Question 1

What is Google Security Operations?

Accepted Answer

Google Security Operations — formerly Chronicle, and still widely called that — is Google's cloud-native security operations platform, combining SIEM, SOAR and threat intelligence in one product rather than three. It runs on the same infrastructure Google built to index the web, which is why searching a year of security telemetry behaves more like a web search than a batch job. Data is normalised on ingest into a Unified Data Model, so a detection written once matches across sources instead of being rewritten per source. Detections are authored in YARA-L, Google's own rule language, and the platform ships with curated Google-authored detection content plus Mandiant threat intelligence, which Google owns outright following its acquisition, alongside VirusTotal. It comes in three packages: Standard covers ingestion, detection, investigation and response; Enterprise adds UEBA, richer threat intelligence and Gemini AI assistance; Enterprise Plus adds the full Mandiant and VirusTotal intelligence, advanced data pipeline management and extended storage options. The defining commercial fact is retention: every package includes twelve months of hot, searchable data at no extra cost. Google was named a Leader in the 2025 Gartner Magic Quadrant for SIEM in only its second year of participating, positioned furthest for Completeness of Vision of any vendor evaluated. TechBag sells Splunk and Microsoft Sentinel too, so the advice here is about fit rather than allegiance.

Question 2

How is Google Security Operations priced — and did the model change?

Accepted Answer

Yes, the model changed, and this is the single most important thing to know before reading any comparison written before 2026. Chronicle was known for metering per employee per year with effectively unlimited ingestion bundled in — a genuinely distinctive model that made it cheap for organisations with huge log volumes relative to headcount. That is not how it is sold now. Today you buy a package — Standard, Enterprise or Enterprise Plus — against a data cap measured in GB, and ingestion is metered against that cap. Any analysis, blog post or vendor comparison written against the per-employee model is describing a product you cannot buy, and that includes a lot of the material still circulating. What is included: twelve months of hot retention on every tier, with retention beyond that window billed separately by volume. There is also a Data Benefit Program covering eligible sources — Google Cloud audit logs and Google Workspace logs free up to 10 GB a day, plus Google Cloud CNAPP alerts, Chrome Enterprise logs and approved third-party EDR alerts — for which you qualify on a new or renewal SecOps order from 1 February 2026 on the Enterprise or Enterprise Plus tier. What is not published: Google does not publish US commercial unit prices, so every deal is quote-based. The one openly published unit price we are aware of is a UK G-Cloud listing at roughly £2,000 per terabyte per year, which is a useful order-of-magnitude anchor and not a quote for you. Practically, this means the number that decides your cost is your GB/day by source measured against a package cap — which is exactly the modelling TechBag does before you commit, quoted in INR with GST.

Question 3

What does twelve months of hot retention actually mean?

Accepted Answer

It means that for a full year, every event you ingested is searchable at full speed as part of what you already bought — not archived to cold storage, not sitting in a cheaper tier you query with different tooling, and not requiring a rehydration step that costs money and takes time. On most SIEMs, retention is a running negotiation: storage is billed per GB per month, so someone decides which sources to keep and for how long, and those decisions get made on budget rather than on risk. The problem is that intrusions are routinely discovered months after they begin, so the data you most need in an investigation is precisely the data a volume-metered platform has been pressuring you to delete. Teams find this out during an incident, which is the worst possible time. Including twelve months of hot retention in every package removes that decision from the budget conversation for the window that covers the overwhelming majority of real investigations. Two honest qualifications. First, it is twelve months, not unlimited — retention beyond that window is billed separately based on volume, so a mandate requiring multi-year retention still has a cost attached, and you should price it. Second, hot retention only helps if the data actually arrived and parsed correctly; a source that was misconfigured or badly parsed is missing from your year regardless of the retention policy, which is why the parsing work early in a deployment matters more than it looks like it should. For Indian buyers, note that CERT-In's directions require 180 days of ICT logs — comfortably inside the included window — while RBI and SEBI expectations may extend further, so check your specific mandate against the twelve-month line rather than assuming it clears everything.

Question 4

How does it compare to Splunk, Microsoft Sentinel and Cortex XSIAM?

