# Google SecOps {% hint style="info" %} Google SecOps is an SIEM integration. SIEM integrations are used to perform analysis of any SIEM generated alerts, and/or to use generated data as part of investigation analysis. They are optional, but enabling more integrations enhances Dropzone analysis. {% endhint %} Dropzone integrates with [Google SecOps](https://cloud.google.com/security/products/security-operations) to investigate different security alerts across many of Google's security products. ## Integration Overview To enable these integrations you will perform the following actions: * Identify your service account address * Grant IAM access to the Dropzone service account * Obtain your Google Account Details * Enable the Alert and Data sources ## Identify your service account email address To obtain the email address of your Dropzone service account, do the following: * Navigate to your Dropzone AI tenant home page e.g. https\://*mycompany*.dropzone.app * In the bottom left hand corner, navigate to Settings > Integrations

* Click "Available"

* In the Search bar, search Google SecOps, then click "Configure"

* Copy the "SERVICE ACCOUNT EMAIL" field for use in the Google Console interface

## Grant IAM Access to Dropzone AI * Navigate to the Google Console page of the project your SecOps instance is in * In the upper left hand corner, open the navigation menu

* Navigate to IAM & Admin > IAM

* Under "View by principals," click "Grant Access" {% hint style="info" %} To be able to complete this step, you will need the `resourcemanager.projects.setIamPolicy` permission. {% endhint %}

* Under "New principals," input the email address you copied earlier from the Dropzone UI "SERVICE ACCOUNT EMAIL"

Input the email address from the Dropzone UI Service Account Email

* Click "Select a role"

* Search the "Chronicle API Viewer" role, then click it

* Click "Save"

## Obtain Account Details To obtain your Instance Name, do the following: * Return to the Google Console page of the project your SecOps instance is in * In the upper left hand corner, open the navigation menu

* Navigate to Security > Detection and Controls > Google SecOps

* In the Google SecOps page, click the carrot next to "Instance Details"

* Copy the Customer ID shown for use later in the Dropzone UI where it is called "Instance Name"

To obtain your Project ID, do the following: * In the upper left, click on the project icon

* Using the search bar, locate the project your SecOps instance is in * Under "ID," copy the ID value shown for use later in the Dropzone UI where it is called "Project ID"

## SOAR Details If you want Dropzone to be able to investigate [cases](https://cloud.google.com/chronicle/docs/soar/investigate/working-with-cases/cases-overview), you will need to generate a SOAR API Key and locate your SOAR Instance Hostname To generate your SOAR API Key, do the following: * As an admin, log into your Google SecOps instance * In the left sidebar, navigate to Settings > SOAR Settings

* Navigate to Advanced > API Keys

* In the upper right corner, click the `+` icon

* Name the API Key something memorable, such as Dropzone AI * Next to "Permission Group," assign the API Key the Managed User permission

* In the SOC Role section, select your desired [SOC role](https://cloud.google.com/chronicle/docs/soar/admin-tasks/advanced/control-access-to-platform) * Copy the API Key, then click "Save"

* Click "Yes"

To obtain your SOAR Instance Hostname, do the following: * In the left sidebar, navigate to Ingestion > Webhook

* Click the `+` icon

* Name the Webhook something memorable, such as Dropzone AI * Click "Save"

* Next to "Webhook URL," copy the SOAR Instance Hostname, eg https\://*my-hostname*/v1alpha/projects

## Enable Google SecOps To enable the Data Source integration, you will need the following information: | Dropzone Field | Source | | -------------- | ------------------------------------------ | | Instance Name | The "Customer ID" value you copied earlier | | Project ID | The "Project ID" value you copied earlier | To enable the Data Source integration, do the following: * Navigate to your Dropzone AI tenant home page e.g. https\://*mycompany*.dropzone.app * In the bottom left hand corner, navigate to Settings > Integrations

* Click "Available"

* In the Search bar, search Google SecOps, then click "Configure"

* Under the Data Source heading, input the Instance Name and Project ID

The Google SecOps Data Source Configuration

* Click "Test & Save" to finish If you have any errors engage your Dropzone AI support representative. --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://docs.dropzone.ai/integrations/data/googlesecops_data.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.