Skip to main content
Wirespeed integrates with Google SecOps (formerly Chronicle) to poll detections from both custom YARA-L rules and Google-curated rules, and to inventory the rules actively watching your environment.

​
Prerequisites

  • Access to a Google Cloud project that owns your Chronicle instance
  • Admin permissions to create a service account and grant IAM roles
  • A provisioned Chronicle (Google Security Operations) instance
  • Your Chronicle region and customer ID
  • The ability to download a service account key in JSON format

​
Setup Instructions

​
Step 1: Create a Service Account

  1. Navigate to the Google Cloud Console
  2. Select the Project that owns your Chronicle instance
  3. Go to IAM & Admin > Service Accounts
  4. Click Create Service Account
  5. Enter a name (e.g., wirespeed-chronicle-integration)
  6. Enter a description (e.g., Service account for Wirespeed Chronicle integration)
  7. Give the service account the Chronicle API Editor role.
  8. Click Create and Continue
  9. Click Done

​
Step 2: Generate and Download the Service Account Key

  1. In the Service Accounts list, click on the actions and select Manage keys
  2. Click Add Key > Create new key
  3. Select JSON as the key type
  4. Click Create — the JSON key file downloads automatically
    • Keep this file secure — it grants access to your Chronicle detections
  5. Open the JSON file and copy the entire contents

​
Step 3: Find Your Chronicle Region and Customer ID

Chronicle instances are provisioned in a specific region. The region determines the API endpoint used by Wirespeed. You can find this information under Google SecOps in GCP. Region — your Chronicle instance lives in one of the supported regions below:
  • us, eu, europe
  • africa-south1
  • asia-east1, asia-northeast1, asia-northeast3, asia-south1, asia-southeast1, asia-southeast2
  • australia-southeast1
  • europe-central2, europe-west2, europe-west3, europe-west6, europe-west9, europe-west12
  • me-central1, me-central2, me-west1
  • northamerica-northeast2
  • southamerica-east1
Customer ID — the GUID of your Chronicle instance.

​
Step 4: Configure Wirespeed

  1. Log in to Wirespeed and navigate to Integrations > Add Integration
  2. Select Google SecOps
  3. Enter the following:
    • Region: the Chronicle region, e.g. us
    • Customer ID: the GUID from Step 3
    • Service Account Key: the complete JSON contents from Step 2
  4. Click Save
Wirespeed will validate your credentials by making an authenticated call against the configured Google SecOps instance, then begin polling custom and Google-curated detections.
On first sync, Wirespeed imports up to 10,000 custom detections and 10,000 Google-curated detections from the previous 7 days.