MAX SALTONSTALL: Hi.
I'm Max Saltonstall, and I'm here
to show you Chronicle, Google's cloud-native security analytics
platform.
Security systems and their operators
are suffering from intense data overload.
We see companies generating petabytes of security data
to sift through, slowing down the analysis
and making costs skyrocket.
Chronicle Security Analytics solves these problems,
putting threat tools, detection, intelligence,
and forensic signals into one scalable tool set.
There are six things that set Chronicle apart
from traditional security incident and event management
products.
I'll walk you through each one briefly.
Beyond just ingesting and storing
all the data you throw at it, Chronicle also
makes it useful automatically, so you can easily
map people to hosts, to IPs, and track down
the exact sequence of events leading to an incident.
We get major benefits from building on Google Search
components.
Chronicle is continuously re-evaluating log activity
against threat intel.
When intel changes, we automatically
reapply it against all historical activity.
No other SIEM does this.
Five login failures in two minutes
is no longer a useful threat rule.
We extended YARA, an open standard for malware rule
writing, to handle event logs so that you
can write the types of rules to detect subtle malware attacks.
Another perk of using Google infrastructure is speed.
Even searches against petabytes of data
take less than a second.
And because Chronicle is a purpose-built security
application, clients find that tier-1 analysts
are much more productive.
Most organizations spend more time
managing and tuning their SIEM than they do using it
for security operations.
With Chronicle, you don't buy servers or storage,
and you don't tune anything.
Your team can work on operations and analytics
and protect your business.
Get the benefit of cloud operations
and get your analysts out of the business of IT management.
Chronicle rewrites the economics of SIEM.
We don't charge by the byte or for ingest or for servers,
storage, or even compute.
You get a predictable fixed price
based on the size of your organization in people.
One simple price, all in.
And it won't break the bank, because pricing
is based on heads not bytes.
We want to encourage you to have as much data as possible
in Chronicle and never get penalized because you've
gathered more logs to analyze.
How do we make all that magic happen?
Let's take a look at the architecture.
The data layer enables you to send all your security
telemetry and threat intelligence
into a private container, where it
is augmented with additional threat intelligence.
Within your private cloud container,
your security telemetry is normalized, enriched,
de-duplicated, and linked together
into a coherent timeline for analysis and investigation.
Finally, that data is exposed via our investigation hunting
and detection capabilities, as well as to other security
products, via APIs.
In addition to your data, stored privately
in its own encrypted instance, we
can bring in third-party signals and curated internal data
to enhance your ability to detect and respond
to threats quickly.
There are three ways customers are using Chronicle today.
Extend your current SIEM with high-volume data
that today you throw away.
For example at Google, we found that DNS data is incredibly
useful for investigation and detection,
but very few companies actually capture it.
Almost no one keeps a year of it in their SIEM.
But we keep all your security telemetry for an entire year
and make it instantly accessible.
Enhance your event detection and response capabilities
by keeping the data for more than a week or month.
EDR generates a ton of data, and the vendors struggle as much
as customers to keep it.
We can keep a year of it, make it searchable,
and correlate it to other telemetry.
Evolve your old and rusty SIEMs.
They're overdue for an update, and cloud technologies
can make them faster and more efficient.
You can deploy Chronicle in days rather than months
and transform your security operations metrics.
Check out chronicle.security to learn more about how
we can help you extend your current security management
platform, enhance your detection and response,
and evolve from outdated systems.
[MUSIC FADING OUT]