EP139 What is Chronicle? Beyond XDR and into the Next Generation of Security Operations

Security.

Hi there. Welcome to the Cloud Security Podcast by Google. Thanks for joining us today. Your hosts here, actually recorded in person today, are myself, Tim Peacock, the Senior Product Manager for Threat Detection here at Google Cloud, and sitting next to me, unusually, Anton Chuvakin, a reformed analyst and senior staff in Google Cloud's Office of the CISO. You can find and subscribe to this podcast wherever you get your podcasts, as well as at our website, cloud.google.com/podcasts. If you enjoy our content and want it delivered to you piping hot every Monday, please do hit the subscribe button in your podcasting app of choice. You can follow the show and argue with us and the rest of the Cloud Security Podcast listeners on LinkedIn. Anton, this is a fun episode because we have a former manager of mine, the head of Chronicle, a great guy from New Jersey, and worst of all, a Mets fan. join us for a really interesting conversation about sim and Chronicle and EDR somehow. What did you think? I thought this was great.

It felt like we did briefly hover over a precipice of discussing XDR.

We did. In fact, we started there.

Yes.

We leapt off into space to start the episode.

Yes. So I think I felt like we had this moment when the whole conversation could have fallen into the chasm. of, oh, no, XDR, no, not again. But we ended up in a very useful place. And moreover, I would say that Chris— oh, I did say the guest name, but again, that's fine. Yeah, Chris.

That's good.

Extracted some of the useful lessons that led him to the XDR discussion. So, it's kind of interesting that XDR was mentioned in a very positive context.

Yes. I think the other maybe most interesting tidbit in this episode, listeners, to listen for is the conversation around process versus tooling, and where Chris sees the role of vendors in that equation. And so, maybe with that teaser on what I thought was a shockingly interesting insight from Chris, let's turn things over to today's guest. Today, we're joined by Chris Cord, Senior Director here at Google Cloud. Chris, it's been a wild time for you and me working at Google together. I'm delighted to finally have you on the show after Countless jibes about the show. It's fantastic. It's hard first to believe that you're here, but harder still to believe we haven't done a proper Chronicle episode yet. So here we are to do a Chronicle episode. I want to start off with an easy question. Chronicle's not XDR, right? So what is it?

Right, right. Yeah, the great XDR debate. I mean, we started this, you know, when I first started, and Anton has definitely been a good foe in the debate about it.

You would say good, right? You did say good, right? Yeah, I said good.

But listeners, he said foe, not foil. So there's degrees here.

Exactly. Anton's never been on the same side that I've been on. Yeah, I mean, look, I've always stated that XDR to me is a use case, right?

Mm-hmm.

So I don't believe that XDR is some magical category where, you know, it's going to redefine the way we're doing security operations or anything to that degree. But I do think it's reflective of people's desire to want to have their SIEM platforms do more than just log collection.

Sure.

Right? So, like, in my point of view, the industry evolved to be, like, just a log collection platform. Everything else was do-it-yourself. You had to build all of these, like, dashboards and your own rules on top of it. And I think the gravity that people have at least started with XDR, and it seems to have teetered off now, kind of began with this notion of, like, can you just give me more value in this thing I'm spending so much money on? It should provide me with more actual security value, outcome-oriented value.

Is that what Chronicle is then?

That's what Chronicle does. Like, our strategy primarily is about delivering quality outcomes through detection and response, right? Built into a scalable data platform. And I think, to me, XDR is a use case that Chronicle can deliver, but ultimately, we are fighting against the SIEM vendors on a regular basis.

So it's a SIEM that delivers security outcomes that produce value because it's smarter than the other SIEMs.

Absolutely.

Okay, easy.

So, that was an easy question, right?

Yeah.

And so, I guess the second one is kind of in the same ballpark, rightly. Roughly, Tim occasionally makes fun of me for only using faint praise, like, yeah, I guess it's pretty good.

That's actually an okay idea.

That's one of his favorite things to say. Yeah, that's actually an okay idea. Yes, I've said this several times on air. But ultimately, I loved Chronicle so much that I left the safety of Gartner and joined it in 2019, right? So, in that sense, and I think I've posted a very, like, excited Awesome Plus blog about like, oh my God, my dream has come true. I'm at Chronicle. So this was 2019. This is 2023. So since you've joined the team, what is your, oh my God, it's such a happy place. It's the proudest thing I've done. Like, what are you the most proud of shipping?

Yeah. I mean, like putting aside the—

I'm throwing a love fist. You okay with that, Jeff?

Yeah, yeah, yeah.

