Procedure or best practices to purge ingested data by specific Log Type in Google SecOps?

Question

Hello everyone,I'm currently looking into data lifecycle management and retention within Google SecOps, and I have a specific use case I was hoping to get some insights on from the community.We have a scenario where we might need to remove historical data that has already been ingested, specifically filtered by a single log_type (e.g., the OpenAI log_type).Has anyone here successfully requested or performed a targeted deletion of already ingested data based solely on a specific log_type?I'd like to understand:Is this natively possible via the SecOps UI/API, or is it strictly a backend procedure handled via a Google Cloud Support ticket?	If it requires a support ticket, does anyone know if Google typically accommodates granular purges like this without affecting other logs ingested during the same timeframe?Any insights, documentation links, or shared experiences on how you handle targeted data removal would be greatly appreciated.Thanks in advance!João Carvalho

cmmartin_google · Accepted Answer

Google SecOps currently has a global retention limit that is part of your contract, and cannot be reduced.Support requests can be logged for removing targeted data, for example inadvertent PII.

hliu · Answer

some customer (definitely not me) ingested millions of IOC without metadata.interval.end_date and they have no way to permanently remove those from the system.

support statement was:
Google SecOps retains all ingested Indicators of Compromise (IOCs) permanently; direct deletion is not possible. Newer IOC versions can temporarily override existing ones.

the house cannot be cleaned, not even false positives.

Sign up

Login with SSO

Login to the community

Login with SSO