Accepted Answer

TechBag sells Splunk and Sentinel as well, so here is the comparison without the pitch. Google SecOps' genuine strengths are twelve months of hot retention included on every tier, search fast enough across that window to change how analysts investigate, SIEM plus SOAR plus Mandiant threat intelligence as one platform rather than three contracts, and a Unified Data Model that keeps a detection library maintainable. Its genuine weaknesses are that it is SaaS-only on Google Cloud with no on-premises or air-gapped option whatsoever, that YARA-L is a language your team must learn with a smaller talent pool than SPL or KQL, and that it asks for a platform commitment rather than slotting in beside what you run. Splunk remains the benchmark for raw search power and detection-engineering flexibility, has the largest talent pool by a distance, and deploys on-premises, in cloud or hybrid — it is the right answer when your value is an existing SPL library or when on-prem is non-negotiable, though it has historically been the expensive option. Microsoft Sentinel is the strongest choice for Microsoft-standardised estates, because Azure Activity, Microsoft 365 audit logs and Defender XDR alerts ingest free and SIEM sits in the same incident queue as Defender XDR — but ingest costs from noisy non-Microsoft sources escalate, and the Azure portal experience retires on 31 March 2027, which is a migration to plan. Palo Alto Cortex XSIAM makes the most aggressive argument of the four: that the alert-triage SOC model is itself the problem and should be replaced by AI-led detection and automated response — compelling if you agree with the premise and are already a Palo Alto estate, and a large operating change if not. Elastic Security is where the conversation goes when cost control or air-gapped deployment dominates. The honest rule of thumb: if retention and search across large volumes are your pain, Google SecOps is very strong; if you are Microsoft-shaped, Sentinel; if your team's value is SPL or you need on-prem, Splunk.

Question 5

Can we run Google Security Operations on-premises, and where is our data processed?

Accepted Answer

No, and this rules it out for some buyers entirely, so it is worth settling early rather than late. Google Security Operations is delivered only as SaaS on Google Cloud. There is no on-premises deployment, no air-gapped option and no self-hosted edition — this is not a licensing question that a large enough deal can resolve, it is what the product is. If you have a hard on-premises mandate, an air-gapped environment, or a regulator who has ruled specifically on where security telemetry may be processed, then the honest shortlist is a different one: ManageEngine Log360 on-premises, Fortinet FortiSIEM on appliances, Kaspersky KUMA, or self-managed Elastic Security — all of which satisfy residency by definition because the data never leaves your infrastructure. On residency more precisely: because this is a Google Cloud service, the regions available to you and the processing arrangements are Google Cloud's, and they are the thing to confirm in writing against your specific obligation before a proof of concept rather than at an audit. The distinction that catches people out across this whole category is between where data is STORED and where it is PROCESSED — those are two different commitments, a vendor can meet one without meeting the other, and which one your regulator means is a question worth answering explicitly. For Indian regulated buyers under the DPDP Act, or subject to RBI, SEBI or IRDAI expectations, TechBag will put the vendor's own documentation in front of your compliance team rather than paraphrasing it, and will tell you plainly when an on-premises SIEM is the honest answer for your mandate.

Question 6

Why buy Google Security Operations through TechBag?

Accepted Answer

TechBag is a Bengaluru-headquartered reseller serving pan-India, and because we also sell Splunk, Microsoft Sentinel and the on-premises alternatives, what you get is a fit assessment rather than a quota being filled. For Google SecOps specifically, the most valuable thing we do is size the cap: inventorying your log sources, estimating GB per day for each, identifying what qualifies for the Data Benefit Program, and showing you which package and cap your volume actually needs — plus what happens commercially when you exceed it. Google does not publish US commercial unit prices, so that modelling is the difference between a defensible business case and a number you cannot explain to your board. Beyond that we will flag when the analysis you are working from is written against the retired per-employee model, plan the parsing and onboarding work that decides whether your detection coverage is real, budget the YARA-L ramp honestly rather than pretending it is free, and design the SOAR playbooks so automation runs on tuned detections instead of noise. We will also tell you plainly when this is the wrong product: if you have an on-premises or air-gapped mandate, or your team's value is a mature SPL library, we will say so and price the alternative. Everything is quoted in INR with GST-compliant invoicing and local support.

