Google Chronicle Integration

Create Service Account

Create a Google Cloud service account with Chronicle API access.

                # Create service account for Chronicle integration
gcloud iam service-accounts create dbaudit-chronicle \
    --display-name="DB Audit Chronicle Integration"

# Grant Chronicle ingestion permissions
gcloud projects add-iam-policy-binding PROJECT_ID \
    --member="serviceAccount:dbaudit-chronicle@PROJECT_ID.iam.gserviceaccount.com" \
    --role="roles/chronicle.editor"

# Create and download JSON key
gcloud iam service-accounts keys create dbaudit-chronicle-key.json \
    --iam-account=dbaudit-chronicle@PROJECT_ID.iam.gserviceaccount.com

# The JSON key file will look like:
{
  "type": "service_account",
  "project_id": "your-project-id",
  "private_key_id": "key-id",
  "private_key": "-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----\n",
  "client_email": "dbaudit-chronicle@project.iam.gserviceaccount.com",
  "client_id": "123456789",
  ...
}
              

Get Chronicle Customer ID

Find your Chronicle customer ID in the Chronicle console settings.

1. Log in to Chronicle console
2. Navigate to Settings → SIEM Settings
3. Copy your Customer ID (UUID format)

Test Connection

Verify the service account can access the Chronicle ingestion API.

                # Test Chronicle ingestion API
# First, get access token using service account
ACCESS_TOKEN=$(gcloud auth print-access-token \
    --impersonate-service-account=dbaudit-chronicle@PROJECT_ID.iam.gserviceaccount.com)

# Test ingestion endpoint
curl -X POST "https://malachiteingestion-pa.googleapis.com/v2/unstructuredlogentries:batchCreate" \
    -H "Authorization: Bearer $ACCESS_TOKEN" \
    -H "Content-Type: application/json" \
    -d '{
      "customerId": "YOUR_CUSTOMER_ID",
      "logType": "DBAUDIT",
      "entries": [
        {"logText": "{\"test\": \"event from dbaudit\"}"}
      ]
    }'

# Expected response: empty on success (HTTP 200)
              

Configure in DB Audit

Add the Google Chronicle integration in the DB Audit dashboard.

1. Navigate to Integrations → SIEM in DB Audit
2. Click Add SIEM Integration
3. Select Google Chronicle as the provider
4. Paste the service account JSON key
5. Enter your Chronicle customer ID
6. Select event types to forward
7. Test the connection and save

Create Detection Rules (Optional)

Create YARA-L rules to detect suspicious database activity.

                // YARA-L Rule - Suspicious Database Data Access
// Detection → Rules → Create Rule

rule dbaudit_suspicious_data_exfiltration {
  meta:
    author = "DB Audit"
    description = "Detects queries returning large amounts of potentially sensitive data"
    severity = "HIGH"

  events:
    $e.metadata.vendor_name = "DBaudit"
    $e.metadata.event_type = "USER_RESOURCE_ACCESS"
    $e.additional.fields["rows_affected"] > 10000
    $e.additional.fields["contains_pii"] = "true"

  condition:
    $e
}

// YARA-L Rule - Failed Database Authentication
rule dbaudit_auth_brute_force {
  meta:
    author = "DB Audit"
    description = "Detects multiple failed authentication attempts from same IP"
    severity = "MEDIUM"

  events:
    $e.metadata.vendor_name = "DBaudit"
    $e.metadata.event_type = "USER_LOGIN"
    $e.security_result.action = "BLOCK"

  match:
    $e.principal.ip over 10m

  condition:
    #e > 5
}

// YARA-L Rule - Unusual Database Access Hours
rule dbaudit_off_hours_access {
  meta:
    author = "DB Audit"
    description = "Detects database access outside business hours"
    severity = "LOW"

  events:
    $e.metadata.vendor_name = "DBaudit"
    $e.metadata.event_type = "USER_RESOURCE_ACCESS"

  condition:
    $e and (
      timestamp.get_hour($e.metadata.event_timestamp) < 6 or
      timestamp.get_hour($e.metadata.event_timestamp) > 22
    )
}