Google SecOps | D3 Docs

LAST UPDATED: Sep 24, 2026

Overview

Google SecOps is Google Cloud's security operations platform, combining a SIEM for large-scale telemetry ingestion, detection and threat hunting with a SOAR module for case management. This integration covers the case management surface: it lists and retrieves cases, and changes their priority, stage, assignee and other fields directly from a playbook.

Google SecOps is available for use in:

D3 ASOC	V18.4.0+
Category	SIEM & XDR
Deployment Options	Option I, Option II, Option III, Option IV

Connection

Gather the following information to connect D3 to Google SecOps.

Parameter	Description	Example
Server URL	The regional Chronicle API host for the Google SecOps instance. Enter the host only, without a path. Standard tenants use the form https://{region}-chronicle.googleapis.com, for example https://us-chronicle.googleapis.com or https://europe-chronicle.googleapis.com. Data residency tenants use the form https://chronicle.{region}.rep.googleapis.com, for example https://chronicle.eu.rep.googleapis.com. To find the region, check the Google SecOps console URL: a tenant URL without a region label, such as https://example.backstory.chronicle.security, indicates region us, while https://example.europe.backstory.chronicle.security indicates region europe. The full endpoint list is at https://docs.cloud.google.com/chronicle/docs/reference/rest .	https://us-chronicle.googleapis.com
Service Account JSON	The contents of the Google Cloud service account JSON key file used for authentication. The service account must be granted the IAM permissions listed for each command in the Permission Requirements section. Refer to https://developers.google.com/identity/protocols/oauth2/service-account .	{"type":"service_account","project_id":"my-project","private_key_id":"...","private_key":"-----BEGIN PRIVATE KEY-----...","client_email":"d3-secops@my-project.iam.gserviceaccount.com"}
Customer ID	The customer ID of the Google SecOps instance, obtainable from the Google SecOps console under Settings > Profile. This value identifies the tenant in every API request.	01234567-89ab-cdef-0123-456789abcdef
Project ID	The Google Cloud project hosting the Google SecOps instance, from Settings > Profile > Organization Details. Leave blank to use the project_id from the Service Account JSON, which is correct only when the service account was created in that same project.	123456789012

Permission Requirements

Each endpoint in the Google SecOps API requires a certain permission scope. The following are required scopes for the commands in this integration:

Command	Required Permissions
Test Connection	chronicle.instances.get
Update Case	chronicle.cases.update
Assign Case	chronicle.cases.update
Get Case	chronicle.cases.get
Change Case Priority	chronicle.cases.update
Change Case Stage	chronicle.cases.update
List Cases	chronicle.cases.get
List Case Stages	chronicle.caseStageDefinitions.get

Configuring Google SecOps to Work with D3

Complete the following steps in the vendor environment before configuring the D3 connection:

Sign in to the Google SecOps console.
In the Google SecOps console, go to Settings > Profile. In the Organization Details section, copy the following values. The Chronicle API identifies the target tenant from the request URL, so the Customer ID and Server URL must be correct; there is no fallback.
1. Customer ID: The unique identifier of your Google SecOps instance, shown as a UUID (for example, xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx). Copy the full value exactly as displayed.
2. Project ID: The Google Cloud project that hosts your Google SecOps instance. Leave this field blank only if the service account was created in the same project as your Google SecOps instance. If the service account belongs to a different project, this field is required. Enter either of the following:
  1. GCP Project ID: The alphanumeric project identifier, shown as a link.
  2. GCP Project Number: The numeric project identifier.
3. Server URL: The regional base URL of the Chronicle API. The Chronicle API URL field shows the full endpoint, but only the base URL, the part before /projects/, is needed. For example:
  1. Full value shown: https://us-chronicle.googleapis.com/projects/<project>/locations/us/instances/<customer-id>
  2. Value to enter: https://us-chronicle.googleapis.com in the connection Server URL.
  3. Do not include /projects/, the location, or the instance path in the Server URL; D3 builds the full request path from the Project ID and Customer ID. The regional prefix depends on where your instance is hosted (for example, us-, eu-, or asia-southeast1-), so always copy it from your own console rather than using the example above.
Enable the Chronicle API.
1. In the Google Cloud console for that project, open APIs & Services > Library
2. Search for Chronicle API, and click Enable. Skipping this produces an HTTP 403 naming the project number.
Service Account JSON:
1. Open IAM & Admin > Service Accounts, click Create service account, and give it a name such as d3-secops-integration.
2. Enter a Service account name (for example, d3-secops-integration), then click Create and continue.
3. Under Permissions, select the Chronicle API editor role or a custom role including all the permissions for this integration, then click Continue.
4. Under Principals with access (optional), leave both fields blank; D3 doesn't need them. Click Done to create the service account.
In the Service accounts list, find the service account you just created. Click to open the new service account.
Create the Service Account JSON.
1. On the service account details page, select the Keys tab.
2. On the Keys tab, click Add key > Create new key.
3. Select Create new key.
4. Under Key type, select JSON, then click Create. The JSON key file downloads to your computer automatically. Store it securely: the private key can't be downloaded again, and if it's lost, you'll need to create a new key. You'll paste its contents into the D3 integration connection Service Account JSON.
Grant the service account a role covering the permissions its commands need - the Permission Requirements section lists them per command. The predefined Chronicle API Viewer role covers the read-only commands; commands that write require an editor-level or custom role. A read-only service account passes Test Connection and every list command, then returns HTTP 403 on every write, so under-granting here fails late and misleadingly.
(Optional) Create a custom role:
1. In the Google Cloud console, go to IAM and admin > Roles, click the Custom tab, then click + Create custom role.
2. Enter the role details:
  - Title: D3 SecOps Integration Custom Role
  - Description: Permissions required by the D3 Google SecOps integration
  - Set the Role launch stage to General availability.
  - Click + Add permissions, filter by each permission name, select it, and click Add:
    - chronicle.instances.get
    - chronicle.cases.get
    - chronicle.cases.update
    - chronicle.caseStageDefinitions.get
  - Click Create.
3. Note: If you used the custom role, remove Chronicle API Editor from the service account.

