Introduction to Google Security Operations (SIEM)

About this course

This course provides a comprehensive, end-to-end exploration of Google SecOps SIEM, guiding learners from foundational concepts to advanced investigation and detection engineering. Participants will gain hands-on experience with data ingestion, normalization, RBAC configuration, searching, and dashboarding using both legacy and native capabilities. Through structured modules, demos, and curated examples, the course emphasizes real-world investigation workflows, UDM-based analytics, and YARA-L rule development. By the end of the course, learners will be equipped to operationalize SIEM effectively within their environment and build scalable processes for detection, investigation, and reporting.

What you will learn

• Explain the architecture, data model, and core components of Google SecOps SIEM, including ingestion methods, UDM, normalization, and RBAC.
• Ingest, normalize, and manage log data from multiple sources, using direct ingestion, APIs, cloud buckets, streaming services, and on-prem collectors
• Perform effective investigations using raw logs, UDM search, statistical search, and data tables, and build dashboards.
• Design, test, and optimize detections using YARA-L, including single-event, multi-event, composite rules, entity context, etc..