How to Export Logs from Google SecOps (Chronicle)

For small, targeted pulls, run a UDM search and call the same search through the Google SecOps API to get JSON. For raw logs in their original format, the Data Export API copies logs for a time range and log type into a Cloud Storage bucket you own. The UI’s export produces a spreadsheet-style file that LogTotal doesn’t read today.

Google SecOps keeps a year of data by default at Google scale, and it’s increasingly where security teams look first. Prime Core has 20,031 detection rules for Google SecOps, mapped to 663 MITRE ATT&CK techniques. Below is how to get data out, sanitize it, and investigate it for free in LogTotal.

Get Started For Free

Before you start

Raw logs or UDM events? Google SecOps keeps both: the raw logs as ingested, and normalized UDM events. When the raw logs are syslog or JSON, they’re usually the better input for LogTotal. UDM JSON works too.

Permissions. Access is granted through IAM roles on the SecOps instance. A data export also needs permission to create exports and a bucket the SecOps service account can write to.

Retention. Standard retention is 12 months. 

Log types. Every feed has a log type label, such as WINEVTLOG for Windows event logs. Note the ones you need before you export.

The steps follow Google’s documentation, checked October 2026. Endpoints differ by region and API version, so check them against your instance.

Option 1: UDM search through the API

Write the search in the UI first, for example principal.hostname = “web-03”, and check the results. Then run it through the API with a time range:

TOKEN=$(gcloud auth print-access-token)

curl -sS -H "Authorization: Bearer $TOKEN" \
  "https://<region>-chronicle.googleapis.com/v1alpha/projects/<project>/locations/<region>/instances/<instance-id>:udmSearch?query=principal.hostname%3D%22web-03%22&timeRange.startTime=2026-10-19T00:00:00Z&timeRange.endTime=2026-10-20T00:00:00Z&limit=10000" \
  | jq -c '.events[]' > secops_web03_1019.jsonl

Option 2: Raw logs with the Data Export API

For larger windows, or when you want logs exactly as they arrived:

1. Create a Cloud Storage bucket and give the SecOps service account write access to it.
2. Create a data export for your time range and log type, pointing at the bucket.
3. Poll the export until it finishes.
4. Download the files:

gcloud storage cp -r gs://my-secops-export/<export-path>/ ./secops-export/

The files hold the original log lines for that log type. Decompress them if needed, then upload.

Option 3: Export logs through the Google SecOps UI

For quick investigations or smaller log samples, you can export search results directly from the Google SecOps interface without using the API.

1. Open Search. Sign in to Google SecOps and navigate to Investigation > Search.
2. Run a search. Enter a UDM query, for example principal.hostname = “web-03”, or search raw logs. Set the time range and click Run Search.
3. Review results. Check the matching events. For UDM searches, use the Column Manager to select the fields you want to export.
4. Download the logs.
   • UDM events: In the Events table, click Download and select Download as CSV. You can also select Download as CSV (with raw logs) to include the original log entries.
   • Raw logs: In the Raw Logs results table, click More > Download as CSV.
5. Save the file. Google SecOps downloads the results as a CSV file.

Limitations. UI exports use CSV rather than JSON or JSONL, which LogTotal doesn’t currently support. Raw log searches are limited to 10,000 results per query. For larger exports, narrow the time range or use the Data Export API. To analyze the exported data in LogTotal, extract the original log entries into a supported raw log format or use the API export methods described above.

Step 3: Upload, sanitize and review in LogTotal

1. Upload. Open logtotal.com and drop in the file. 
2. Sanitize. 
3. Review. 

When it goes wrong