Google Security Operations (SecOps) is a cloud-based platform that helps security teams detect, investigate, and respond to threats. It includes security orchestration, automation, and response (SOAR) capabilities. The product was formerly called Chronicle.   To pass alert information to third-party integrations or tools such as Google Security Operations SIEM from Prisma Cloud, you can use the webhook integration.  Prisma Cloud will send alert data to a custom webhook, which can then be integrated with some security application.  For demonstration in this article, we will work with Google Security Operations. This integration helps your incident response teams monitor and act on alerts in real time.   In this article we will cover how to configure both Google Security Operations and Prisma Cloud to achieve the alert data pipeline sending alert data from Prisma Cloud to Google Security Operations.

Event Assisted Ingestion is an enhancement that is intended to reduce the number of API calls. It helps to make the API call only if the resource configuration is changed. Prisma Cloud will listen to any changes on the resources we support and it calls the corresponding API to sync the details for the resource between the cloud and itself.   Prisma Cloud leverages Amazon EventBridge to receive audit logs in near real-time, thus allowing Prisma Cloud to reduce the total number of API calls and total time to alert.