Hello Team or esteemed members,

Do we have any recommended best practices from Google or your own recommendations for Google SecOps (SIEM and SOAR)? There is a link in the community for Chronicle Best Practices (https://www.googlecloudcommunity.com/gc/Google-Security-Operations-Best/tkb-p/chronicle-best-practices), but it seems to be more focused on operational aspects and limited to specific topics such as Yara-L function, regex and query.

I am looking for best practices for Chronicle SIEM and SOAR that encompass tool configuration best practices and recommendations for establishing a mature Google SecOps setup.

For example, best practices could include:
- Managing user access - Defining RBAC roles
- Managing log retention - Strategies for managing log retention for more than 12 months
- Health monitoring
- How to track log ingestion and log optimization best practices specific to Chronicle, and so on.