| Capability |
| Data ingestion, search, retention |
Security data ingestion from virtually any source (multi-cloud, data center, on-prem) at petabyte scale. Unified Data Model enables search at sub-second speeds, and you can search raw unparsed logs in Chronicle. Twelve months of hot security telemetry data. |
With single Sign On (SSO), you can pivot seamlessly from Foundation to Chronicle to search and threat hunt. |
| Multi-level multitenancy |
|
Purpose-built for service providers and enterprises that manage multiple tenants, Resolution Intelligence Cloud Foundation provides highly scalable deployment, visibility, and management across multiple Chronicle tenants secured with role-based access control (RBAC) and SSO. |
| Detection rules |
You can write and edit rules in YARA-L. |
GUI detection rule builder so you can create and edit YARA-L rules without code — a huge time saver for most people. Rules are saved and run directly in Chronicle. Includes rule testing. Content Management System for managing rules and applying to all, some, or one Chronicle tenant. |
| Rule and parser packs |
Chronicle comes with a set of detection rules and parsers. |
Foundation comes with additional detection rules and parser packs. Netenrich services can, optionally, create custom rules and parsers for you. |
| Dashboards and reports |
Chronicle has default dashboards for analysis and reporting. Reporting is available by converting a dashboard to a shareable file (PDF, Excel, CSV, etc.). Dashboards are built on Looker (visualization layer) and BigQuery (data layer). |
Foundation comes with additional dashboards and reports — modify those or create your own with our no-code, configurable dashboard builder built directly on BigQuery. It's faster and easier to use. Run reports on one, some, or all Chronicle tenants. |
| MITRE ATT&CK mapping |
Google Cloud Threat Intelligence (GCTI) provides and manages a set of YARA-L rules to help customers identify threats to their enterprise. |
Foundation maps alerts to the MITRE ATT&CK framework, providing context and making it easier to detect and respond. Foundation reveals gaps where you lack log coverage. At higher subscription levels, Resolution Intelligence Cloud shows patterns of related alerts mapped to MITRE ATT&CK to provide even more context. |
| Threat intelligence |
Chronicle includes VirusTotal. Chronicle customers who are Google Cloud Threat Intelligence (GCTI) customers get GCTI alerts. |
Netenrich Threat Intelligence adds third-party threat intelligence, vulnerability disclosures, reference lists of threat intelligence, and advisories. |
| Content Management System |
|
Manage sets of rules for one or more Chronicle instances. For example, group sets of rules that belong together, such as compliance rules, or even sets of rules specific to a type of compliance like PCI, HIPAA, and GDPR. Service providers can then create and manage rule packs for their customers who need them. |
| |
|
|
.png?width=221&height=100&name=agiliti-pp3fy2waenyzq4jnun4z5d6d9j74rxybe8i1y8zzsw%20(1).png)
