GoogleCloudPlatform/secops-toolkit

Letzte erfasste Quellaktivität: 12. Juni 2026 um 14:06

SkillsMP-Katalog aktualisiert: 9. November 2026 um 14:22

gesammelte Skills: 9

GitHub-Stars: 94
GitHub-Forks: 28

Mit einem KI-Assistenten installieren

Diesen Prompt kopieren und in den verwendeten KI-Assistenten einfügen.

Follow https://skillsmp.com/skill-install/prompt.md to install Agent Skills from https://github.com/GoogleCloudPlatform/secops-toolkit.

README des Repositorys

README-Quelldatei: README.md

README-Quelldatei lesen

Vollständige README anzeigen

<picture> <source media="(prefers-color-scheme: dark)" srcset="./assets/logo-dark.png"> <source media="(prefers-color-scheme: light)" srcset="./assets/logo-light.png"> <img src="./assets/logo-light.png" alt="SecOps Toolkit" style="align-content: center; width: 33%; max-width: 928px"> </picture> # SecOps Toolkit This repository provides a comprehensive collection of Terraform blueprints, modules, and CICD pipelines designed to automate the implementation of custom integrations, agents, and configurations for Google Cloud SecOps (formerly Chronicle). It aims to provide modular and scalable solutions for various SecOps automation needs. # Foundation <a href="./foundation/" title="SecOps Toolkit Foundation"><img src="./foundation/stages.png" align="left" width="300px"></a> The [SecOps Toolkit Foundation](./foundation/) provides a comprehensive automated solution and reference implementation for setting up a production-ready Google SecOps tenant. Designed with a security-first approach, it seamlessly integrates with both new and existing GCP organizations, addressing common deployment challenges using best practices, Terraform, and YAML-based resource factories. It covers the end-to-end setup across multiple stages, from GCP project provisioning and VPC Service Controls to bootstrapping the SecOps instance with RBAC, rules, and configurations. # Blueprints This folder contains Terraform blueprints for deploying and managing Google Cloud SecOps components and integrations. ## BindPlane OP Management container running on cos-based GCE instance <a href="./blueprints/bindplane-gce/" title="BindPlane OP Management console on GCE"><img src="./blueprints/bindplane-gce/images/diagram.png" align="left" width="300px"></a> This [blueprint](./blueprints/bindplane-gce/) is a simple script for running BindPlane OP Management Console container on Google Compute Engine instance with COS. ## BindPlane OP Management on GKE <a href="./blueprints/bindplane-gke/" title="BindPlane OP Management console on GKE"><img src="./blueprints/bindplane-gke/images/diagram.png" align="left" width="300px"></a> This [blueprint](./blueprints/bindplane-gke/) is a modular and scalable solution for deployment of the BindPlane OP Management Console within a Google Kubernetes Engine (GKE) environment. ## SecOps Archiver <a href="./blueprints/secops-archiver/" title="SecOps Archiver"><img src="./blueprints/secops-archiver/images/diagram.png" align="left" width="300px"></a> This [blueprint](./blueprints/secops-archiver/) offers a comprehensive and adaptable solution for constructing an automation for exporting raw data from a SecOps tenant to Google Cloud Storage for longer retention. The pipeline is built on top of various Google Cloud products. ## SecOps Anonymization Pipeline <a href="./blueprints/secops-anonymization-pipeline/" title="SecOps Anonymization Pipeline"><img src="./blueprints/secops-anonymization-pipeline/images/diagram.png" align="left" width="300px"></a> This [blueprint](./blueprints/secops-anonymization-pipeline/) is a comprehensive and adaptable solution for constructing a SecOps pipeline for exporting raw data from a SecOps tenant, optionally anonymize this data and then import data back in a different SecOps tenant. ## SecOps GKE Forwarder <a href="./blueprints/secops-gke-forwarder/" title="SecOps GKE Forwarder"><img src="./blueprints/secops-gke-forwarder/images/diagram.png" align="left" width="300px"></a> This [blueprint](./blueprints/secops-gke-forwarder/) is a modular and scalable solution for setting up a SecOps forwarder on Google Kubernetes Engine (GKE). This forwarder is designed to handle multi-tenant data ingestion, ensuring secure and efficient log forwarding to your SecOps SIEM instances. ## SecOps Tenant <a href="./blueprints/secops-tenant/" title="SecOps Tenant"><img src="./blueprints/secops-tenant/images/diagram.png" align="left" width="300px"></a> This [blueprint](./blueprints/secops-tenant/) allows automated configuration of a SecOps instance at both infrastructure and application level with out-of-the-box Feeds integration, automated deployment of SecOps rules and reference lists, as well as Data RBAC scopes. ## SecOps Tenant Factory <a