---
title: Google Security Operations
description: >-
  Monitor forwarder health, log ingestion, and log processing pipeline metrics
  for Google Security Operations.
breadcrumbs: Docs > Integrations > Google Security Operations
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Google Security Operations
Integration version1.0.0
{% callout %}
# Important note for users on the following Datadog sites: us2.ddog-gov.com

{% alert level="info" %}
To find out if this integration is available in your organization, see your [Datadog Integrations](https://app.datadoghq.com/integrations) page or ask your organization administrator.

To initiate an exception request to enable this integration for your organization, email [support@ddog-gov.com](mailto:support@ddog-gov.com).
{% /alert %}

{% /callout %}

## Overview{% #overview %}

Google Security Operations (Google SecOps), formerly Chronicle, is Google Cloud's security operations platform for ingesting, normalizing, and analyzing security telemetry data at scale for threat detection, investigation, and response.

Use the Datadog Google Cloud Platform integration to collect metrics from Google Security Operations, including forwarder health, log ingestion, and log processing pipeline performance.

## Setup{% #setup %}

### Installation{% #installation %}

If you haven't already, set up the [Google Cloud Platform integration](https://docs.datadoghq.com/integrations/google-cloud-platform.md) first. There are no other installation steps.

## Data Collected{% #data-collected %}

### Metrics{% #metrics %}

|  |
|  |
| **gcp.chronicle.agent.cpu_seconds**(gauge)                                          | Total CPU time consumed by the Google SecOps agent process in seconds.*Shown as second*                                |
| **gcp.chronicle.agent.exporter_accepted_spans_count**(count)                      | The number of spans accepted by the exporter.                                                                          |
| **gcp.chronicle.agent.exporter_queue_capacity**(gauge)                             | Current capacity of the exporter queue.                                                                                |
| **gcp.chronicle.agent.exporter_queue_size**(gauge)                                 | Current size of the exporter queue.                                                                                    |
| **gcp.chronicle.agent.exporter_refused_spans_count**(count)                       | The number of spans refused by the exporter.                                                                           |
| **gcp.chronicle.agent.memory_used**(gauge)                                          | Memory used by the Google SecOps agent process.*Shown as byte*                                                         |
| **gcp.chronicle.agent.process_uptime**(gauge)                                       | The uptime of the Google SecOps agent process.*Shown as second*                                                        |
| **gcp.chronicle.agent.processor_accepted_spans_count**(count)                     | The number of spans accepted by the processor.                                                                         |
| **gcp.chronicle.agent.processor_refused_spans_count**(count)                      | The number of spans refused by the processor.                                                                          |
| **gcp.chronicle.agent.receiver_accepted_spans_count**(count)                      | The number of spans accepted by the receiver.                                                                          |
| **gcp.chronicle.agent.receiver_refused_spans_count**(count)                       | The number of spans refused by the receiver.                                                                           |
| **gcp.chronicle.azure_event_hub.bytes_count**(count)                              | The total size of logs ingested by Azure Event Hubs feeds.*Shown as byte*                                              |
| **gcp.chronicle.azure_event_hub.is_unhealthy**(gauge)                             | The status of each Azure Event Hubs ingestion source. State value describes the type of status for unhealthy sources.  |
| **gcp.chronicle.azure_event_hub.record_count**(count)                             | The total number of logs ingested by Azure Event Hubs feeds.                                                           |
| **gcp.chronicle.forwarder.buffer_used**(gauge)                                      | Percentage of buffer used by the forwarder.*Shown as percent*                                                          |
| **gcp.chronicle.forwarder.container.cpu_used**(gauge)                               | Percentage of CPU used by the forwarder container.*Shown as percent*                                                   |
| **gcp.chronicle.forwarder.container.disk_used**(gauge)                              | Percentage of disk used by the forwarder container.*Shown as percent*                                                  |
| **gcp.chronicle.forwarder.container.memory_used**(gauge)                            | Percentage of memory used by the forwarder container.*Shown as percent*                                                |
| **gcp.chronicle.forwarder.last_heartbeat**(gauge)                                   | The timestamp of the forwarder's last heartbeat, in seconds since the Unix epoch (UTC).*Shown as second*               |
