Prophet AI Now Integrates with Google Security Operations

We're excited to announce that Prophet AI is now an official integration partner with Google Security Operations, bringing Prophet AI’s investigation capabilities directly into one of the most powerful cloud-native SIEM platforms on the market.

This integration is listed on the Google Security Operations Partner-Hosted SIEM Integrations page, marking a significant step forward in how security teams can leverage Prophet AI to cut through alert noise and accelerate threat response.

What This Integration Does

Security teams running Google Security Operations can now connect Prophet AI to their environment to unlock the following capabilities:

Alert Ingestion: Prophet AI automatically ingests alerts generated by Google Security Operations into the Prophet AI platform. Analysts can configure a start time to control exactly when ingestion begins, ensuring full continuity with existing investigation workflows.

Contextual SIEM Querying: During investigations and threat hunts, Prophet AI queries Google Security Operations directly using the Chronicle API — pulling UDM event searches, alert details, and related events — enriching each investigation with the full depth of your SIEM data in real time.

Bidirectional Alert Sync: Prophet AI can optionally sync investigation results back to Google Security Operations, keeping your SIEM up to date with Prophet's findings. Teams can choose to sync full investigation results, or limit sync to comments only, giving analysts precise control over what flows back into Google Security Operations.

{{ebook-cta}}

Why This Matters for Customers

Google Security Operations is trusted by enterprise security teams worldwide for its petabyte-scale data ingestion, sub-second search, and native Google Threat Intelligence. Prophet AI brings a layer of reasoning and automation on top of that data fabric, enabling analysts to:

• Investigate more alerts in less time — AI-assisted triage means fewer alerts sit unexamined in the queue.
• Hunt threats proactively — Prophet can autonomously query the SIEM for indicators of compromise, lateral movement, and anomalous behaviors across your environment.
• Reduce analyst fatigue — By handling routine investigation steps automatically, Prophet lets your team focus on the high-judgment decisions that truly require human expertise.‍
• Keep both platforms in sync — Optional result sync means Google Security Operations reflects Prophet's investigation progress, eliminating duplicate work.

How It Works

The integration is configured in Prophet AI using a Google Cloud Service Account with Chronicle API permissions. Here's what's required to connect:

What you'll need:

• Your Google Security Operations Customer ID, GCP Project ID, and Region (found in Google Security Operations Console under Settings > SIEM Settings > Profile)
• A Service Account created in the Google Cloud Console with one of the following roles:
  
  • API Viewer — for alert ingestion and investigation queries only
  • API Editor — if you also want to sync Prophet's investigation results back to Google Security Operations
• A JSON key file generated from that service account

Permissions used by Prophet AI:

Once configured in the Prophet AI dashboard, the integration operates in two directions:

1. Inbound (Google Security Operations → Prophet AI): Alerts and detections are ingested into Prophet AI for AI-driven investigation. A configurable start time lets you define exactly when ingestion begins.‍
2. Outbound (Prophet AI → Google Security Operations): During active investigations, Prophet queries the API for supporting evidence — UDM events, alert details, and related activity. Optionally, investigation results and comments are synced back to Google Security Operations.

Getting Started

If you're a current customer of both Prophet AI and Google Security Operations, you can set up the integration directly from the Integrations page in your Prophet AI dashboard. Search for Google Security Operations, provide your Project ID, Customer ID, Region, and Service Account key, and you're ready to go.

Full step-by-step configuration instructions are available in the Prophet AI documentation.

Interested in learning more? Request a demo to see Prophet AI and Google Security Operations in action.