I was gonna say, aside from shipping me out of his org chart, what are you most proud of shipping?

Right, right, right. But putting aside like the acquisition stuff, which we'll touch on, you know, maybe later in this conversation, I think from a pure Chronicle feature perspective, you know, I joined the team in 2021, like mid-2021. And, you know, I had this firm vision, like we talked about just now, of, like, SIEMs needing to do more than just simple log collection and aggregation and dashboarding. And so we shipped a curated detection feature in early 2022, I think Q2 2022, which basically provided out-of-the-box detections, out-of-the-box analytics, and things that were curated and managed by our own Google Cloud Threat Intel team. And to me, that was a seminal moment for the product. It moved it from really being this data platform that was just doing log collection and doing it well because we were very scalable, but really kind of started to deliver on this vision of having an outcome-oriented tool. And we've been able to build on it ever since. And so I was super proud that we were able to get that out the door when we did.

I think that was a great launch, and I really like the degree to which it made you more opinionated about the data you were ingesting.

But to add to this, funny enough, and that was like a case where I think we've probably virtually argued a little bit because when we started doing curated detections, at least on the marketing side, the perception was, wait a second, every SIEM had canned detections. And every SIEM going back to 1998 would say, here, customer, here's a rule.

Bye.

They're not really curated. They're kind of canned rules. And customers developed a bit of a disdainful attitude about canned rules. Do they work? Do they not work? But curated detections, in our case, we stand behind them.

That's right.

We give them to a customer, and we almost— I think of them in my mind, and that's when I flip the switch towards loving them, is that they're sort of guaranteed. They're sort of like, we say, do these work? If they don't work slightly, here's how to make them work. So unlike other teams having canned detections that are kind of more like samples or like, here, you try it, but the results, outcomes are in your hands. In our case, we ship something that we stand behind, and curated means They're going to work.

You hit the nail on the head.

That's the magic. That is the legit magic.

Most other SIEMs, like, they're delivering a set of, you know, saved searches, basically, that they're giving you as templates, and then you have to operate over those templates. And, you know, they're not actually managing the effectiveness of those detections over the course of their lifecycle. And that's the big difference for us, is the fact that these things are managed from an effectiveness perspective. Again, the analogy I always like to use is how the EDR market evolved and how it went from being this forensic platform where you had to do a bunch of stuff yourself, and then you had to maybe grab a bunch of saved queries from the vendor, to being this place that had a lot of out-of-the-box value, like detection value. And they actually kept tuning that over time with additional cloud oversight and managed defense oversight and IR engagements. And that just made those detections that much better. That's the kind of experience that we have in Chronicle, which is, I agree with you, very game-changing over a traditional SIEM.

What I love about that story there is, listeners, I was a political science major and the story of how I became a PM, we'll talk about on the AMA episode. But what I love about that is it presents an asymmetry where Chronicle gets better at detecting bad guys across its whole pool of users, and then every user benefits from that. It's unlike a traditional SIEM because you keep learning and getting better. I want to shift gears and speaking about catching bad guys, you were part of Google's second largest acquisition in history. How does it feel, first of all, to be number 2 to an acquisition that I would bet one pure bonus most listeners couldn't name? And then now that you're into it, what's been a happy surprise about all of it and what are you looking forward to still with it?

Yeah. What is the biggest one?

I mean, we're going to keep— It was Motorola.

Oh yeah.

Yeah. It was when we purchased Motorola.

Got it.

That was actually more than twice the size of what you purchased. Sorry.

I think Mandiant is a happier story though. It's already very clear. It's very clear at this point.

I don't think there's anything wrong with the Motorola acquisition. I just think it might have been forgotten in the sands of time.

Well, that's a good tidbit. I didn't even think of that one.

Because you're 5x bigger than YouTube by purchase size.

Exactly. Therefore, we're 5x more important, clearly. I mean, I think it's— to me, it shows a lot of commitment in the space, right? So, like, as a security practitioner joining Google, you know, when I did, there was obviously a lot of momentum and a lot of desire to get more serious about security. But, you know, it was still a very nascent business, right, in 2021 when I joined. in some ways, still a very nascent business now, right, in terms of its profile in the industry. But the desire for our organization to get serious about it was real. I felt it at the time that I joined. And I think the opportunity when Mandiant came along as an acquisition opportunity, that the fact that we were able to jump on it and we had so much support going up through the leadership chain was pretty shocking to me. So, you know, I think it was a great signal that we're serious about security and that we'll continue to be serious about security and that we're willing to invest in it.

