Google Cloud updates its Chronicle security tool for greater visibility in attack surface management

Google Cloud announced steps this week to help security operations teams analyze the tremendous amount of data now flowing through network operations.

On Monday, the cloud provider updated its Chronicle Security Operations platform to combine security information and event management, or SIEM, along with security orchestration automation and response, or SOAR, adding threat intelligence from Mandiant to help visibility for organizations in attack surface management.

“How do you prioritize those things that are the ones that are the most critical for you to work on?” asked Jeff Reed (pictured), vice president of product for cloud security at Google LLC. “If it’s both a potential problem and we think it’s exploitable externally, that increases the prioritization that you should put on that. That’s where bringing the visibility on the attack surface management combined with the richness and the alerts and findings that we have in the SIEM and SOAR environment really makes sense.”

Reed spoke with theCUBE industry analysts Rebecca Knight and Rob Strechay at the mWISE Conference, in an exclusive broadcast on theCUBE. They discussed the company’s most recent announcements and challenges facing enterprise security teams today. (* Disclosure below.)

Looking for compromise

The integration of Mandiant’s threat intelligence is designed to help customers more rapidly and accurately spot indicators of compromise, or IOC, according to Reed.

“We can retroactively search all the customers using Chronicle with Mandiant breach analytics for the past year,” he said. “Have we seen that IOC in their environment ever before? We’ve identified the specific vector of a threat and how we make sure that that’s not happening with any of our customers.”

The Chronicle updates include an ability to preview chatbot Duet AI’s natural language questions and summarization capabilities.

“What we do in Duet on Chronicle is the ability to use a natural language search for your unified data model query,” Reed said. “Instead of requiring someone who is just starting to understand that query language right away, you can just say: ‘Who are all the users that downloaded files that have personal identifiable information over the last seven days?’ We generate that query on behalf of the SOC analysts.”

Here’s the complete video interview, part of SiliconANGLE’s and theCUBE’s coverage of the mWISE Conference:

(* Disclosure: Google Cloud sponsored this segment of theCUBE. Neither Google Cloud nor other sponsors have editorial control over content on theCUBE or SiliconANGLE.)

Photo: SiliconANGLE