What is Chronicle SIEM?

Chronicle SIEM is the security information and event management side of Google SecOps — the component responsible for ingesting raw logs, normalizing them into UDM, running detection rules (via YARA-L), and providing search and dashboards over that normalized telemetry.

It's designed as a cloud-native SIEM, meaning it doesn't require customers to size, deploy, or manage their own indexing infrastructure the way many on-premises SIEM products historically did; ingestion, storage, and query execution all run on Google's own infrastructure, with retention (12 months of hot data by default in standard offerings) handled as part of the service.

Within the unified Google SecOps console, Chronicle SIEM specifically covers the "Search" experience for UDM events and alerts, along with SIEM-specific administrative settings — ingestion configuration, parser management, and detection rule settings — which are managed separately from the SOAR side's case-management and automation settings.