Collect Chrome Enterprise data

This document describes how to collect Google Chrome logs into Google SecOps using the Enterprise reporting connector. It details the data ingestion process for both Google Chrome Enterprise Core and Chrome Enterprise Premium deployments, while noting that some advanced log data requires a Chrome Enterprise Premium license.

Typical deployment

A typical deployment consists of a combination of the following components:

• Chrome: The Chrome browser and ChromeOS management events that you want to collect.

• ChromeOS: You can configure ChromeOS managed devices to send logs to Google SecOps. ChromeOS devices are optional.

• Chrome Enterprise reporting connector: The Chrome Enterprise reporting connector forwards Chrome logs to Google SecOps.

• Google SecOps: Retains and analyzes Chrome logs.

Before you begin

• A Google Workspace Administrator account.
• Google Chrome 137 or later. Earlier versions don't provide complete referrer URL data.
• Chrome Enterprise Premium licenses for advanced features.
• Optional: A Google SecOps ingestion token. If using this option, you also need your Google Workspace Customer ID from the Google Workspace Admin console.
• Optional: A Chronicle Ingestion API key provided by your Google SecOps representative.

Set up Chrome browser cloud management

1. Enroll the target devices to enable cloud management of Chrome browsers. For details, see Enroll cloud-managed Chrome browsers .

2. Optional: Configure Evidence Locker for investigation of suspicious files. (Chrome Enterprise Premium only)

3. Optional: If you use Identity-Aware Proxy, perform the steps in Collect Chrome Enterprise Premium Context Access Aware Data to integrate this data into Google SecOps.

Connect Chrome data to your Google SecOps instance

Configure the Chrome Management parser and the Chrome Enterprise reporting connector.

Configure the Chrome Management parser

You may need to update to a new version of the Chrome Management parser to support recent Chrome logs.

1. In your Google SecOps instance, go to Menu> Settings> Parsers.
2. Find the Chrome Management prebuilt entry and verify that you are using a version date 2025-08-14or newer by applying any pending updates.

Configure Chrome Enterprise Premium

This section describes how to set up logging for Chrome Enterprise Premium.

You can configure log forwarding for Chrome Enterprise Premium that includes context from Safe Browsing. The Chrome Enterprise reporting connector for Chrome Enterprise Premium can configure, and optionally forward the following log types:

• Browser crashes
• Content transfers
• Data access controls
• Extension installations
• Extension telemetry
• Google login activity
• Malware transfer
• Password breach
• Password changed
• Password reuse
• Sensitive data transfer
• Suspicious URL
• Unsafe site visits
• URL filtering interstitial
• URL navigations

Set up the Chrome Enterprise Premium data for export

To configure the Chrome Enterprise reporting connector for Chrome Enterprise Premium logging using the recommended security settings:

1. In the Google Admin console, go to Menu > Chrome browser > Connectors .
2. In the Introducing Google SecOps for Chrome Enterprise Databanner, click View Details & Enable.
3. On the Enable Google SecOps for Chrome Enterprise Premiumpage, enter a Configuration name.
4. Select a forwarding option, as described in Configure the Chrome Enterprise reporting connector .

Configure the Chrome Enterprise reporting connector

The Chrome Enterprise reporting connector sends log data to Google SecOps for both Chrome Enterprise Premium and Chrome Enterprise Core.

Configure the Chrome Enterprise reporting connector to send Chrome data to Google SecOps using one of the following options:

• If you've previously configured Google Cloud Audit Logs to forward to a Google SecOps, you may have an option to send Chrome Enterprise Premium logs. For details, see
  Configure Chrome Forwarding to a Google SecOps instance in the same organization .

• You can use a temporary token code generated from Google SecOps to configure forwarding to a Chrome Enterprise Premium instance. For details, see
  Configure Chrome Forwarding to Google SecOps using an integration token .

• Alternatively, you can use a Chronicle Ingestion API key. For details, see
  Configure Chrome Forwarding to Google SecOps using the Chronicle Ingestion API .

Configure Chrome Forwarding to a Google SecOps instance in the same organization

You may have an option to select an existing Google SecOps instance in the connector configuration if all of the following prerequisites are satisfied:

• The Google SecOps instance is connected to a Google Cloud project.

• The Google Cloud project is within the same organization as the Google Workspace managing your Chrome Enterprise Premium.

• You previously configured a Cloud Audit Logs integration from that organization to Google SecOps.

If these prerequisites are satisfied, the Google SecOps instance should appear in the selection list under Use instance in associated GCP account.

