Architecture and onboarding
Tenant design, forwarders and feeds, parser selection and custom parsers, and mapping your sources into the Unified Data Model (UDM) so searches and detections work across every log type.
Google Cloud Partner
Google SecOps, engineered properly.
Summit Cyber Group is a Google Cloud Partner. We design, build and tune Google Security Operations: getting the right data in, writing detections that fire for the right reasons, and automating the response. Perth-based, senior people.
Google Cloud PartnerGoogle SecOpsSIEM and SOARCribl
What we do with Google SecOps
Google Security Operations brings SIEM, SOAR and Google threat intelligence into one platform. The platform is only half of it. The value comes from what you feed it, how the data is normalised and what you build on top.
Detection engineering
YARA-L rules mapped to MITRE ATT&CK and the Essential Eight, tuned against your environment. Curated detections switched on where they help, and custom content where they do not cover what matters to you.
SOAR and automation
Playbooks that enrich alerts, contain threats and open tickets, so analysts spend their time on decisions instead of copying data between consoles.
Migrations and side-by-side running
Most organisations do not arrive at Google SecOps with a blank sheet. We have engineered data pipelines that feed Google SecOps alongside Splunk and Microsoft Sentinel, using Cribl to route, reduce and mask data before it lands. That lets you run platforms in parallel, compare detections and cut over without a gap in coverage.
- Source inventory and a migration plan that puts high-value data first
- Detection content translated and tested, not just copied across
- Cribl pipelines so one stream of data can feed more than one platform
- As-built documentation and a handover your own team can run with
Normalisation is where Google SecOps pays off, or does not. Data that is poorly mapped to UDM still arrives, but searches miss it and detections do not fire. Getting the parsing right at onboarding saves rework on every rule you write afterwards.
Why work with us
- Google Cloud Partner, alongside our Tenable Assure Gold, Splunk, Cribl and Check Point partnerships
- SIEM engineering across Google SecOps, Splunk and Microsoft Sentinel, so advice on platform choice is grounded in all three
- Detection and pipeline content you own, in your repository