Google Security Operations · SIEM + SOAR
Google SecOps sized by the volume you actually generate
Google's security operations platform in fixed plans by daily log volume. You choose which sources to send, subscribe to the plan that covers that volume and operate with your own team. The entire journey happens on the platform, with no sales step.
01Platform
What Google SecOps is
A cloud-native platform that centralizes security telemetry, normalizes events into a single model, runs continuous detections and orchestrates response. Search runs in seconds across the contracted retention period. In the UPX USS model the technology is the same; what changes is the contracted volume and who operates it.
Collection and normalization (UDM)
Cloud, SaaS, network and endpoint logs are converted to the Unified Data Model, so events from different origins can be correlated with the same query. Parsers are maintained by Google, with no upkeep on your side.
YARA-L rules◆
Detections over events and entities across time windows, written in YARA-L 2.0. The set of curated detections that ships with the environment depends on the contracted edition.
Threat intelligence and enrichment◆
Threat indicators cross-referenced with telemetry and enrichment of users, assets and domains. The source of the intelligence and the availability of behavioral analytics (UEBA) vary by edition.
Cases and playbooks (SOAR)
Alerts grouped into cases, with playbooks for triage, enrichment and containment actions automated through integrations.
Marked capabilities depend on the Google SecOps edition provisioned in your environment. The breakdown is available on the platform, before you subscribe.
02Sources
Pick the sources, size by volume
You don't have to send the company's entire telemetry. Start with the most critical sources and subscribe to the plan that covers their daily volume. New sources join the same environment whenever you want, and start being correlated with the existing ones; if volume grows, you just change plans.
Source examples: typical use cases and MITRE ATT&CK tactics covered
Application / environment
Log sources
Detection examples
ATT&CK tactics
Google Workspace
Log sources
Login, admin and Drive audit
Detection examples
- Login from anomalous origin
- Mass external sharing
- Admin privilege change
ATT&CK tactics
- Initial Access
- Privilege Escalation
- Exfiltration
Microsoft 365 / Entra ID◆
Log sources
Sign-in logs, audit logs, Exchange and SharePoint activity
Detection examples
- Impossible travel
- MFA fatigue
- Email forwarding rule creation
ATT&CK tactics
- Initial Access
- Credential Access
- Collection
AWS
Log sources
CloudTrail, VPC Flow Logs, GuardDuty
Detection examples
- Root credential use
- IAM policy changes
- Public bucket exposure
ATT&CK tactics
- Initial Access
- Persistence
- Exfiltration
Google Cloud◆
Log sources
Cloud Audit Logs, VPC Flow Logs, Security Command Center
Detection examples
- Service account key creation
- Firewall change
- Out-of-pattern access
ATT&CK tactics
- Persistence
- Defense Evasion
- Initial Access
Network perimeter
Log sources
Firewall, proxy and DNS via syslog
Detection examples
- Port scanning
- C2 beaconing
- Known malicious domain lookups
ATT&CK tactics
- Reconnaissance
- Command and Control
Web application / ERP
Log sources
Application logs, WAF, web server
Detection examples
- Authentication brute force
- Injection patterns
- Anomalous data extraction
ATT&CK tactics
- Credential Access
- Initial Access
- Exfiltration
Marked rows include behavioral detections, which depend on UEBA. Without that capability in the contracted edition, they are examples of rules your team writes in YARA-L.
Full list of supported sources and parsers on the platform.
See the list on UPX USS
Sources
The tools already in your environment
EDR, firewall, cloud, identity, and SaaS send telemetry to the same environment, normalized into Google SecOps' single data model.
03Plans
Fixed volume, fixed price
Plans differ only in daily ingestion volume. The platform, the detections and the retention are the same in all of them. Monthly billing, no cost per search.
Starter
US$ 349
/ month
- Ingestion
- 5 GB/day
- Retention
- 180 days
To start with a few critical sources, such as identity and one cloud environment.
