Skip to main content
Wirespeed integrates with Google Chronicle SIEM to poll detections from both custom YARA-L rules and Google-curated rules, and to inventory the rules actively watching your environment.

​
Prerequisites

  • Access to a Google Cloud project that owns your Chronicle instance
  • Admin permissions to create a service account and grant IAM roles
  • A provisioned Chronicle (Google Security Operations) instance
  • Your Chronicle region and customer ID
  • The ability to download a service account key in JSON format

​
Setup Instructions

​
Step 1: Create a Service Account

  1. Navigate to the Google Cloud Console
  2. Select the Project that owns your Chronicle instance
  3. Go to IAM & Admin > Service Accounts
  4. Click Create Service Account
  5. Enter a name (e.g., wirespeed-chronicle-integration)
  6. Enter a description (e.g., Service account for Wirespeed Chronicle integration)
  7. Give the service account the Chronicle API Editor role.
  8. Click Create and Continue
  9. Click Done

​
Step 2: Generate and Download the Service Account Key

  1. In the Service Accounts list, click on the actions and select Manage keys
  2. Click Add Key > Create new key
  3. Select JSON as the key type
  4. Click Create — the JSON key file downloads automatically
    • Keep this file secure — it grants access to your Chronicle detections
  5. Open the JSON file and copy the entire contents

​
Step 3: Find Your Chronicle Region and Customer ID

Chronicle instances are provisioned in a specific region. The region determines the API endpoint used by Wirespeed. You can find this information under Google SecOps in GCP. Region — your Chronicle instance lives in one of the supported regions below:
  • us, eu, europe
  • africa-south1
  • asia-east1, asia-northeast1, asia-northeast3, asia-south1, asia-southeast1, asia-southeast2
  • australia-southeast1
  • europe-central2, europe-west2, europe-west3, europe-west6, europe-west9, europe-west12
  • me-central1, me-central2, me-west1
  • northamerica-northeast2
  • southamerica-east1
Customer ID — the GUID of your Chronicle instance.

​
Step 4: Configure Wirespeed

  1. Log in to Wirespeed and navigate to Integrations > Add Integration
  2. Select Google Chronicle
  3. Enter the following:
    • Region: the Chronicle region, e.g. us
    • Customer ID: the GUID from Step 3
    • Service Account Key: the complete JSON contents from Step 2
  4. Click Save
Wirespeed will validate your credentials by making an authenticated call against the configured Chronicle instance, then begin polling detections. Note that we only sync alerting detections.
On first sync, Wirespeed backfills the last 7 days of detections. All detections are ingested as informational during Phase 1.