We also got some decent products with it as well. Apart from obviously world-class IR services, we got some decent products with Mandiant as well.

I mean, my personal opinion is like the reputational bump that we got immediately out of the gate has been game-changing. Like, there's been so many different opportunities that we're in now with Chronicle, maybe not even with Mandiant standalone products, but with Chronicle. But we're in those opportunities specifically because of the Mandiant acquisition. Because, number one, people say, oh, Google's serious about this. Number two, they have a higher degree of trust that all those detection capabilities that we just talked about are going to be way higher fidelity because now you're pulling in all of that advanced intel and IR engagements that Mandiant is doing, and you're feeding those into the product to create value. And then, they just have great relationships with CISOs, right? And so I think when you combine all of those things, it's created a huge amount of momentum us in the business. And I think, you know, the products themselves, you know, while we're in the process of integrating a lot of those to different parts of the portfolio, they do give us a lot of interesting functionality that we wouldn't have had otherwise. Yeah.

Yeah. In fact, even merging ASM into the SOC, into the detection response function, to me is kind of interesting because it makes SOC look kind of to the left from the incident. And to me, this is kind of, I mean, from all the Mandiant products, I felt like ASM, bringing ASM into the SOC vision is kind of a strong argument that We are unique. I mean, we're not, like, pretty unique. We are, in fact, unique by doing it.

I agree. I agree. I think, like, you know, we're referring to that as the addition of context, right? And so the more context you can bring into a log event, the better off you are in making decisions and being proactive in terms of how you determine risk. And not only ASM but also security validation with Mandiant helps bring in and introduce that context, which I agree is a very unique point of view.

So to sort of briefly go on a short tangent here, of course, you are a senior product leader, but some people would say that, security operations success of the company connects to how mature their processes are and of course what products they use. So what's your take on kind of the balance of tools versus practices at a company? If I'm building a DNR team or a SOC—

Or refactoring one.

Or refactoring one. That's right. That's a good point. How should I think about buying the absolute best products but keeping mature practices or boosting the practices but maybe keeping the products? What's the best route here?

Well, don't say both.

And both is the right answer though. Well, don't tell him what the right answer is.

Okay, fine.

Chris, what's your answer?

You're right, I might be a little biased, but I think that the emphasis on people needing to solve problems themselves through practices is a manifestation of our inability of delivering the right level of value in SIEM in particular, or security operations.

Hang on. Say that again. Say what you just said.

The overemphasis that we're placing on like, hey, improve your overall security processes, include your manual kind of playbooks for how you handle certain types of events or incidents, all those types of things that, you know, we overemphasize is only there because SIEM products have not delivered on the type of value that they should be creating.

So they're covering holes in broken products by trying to polish practice. Exactly.

This is actually— It's a good answer.

Kind of profound.

It's better than Anton's answer. Okay, it's not profound.

It's actually kind of profound.

See, that's the Slavic phrase right there. That's what we were talking about. But that's a great answer and way better than Anton's answer. I like that a lot.

Yeah. And then, so my point of view is like, look, the products need— like, our promise as vendors needs to be to make the products better so that people are better at doing their job, you know? And again, I think, not to keep using this analogy, but Endpoint did that super well.

Sure.

I don't think anyone would've said like, hey, once you had just data collection and endpoint, job done, because everything else is process-oriented. But instead, the ball had to keep moving forward in terms of making sure that we're stopping bad guys consistently, making sure that we're doing that with higher degrees of fidelity and expertise and capability and accuracy. And all those types of things kept moving that market forward. And to me, we're on the early stages of SIEM doing the same thing.

Yes. So SIEM is going to go through the same transformation of reputation that we had of AV, dirty, disgusting product, to EDR, cool, useful product. We'll have that for SIEM.

I think even beyond just AV to EDR, but AV to EDR to, like, what I would refer to as the endpoint protection suite or platform, like, that iteration is the way SIEM is moving, right? So I think it's going from this kind of, like, checkbox compliance thing to, okay, collecting a bunch of forensic data. And then now, I think, hopefully, to this outcome-oriented, security-focused platform.

So, to me, the logic is that you would want— it's not like you want to make SIEM look like AV, but you want to focus on kind of outcomes that you get right after you deploy the product, not deploy the product and then start your journey that takes you through 14 months of hard work to a value. But you want something that you deploy the product and you see the outcomes soon without doing any hard labor. That's the short version of that.

