Collect Google Chrome logs

This document describes how you can collect Chrome Browser and ChromeOS security events logs by setting up a Chrome Enterprise reporting connector and how log fields map to Chrome Unified Data Model (UDM) fields.

For more information, see Data ingestion to Google SecOps .

Overview

A typical deployment consists of Chrome Browser and ChromeOS security events configured to send logs to Google SecOps. Each customer deployment might differ and might be more complex. The deployment consists of the following components:

• Chrome: The Chrome Browser and ChromeOS security events that you want to collect.

• Chrome Enterprise reporting connector: The Chrome Enterprise reporting connector forwards Chrome logs to Google SecOps.

• Google SecOps: Retains and analyzes Chrome logs.

An ingestion label identifies the parser which normalizes raw log data to structured UDM format. The information in this document applies to the parser with the CHROME_MANAGEMENT ingestion label.

Before you begin

• Ensure that you have a Google Workspace Administrator account.

• Ensure that all systems in the deployment architecture are configured in the UTC time zone.

• Ensure that you have a Chronicle Ingestion API key. If you don't have one, then contact Google SecOps Support or your Google SecOps customer point of contact to request your Chronicle Ingestion API key.

• For more information, refer to the Chrome log events .

Set up Chrome Browser Cloud Management

The following are the high-level steps to setup Chrome browser Cloud Management:

• Enroll cloud-managed Chrome browsers

• Turn on Chrome browser reporting

• Add new provider configurations

Perform the following steps to setup Chrome browser Cloud Management.

1. In the Admin console, Click Menu> Devices> Chrome> Managed browsers.

2. Optional: Select the top-level organization or select the organizational unit where you want to generate a token that enrolls browsers directly to that specific organizational unit. For more information, see Add an organization unit .

3. Click Enroll. If this is your first browser enrollment, you are prompted to accept the Chrome Browser Cloud Management (CBCM) Terms of Service.

4. Click Copy enrollment token to clipboard.

5. To enroll cloud-managed Chrome browsers, click Done.

6. In the Admin console, go to Menu> Devices> Chrome> Settings> Users & browsers. Select your top-level organizational unit, so that all child organizations inherit the policy. Scroll down to Browser reporting.

7. Set Managed browser reportingto Enable managed browser cloud reporting.

8. To turn on Chrome browser reporting, click Save.

9. In the Admin console, go to Menu> Devices> Chrome> Connectors.

10. Optional: If you are configuring Chrome Enterprise connectors settings for the first time, follow the prompts to turn on Chrome Enterprise Connectors.

11. At the top, click + New provider configuration.

12. In the panel that appears on the right, find the Google SecOps setup and click Set up.

13. Enter the Configuration ID, API key, and Host Name:

    • Configuration ID: The ID that is shown on the User & browsers settingspage and the Connectorspage.

    • API key: The API key to specify when calling the Chronicle ingestion API to identify the customer.

    • Host Name: The ingestion API endpoint. For US customers this will always be malachiteingestion-pa.googleapis.com; for other regions see regional endpoints documentation .

14. Click ADD CONFIGURATIONto add the new provider configuration.

Supported log types and data models

The following are the supported log types and events for Chrome Management. All the supported log types and events are in JSON format.

Supported Google Chrome log formats

The Google Chrome parser supports logs in JSON format.

Supported Google Chrome sample logs

• JSON:

   {
    "event": "badNavigationEvent",
    "time": "1622093983.104",
    "reason": "SOCIAL_ENGINEERING",
    "result": "EVENT_RESULT_WARNED",
    "device_name": "",
    "device_user": "",
    "profile_user": "sample@domain.io",
    "url": "https://test.domain.com/s/phishing.html",
    "device_id": "e9806c71-0f4e-4dfa-8c52-93c05420bb8f",
    "os_platform": "",
    "os_version": "",
    "browser_version": "109.0.5414.120",
    "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36",
    "client_type": "CHROME_BROWSER_PROFILE"
  } 
  

Field mapping reference

This section explains how the Google SecOps parser maps Chrome log fields to Google SecOps Unified Data Model (UDM) fields for the data sets.

Field mapping reference: Event Identifier to Event Type

The following table lists the CHROME_MANAGEMENT log types and their corresponding UDM event types.

Field mapping reference: CHROME_MANAGEMENT

The following table lists the log fields of the CHROME_MANAGEMENT log type and their corresponding UDM fields.

What's next

• Data ingestion to Google SecOps

For Community blogs on Chrome logs, see:

• Integrating Chrome Enterprise Management with Google SecOps

Need more help? Get answers from Community members and Google SecOps professionals.