Chronicle (Google SecOps)

Configure SURF to send security events to Google Security Operations (formerly Chronicle) using the Malachite Ingestion API.

Requirements

A Google Cloud project connected to Google Security Operations
Permissions to create service accounts and manage IAM roles
Your Chronicle Customer ID
Administrator access to the SURF Admin console

Step 1: Create a service account in Google Cloud

Open https://console.cloud.google.com/iam-admin/serviceaccounts
Click Create Service Account.
Use the following values:

Field	Value
Name	`Surf Security Chronicle Ingestion`
Description	`Allows Surf Security to send UDM events to Chronicle.`

Click Create and Continue.

Step 2: Assign the required role

SURF needs a service account with permission to ingest UDM events into Chronicle.

Preferred method

Assign the predefined Google role Chronicle Ingestion Service Account, or Malachite Ingestion Service Account, depending on your region and tenant. This is the official Google role designed for API ingestion into Chronicle.

If the role is not visible in your IAM console

Some organisations do not expose this role by default. In that case, create a custom IAM role with the permissions below and assign it to the service account.

Permission	Purpose
`malachite.events.batchCreate`	Creating UDM events via the ingestion API
`malachite.events.create`	Submitting individual UDM events
`malachite.ingestion.upload`	Ingestion of structured UDM data
`malachite.udmevents.write`	Writing UDM events to Chronicle

Permission prefixes may appear as chronicle., malachite., or secops.* depending on the tenant.
If unsure, search IAM permissions for the keywords malachite, udm, or ingestion, and select all related write permissions.
Restrict the custom role to ingestion only.

Step 3: Create a JSON key

Open the service account.
Go to Keys → Add Key → Create new key → JSON.
Download the JSON key file.

Step 4: Locate your Chronicle Customer ID

In Google Security Operations, go to Settings → Customer Information → Customer ID.

Step 5: Configure the integration in SURF

Log into the SURF Admin console.
Navigate to Integrations → Chronicle.
Fill in the fields:

Field	Value
Service Account	The full contents of the JSON key file from Step 3
Customer ID	The Chronicle Customer ID from Step 4

Click Enable / Submit.

Troubleshooting

Symptom	Check
Events rejected with a permissions error	The service account does not hold an ingestion role. Confirm the predefined role, or that the custom role includes all four permissions.
Ingestion role not listed in IAM	The organisation does not expose it by default. Use the custom role route in Step 2.
Authentication failure in SURF	Partial JSON pasted into the Service Account field
Events accepted but not visible in SecOps	Wrong Customer ID. Reconfirm under Settings → Customer Information.

For anything not covered here, contact the SURF support team.