| **gcp.chronicle.forwarder.log.drop_count**(count)                                   | Number of logs dropped by the forwarder.                                                                               |
| **gcp.chronicle.gcp.is_unhealthy**(gauge)                                           | The status of each native GCP ingestion log type. State value describes the type of status for unhealthy sources.      |
| **gcp.chronicle.https_push.bytes_count**(count)                                    | The total size of logs ingested by the HTTPS push ingestion source.*Shown as byte*                                     |
| **gcp.chronicle.https_push.is_unhealthy**(gauge)                                   | The status of each HTTPS push ingestion source. State value describes the type of status for unhealthy sources.        |
| **gcp.chronicle.https_push.record_count**(count)                                   | The total number of logs ingested by HTTPS push feeds.                                                                 |
| **gcp.chronicle.ingestion.is_unhealthy**(gauge)                                     | The status of each source of ingestion. State value describes the type of status for unhealthy sources.                |
| **gcp.chronicle.ingestion.log.bytes_count**(count)                                  | The total size of logs ingested.*Shown as byte*                                                                        |
| **gcp.chronicle.ingestion.log.quota_rejected_bytes_count**(count)                 | The total size of logs rejected due to insufficient quota.*Shown as byte*                                              |
| **gcp.chronicle.ingestion.log.record_count**(count)                                 | The total number of logs ingested.                                                                                     |
| **gcp.chronicle.ingestion.quota_limit**(gauge)                                      | The ingestion quota limit.*Shown as byte*                                                                              |
| **gcp.chronicle.log_processing_pipeline.emitted_bytes_count**(count)             | Total size of logs in bytes emitted by the log processing pipeline.*Shown as byte*                                     |
| **gcp.chronicle.log_processing_pipeline.emitted_log_count**(count)               | Total count of logs emitted by the log processing pipeline.                                                            |
| **gcp.chronicle.log_processing_pipeline.ingested_bytes_count**(count)            | Total size of logs in bytes received by the log processing pipeline.*Shown as byte*                                    |
| **gcp.chronicle.log_processing_pipeline.ingested_log_count**(count)              | Total count of logs received by the log processing pipeline.                                                           |
| **gcp.chronicle.log_processing_pipeline.processing_latencies.avg**(gauge)         | The average latency of logs processed by the log processing pipeline.*Shown as millisecond*                            |
| **gcp.chronicle.log_processing_pipeline.processing_latencies.samplecount**(count) | The number of latency samples recorded for logs processed by the log processing pipeline.                              |
| **gcp.chronicle.log_processing_pipeline.processing_latencies.sumsqdev**(count)    | The sum of squared deviations of latencies for logs processed by the log processing pipeline.                          |
| **gcp.chronicle.normalizer.event.record_count**(count)                              | The total number of events generated after parsing.                                                                    |
| **gcp.chronicle.normalizer.is_unhealthy**(gauge)                                    | The status of the log parsing ratio for each log type. State value describes the type of status for unhealthy sources. |
| **gcp.chronicle.normalizer.log.record_count**(count)                                | The total number of log entries received for parsing.                                                                  |
| **gcp.chronicle.outofband.log.bytes_count**(count)                                  | The total size of logs ingested for feeds created using the Feed Management API.*Shown as byte*                        |
| **gcp.chronicle.outofband.log.is_unhealthy**(gauge)                                 | The status of each feed-based ingestion source. State value describes the type of status for unhealthy sources.        |
| **gcp.chronicle.outofband.log.record_count**(count)                                 | The total number of logs ingested for feeds created using the Feed Management API.                                     |
| **gcp.chronicle.workspace.is_unhealthy**(gauge)                                     | The status of the Native Workspace ingestion source. State value describes the type of status for unhealthy sources.   |

### Events{% #events %}

The Google Security Operations integration does not include any events.

### Service Checks{% #service-checks %}

The Google Security Operations integration does not include any service checks.

## Troubleshooting{% #troubleshooting %}

Need help? Contact [Datadog support](https://docs.datadoghq.com/help/).