Configuring D3 to Work with Google SecOps

Log in to D3.
See Adding a Connection for instructions on how to find the integration within D3 and fill out the generic integration connection parameters.
System: This section contains the parameters defined specifically for the integration. These parameters must be configured to create the integration connection.
1. Configure the integration-specific parameters as documented in the Connection parameter table above.
Test the connection.
1. Click on the Test Connection button to verify credentials and connectivity. A success alert displays Passed with a green checkmark. If the connection fails, review the parameters and retry.
2. Click OK to close the alert window.
3. Click + Add to create and add the configured connection.

Commands

Google SecOps includes the following executable commands for users to set up schedules or create playbook workflows. With the Test Command function, users can execute these commands independently for playbook troubleshooting.

Integration API Note

For more information about the Google SecOps API, refer to the Google SecOps API reference.

READER NOTE
Certain permissions are required for each command. Refer to the Permission Requirements and Configuring Google SecOps to Work with D3 sections for details.

Update Case

Updates the specified Google SecOps cases. This command cannot close a case - the case status is read-only on the Case resource; use the Close Case command instead. It also cannot set tags; use the Manage Case Tag command.

Input

Input Parameter	Required/Optional	Description	Example
Case IDs	Required	The cases to update. Case IDs can be obtained using the List Cases command. Every field supplied below is applied to every case in this list, and at least one field must be supplied.	["41"]
Display Name	Optional	The new display name for the case. By default, or when the value is empty, the current value is unchanged.	N/A
Priority	Optional	The new priority for the case. By default, or when the value is empty, the current value is unchanged.	PRIORITY_HIGH
Stage	Optional	The new stage for the case. Stages are configured per tenant in Google SecOps, so the valid names depend on the tenant - use the List Case Stages command to retrieve them. By default, or when the value is empty, the current value is unchanged.	N/A
Assignee	Optional	The user the case is assigned to. By default, or when the value is empty, the current value is unchanged. To assign several cases in one call, or to assign to a SOC role, use the Assign Case command instead.	N/A
Description	Optional	The new description for the case. By default, or when the value is empty, the current value is unchanged.	N/A
Environment	Optional	The environment the case belongs to. By default, or when the value is empty, the current value is unchanged.	N/A
Important	Optional	The flag that marks the case as important. By default, or when the value is empty, the current value is unchanged.	true
Incident	Optional	The flag that marks the case as an incident. By default, or when the value is empty, the current value is unchanged.	true
Score	Optional	The score assigned to the case. By default, or when the value is empty, the current value is unchanged.	N/A

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data displays Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Update Case failed.
Status Code	The response code issued by the third-party API server or the D3 system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Google SecOps portal. Refer to the HTTP Status Code Registry for details.	Status Code: 403.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Invalid request — missing required parameter.

Error Sample Data
Update Case failed.
Status Code: 403
Message: Request had insufficient authentication scopes.

Assign Case

Assigns the specified Google SecOps cases to a user or a SOC role in a single call.

Input

Input Parameter	Required/Optional	Description	Example
Case IDs	Required	The cases to assign. Case IDs can be obtained using the List Cases command.	["41"]
Assignee	Required	The user name to assign the cases to. Google SecOps also supports assigning to a SOC role, but the format for naming a role is not documented, so the exact value should be confirmed with a Google SecOps administrator. This command returns no confirmation of who was assigned, so an unrecognized name appears to succeed without assigning anyone.	analyst@example.com

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data displays Failed, an Error tab will appear in the Test Result window.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Assign Case failed.
Status Code	The response code issued by the third-party API server or the D3 system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Google SecOps portal. Refer to the HTTP Status Code Registry for details.	Status Code: 403.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Invalid request — missing required parameter.

Error Sample Data
Assign Case failed.
Status Code: 403
Message: Request had insufficient authentication scopes.

Get Case

Retrieves the specified Google SecOps cases, including their display name, priority, stage, status, assignee, type, environment and alert count.

