The integration of Google Chronicle Suite with existing SIEM systems needs to be more mature, so some customization is required. With custom applications, it's quite difficult, and they need to work on this. The automated threat detection features in Google Chronicle Suite come with a lot of false positives and noise. They are new to the market and need to improve significantly. Customization is vital where users can customize the alerts, dashboard, or content as per their needs. This is more required in Google Chronicle Suite, allowing analysts or engineers to create according to the organization. They need to provide cheaper options for online versus offline log storage and improve retention and compression of the logs. Especially searching offline logs is a feature missing from most SIEM solutions nowadays.
Google Cloud Security Tech Lead - EMEA at Devoteam Management Consulting
Real User
Top 10
Mar 19, 2025
The user interface could be more intuitive, particularly in navigation. Moreover, the dashboards should be enhanced as they are not up to the mark. The UI is the primary challenge in need of improvement.
At the moment, Google Chronicle suite lacks for real-time threat intelligence. To overcome this, it needs to be integrated with Mandiant. As an improvement, real-time threat intelligence capability needs to be brought in-built in Google Chronicle suite.
It is still not mature enough. If I create some content, there might be roadblocks, although this could change in the future. As of now, it is an immature solution with potential for improvement. I might face problems during integration, as it has not been deployed on the production suite yet.
Senior Solution Architect at Stichting Inlichtingenbureau
Real User
Top 10
Dec 23, 2024
The graphical user interface could be improved to enhance user experience. Additionally, integrating more sources for threat intelligence and deeper integration with SOAR tools would be beneficial. While improvements in machine learning and AI are ongoing, the current offering is satisfactory.
Cyber Security & ICT Director at Polish Security Experts Association
Real User
Top 10
Jan 4, 2024
It is challenging to create rules and context of the language. A few areas are difficult to understand for someone who has less experience using the product.
Solution Delivery Lead at a consultancy with 10,001+ employees
Real User
Nov 7, 2023
The tool needs to improve tasking packages. Its GUI needs to be improved. The product needs to include time-based filtration. We can only see the alert detection timeline now.
Security Consultant at a tech consulting company with 1,001-5,000 employees
Consultant
Nov 6, 2023
The configuration is not optimal. It requires copy and paste of configuration files. Generally, the ingest of logs could be done in simpler and more streamlined ways. The exporting of log information also has room for improvement.
Organizations primarily leverage Google Chronicle Suite for centralized log management, threat intelligence, and endpoint security, addressing MDR requirements with continuous monitoring.
Google Chronicle Suite supports storage, security, and alert checking. Utilizing log information to generate alerts and integration with search engines, it monitors network and login issues. It is a choice for consultants on client projects, and partners handle its global resale and implementation.
...
The integration of Google Chronicle Suite with existing SIEM systems needs to be more mature, so some customization is required. With custom applications, it's quite difficult, and they need to work on this. The automated threat detection features in Google Chronicle Suite come with a lot of false positives and noise. They are new to the market and need to improve significantly. Customization is vital where users can customize the alerts, dashboard, or content as per their needs. This is more required in Google Chronicle Suite, allowing analysts or engineers to create according to the organization. They need to provide cheaper options for online versus offline log storage and improve retention and compression of the logs. Especially searching offline logs is a feature missing from most SIEM solutions nowadays.
The functionalities for parsing and including feeds need improvement. Google should make it easier for clients to manage these aspects.
The user interface could be more intuitive, particularly in navigation. Moreover, the dashboards should be enhanced as they are not up to the mark. The UI is the primary challenge in need of improvement.
At the moment, Google Chronicle suite lacks for real-time threat intelligence. To overcome this, it needs to be integrated with Mandiant. As an improvement, real-time threat intelligence capability needs to be brought in-built in Google Chronicle suite.
It is still not mature enough. If I create some content, there might be roadblocks, although this could change in the future. As of now, it is an immature solution with potential for improvement. I might face problems during integration, as it has not been deployed on the production suite yet.
The graphical user interface could be improved to enhance user experience. Additionally, integrating more sources for threat intelligence and deeper integration with SOAR tools would be beneficial. While improvements in machine learning and AI are ongoing, the current offering is satisfactory.
The tool is perfectly fine, and I have not faced any challenges while using it.
The solution's graphical user interface (GUI) should be more user-friendly.
The tool is a little bit difficult to use compared to Microsoft Sentinel. I use it every day. I needed time to adjust and get used to the solution.
It is challenging to create rules and context of the language. A few areas are difficult to understand for someone who has less experience using the product.
The tool needs to improve tasking packages. Its GUI needs to be improved. The product needs to include time-based filtration. We can only see the alert detection timeline now.
The configuration is not optimal. It requires copy and paste of configuration files. Generally, the ingest of logs could be done in simpler and more streamlined ways. The exporting of log information also has room for improvement.
The product's default dashboard feature has a few limitations regarding availability.