I mean, you should be able to get value immediately. Like, as soon as I start ingesting event data, especially event data from high-fidelity sources, immediately I should start getting some understanding. Like, is there anything indicative of an active breach? Is there any behavior that's going on that I should be aware of or alerted of that might be, you know, attacker-driven behavior? Like, these kind of things should be out-of-the-box value.

And it shouldn't require hiring a team of ex-NSA guys to make it work.

Absolutely.

It should be an easy process, not a crazy process. Yeah.

'Cause if it does require a team of people from the NSA, then, like, zero chance that most organizations are going to be able to do it, right?

Right.

The Fortune 500 will win, and everybody else will suffer.

Exactly.

That's not a good outcome for anyone.

But for a lot of SIEM products, they're still stuck in the old mentality where they give you the tool and they give you some sample content and ultimately give you—

And good luck from there.

And give you some good luck charms to succeed. And even large, highly visible SIEM competitors are doing that. So in essence, we are doing something different, but many of the customers seem to be stuck in the, oh, SIEM, yeah, I got to write my own rules because canned rules are probably bad. There's a lot of work. I can't handle it. How are we changing the minds? Like, if somebody is trained on certain log search engine that wants to be a SIEM or some other products, how are we changing their minds? How are we making them— actually, if you get Chronicle, you're going to get results and you wouldn't have to suffer for 12 months or for 14 months to get the results. So, what is the secret to changing their minds, if it makes sense? It's probably a little too philosophical, but—

No, I think it's a good question. And I wanted to ask you slightly differently, which is, How do you convince people they don't need to port over and invest in porting over 18 years' worth of rules written in another language?

To be honest, like, this is the hardest part. Like, if you're going to look at tactically, when we are in the middle of trying to switch out incumbent vendors, the hardest part is convincing them that maybe a one-for-one, like-for-like type comparison is not necessarily what they should be doing. And then after even we've convinced them to switch, trying not to Just simply poured over all the old stuff, right? You know, I used to work in the virtual firewall business, and like, there was a joke where like no one ever wanted to touch a firewall rule that was in there because it's like a game of Jenga, and no one ever wanted to pull anything out because you were concerned that whole thing's going to topple over. That's kind of the way people feel like their SIEM rules— like, they may have 1,000 of them, 2,000 of them, they have no idea if they're valuable.

Sure.

But they refuse to want to touch them because if they try to cut them down at all, They're concerned they'll miss something, right? And so it is extremely hard to get them to just say, let's use this opportunity to slim down the rule set.

There are whole vendors trying to do analytics of that, funny enough. Like, there's a whole little segment of a market when people deploy tech to kind of like go through SIEM rules and see if they're good, which is amazing, right? People would pay money for it to actually have the tool do that.

That sounds like somebody's buying a dowsing rod to me. That doesn't sound easy.

No, it's based on real Quote-unquote machine learning.

Yeah. Okay.

Okay.

So back to dowsing rods.

But this is one area where I actually think Mandiant helps a lot, right? So Mandiant has a product called Security Validation that can be run, like, in a managed version or can be run in a product-driven version. But that product does help people go through breach and attack simulations with real-world examples of, like, look, these are 10 or 12 different attack vectors. These are different types of threat actors. These are campaigns. And you can run those simulations against your environment, and you can see—

Really?

Am my tools catching them? Are my SIEM tools, like, alerting on me or detecting these kind of events? And so the plan right now is for us to use a lot of that breach and attack simulation to showcase, okay, if you care about these parts of the MITRE ATT&CK matrix, then we'll be able to validate that the rules that we have in place with Chronicle are able to catch them, right?

That's really cool. So that product effectively turns somebody's organization in its current state into a bit of a cyber lab.

That's right.

For their own stuff.

That's cool. That's a fancy way of saying it, but that was the old Verodien stack, right, that Mandiant acquired. So I remember it from the Gartner days, and it's kind of impressive in terms of what they would simulate and how deep they would integrate to the detection stack. So it's genuinely cool, and it genuinely delivers that type of insight about, are your detections any good, or are you only pretending you're collecting and then pretending you're detecting?

And then we want to keep using that over time. This goes into the context thing. Not only do you want to do that at a point in time, but if we can continuously validate, And then, let's say we see that, okay, this portion of your environment is susceptible to ransomware or some other attack vector. We can adjust the alerting risk score associated with those events, or we can highlight certain areas because the events should matter more because we know that you're susceptible to an attack. So that's kind of the context part, which, to your point, Anton, before, I think are things that only we're doing, really, versus any other vendor.

