Skip to main content
Question

Google SecOps SIEM Dashboards Export and Import

  • February 16, 2026
  • 3 replies
  • 91 views

vnair
Forum|alt.badge.img

We have multiple instances of SecOps, one for Dev and the other for Prod - the nature of business requires us to do this. Developers build Dashboards in the Dev environment, publish for testing and once tested and found okay, will be exported to create the JSON files which will be imported in the Prod environment.

A dashboard can call another dashboard using a button. When copying the link details in the creation of the button, we cannot select from a list of available Dashboards. What we do today is view the Dashboard we need to connect to, copy the URL and then paste it in the box for the link. We can then remove everything after the dashboard ID and it will continue to work.

Q1: Are we doing this correctly? Is there a better way to do this?

 

The export creates the JSON file with appropriate dashboard IDs generated in the Dev environment. Button links point to the Dev environment dashboard, naturally and preserved in the import. To avoid linking to a different environment, we had to first view the linked dashboard in the Prod environment (if we have exported and imported it), then edit the newly imported dashboard that calls it, edit the specific button and paste the new link.

Q2. Are we doing this correctly? Is there a better way to do this? 

 

Q3. We are trying to migrate published code in Dev to Prod and publish it for consumption of customers; and trying to automate this process somehow. Has someone done this or is there a way to do this? In general, the export and import process works if there are no links outside the dashboard specific to a SecOps environment.

 

3 replies

Ulab
Forum|alt.badge.img+2
  • Bronze 1
  • February 17, 2026

You’re handling the dashboard links correctly, but there’s a more efficient approach. Instead of manually editing button URLs after import, consider using environment variables or a consistent naming scheme for dashboards across Dev and Prod. Automate export/import with scripts that update the JSON to replace Dev dashboard IDs with their Prod counterparts. This ensures links work without manual edits and helps streamline migration and publishing.


vnair
Forum|alt.badge.img
  • Author
  • New Member
  • February 19, 2026

@Ulab , Thank you for your response. I have learned since posting my query that the Export/Import approach will not work for updates to the dashboard as it creates a new one every time. Google says I need to update via API patch. I have not tried this out yet and anybody has any insights on this, I would appreciate it. Thanks again!


chrisd2
Forum|alt.badge.img+9
  • Bronze 5
  • February 20, 2026

Hello ​@vnair ,

Google recently published a python SDK to interact with Chronicle, it will make things easier than reimplementing API methods from scratch !

It looks like the CRUD methods related to Dashboards are already present in it !

https://github.com/google/secops-wrapper

https://github.com/google/secops-wrapper?tab=readme-ov-file#chronicle-dashboard

 

Basically you’ll need to provide credentials and connection params to your Chronicle instance(s) and then you’ll be able to query the API easily using the provided methods.

Have fun !