href="./blueprints/secops-tenant-factory/" title="SecOps Tenant Factory"><img src="./blueprints/secops-tenant-factory/images/diagram.png" align="left" width="300px"></a> This [blueprint](./blueprints/secops-tenant-factory/) implements end-to-end configuration of new projects and SecOps SIEM tenants via YAML data configurations and [secops-tenant](./blueprints/secops-tenant) blueprint code. ## SecOps AI Migration Helper <a href="./blueprints/secops-ai-migration-helper/" title="SecOps AI Migraiton Helper"><img src="./blueprints/secops-ai-migration-helper/misc/yaral/images/steps_overview.png" align="left" width="300px"></a> This [blueprint](./blueprints/secops-ai-migration-helper/) is a tool that helps you migrate rules from a SIEM to Google SecOps and reduce the migration time significantly. It uses GenAI to help you migrate the rules in multiple steps. # Modules This folder contains a suite of Terraform modules for Google SecOps automation. These modules are designed to be composed together and can be forked and modified where the use of third-party code and sources is not allowed. Modules aim to stay close to the low-level provider resources they encapsulate and share a similar interface that combines management of one resource or set of resources, and their corresponding IAM bindings. ## SecOps Data RBAC <a href="./modules/secops-data-rbac/" title="SecOps Data RBAC"><img src="./modules/secops-data-rbac/images/diagram.png" align="left" width="300px"></a> This [module](./modules/secops-data-rbac) allows configuration of Data RBAC in Google SecOps. ## SecOps Data Tables <a href="./modules/secops-data-tables/" title="SecOps Data Tables"><img src="./modules/secops-data-tables/images/diagram.png" align="left" width="300px"></a> This [module](./modules/secops-data-tables) allows creation and management of custom data tables in Google SecOps. ## SecOps Rules and Reference lists <a href="./modules/secops-rules/" title="SecOps Rules"><img src="./modules/secops-rules/images/diagram.png" align="left" width="300px"></a> This [module](./modules/secops-rules) allows creation and management of custom rules as well as reference lists in Google SecOps. # Pipelines This folder provides a collection of sample repositories for automating Google Cloud SecOps configuration through CICD pipelines. ## Dashboards As Code <a href="./pipelines/dashboards-as-code/" title="Dashboards As Code pipeline"><img src="./pipelines/dashboards-as-code/images/diagram.png" align="left" width="300px"></a> This [sample repository](./pipelines/dashboards-as-code/) provides a framework for managing SecOps Native Dashboards as Code. ## Detection As Code <a href="./pipelines/detection-as-code/" title="Detection As Code pipeline"><img src="./pipelines/detection-as-code/images/diagram.png" align="left" width="300px"></a> This [sample repository](./pipelines/detection-as-code/) contains ready-to-use code for automated deployment of detection rules and reference lists in Google SecOps via CICD (currently with sample pipelines for GitLab and GitHub). ## Detection As Code (Multitenant) <a href="./pipelines/detection-as-code-multitenant/" title="Detection As Code (Multitenant) pipeline"><img src="./pipelines/detection-as-code-multitenant/images/diagram.png" align="left" width="300px"></a> This [sample repository](./pipelines/detection-as-code-multitenant/) contains a framework for automated deployment of Detection Rules and Data Tables in a multitenant Google SecOps via CICD (we currently have a sample pipeline for GitLab), using Python scripts. ## Parsers As Code <a href="./pipelines/parsers-as-code/" title="Parsers As Code pipeline"><img src="./pipelines/parsers-as-code/images/diagram.png" align="left" width="300px"></a> This [sample repository](./pipelines/parsers-as-code/) provides a framework for managing SecOps parsers as code. ## Response As Code <a href="./pipelines/response-as-code/" title="Response As Code pipeline"><img src="./pipelines/response-as-code/images/diagram.png" align="left" width="300px"></a> This [sample repository](./pipelines/response-as-code/) provides a framework to manage and deploy SOAR playbooks using a "Response as Code" methodology. # Extensions This folder contains editor extensions and developer tooling designed to enhance the authoring experience for Google Cloud SecOps configurations. ## SecOps Grok Language [SecOps Grok Language](./extensions/secops-grok-language/): Visual Studio Code extension providing syntax highlighting and automated document formatting for the Google Security Operations flavor of the Logstash Grok parser configuration files.

README des Repositorys wird geladen…

Skills in diesem Repository

Softwareentwickler Informationssicherheitsanalysten Softwarequalitätssicherungsanalysten und -tester

3 Berufskategorien · 100% klassifiziert