Validate Full Event List (15 Events) Against Chronicle SIEM Logs and Display Missing Events

It looks like you are looking for an outer join, being the primary data set the data table with those 15 values.

While Secops features now the outer joins, it is still quite limited at the moment. One of those limitations is

“The primary Unified Data Model (UDM) event must be the preserved side of the outer join.”

that limitation prevents taking the table as the preserved side, in other words: no event = no result.

I don’t know of any hack to work around that limitation. If there’s no other suggestion from the community, you might have to switch to bigquery.

The limitation ​@hliu shared above is the reason why the UDM Search query cannot be completed since we currently require the UDM events. You can use BigQuery as suggested. 

I hope to see SecOps move from event-centric models toward a more flexible, data-driven approach. It’s frustrating for customers to have to look at external tools for this, particularly when some licenses still involve pay-per-query/per-scanned-data costs in BigQuery.

Hi Mates,

Thanks for the update.

If possible, could we build a Google Chronicle SIEM query using these conditions instead of a data table? I need the exact same structure.

Also, I explored another approach but it’s not convincing. Below is the output I produced:

Product | Event1 | Event2 | Event3

-------------------------------------------------------------------------------------

productname | logs are available | logs are not available | logs are available

Thank you.