Integrating Zoho Vault with Google Security Operations (Chronicle)
Overview
Zoho Vault integrates with Google Security Operations (formerly Google Chronicle) to enable real-time event streaming. Once configured, new events appear in your Google SecOps environment almost immediately, giving your security team up-to-date visibility into vault activity.
Setup instructions
Create an API Key in Google Cloud
- Go to the Google Cloud Console and select the project linked to your Google SecOps environment.
- Navigate to APIs & Services, then select Credentials.
- Click Create Credential and choose API Key.
- Once the key has been created, click Edit on the key to apply usage restrictions.
- Restrict the API key to Chronicle API capabilities only. This limits the key's scope and improves security.
- Copy and save this API key you will need it in Step 4.
Create a Custom Log Type in Google SecOps
You need to define a new Log Type in Google SecOps so that it can correctly identify and categorize events coming from Zoho Vault.
- In your Google SecOps tenant, go to Settings, then SIEM Settings.
- Under Available Log Types, click Request a Log Type.
- Fill in the following details:
- Vendor/Product Name: ZohoVault
- Log Type Name: ZOHOVAULT
Create a Feed
A feed acts as the receiving endpoint for log data sent by Zoho Vault. You will set up a Webhook-based feed tied to the log type you just created.
- In your Google SecOps tenant, go to Settings, then SIEM Settings, and select Feeds.
- Click Add New Feed.
- Set the Source Type to Webhook, then select ZOHOVAULT as the Log Type.
- Click Next, review the settings, and click Submit.
- When prompted, click Generate Secret Key. Copy and save the Feed Endpoint and Feed Secret Key for use in in the next step.
Configuring Google SecOps in Zoho Vault
With the API key, secret key, and feed endpoint ready, you can now complete the setup on the Zoho Vault side to begin streaming logs.
- Log in to your Zoho Vault account as a super admin.
- Go to Settings and select SIEM Integration.
- Under the Google SecOps section, click Edit Configurations.
- Enter the following details in the respective fields:
- Feed Endpoint: The endpoint URL copied in Step 3
- Feed Secret Key: The secret key generated in Step 3
- API Key: The API key created in Step 1
- Protocol: HTTPS
- Click Save Configuration to activate the integration.
Once saved, Zoho Vault will begin streaming event logs to your Google SecOps environment in real time.
Search for and Verify Logs in Google SecOps
After the integration is active, you can verify that logs are flowing correctly by running a search in Google SecOps.
- In your Google SecOps tenant, navigate to Investigation, then select SIEM Search.
- In the search bar, enter the following query to filter for Zoho Vault events: metadata.log_type="ZOHOVAULT_CUSTOM"
- Review the results to confirm that Zoho Vault events are appearing as expected.
Access your files securely from anywhere
Zoho CRM Training Programs
Learn how to use the best tools for sales force automation and better customer engagement from Zoho's implementation specialists.
Zoho DataPrep Personalized Demo
If you'd like a personalized walk-through of our data preparation tool, please request a demo and we'll be happy to show you how to get the best out of Zoho DataPrep.
- Zoho Workerly Home
- Forums
- Connect With Us:
- Zoho Recruit Home
- Forums
- Connect With Us:
Centralize Knowledge. Transform Learning.
All-in-one knowledge management and training platform for your employees and customers.
New to Zoho Writer?
Create. Review. Publish.
New to Zoho CRM Plus?
Deliver unforgettable customer experiences
New to Zoho CRM Plus?
Deliver unforgettable customer experiences
New to Zoho Marketing Plus?
Everything you need to run your marketing
New to Zoho Marketing Plus?
Everything you need to run your marketing
You are currently viewing the help pages of Qntrl’s earlier version. Click here to view our latest version—Qntrl 3.0's help articles.
New to Zoho Survey?
Zoho Sheet Resources
Zoho Forms Resources
New to Zoho Sign?
Zoho Sign Resources
Sign, Paperless!
New to Zoho TeamInbox?
Zoho TeamInbox Resources
New to Zoho ZeptoMail?
Design. Discuss. Deliver.
New to Zoho Workerly?
New to Zoho Recruit?
New to Zoho CRM?
New to Zoho Projects?
New to Zoho Sprints?
New to Zoho Assist?
New to Bigin?
Related Articles
Integration with Popular SIEM Solutions
Security information and event management (SIEM) tools gather sensitive security logs from various services to monitor all activities performed from a central location. Having security logs from multiple IT resources can help IT teams to identify ...Integrating Zoho Vault with IBM QRadar
Log in to your IBM QRadar console and go to the Admin tab in the top navigation panel. Under the Apps section, click QRadar Log Source Management. Click New Log Source to begin adding a new integration. Choose Single Log Source. In the Log Source ...Webhooks Integration
Send instant notification to legacy or third-party applications as and when critical events occur using Zoho Vault's Webhook integration. Using webhooks, you can configure custom workflow rules to trigger critical notifications and custom actions ...Zoho Vault Integration with Zoho Desk
Zoho Desk, your one-stop shop for managing customer service across various channels, now integrates seamlessly with Zoho Vault. This powerful combo lets your support agents ditch the password struggle and dedicate their time to resolving customer ...Zoho Vault for macOS
Zoho Vault is a cloud-based password manager that helps individuals, teams, and enterprises to securely store, share, and manage passwords, credit cards, keys, certificates, and other sensitive information from anywhere and at any time in a ...
New to Zoho LandingPage?
Zoho LandingPage Resources