Google Chronicle | Ingesting entities into Chronicle#
To have Chronicle automatically ingest Intelligence Center data, you have to:
Create an outgoing feed in Intelligence Center#
In Intelligence Center, in the left navigation bar, go to Data configuration
> Outgoing feeds.In the top-left corner of the view, select the
plus icon in the top-left corner of the page.Under Outgoing feed name, enter a name for the feed.
From the Datasets dropdown, select the datasets you’d like to send to Google Chronicle.
From the Update strategy dropdown, select Append.
From the Transport type dropdown, select HTTP download.
From the Content type dropdown, select EclecticIQ Observables CSV.
Under Transport configuration, uncheck the Public checkbox (if it is checked) and select one or more groups from the Authorized groups dropdown.
If you are using an automation user as defined in our documentation on creating API tokens make sure you choose a group that user belongs to under Authorized groups.Under Schedule, define a schedule for the outgoing feed to run on.
(Optional) Configure the advanced options if needed.
Select Save.
Once the outgoing feed has been created, open it. From its URL, note the feed ID, i.e.
the number at the end of the URL after outgoing-feeds?detail=.
Select Run now to ensure the feed correctly packages the Observables from the datasets you selected for it.
Configure the Connector in Chronicle.#
In Chronicle, in the left navigation bar, go to
Settings.In the left Settings menu, expand the Ingestion dropdown.
Select Connectors.
In the top-left corner of the screen, next to Connectors select the
plus icon.From the Connector dropdown, select the EclecticIQ - Feed Connector.
Select Create.
If you have multiple Chronicle environments, select one from the Environment dropdown.
For Run Every choose a frequency that aligns with the schedule the outgoing feed you just configured runs on.
For API Token, enter the API token you created for the Chronicle integration.
For EclecticIQ URL, enter the URL of your Intelligence Center instance.
For Outgoing Feed ID, enter the feed ID you noted after the creation of the outgoing feed in Intelligence Center.
Select Save.
The connection enabling the ingestion of Intelligence Center Observables into Chronicle is now set up.
You can test the connection by going to the Testing tab and selecting Run connector once. If you ran the outgoing feed after you set it up or it has run automatically according to its Execution schedule
Next step: automate enrichment
With ingestion setup, you can automate the enrichment of intelligence in Chronicle.