Chronicle

Every computer in a company constantly records what it does. Who logged in, which file was opened, which internet address was accessed. These records are called logs. In a large corporation, billions of lines of these accumulate every day. Chronicle is a Google service that collects all these lines, stores them for years, and automatically searches them for clues of an attack. The product originated in 2018 at Google’s idea lab X and has officially been called Google Security Operations since 2023.

Why attackers often go unnoticed for months

Break-ins into company networks are rarely noticed immediately. Studies frequently cite several weeks to months for the time between intrusion and detection. During this period, the attacker moves through the network and gathers data. The traces of this are almost always in the logs. It’s just that no one looks at them, because there are far too many.

On top of that, there’s a cost problem. Classic security systems charge based on the amount of data fed into them. As a result, companies often delete their logs after just 30 or 90 days. When a new attack method later becomes known, exactly the old data one would need to check is missing.

This is where Chronicle comes in. The price is not based on data volume, but roughly on the size of the company. Logs are retained for one year by default. If an attack method from the previous year becomes known in March, one can retroactively check whether one was affected.

From raw log to alert

The first step is collection. Firewalls, laptops, servers, and cloud services send their logs to Chronicle. Each device writes them in a different format. Chronicle translates everything into a unified schema so the data can be compared at all. This step is called normalization and is the actual grunt work.

After that, events are linked together. A suspicious internet address from a public threat list is checked against all stored connections. Chronicle then shows which machine contacted it and when, across the entire stored time period. Google touts that such searches finish in seconds rather than hours. This is made possible by the same infrastructure that also runs Google Search.

The third layer is rules and AI. Security professionals write detection rules in a dedicated language called YARA-L, for example: alert if an account logs in from two countries within one hour. Since 2023, Gemini, Google’s language model, has been added. It summarizes incidents in understandable sentences and turns a typed question into a search query. An important distinction: a virus scanner protects a single device, while Chronicle is the analysis across all devices.

Who uses Chronicle and how it stands in the market

As a private individual, you will never operate Chronicle. The product is aimed at the security departments of large organizations, meaning banks, insurers, hospital operators, or government agencies. There, teams sit in so-called Security Operations Centers and work through alerts. Chronicle is their work interface.

In business news, the name usually comes up in one particular context: the competition for the security platform market. The technical term for this is SIEM, short for Security Information and Event Management. Competitors include Microsoft Sentinel, Splunk, and CrowdStrike. Google’s acquisition of the security firm Mandiant in 2022 for roughly 5.4 billion dollars also served to feed Chronicle with current knowledge about real attacker groups.

A common misconception is that such a system prevents attacks. It does not. Chronicle blocks nothing, it observes and reports. Blocking happens elsewhere, for example at the firewall. And the quality depends entirely on what data is fed into it. Anyone who fails to connect an important data source will see nothing from it there.