SOC for Cloud Environments · Topic 3 of 3
GCP SOC, Security Command Center and Google Security Operations
Learn the Google Cloud SOC architecture, Security Command Center, Google Security Operations (formerly Chronicle) and GCP log sources for CSA 312-39.
- 5 min
- Security Command Center is Google Cloud's posture and threat findings hub.
- Security Health Analytics finds misconfigurations; Event Threat Detection finds threats in logs.
- Google Security Operations (formerly Chronicle) is the SIEM and SOAR, using UDM and YARA-L rules.
What it is
A Google Cloud SOC monitors Google Cloud projects and organizations using Google's logging, posture and threat detection services. Two products are central: Security Command Center (SCC), which finds misconfigurations, vulnerabilities and threats in Google Cloud, and Google Security Operations (formerly Chronicle), a cloud SIEM and SOAR platform.
As with other clouds, Google secures the infrastructure and the customer secures its identities, data, configurations and workloads.
How it works
Main Google Cloud log sources
| Source | What it records |
|---|---|
| Cloud Audit Logs, Admin Activity | Configuration and metadata changes, such as creating a VM or changing IAM policy |
| Cloud Audit Logs, Data Access | Reads and writes of user data and metadata (mostly off by default except BigQuery) |
| Cloud Audit Logs, System Event | Actions Google Cloud systems take on resources |
| Cloud Audit Logs, Policy Denied | Requests denied by a security policy |
| VPC Flow Logs | Network flows to and from VM interfaces |
| Firewall Rules Logging | Connections allowed or denied by specific firewall rules |
| Cloud DNS logs | DNS queries from the network |
| Cloud Load Balancing and Cloud Armor logs | Web requests and security policy matches |
Cloud Logging collects these logs, and log sinks can route them to storage, BigQuery or a SIEM.
Security Command Center
SCC gives a central view of security findings across an organization's Google Cloud assets.
| SCC capability | What it finds |
|---|---|
| Asset inventory | What resources exist and how they are configured |
| Security Health Analytics | Misconfigurations, such as public buckets, open firewall rules or missing MFA |
| Event Threat Detection | Threats found in logs, such as malware domains, crypto mining or anomalous IAM grants |
| Container Threat Detection | Runtime attacks in container workloads |
| VM Threat Detection | Malicious software, such as crypto miners, inside VM instances |
| Web Security Scanner | Common web vulnerabilities in App Engine, GKE and Compute Engine applications |
| Compliance reporting | Mapping findings to standards such as CIS benchmarks and PCI DSS |
SCC comes in service tiers. Standard gives baseline posture checks at no extra charge. Premium adds the threat detection services (Event Threat Detection, Container Threat Detection and VM Threat Detection) and wider posture and compliance checks. The older Enterprise tier is deprecated, and Google is moving its users to Premium.
Google Security Operations (formerly Chronicle)
| Feature | What it does |
|---|---|
| Data ingestion | Collects telemetry from Google Cloud, other clouds, endpoints, network and applications |
| Unified Data Model (UDM) | Normalizes events into one schema for search and correlation |
| Detection rules | Written in YARA-L, Google's rule language for events |
| Search and investigation | Fast search over long retention, entity and timeline views |
| Threat intelligence | Built in intelligence from Google, including Mandiant and VirusTotal sources |
| SOAR | Case management and automated playbooks for response |
Other Google Cloud security tools
| Tool | Role |
|---|---|
| Cloud Armor | Web application firewall and DDoS protection for load balanced services |
| Cloud IDS | Network intrusion detection for traffic in a VPC |
| Identity and Access Management (IAM) | Controls who can do what; its changes appear in Admin Activity logs |
| Sensitive Data Protection | Discovers and protects sensitive data |
| Cloud Key Management Service | Manages encryption keys |
| Google Threat Intelligence | Threat intelligence combining Google, Mandiant and VirusTotal data |
How a Google Cloud SOC detects and responds
Posture findings drive fixes before attackers find them, threat findings drive incident response, and the SIEM correlates both with logs from the rest of the business.
A worked example
Event Threat Detection reports that a service account was granted an Owner role by an unfamiliar user, followed by many new VM instances in a new region. The finding opens a case in Google Security Operations.
The analyst checks Admin Activity audit logs to confirm who made the IAM change and from where, removes the grant, disables the user's key and stops the instances after preserving disk snapshots. VM Threat Detection confirms crypto mining on the instances.
How the exam asks about this
- "Which Google Cloud service gives a central view of misconfigurations and threats across an organization?" → Security Command Center.
- "What is the current name of Chronicle?" → Google Security Operations.
- "Which Cloud Audit Logs type records an IAM policy change?" → Admin Activity audit logs.
What to remember for the exam
- Security Command Center is Google Cloud's posture and threat findings hub.
- Security Health Analytics finds misconfigurations; Event Threat Detection finds threats in logs.
- Google Security Operations (formerly Chronicle) is the SIEM and SOAR, using UDM and YARA-L rules.
- Cloud Audit Logs types: Admin Activity, Data Access, System Event, Policy Denied.
- Cloud Armor is the WAF and DDoS protection; Cloud IDS is network intrusion detection.
Data Access audit logs are mostly disabled by default (BigQuery is the main exception). If they are not turned on, the SOC cannot see who read the data.
Common mistakes
Confusing SCC with Google Security Operations. SCC finds Google Cloud posture and threat issues; Google Security Operations is the SIEM and SOAR across all sources.
Assuming every read is logged. Without enabled Data Access logs, data reads leave no audit record.
Treating YARA-L as YARA. YARA matches file content; YARA-L is Google's rule language for detecting patterns in events.
Check yourself
What does Security Health Analytics detect?
Misconfigurations in Google Cloud resources, such as publicly accessible storage or overly open firewall rules.
What does UDM do in Google Security Operations?
It normalizes events from many sources into one data model so they can be searched and correlated.
Which log type would show who changed a firewall rule in a Google Cloud project?
Admin Activity audit logs, which record configuration changes.
Topic 3 of 3 in SOC for Cloud Environments
Test yourself on SOC for Cloud Environments
The full EC-Council 312-39 question bank has 700 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.