By SOC Prime Team
Publication Date: 2026-10-30 09:09:00
For small, targeted pulls, run a UDM search and call the same search through the Google SecOps API to get JSON. For raw logs in their original format, the Data Export API copies logs for a time range and log type into a Cloud Storage bucket you own. The UI’s export produces a spreadsheet-style file that LogTotal doesn’t read today.
Google SecOps keeps a year of data by default at Google scale, and it’s increasingly where security teams look first. Prime Core has 20,031 detection rules for Google SecOps, mapped to 663 MITRE ATT&CK techniques. Below is how to get data out, sanitize it, and investigate it for free in LogTotal.
Before you start
Raw logs or UDM events? Google SecOps keeps both: the raw logs as ingested, and normalized UDM events. When the raw logs are syslog or JSON, they’re usually the better input for LogTotal. UDM JSON works too.
Permissions. Access is granted through IAM roles on the SecOps…
