How to Export Google SecOps Logs for Investigation
Summary
A practical guide to exporting Google SecOps logs through UDM search, the Data Export API, or the UI, with notes on permissions, raw versus normalized data, and CSV and result-limit constraints.
Key points
- Google SecOps retains raw ingested logs and normalized UDM events; standard retention is 12 months.
- For targeted pulls, UDM searches can be run through the API to retrieve events as JSON.
- The Data Export API copies original logs for a selected time range and log type to a Cloud Storage bucket.
- UI exports provide CSV, which LogTotal does not currently support; raw-log searches through the UI are limited to 10,000 results per query.
- Exports require appropriate IAM permissions, and the SecOps service account needs write access to the destination bucket.
- The guide recommends raw syslog or JSON logs for LogTotal when available, with UDM JSON as an alternative.
Article Details
- Defense Focus
- Export Google SecOps logs for investigation in LogTotal, using targeted UDM searches or raw-log exports.
- Detection Methods
- Search UDM events in the Google SecOps UI or through the UDM Search API, specifying a time range and query.
- For larger exports or original log contents, use the Data Export API and select the required time range and log type.
- Review matching events in the UI and select relevant fields with Column Manager before exporting.
- Data Sources
- Raw logs as ingested, including syslog or JSON
- Normalized UDM events
- Windows event logs identified by the WINEVTLOG log type
- Rule Types
- UDM search queries
- Raw-log searches
- Defensive Actions
- Choose the needed log types and time range before exporting.
- Grant the required IAM permissions and allow the SecOps service account to write to the destination Cloud Storage bucket.
- Check that the API endpoint uses the correct region and instance ID.
- Use the Data Export API or narrow the time range when UI or query result limits prevent a complete export.
- Prefer raw syslog or JSON logs for LogTotal when available; use UDM events as a fallback.
- For UI exports, account for the CSV format and extract original log entries into a supported raw-log format before analyzing them in LogTotal.