Today, we are announcing an expanded partnership with Tanium, which includes joint solutions between Tanium Threat Response and Chronicle for security analytics, along with BeyondCorp Remote Access, our cloud solution for the zero trust access system used to protect Google itself. The integration between Threat Response and Chronicle, sold by Tanium, is available now. We’re also furthering our integration between Tanium and BeyondCorp as a next step in our partnership. Our vision is to provide an integrated solution for securing endpoint devices and operating systems, browser-based access, and analyzing all activity for unusual behavior and threats.

A fundamental design principle of the Chronicle platform is the ability to manage massive amounts of security telemetry, easily and over long periods of time. Log volumes have grown, and legacy systems have struggled to keep up from a cost and speed perspective. More recently, the rise of Endpoint Detection and Response (EDR) solutions has accelerated this data growth. As more IT systems move from the data center to the cloud, corporate endpoints have become the central point for security and control.

The combination of an EDR solution and Chronicle is our most common customer use case. EDRs can generate huge volumes of extremely useful and detailed telemetry — including registry key alterations, file hashes, and process trees — but aren’t built for long term retention of that telemetry. Moreover, EDRs don’t correlate network, proxy, and other data from elsewhere in the architecture. For customers looking to secure their endpoints from modern threats, use that data to detect other threats and investigate incidents, a Chronicle-Endpoint Security integration is a helpful solution.

We announced an early partnership with Tanium in 2019. Since then, we’ve made great progress integrating Tanium Threat Response and Chronicle. With this integration, Tanium endpoint telemetry is automatically sent to Chronicle, where it is linked with other data, analyzed for new threats, and retained for instant investigation for a year by default. Unlike EDR vendors, Tanium provides unified endpoint security and management, offering capability including device inventory, configurations, and patches to ensure good hygiene and limit the attack surface. The ability to manage configurations and also detect threats enables better protection and response for our customers.

Google Cloud is excited to work with Tanium to help our joint customers deploy this unique and powerful Chronicle-Tanium integration. You can read the joint press release here and can get additional perspective from Anton Chuvakin, former Gartner analyst and current Google Cloud strategist here. Tanium customers can contact their account managers to learn more. Join us on August 20 for a webinar to learn more and see the products in action.