How to integrate Hubspot with chronicle?

Hi Krish,

To ingest HubSpot logs into Google SecOps (Chronicle SIEM), there is currently no direct standard out-of-the-box connector, so you'll need to set up an API-driven ingestion pipeline.

Here is the standard 3-step architecture for this integration:

1. HubSpot Audit Log Extraction

Leverage the HubSpot Audit Logs API (⁠/settings/v3/audit-logs/⁠) to fetch security events, user activity, login attempts, and permission changes.

Authenticate using a Private App Token or OAuth 2.0 with the ⁠account-info.settings.read⁠ scope.

2. Middleware & Ingestion Pipeline

Choose one of the following methods to ship logs to SecOps:

Google Cloud Native (Serverless): Set up a scheduled Cloud Run job or Cloud Function to query the HubSpot API periodically, write state/checkpoints (to avoid duplicate ingestion), and send payloads directly to the Google SecOps Ingestion API (UDM format).

Chronicle Feed Manager / SecOps Forwarder: Deploy the Google SecOps Forwarder on an internal VM, or configure a webhook server/custom script to fetch HubSpot logs and forward them via syslog or HTTPS webhook endpoints.

3. Parsing and UDM Normalization

Map incoming JSON log fields from HubSpot to Google SecOps Unified Data Model (UDM) fields (e.g., mapping user IDs to ⁠principal.user.userid⁠, actions to ⁠target.resource.name⁠, and IP addresses to ⁠principal.ip⁠).

If using the SecOps Ingestion API, configure a custom parser rule in SecOps if standard parsing isn't automatically applied.

Hi ​@Bernier Advise ,

Thanks for replying, really appreciate it! If you have any reference links or documentation, could you please share them here? It would make it a bit easier for us to understand and proceed.