SIEM Entity Enrichment

Assuming you are wanting to ingest raw/unstructured entity logs to SecOps SIEM, I would actually suggest using the regular importLogs endpoint (https://docs.cloud.google.com/chronicle/docs/reference/ingestion-methods#importlog).

This does not necessarily need to be done by manually making requests to the REST endpoint, assuming you are able to route the logs from the source product through Bindplane (https://docs.cloud.google.com/chronicle/docs/ingestion/use-bindplane-agent) or Cribl or similar. Since Bindplane is bundled with SecOps license, I would suggest the Bindplane approach as easiest.

Assuming there is no existing LOG_TYPE for the source, you would want to create a custom one for this source in your SecOps tenant SIEM settings which you will use to ingest the logs to.

Once you have your raw logs into SecOps, what makes them “Entity” events is the parser. By assigning data from the raw logs to fields in the Entity data model (https://docs.cloud.google.com/chronicle/docs/reference/udm-field-list#udm_entity_data_model) in your parser, SecOps would create Entity type events from the raw logs.

- Matt

Hi ​@malzahnOptiv ,

Excellent question — enrichment data ingestion in Chronicle SIEM / SecOps is a nuanced area, especially when the source isn’t listed under supported log types or default parsers.

🔑 Key points to understand

Default parsers → Chronicle provides built‑in parsers for common sources, but custom/less common feeds (CMDB, niche IdPs, EDR context) won’t be automatically normalized.

ImportEntities API → Yes, the documented method you linked is the correct entry point for ingesting enrichment data (Assets, Identities, etc.). It allows you to push structured entity data into Chronicle for correlation.

Custom ingestion pipelines → For unsupported sources, you typically need to build a connector or ETL process that:

Extracts data from the source (CMDB, IdP, EDR).

Transforms it into Chronicle’s expected schema (JSON entity format).

Loads via ImportEntities or Data Ingestion API.

🛠 Recommended advanced approach

Define entity schema mapping

Map CMDB fields (hostname, owner, department) → Chronicle Asset entity fields.

Map IdP attributes (userID, email, group) → Chronicle Identity entity fields.

Build ETL connector

Use Cloud Functions, Dataflow, or a lightweight script to pull data periodically.

Normalize into Chronicle’s JSON entity format.

Ingest via ImportEntities

Push batches through the API.

Validate ingestion success with Chronicle’s entity search.

Correlate with UDM events

Once ingested, enrichment data is available for correlation in detections, dashboards, and playbooks.

⚠️ Considerations

Data freshness → Keep enrichment data updated (daily/hourly sync).

Error handling → Log ingestion errors and retries.

Security → Ensure sensitive identity data is handled securely in transit and storage.

👉 In short: Yes, the documented ImportEntities API is the right path. For unsupported sources, you’ll need to construct your own ingestion pipeline (ETL → JSON schema → API). Once ingested, those entities enrich detections and response workflows just like native parsers.

Kind regards