To configure Chrome forwarding to a Google SecOps instance in the same organization, do the following:

1. Type a name for the configuration.
2. From the Use instance in associated GCP accountoption, select the Google SecOps instance.
3. Select the log types to forward from the Log export settings.
4. Click Test connection.
5. Click Enableafter successfully testing the connection.
6. Click Donewhen the configuration has completed.

Configure Chrome Forwarding to Google SecOps using an integration token

If the destination Google SecOps instance doesn't appear in the selection list or you need to forward Chrome logs to a Google SecOps instance in a different Google Cloud, do the following:

1. Provide your Google Workspace Customer ID to the Google SecOps administrator of the destination instance and have them obtain your Google SecOps instance ID and token . This token is valid for 24 hours.

2. Type a name for the configuration.

3. Select Use instance outside of your organization.

4. Enter the token code provided by the Google SecOps administrator.

5. Select the log types to forward from the Log export settings.

6. Click Test Connection.

7. Click Enableafter successfully testing the connection.

8. Click Donewhen the configuration has completed.

Configure Chrome Forwarding to Google SecOps using the Chronicle Ingestion API

You can configure the Google Chrome reporting connector using a Chronicle Ingestion API key. You should only use this method if no other integration method is available.

1. In the Admin console, go to Menu > Devices > Chrome > Connectors.

2. Click + New provider configuration.

3. On the side panel, find the Google SecOps setup and click Set up.

4. Enter the Configuration ID, API key, and Host Name:

   • Configuration ID: The ID is shown on the User & browsers settingspage and the Connectorspage.

   • API key: The API key to specify when calling the Chronicle ingestion API to identify the customer.

   • Host Name: The Ingestion API endpoint. For US customers, this must be malachiteingestion-pa.googleapis.com. For other regions, see regional endpoints documentation .

5. Click Add Configurationto add the new provider configuration.

Collect Chrome Enterprise Premium context access-aware data

Set up feeds to ingest Chrome Enterprise Premium content specific to Identity-Aware Proxy (IAP) and context-aware access data.

Who should enable the Identity-Aware Proxy API?

• Chrome Enterprise Premium customers who use Identity-Aware Proxy (IAP) data should enable it.
• For Chrome Enterprise Premium customers who don't use Identity-Aware Proxy data, enabling the Identity-Aware Proxy API is optional (but recommended). Doing so adds additional context-aware access data fields to your log data.

To enable the Identity-Aware Proxy API, perform the steps in Collect Chrome Enterprise Premium Context Access Aware Data .

Verify the data flow

To verify the data flow:

1. Open your Google SecOps instance.
2. Go to Menu> Search.
3. Run the following search query to look for raw, unparsed events: metadata.log_type = "CHROME_MANAGEMENT"

Supported log types

The following sections are applicable to the CHROME_MANAGEMENT parser.

Supported log events

Supported Chrome log formats

The CHROME_MANAGEMENT parser supports logs in JSON format.

Supported Chrome sample log

Sample of a raw log for ingestion by the Chrome Management parser, in JSON format:

• JSON:

   {
    "event": "badNavigationEvent",
    "time": "1622093983.104",
    "reason": "SOCIAL_ENGINEERING",
    "result": "EVENT_RESULT_WARNED",
    "device_name": "",
    "device_user": "",
    "profile_user": "sample@domain.io",
    "url": "https://test.domain.com/s/phishing.html",
    "device_id": "e9806c71-0f4e-4dfa-8c52-93c05420bb8f",
    "os_platform": "",
    "os_version": "",
    "browser_version": "109.0.5414.120",
    "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36",
    "client_type": "CHROME_BROWSER_PROFILE"
  } 
  

Field mapping reference

The following field mapping tables are relevant to the CHROME_MANAGEMENT parser (log type).

This section explains how the Google SecOps parser maps Chrome log fields to Google SecOps Unified Data Model (UDM) fields for the data sets.

Field mapping reference: Event Identifier to Event Type

The following table lists the CHROME_MANAGEMENT log types and their corresponding UDM event types.

Field mapping reference: CHROME_MANAGEMENT

The following table lists the log fields of the CHROME_MANAGEMENT log type and their corresponding UDM fields.

Field mapping reference (preview version)

All fields are applicable to Chrome Enterprise Core customers and Chrome Enterprise Premium customers. Fields that are only applicable to Chrome Enterprise Premium customers are labeled "[CEP Only]".

Field mapping reference: CHROME_MANAGEMENT (preview version)

The following table lists the log fields of the CHROME_MANAGEMENT log type and their corresponding UDM fields.

Need more help? Get answers from Community members and Google SecOps professionals.