Data security for Security log data ingested in Google Chronicle SIEM.

Hello, please review the following reference, which may help answer your questions:
https://docs.cloud.google.com/chronicle/docs/about/data-retention

Hi, 

Thanks for the help. The article has been helpful to understand the data retention options.

Still, it lacks providing clarity on the tamper-proof mechanism applied on data during the retention period.

Hi,

I think regarding the tamper-proof mechanism, you can refer to the Service Terms under:
1. Google Security Operations → c. → (ii)
https://cloud.google.com/terms/secops/service-terms?hl=en

Any additional information to share as neither response satisfactorily answered the question?

It’s key evidence to provide auditors for SOC, ISO and others. 

One option is you can request the SOC2 report - https://cloud.google.com/security/compliance/soc-2 - which includes 3rd party audit of Google Cloud, e.g., Protection Against Internal & Unauthorized Tampering.

Thanks ​@cmmartin_google my angle was the tool consumer (us) rather than Google themselves. 
 

I’d have imagined there to be a screen showing clear configuration of the settings. 
 

The words are there in the control descriptions of immutable data but nothing to evidence it?

Any ideas?

I’m not aware Google Cloud Security has any public documentation to disprove the negative as it were.  There is no feature that allows for this in SecOps, hence no documentation was written that I know of (tried a range of Google searches, can’t find anything to state it as a feature)

It has been requested before, so at best its in a Feature Request / Bug fix state for a documentation addition.

You can raise a support ticket and request targeted log deletion, but that requires you as the customer to have raised and approved the process (also, not aware this is explicitly documented anywhere).

The SOC2 report shows how a 3rd party audit of Google has in place controls around how we delete data (as the only ones who could) which is what customers I’ve worked with in the past used this to verify the requirements during an audit.

Thanks ​@cmmartin_google I appreciate the insights.