Ontology overview

Google Security Operations ontology uses a formal specification that provides a shareable and reusable knowledgeable representation of alerts and events. The ontology lets Google SecOps build entities from events and define relationships between them. This process lets you see the full picture and explore potential threats on the Explore Cases page. Once entities have been defined using the ontology, you can run actions on them based on their role in the attack or event.

Ontology status

Go to Settings > Ontology {and_then} Ontology Status to see the following information:

• Number of product types : The number of products that Google SecOps captures from your environment. This number is in flux as more products are added to your environments.
• Number of event types : The number of events that Google SecOps captures.
• Number of events assigned to default families : The number of events that Google SecOps has automatically assigned. You can reassign an event (at any time) by locating the default value in the Family Name column and click settings Configure .

You can export selected ontology status rows as a ZIP file containing a JSON file. You can also import ontology status rows. Be sure to import a ZIP file that contains a JSON with the ontology details.

Set up model families

After you've established an initial data connection, you'll need to complete the following procedures to ensure that the data is ingested into the Google SecOps data model. You'll also need to map and model new events and alerts according to your requirements and as your connectors pick up new events.

To set up a model family, follow these high-level steps:

1. Define the family: click Settings > Ontology > Visual Families .
2. Assign the family to the Event (or Product/Source) from either the Events tab or the Ontology Status page, click Event Configuration > Visualization .

Map data fields

To map data fields, follow these high-level steps:

1. In the CaseManagement or Explore screen, identify missing or incorrect field information.
2. Check if this can be solved by attaching a new Visual Family; otherwise, edit and configure the rules that make up both the Family and the general System fields in the Event Configuration > Mapping page.