Dimension	A traditional SIEM stack	Google SecOps
Retention	Priced per GB per month	12 months hot, included
Old data	Archived, rehydrate to search	Hot and searchable now
SOAR	A separate product	In the platform
Threat intel	A third subscription	Mandiant, Google-owned
Pricing axis	Per GB as you go	A package against a GB cap
Rule language	Per-source, rewritten	YARA-L over one data model
Honest caveat	—	Cloud-only; YARA-L to learn
Best fit	—	Large log estates, cloud-committed

Dimension	Google Security Operations	Splunk Enterprise Security	Microsoft Sentinel	Palo Alto Cortex XSIAM	Elastic Security
Position	Cloud-native SIEM + SOAR + intel	The search-power incumbent	SIEM for Microsoft estates	AI-led SOC replacement	Open, ELK-based
Pricing axis	Package against a GB cap	Ingest or workload — historically costly	Per GB ingested per day	Platform subscription by data and scope	Resource-based; free self-managed tier
Retention included	12 months hot on every tier	Priced by volume and term	90 days, then charged	Bundled by tier	Yours to configure
Search speed at scale	Sub-second across a year	SPL — the benchmark	KQL, strong but volume-shaped	Platform-native	Very fast, you tune it
SOAR	In the platform	Splunk SOAR, separate SKU	Logic Apps, billed separately	Included	Basic; often paired
Threat intelligence	Mandiant + VirusTotal, Google-owned	Cisco Talos	MDTI, free tier available	Unit 42	Elastic + community
Deployment model	SaaS only, on Google Cloud	Cloud, on-prem or hybrid	SaaS only, on Azure	SaaS only	Cloud, on-prem, air-gapped
Rule language & talent pool	YARA-L — powerful, smaller talent pool	SPL — the largest pool	KQL — widely known	Platform-native	Lucene / ES\|QL
First-party log economics	Google Cloud and Workspace logs benefit	All sources metered	Microsoft logs ingest free	Palo Alto telemetry native	Neutral
The thing to plan around	Pricing model changed — pre-2026 comparisons are stale	Cisco integration reshaping roadmap	Azure portal retires 31 Mar 2027	An operating-model change, not a swap	You run and tune it yourself
Best fit	Large log estates wanting retention solved	Mature detection-engineering teams	Microsoft-standardised estates	SOCs replacing the triage model	Budget-constrained or air-gapped

Google Security Operations

The Google platform family

Quick facts

Understand SIEM economics before you buy it

What is it?

A traditional SIEM bill vs Google SecOps’ — the honest table

The five pieces of the platform

Ingestion & the data cap

Unified Data Model

YARA-L detection engine

12 months of hot retention

SOAR, Gemini and Mandiant

Twelve capabilities. Collect, detect, respond.

Forwarders, feeds and parsers

Package against a GB cap

12 months hot, included

Unified Data Model

YARA-L detection rules

Curated detections

Behavioural analytics

Mandiant & VirusTotal intel

Sub-second search at scale

Playbooks & case management

Gemini AI assistance

Data pipeline management

Watch Google Security Operations in action

Introducing Google Security Operations

Tour of Chronicle Security Operations

How Google SecOps SIEM transformed security operations

Keep the year of data your investigations actually need.

Twelve months of hot retention, included in every package

SIEM, SOAR and threat intelligence in one product, not three line items

Search that does not make you plan the query in advance

A 2025 Gartner Leader, furthest on Completeness of Vision

The honest caveat — cloud-only, a new language, and a real platform commitment

The honest positioning

The numbers behind the platform

What your Google SecOps rollout looks like

Size the cap

Ingest and parse

Detections and playbooks

Investigate at depth

The review scoreboard

Quick poll — what’s driving your evaluation?

Where everyone sits — the grids

TechBag SIEM Grid

Search & Retention × Cost Predictability

Google Security Operations vs the field

Does Google Security Operations fit you?

Choose Google Security Operations if…

Choose Splunk if…

Choose Microsoft Sentinel if…

Choose Cortex XSIAM if…

Choose Elastic Security if…

How big a cap do you need?

Three ways to consume it

Standard

Enterprise

Enterprise Plus

Buy it for less — TechBag pricing beats list

Get an India-ready quote

The 8 questions to ask every SIEM vendor

Questions buyers ask

Ready to evaluate Google Security Operations?