Subscribe to Starter →Business
US$ 1,249
/ month
- Ingestion
- 25 GB/day
- Retention
- 180 days
To cover identity, cloud and perimeter with room to grow.
Subscribe to Business →Enterprise
US$ 3,999
/ month
- Ingestion
- 100 GB/day
- Retention
- 180 days
For environments with several high-volume sources, such as EDR, firewall and DNS.
Subscribe to Enterprise →Prefer to delegate the operation?
The UPX SOC 24/7 can run your Google SecOps environment, with our team on shift.
Billing
The subscription is billed by UPX US LLC in US dollars.
To estimate your plan, add up the average daily volume of the sources you will send.
04Architecture
Data flow
An event's path from origin to a response case. The sources you choose feed the first stage; the rest of the pipeline is the same on any plan.
Origin · Scope sources
Cloud services, SaaS, identity, EDR, network appliances and applications you chose to send.
Collection · Feeds and collectors
Analysis · Google SecOps
Response · Cases and actions
Evidence · Reporting and trail
05Sign-up
Self-service, from subscription to activation
There is no proposal, meeting or negotiation. You pick the plan, see the price before confirming and complete the subscription in a secure checkout.
- 1
Create the account
Register the organization on UPX USS.
- 2
Pick the plan
Starter, Business or Enterprise, by daily volume.
- 3
Subscribe at checkout
Secure payment and monthly billing.
- 4
Activate and integrate
Environment provisioned and connection guides per source.
- 5
Grow whenever
New sources or a plan change from the dashboard.
Technical requirements
- Administrative access to the sources to enable log export
- Read credentials (service account, app registration or IAM role) for cloud feeds
- A host for the collector and outbound network access, when there are on-premises syslog sources
Shared responsibility
- Platform infrastructure
- Parsers and normalization
- Detections in the contracted edition
- Threat intelligence in the edition
UPX USS
- Environment provisioning
- Subscription and billing
- Integration guides
- Activation support
Customer
- Sending source logs
- Console access management
- Alert triage and response
- Custom rules, if used
06Technical FAQ
Frequently asked questions
Sizing, billing and data handling questions.
Is it the same platform as a direct contract with Google?
Yes. The environment runs on Google Security Operations; the difference is the contracted volume and the sign-up model. The provisioned edition defines which detections and which threat intelligence ship with the environment, and is detailed on the platform before you subscribe.How do I pick the right plan?
Add up the average daily volume of the sources you intend to send and pick the plan that covers that total with some headroom. Sources like EDR, firewall and DNS usually generate more volume than identity or SaaS logs.Can I write my own detection rules?
Yes. The YARA-L 2.0 rule editor is available in every Google SecOps edition, and the rules you write run alongside the detections that ship with the environment. The active rule limit varies by edition: from 1,000 single-event rules and 75 multi-event rules.Who bills the subscription and in which currency?
The subscription is billed by UPX US LLC in US dollars.For how long is data stored?
Retention of 180 days on the plans, with search across the whole period. If your audit requires 12 months of log history, such as PCI-DSS 4.0 requirement 10.5.1, talk to a specialist: extended retention is defined in the scope operated by our SOC.Who analyzes the alerts?
Your team, in the Google SecOps console. If you would rather have UPX operate the environment, the analysis sits with our SOC 24/7.How does support work without a sales contact?
Through the platform itself: integration documentation per source and ticket submission to the UPX team. There is no sales step to subscribe or to request support.
Managed operation
UPX can operate the SIEM for you
The plans above are for your team to operate, in the Google SecOps console. If the operation is what you lack, the UPX 24/7 SOC takes the shift, on this platform or on the tools you already have. Contracted through a specialist.
Get started
Pick your plan and activate today
Subscribe directly on UPX USS, with no sales step.
Google, Google Cloud and Google Security Operations are trademarks of Google LLC.