That's really interesting. I want to switch gears one more time before we get to our traditional closing questions. We have a lot of people listening to the show who are interested in careers in security, interested in careers in security PM. You've been doing PM for security products for a long time, not to call you old. You've been called worse things by fancier people than me lately. What advice do you have for people who are thinking about security PM as a path?

Well, yeah, I mean, I think security is one of those tough areas to break in from a product perspective, mostly because the domain knowledge is not super relevant to a lot of folks, meaning that it's You know, you can put yourself in the shoes of a user of a product that's very open and visible in many cases.

I can imagine using the Uber app. Exactly.

Like, if you wanted to be, you know, a PM in Maps or a PM in Gmail, it's like, in that context, you're at least a user on a regular basis, and it's much easier to put your mind into it. I think security is harder, right? Because it's even a step removed from traditional IT, and most people don't have that necessarily, that depth of knowledge to be able to be a domain expert. Personally, I think a lot of people can get a ton of value at being Tier 1 analysts right out of the gate, right? And so there's so many organizations that I know that are looking for younger talent, people coming into organizations to act as Tier 1 analysts. And the amount of information that you can gather about the domain and about the problem is huge. You know, for people that are still in school, like then there's a number of schools that are now focused on cybersecurity programs in school. Like Carnegie Mellon has been kind of the forefront of having a cyber shop or a cyber program in school. But then absent of that, like sometimes people can just basically switch domains and just spend the time and focus and energy on learning some of the individuality of security, but just bring really good PM discipline to the equation. Like, I think one thing that security in general hasn't done well is we haven't been really good at actually building products with simplicity, right?

And so, like, UX comes out.

Understatement of the episode right there.

And so, like, other disciplines are good at that. And so, if you can bring that kind of discipline into security, even as a relative novice in the domain, you might actually be better off than someone who's done it for years.

You might bring some beginner's mind to that, right?

Yeah. Versus someone who's done it for years. Yeah.

Usually, at the very end of the episode, we ask 2 questions. Any give the audience one tip, in this case, on improving security operations, I would assume. And give us some recommended reading. And of course it's fine to say Chronicle website or whatever else. And I think Tim bans to ban. Yeah.

It's not okay to say Anton's blog.

And please don't say anything. I, Chris would not do that. Chris would not do that.

But don't say anything about New York Mets cuz that's too depressing right now.

Uh, yeah, that's way too depressing. Yeah. Recommended reading. I mean, like, you know, I think there's a number of SIEM books out there, right? Like if you really wanted to go deeper into how SIEMs operate, like I think there's one called the InfoSec Playbook, right? Which kind of walks you through. how you operate and manage a SIEM or our SOC, sorry, and kind of build a security operations playbook. You know, there's a number of really good books about malware in general. Like, I think, I forget the rootkit name, the name of the rootkit book, but it's like the Rootkit Bible or something like that that I read early on in my career, which is another good one.

Listeners, just so you know, nothing from Chris's early career is still technologically relevant.

Exactly. Yeah. So that might be that, that might, that might be that good. But yeah, I think like any type of those kind of practitioner-level books that you can read about like how people operate in the SOC would be great starting points.

And then, uh, one tip to improve security operations outcomes, maybe.

In general, like as a user?

Yeah. As somebody operationally responsible. Yeah. Or as a director or as a CISO, whatever. Yeah. I mean, whatever you're feeling.

I think in most cases people don't put enough emphasis on Trying to build proactive controls in the right spots, right?

Mm-hmm.

And so, like, this is an area where laziness has somewhat taken over to a certain degree. And we know that there's good best practices out there around zero trust, around, you know, locking down policies and procedures more so than what we have done. And we've just been too lazy to deliver that. And so, we default into an operational detection and response mode versus trying to be more proactive. proactive in terms of how we control things. And so I would say that, lean in a little bit more into having the right protective controls in place from the ground up.

Well, Chris, I think that's a surprisingly left-leaning answer for somebody who builds, you know, a SIEM product. I really like that it was not a self-serving answer. So Chris, thank you so much for joining us today.

It's my pleasure. Thank you both.

And now we are at time. Thank you very much for listening and of course for subscribing. You can find this podcast at Google Podcasts, Apple Podcasts, Spotify, Or wherever else you get your podcasts. Also, you can find us at our website cloud.withgoogle.com/cloudsecurity/podcast. Please subscribe so that you don't miss episodes. You can follow us on Twitter twitter.com/cloudsecpodcast. Your hosts are also on Twitter at Anton_Cevajkin and _TimPico. Tweet at us, email us, argue with us, and if you like or hate what we hear, we can invite you to the next episode. See you on the next Cloud Security Podcast episode.