/

/

Google Cloud

/

Google Cloud

Centralize Google Cloud telemetry in seconds

Centralize Google Cloud telemetry in seconds

Optimize Chronicle and BigQuery costs, stream from Pub/Sub, and build efficient security data architectures on Google Cloud infrastructure.

Native

Chronicle integration

Native

Chronicle integration

Native

Chronicle integration

Full

GCS/BigQuery support

Full

GCS/BigQuery support

Full

GCS/BigQuery support

All

GCP Deployments

All

GCP Deployments

The Problem

The spiraling cost of cloud silos

The spiraling cost of cloud silos

Chronicle pricing works until cloud growth triggers budget talks. High-volume VPC and Audit logs often drive premium prices for routine telemetry. By adding a transformation layer, you can optimize these streams and ensure your investment is focused on high-value security insights at any scale.
The Solution
The Solution
The Solution

Optimize GCP security data with Tenzir

Tenzir filters, transforms, and routes Google Cloud security telemetry efficiently. Reduce Chronicle ingest costs, optimize BigQuery storage, and maintain full visibility across your GCP environment. Chronicle remains your detection engine, Tenzir makes sure it only sees what matters.
Chronicle optimization

Refine your telemetry before Chronicle ingest by filtering routine events at the source. Focus on high-fidelity data to maximize security impact while keeping your operations lean.

Chronicle optimization

Refine your telemetry before Chronicle ingest by filtering routine events at the source. Focus on high-fidelity data to maximize security impact while keeping your operations lean.

Chronicle optimization

Refine your telemetry before Chronicle ingest by filtering routine events at the source. Focus on high-fidelity data to maximize security impact while keeping your operations lean.

Pub/Sub native

Unlock sub-second latency for Cloud Audit and VPC Flow Logs with real-time Pub/Sub ingestion. Build unified pipelines that scale effortlessly alongside your custom app events.

Pub/Sub native

Unlock sub-second latency for Cloud Audit and VPC Flow Logs with real-time Pub/Sub ingestion. Build unified pipelines that scale effortlessly alongside your custom app events.

Pub/Sub native

Unlock sub-second latency for Cloud Audit and VPC Flow Logs with real-time Pub/Sub ingestion. Build unified pipelines that scale effortlessly alongside your custom app events.

BigQuery & GCS routing

Stream data to BigQuery for analytics or archive to GCS in Parquet format. Achieve 10x cost savings over direct streaming while maintaining deep, searchable historical visibility.

BigQuery & GCS routing

Stream data to BigQuery for analytics or archive to GCS in Parquet format. Achieve 10x cost savings over direct streaming while maintaining deep, searchable historical visibility.

BigQuery & GCS routing

Stream data to BigQuery for analytics or archive to GCS in Parquet format. Achieve 10x cost savings over direct streaming while maintaining deep, searchable historical visibility.

Deep Dive
Deep Dive
Deep Dive

The GCP-native security data pipeline

Tenzir filters, transforms, and routes Google Cloud security telemetry efficiently. Reduce Chronicle ingest costs, optimize BigQuery storage, and maintain full visibility across your GCP environment. Chronicle remains your detection engine, Tenzir makes sure it only sees what matters.

from file "/var/log/suricata/*.json"
| where event_type ! = "stats"
| where alert.severity > 2
| publish suricata-alerts
| to splunk

from file "/var/log/suricata/*.json"
| where event_type ! = "stats"
| where alert.severity > 2
| publish suricata-alerts
| to splunk

from file "/var/log/suricata/*.json"
| where event_type ! = "stats"
| where alert.severity > 2
| publish suricata-alerts
| to splunk

Why Tenzir optimizes GCP security

Direct ingestion

Most SIEMs have limited validation. Bad data gets indexed, consuming license and corrupting analytics. You find out during an investigation, when a rule should have fired but didn't.

No pre-ingest filtering
Premium pricing for noise
Limited transformation options

Tenzir sits between GCP sources and destinations, optimizing data before it incurs costs. Filter and aggregate to maximize value. Chronicle handles detection and Tenzir data engineering.

Pre-ingest optimization
Significant cost reduction
Full transformation capabilities
Integrations

Connect your GCP security stack

Unify VPC Flow Logs, Cloud Armor, and Audit data into one agile stream. Capture feeds from Pub/Sub or Security Command Center and route signal to Chronicle, BigQuery, GCS, or external tools like Splunk and Sentinel. Build with Terraform for GKE and Cloud Run to scale as fast as your code.

Integrations

Connect your GCP security stack

Unify VPC Flow Logs, Cloud Armor, and Audit data into one agile stream. Capture feeds from Pub/Sub or Security Command Center and route signal to Chronicle, BigQuery, GCS, or external tools like Splunk and Sentinel. Build with Terraform for GKE and Cloud Run to scale as fast as your code.

Integrations

Connect your GCP security stack

Unify VPC Flow Logs, Cloud Armor, and Audit data into one agile stream. Capture feeds from Pub/Sub or Security Command Center and route signal to Chronicle, BigQuery, GCS, or external tools like Splunk and Sentinel. Build with Terraform for GKE and Cloud Run to scale as fast as your code.

Unify your cloud streams

to close visibility gaps

Unlock the full power of your GCP telemetry without the heavy lifting. Scale your Chronicle and BigQuery workflows with a lean and agile data plane that puts you back in the driver seat of your cloud footprint.
Explore Tenzir on your own

Start instantly with the Tenzir Community Edition. Log in to get hands-on with core features.

Read tutorial and guides

Our docs come with tutorials, explanations, and a rich reference. Everything you need to start.

Join the community

Share your thoughts and questions with our community of security and data enthusiasts.

Unify your cloud streams

to close visibility gaps

Unlock the full power of your GCP telemetry without the heavy lifting. Scale your Chronicle and BigQuery workflows with a lean and agile data plane that puts you back in the driver seat of your cloud footprint.
Explore Tenzir on your own

Start instantly with the Tenzir Community Edition. Log in to get hands-on with core features.

Read tutorial and guides

Our docs come with tutorials, explanations, and a rich reference. Everything you need to start.

Join the community

Share your thoughts and questions with our community of security and data enthusiasts.

Unify your cloud streams

to close visibility gaps

Unlock the full power of your GCP telemetry without the heavy lifting. Scale your Chronicle and BigQuery workflows with a lean and agile data plane that puts you back in the driver seat of your cloud footprint.
Explore Tenzir on your own

Start instantly with the Tenzir Community Edition. Log in to get hands-on with core features.

Read tutorial and guides

Our docs come with tutorials, explanations, and a rich reference. Everything you need to start.

Join the community

Share your thoughts and questions with our community of security and data enthusiasts.