Standardize Windows Events for Google SecOps
A bundle of processors for standardizing Google SecOps data.
Included Processors
1
Google SecOps Standardization
Standardizes Windows Event Logs into a common format that can be used with Google SecOps. Sets the SecOps log type from the channel-specific 'log_type' attribute emitted by the Windows Events sources, defaulting to 'WINEVTLOG' and routing non-standard channels (Sysmon, PowerShell, DNS, MSSQL) to their dedicated SecOps log types.
2
Copy Field
Copies the resource's host name to the 'ingestion_source' ingestion label for Google SecOps alerting and SHM functionality.
Example Telemetry
Log
| Name | Before | After |
|---|---|---|
| observed_time | 2026-01-02T09:15:00Z | 2026-01-02T09:15:00Z |
| time | 2026-01-02T09:14:58Z | 2026-01-02T09:14:58Z |
| severity_text | INFO | INFO |
| severity_number | 9 | 9 |
Body
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"><System><Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-a5ba-3e3b0328c30d}"/><EventID>4624</EventID><Version>2</Version><Level>0</Level><Task>12544</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime="2026-01-02T09:14:58.123Z"/><EventRecordID>9876</EventRecordID><Channel>Security</Channel><Computer>DC01.corp.example.com</Computer></System><EventData><Data Name="SubjectUserSid">S-1-5-18</Data><Data Name="TargetUserName">jsmith</Data><Data Name="LogonType">3</Data></EventData></Event><Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"><System><Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-a5ba-3e3b0328c30d}"/><EventID>4624</EventID><Version>2</Version><Level>0</Level><Task>12544</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime="2026-01-02T09:14:58.123Z"/><EventRecordID>9876</EventRecordID><Channel>Security</Channel><Computer>DC01.corp.example.com</Computer></System><EventData><Data Name="SubjectUserSid">S-1-5-18</Data><Data Name="TargetUserName">jsmith</Data><Data Name="LogonType">3</Data></EventData></Event>Attributes
| Name | Before | After |
|---|---|---|
| log.windows.channel | Security | Security |
| log.windows.computer | DC01.corp.example.com | DC01.corp.example.com |
| chronicle_ingestion_label["ingestion_source"] | DC01.corp.example.com | |
| chronicle_log_type | WINEVTLOG |
Resource
| Name | Before | After |
|---|---|---|
| host.name | DC01.corp.example.com | DC01.corp.example.com |
| os.type | windows | windows |