Originally reported by ZDNet, February 2020.
Overview
Google Cloud announced a series of new security capabilities aimed at enterprise customers. The centerpiece of the announcement was a significant expansion of Chronicle’s security analytics platform, including a new threat-detection rules language and a unified event timeline data model. Google also moved two additional security services — Web Risk API and reCAPTCHA Enterprise — into general availability.
Chronicle Joins Google Cloud
Chronicle was originally incubated inside Alphabet’s X moonshot division as a standalone cybersecurity company. Google subsequently folded Chronicle into Google Cloud, positioning it as the foundation of the company’s enterprise security analytics story. The integration gave Google Cloud a purpose-built platform for ingesting, indexing, and analyzing large volumes of security telemetry.
YARA-L: A Threat Detection Language Built for Modern Attacks
The most technically significant announcement was YARA-L, a new rules language designed specifically for detecting threats in security logs and telemetry data.
Background: What Is YARA?
YARA is a widely adopted, open-source pattern-matching language originally designed for identifying and classifying malware samples based on file characteristics. Security researchers and analysts use YARA rules extensively to describe malware families and detect malicious binaries.
What YARA-L Adds
The Chronicle team extended the YARA concept to cover log-based detection use cases — hence the “L” suffix. YARA-L allows security analysts to write detection rules that operate on:
- Security log data (authentication logs, firewall logs, etc.)
- Endpoint Detection and Response (EDR) telemetry
- Network traffic metadata
Critically, YARA-L rules are designed to map to the tactics and techniques catalogued in the MITRE ATT&CK framework — an industry-standard knowledge base that organizes the methods adversaries use during an attack lifecycle. This alignment means analysts can write detection logic that directly corresponds to known adversary behaviors rather than only looking for specific file signatures.
Google stated that the new threat detection offering supports massively scalable rule execution in both real-time and retroactive modes — meaning analysts can run new rules against historical data to find threats that may have gone undetected previously.
Unified Event Timeline: Automatic Attack Chain Correlation
Chronicle also introduced a new data structure that combines an updated data model with the ability to automatically link multiple security events into a single, coherent timeline.
To illustrate the value: imagine an employee who receives a phishing email containing a malicious link, then visits a credential-harvesting site, and finally downloads a malware payload. These three actions generate logs in three separate systems — email gateway, proxy or DNS logs, and endpoint telemetry. Traditionally, a security analyst investigating a breach would need to manually correlate these logs to reconstruct the attack chain.
Chronicle’s new data structure automates this correlation, stitching together seemingly unrelated events into a single timeline automatically. This reduces investigation time and lowers the risk that an analyst misses a critical link in an attack sequence.
Palo Alto Networks Cortex XSOAR was announced as the first Google Cloud partner to integrate with this new data structure.
Web Risk API and reCAPTCHA Enterprise Reach General Availability
Two additional Google Cloud security services moved from preview into general availability as part of the same announcement.
Web Risk API
The Web Risk API gives organizations programmatic access to Google’s database of known malicious URLs and domains. Practical use cases include:
- Warning users before they follow a suspicious link on your platform
- Blocking user-submitted content that contains links to known malicious pages
- Scanning URLs at ingestion time to flag high-risk content
reCAPTCHA Enterprise
reCAPTCHA Enterprise is aimed at protecting web applications and user accounts from automated abuse. It targets threats such as:
- Credential stuffing and misuse — automated login attempts using leaked username/password pairs
- Web scraping — automated harvesting of site content at scale
- Fake account creation — bot-driven registration of fraudulent accounts
Unlike the consumer-facing reCAPTCHA product, the Enterprise tier is designed for integration into business-critical workflows with more granular risk scoring and policy controls.
Context: Google Cloud’s Enterprise Security Push
These announcements came as Google Cloud was actively working to close the gap on AWS and Microsoft Azure in the enterprise market. At the time of the announcement, Google Cloud had disclosed an annual revenue run rate of $10 billion. Security capabilities are a key differentiator for enterprise cloud buyers, and absorbing Chronicle gave Google a credible enterprise security analytics story to compete alongside native offerings from its rivals.
In December 2019, Google Cloud had also announced new partnerships with external cybersecurity firms, further broadening its security ecosystem ahead of this February 2020 product wave.
Summary
| Capability | What It Does | Status |
|---|---|---|
| YARA-L | Log-based threat detection rules language aligned to MITRE ATT&CK | New feature in Chronicle |
| Unified Event Timeline | Automatically correlates disparate events into a single attack chain | New feature in Chronicle |
| Web Risk API | Identifies known malicious URLs for real-time protection | Generally Available |
| reCAPTCHA Enterprise | Protects against automated account abuse and scraping | Generally Available |