Input

Input Parameter	Required/Optional	Description	Example
Case IDs	Required	The cases to retrieve. Case IDs can be obtained using the List Cases command.	["41"]

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data displays Failed, an Error tab will appear in the Test Result window.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Get Case failed.
Status Code	The response code issued by the third-party API server or the D3 system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Google SecOps portal. Refer to the HTTP Status Code Registry for details.	Status Code: 403.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Invalid request — missing required parameter.

Error Sample Data
Get Case failed.
Status Code: 403
Message: Request had insufficient authentication scopes.

Change Case Priority

Changes the priority of the specified Google SecOps cases in a single bulk call.

Input

Input Parameter	Required/Optional	Description	Example
Case IDs	Required	The cases to act on. Case IDs can be obtained using the List Cases command.	["41","42"]
Priority	Required	The priority to set on the cases.	PRIORITY_HIGH

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data displays Failed, an Error tab will appear in the Test Result window.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Change Case Priority failed.
Status Code	The response code issued by the third-party API server or the D3 system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Google SecOps portal. Refer to the HTTP Status Code Registry for details.	Status Code: 403.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Invalid request — missing required parameter.

Error Sample Data
Change Case Priority failed.
Status Code: 403
Message: Request had insufficient authentication scopes.

Change Case Stage

Changes the stage of the specified Google SecOps cases in a single bulk call.

Input

Input Parameter	Required/Optional	Description	Example
Case IDs	Required	The cases to act on. Case IDs can be obtained using the List Cases command.	["41","42"]
Stage	Required	The case stage to set. Stages are configured per tenant in Google SecOps; use the List Case Stages command to retrieve the valid names for a tenant.	Triage

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data displays Failed, an Error tab will appear in the Test Result window.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Change Case Stage failed.
Status Code	The response code issued by the third-party API server or the D3 system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Google SecOps portal. Refer to the HTTP Status Code Registry for details.	Status Code: 403.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Invalid request — missing required parameter.

Error Sample Data
Change Case Stage failed.
Status Code: 403
Message: Request had insufficient authentication scopes.

List Cases

Returns Google SecOps cases, optionally filtered and ordered. This is the only way for a playbook to discover case IDs when it did not begin from a fetched case event.

Input

Input Parameter	Required/Optional	Description	Example
Case Filter	Optional	The expression restricting which cases are returned. Supported filter fields are displayName, creatorUserId, creatorUser, lastModifyingUserId, lastModifyingUser, assignee, assignedUser, stage, priority, important, type, environment, case_data_state, score, alertsSla, sla, tags, products, closureDetails, and tasks. String values are wrapped in single quotes, for example displayName='some_name'. The case_data_state field is the only one spelled with underscores, and there is no status field; case_data_state is used in its place. By default, or when the value is empty, all cases are returned.	displayName='some_name'
Order By	Optional	The order of the cases in the response, given as a comma separated list of fields, each optionally followed by desc, for example displayName desc, priority. Supported sort fields are the same as the filter fields. By default, cases are returned in descending order of their create time.	createTime desc
Limit	Optional	The maximum number of cases to return. By default, the value is 100. The command requests up to 1000 per page and pages until the limit is reached, so a value above 1000 is honored rather than truncated.	100

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data displays Failed, an Error tab will appear in the Test Result window.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	List Cases failed.
Status Code	The response code issued by the third-party API server or the D3 system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Google SecOps portal. Refer to the HTTP Status Code Registry for details.	Status Code: 403.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Invalid request — missing required parameter.

Error Sample Data
List Cases failed.
Status Code: 403
Message: Request had insufficient authentication scopes.

List Case Stages

Returns the case stages configured on this Google SecOps instance. Use it to discover the valid values for the Stage parameter of the Change Case Stage and Update Case commands, which are tenant-specific and cannot be guessed.

Input

N/A

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data displays Failed, an Error tab will appear in the Test Result window.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	List Case Stages failed.
Status Code	The response code issued by the third-party API server or the D3 system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Google SecOps portal. Refer to the HTTP Status Code Registry for details.	Status Code: 403.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Invalid request — missing required parameter.

Error Sample Data
List Case Stages failed.
Status Code: 403
Message: Request had insufficient authentication scopes.

Test Connection

Performs a health check on the integration connection. A periodic health check can be scheduled by selecting Connection Health Check when editing the integration connection.

Input

N/A

Output

Output Type	Description	Return Data Type
Return Data	Indicates one of the possible command execution states: Successful or Failed. The Failed state can be triggered by any of the following errors: A connection issue with the integration The API returned an error message No response from the API More details about an error can be viewed in the Error tab.	String

Error Handling

If the Return Data displays Failed, an Error tab will appear in the Test Result window.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Test Connection failed. Failed to check the connector.
Status Code	The response code issued by the third-party API server or the D3 system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Google SecOps portal. Refer to the HTTP Status Code Registry for details.	Status Code: 403.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: You must have a valid support account to call this API.

Error Sample Data
Test Connection failed. Failed to check the connector.
Status Code: 403
Message: Request had insufficient authentication scopes.