v1alpha/.../webhooks/{id}

Parameter	Type	Required	Description
name	string	Yes	Resource name of the webhook

webhooks.exportLogs

Export logs received by a webhook to a destination.

• HTTP Method: POST
• API Version: v1alpha
• Path: /v1alpha/.../webhooks/{id}:exportLogs

Parameter	Type	Required	Description
name	string	Yes	Resource name of the webhook
startTime	string	No	Start of the time range (RFC3339 format)
endTime	string	No	End of the time range (RFC3339 format)

webhooks.get

Retrieve a specific webhook.

• HTTP Method: GET
• API Version: v1alpha
• Path: /v1alpha/.../webhooks/{id}

Parameter	Type	Required	Description
name	string	Yes	Resource name of the webhook

webhooks.getLogs

Retrieve recent log entries received by a webhook.

• HTTP Method: GET
• API Version: v1alpha
• Path: /v1alpha/.../webhooks/{id}:getLogs

Parameter	Type	Required	Description
name	string	Yes	Resource name of the webhook
pageSize	number	No	Maximum number of log entries to return
pageToken	string	No	Pagination token from a previous response

webhooks.getStatistics

Retrieve throughput and error rate statistics for a webhook.

• HTTP Method: GET
• API Version: v1alpha
• Path: /v1alpha/.../webhooks/{id}:getStatistics

Parameter	Type	Required	Description
name	string	Yes	Resource name of the webhook
startTime	string	No	Start of the time range (RFC3339 format)
endTime	string	No	End of the time range (RFC3339 format)

webhooks.list

List all webhook ingestion endpoints.

• HTTP Method: GET
• API Version: v1alpha
• Path: /v1alpha/.../webhooks

Parameter	Type	Required	Description
pageSize	number	No	Maximum number of results to return
pageToken	string	No	Pagination token from a previous response

webhooks.update

Update an existing webhook.

• HTTP Method: PATCH
• API Version: v1alpha
• Path: /v1alpha/.../webhooks/{id}

Parameter	Type	Required	Description
name	string	Yes	Resource name of the webhook
displayName	string	No	New display name
updateMask	string	No	Comma-separated list of fields to update

webhooks.revokeUrl

Revoke the current webhook ingestion URL and generate a new one. Use when the URL has been compromised.

• HTTP Method: POST
• API Version: v1alpha
• Path: /v1alpha/.../webhooks/{id}:revokeUrl

Parameter	Type	Required	Description
name	string	Yes	Resource name of the webhook

---

Known Limitations

The following operations are unavailable on some Google SecOps tiers or require specific resource IDs that are only available through upstream operations. They are implemented in the connector but will be skipped in automated evidence tests.

Operation	Limitation	Workaround
logTypes.getLogTypeSetting	Returns HTTP 404 on instances that do not have per-log-type settings enabled	Use logTypeSettings.list to check what settings are available
logTypeSettings.list	Returns HTTP 404 on some Google SecOps tiers	Confirm tier supports this endpoint; use logTypes.list instead
searchQueries.list	Returns HTTP 404 on some Google SecOps tiers	Verify your subscription includes saved search query sharing
parsers.list	Requires a concrete log type ID in the path; returns HTTP 404 if called without one	Obtain a valid log type ID via logTypes.list first
ingestionLogLabels.list	Returns INVALID_ARGUMENT when pageSize is supplied on some instances	Call the endpoint without pageSize; the API returns all labels in a single response

---

Best Practices

1. Use logTypes.list before parser operations. Parser, parser extension, and analysis report operations all require a concrete log type ID. Always retrieve the log type list first and resolve the exact log type identifier before making downstream calls.

2. Paginate all list operations. All list operations accept pageSize and pageToken. Request a reasonable pageSize (e.g. 100–500) and follow nextPageToken in the response until it is empty.

3. Test parsers before activating. Use logTypes.runParser with a sample log entry and logProcessingPipelines.testPipeline to validate output before activating a parser or deploying a pipeline.

4. Retrieve the feed service account before creating feeds. Use feedServiceAccounts.fetchServiceAccountForCustomer to get the Google SecOps-managed SA email, then grant it the necessary read permissions on your data source (GCS bucket, S3 bucket, etc.) before creating a feed.

5. Rotate webhook secrets after URL revocation. After calling webhooks.revokeUrl, update the webhook URL in all systems that POST to it. Maintain a short rotation window to avoid data loss.

6. Least-privilege IAM. Use roles/chronicle.viewer for monitoring workflows. Only grant roles/chronicle.editor or roles/chronicle.admin to credentials used by automation that performs write operations.

7. Handle 429 responses. The connector retries automatically up to 3 times with back-off. If persistent 429 responses occur outside of the connector, reduce request frequency or contact Google Cloud support to increase quota.

8. Use updateMask on PATCH operations. Always specify updateMask to avoid unintentionally overwriting fields not included in the request body.

9. RFC3339 time formats. All startTime and endTime parameters must be in RFC3339 format (e.g. 2024-06-01T00:00:00Z). Omitting the timezone suffix may cause API errors.

10. Use v1alpha endpoints cautiously. Endpoints on v1alpha are subject to breaking changes without advance notice. Prefer v1 equivalents where available.

---

Troubleshooting

Issue	Possible Cause	Solution
401 Unauthorized	Service account key is invalid or expired	Verify the JSON key is complete and correctly pasted; rotate the key if it has been revoked
403 PERMISSION_DENIED	Service account lacks the required Google SecOps IAM role	Grant roles/chronicle.viewer or roles/chronicle.editor as appropriate on the GCP project
404 Not Found on list/get	Resource ID is incorrect or the feature is not available on this Google SecOps tier	Verify the resource ID exists; check whether the endpoint is supported on your Google SecOps subscription
404 Not Found on parser operations	Log type ID not provided or invalid	Obtain the log type ID via logTypes.list and use it in the resource path
400 INVALID_ARGUMENT	A query parameter is not supported by the endpoint (e.g. pageSize rejected by ingestionLogLabels.list)	Remove the rejected parameter and retry; consult the Known Limitations section
429 Too Many Requests	API rate limit exceeded	The connector retries automatically; if persistent, reduce call frequency or request a quota increase
UNAUTHENTICATED	OAuth2 token has expired or scope is insufficient	Verify cloud-platform scope is present in the service account; check system clock drift
Field not found in updateMask	updateMask references a non-existent field name	Verify field names against the Google SecOps API documentation for the resource
Connection timeout	Network connectivity issue or incorrect region value	Verify the region prefix and that outbound HTTPS traffic to *.googleapis.com is allowed

Support

For issues with this integration, provide:

• The operation name attempted (e.g. parsers.create)
• The error message and HTTP status code
• The Google SecOps region and instance ID
• The parameters used (excluding the service account JSON key)

For Google SecOps API reference documentation, see the Google SecOps API documentation.

Updated: 2026-07-07