What is Google SecOps?

Google Security Operations (Google SecOps) is Google Cloud's unified security operations platform, combining a cloud-native SIEM, a SOAR (security orchestration, automation, and response) engine, and integrated threat intelligence into a single console for detecting, investigating, and responding to threats.

The platform has gone through a few names: it began as Chronicle (originally "Backstory") in 2019, gained SOAR capabilities after Google acquired Siemplify in 2022, unified the SIEM and SOAR experience into one interface in late 2023, and was rebranded from "Chronicle Security Operations" to "Google Security Operations" in April 2024, though the underlying platform and much of its documentation still carries the Chronicle name in places.

It's built on Google's own infrastructure and is designed to ingest and retain very large volumes of security telemetry cheaply, normalize it into a consistent schema, and let analysts search, detect, and respond to threats at what Google describes as "Google speed" — sub-second search across large log volumes.