Clarification on Ingesting Google Vault Logs into Google SecOps SIEM

Hi ​@manoj610 .  In the following documentation I can see Password Vault listed as one of the supported log types under WORKSPACE_ACTIVITY, so I believe in short the logs are supported.  There might be some additional logistics involved in making sure that the Vault logs are actually getting generated and flowing, but on surface level I want to say that they are one of the supported log types under the WORKSPACE_ACTIVITY log type.

https://cloud.google.com/chronicle/docs/ingestion/default-parsers/workspace-activity

Showing the Content Hub item for Google Workspace, specifically the Data Collection section

--Vasken

Hi, 

I am also looking to ingest vault logs into secops. I have workspace logs coming into secops but can’t seem to see any vault logs coming in. I can see the events in Google Admin so can confirm events are being created. 

Is there anything specific that needs to be setup to enable these events to come in? 

Thanks 

There is a documentation page covering what is covered by native integration and not.  Vault is listed as being covered by the native integration -   https://docs.cloud.google.com/chronicle/docs/ingestion/default-parsers/collect-workspace-logs

It used to be you had to create a manual feed and specify the application (via the api name, which is vault from memory)

Thanks for the reply! 

This might be a silly questions - but I can’t see Google Vault under the supported application name and event types for WORKSPACE_ACTIVITY? Did you mean password vault by chance? 

I may have got the two mixed up, apologies.  In which case yes, I do not see vault in there, and so you would need to use the legacy Feed Management, and set the application as vault.

Additionally, a support request to raise as a FR so Google can consider adding that to the native list of sources they ingest.

Ah ok no worries - is there any documentations or steps to get the Vault logs via the legacy feed management way? Not sure I have done it before. 

Thanks 

​@d_patel_dj , You can find the legacy feed method here, under Method 2:

https://docs.cloud.google.com/chronicle/docs/ingestion/default-parsers/collect-workspace-logs

Vault can be added to the applications: