---
title: Google Chronicle SIEM
slug: authentication-guides/google-chronicle-siem
docTags: 
createdAt: 2026-04-28T10:13:37.577Z
---

# Introduction

This guide tells you how to authenticate the Google Chronicle SIEM connector in Swimlane using OAuth 2.0 Service Account Authentication.

You will create a Google Cloud project, configure a service account, assign required permissions, collect required identifiers, and configure the connector in Swimlane.

# Prerequisites

## Google Chronicle Access Requirements

You must have permissions to:

- Access Google Cloud Console
- Create and manage GCP projects
- Enable APIs and services
- Create and manage service accounts
- Assign IAM roles and permissions
- Configure domain-wide delegation (if required)

## Required Credentials

During setup, you will collect:

- Service Account JSON Key (Base64 encoded)
- API Base URL (Chronicle endpoint)
- Scope
- GCP Project ID

## Scopes

The following scope is required for Chronicle API access:

[https://www.googleapis.com/auth/chronicle-backstory](https://www.googleapis.com/auth/chronicle-backstory)

## Google Chronicle Setup

Take the following steps to create a GCP Project:

1. Navigate to: [https://console.cloud.google.com/](https://console.cloud.google.com/)
2. Click the project selector dropdown.
3. Click **New Project**.
4. Enter a project name.
5. Click **Create**.

### Take the following steps to enable Chronicle API:

1. Navigate to **APIs & Services → Library**.
2. Search for **Chronicle API**.
3. Click **Enable**.

Take the following steps to create a Service Account:

1. Navigate to **IAM & Admin → Service Accounts**.
2. Click **Create Service Account**.
3. Enter:
   - Name
   - ID
   - Description
4. Click **Create and Continue**.

### Take the following steps to assign roles:

1. In the **Grant this service account access** step:
2. Assign one of the following roles:
   - Chronicle API Admin
   - Chronicle API Reader
3. Click **Continue**, then **Done**.

### Take the following steps to generate JSON Key:

1. Open the created service account.
2. Navigate to the **Keys** tab.
3. Click **Add Key → Create New Key**.
4. Select **JSON** format.
5. Click **Create**.
6. Download and securely store the JSON file.

### Take the following steps to configure API Scopes:

1. Navigate to: *https\://admin.google.com*
2. Go to **Security → API Controls**.
3. Click **Manage Domain Wide Delegation**.
4. Click **Add new**.
5. Enter:
   - Client ID (from service account)
   - Scope:
     https\://www\.googleapis.com/auth/chronicle-backstory
6. Click **Authorize**.

### API Endpoint URLs

| **Region**      | **Endpoint**                                                                                                |
| --------------- | ----------------------------------------------------------------------------------------------------------- |
| US Multi-Region | [https://backstory.googleapis.com/](https://backstory.googleapis.com/)                                      |
| Europe          | [https://europe-backstory.googleapis.com/](https://europe-backstory.googleapis.com/)                        |
| Asia            | [https://asia-southeast1-backstory.googleapis.com/](https://asia-southeast1-backstory.googleapis.com/)      |
| Australia       | [https://australia-southeast1-backstory.googleapis.com/](https://asia-southeast1-backstory.googleapis.com/) |

## Connector configuration in Swimlane

1. Log in to Turbine.
2. From the left-hand navigation pane, click **ORCHESTRATION** and click **Assets**.
3. Asset homepage opens.
4. Click the plus icon to open the Configure your Connector Asset window.
5. Select **Google Chronicle SIEM** from the Asset type list.
6. Fill in the Asset Settings and Asset Input as shown:

### Configuration – OAuth 2.0 Service Account

| **Field**          | **Description**                         | **Required/Optional** |
| ------------------ | --------------------------------------- | --------------------- |
| b64\_service\_info | Base64-encoded JSON service account key | Required              |
| url                | Chronicle API base URL                  | Required              |
| scopes             | API scope (chronicle-backstory)         | Required              |
| verify\_ssl        | Enable/Disable SSL Verification         | Optional              |
| http\_proxy        | Optional proxy configuration            | Optional              |

Fields with \* marks are required.

![](https://api.archbee.com/api/optimize/n8uUzk0MM4uC57-zlHNtY/dNErHAfy6P5TK4tyxeGG__.blob)

![]()

# Troubleshooting

If authentication fails:

- Ensure the **JSON key file is valid and correctly encoded**
- Verify the **Chronicle API is enabled**
- Confirm the **service account has correct roles**
- Check the **scope is correctly configured**
- Ensure **domain-wide delegation is authorised**
- Verify the **correct regional endpoint is used**

You have successfully authenticated the Google Chronicle SIEM Connector in Swimlane.

**Sources**

- Google Chronicle API Documentation : [https://cloud.google.com/chronicle/docs](https://cloud.google.com/chronicle/docs)
- Google Cloud Service Account Documentation: [https://cloud.google.com/iam/docs/service-accounts](https://cloud.google.com/iam/docs/service-accounts)