Google Security Operations (formerly Chronicle) is Google Cloud's SIEM and SOAR service, sold in packages priced on ingestion. Pages here cover replacing it with self-hosted Wazuh, OpenSearch and Shuffle.
Comparing Google SecOps with self-hosted Wazuh: ingestion-based packages versus no license fee, detection rules and UEBA against Wazuh rules, agents and compliance dashboards, retention set by contract versus your own storage, and the team each needs.
Comparing Google SecOps with a self-hosted OpenSearch stack using Security Analytics: search and detection, retention you size yourself, data pipelines with Data Prepper instead of Bindplane, and the engineering work OpenSearch leaves to you.
Moving from Google SecOps to Wazuh: repointing forwarders and Bindplane collectors, translating YARA-L rules to Wazuh rules or Sigma, keeping parsers for key log types, retaining history before the subscription ends, and running both in parallel.
Moving SecOps log search and detection to OpenSearch: ingestion with Data Prepper or Fluent Bit, index and retention design, Security Analytics detectors and Sigma rules, dashboards, and exporting history while the Data Period still applies.
Cost by component: ingestion-based package fees and Unit overages, retention beyond 12 months and BigQuery export in Enterprise Plus, against Wazuh and OpenSearch infrastructure, storage for the retention you need, migration and SOC engineering time.
Google may delete SecOps data when the subscription ends, and BigQuery export is an Enterprise Plus feature. This page covers what to export before the contract ends, raw logs versus normalized events, rules and parsers, and how long the extraction takes.
Replacing the SOAR capabilities bundled in Google SecOps packages with self-hosted Shuffle: playbooks to workflows, case handling, integrations with Wazuh and threat intelligence, and what changes when SIEM and SOAR are separate products.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.