Skip to content
English
Sign in
Open/Manage Support Request
  • There are no suggestions because the search field is empty.

How To Configure the ZeroLock® Management Console to Send Activity Data to Google Security Operations

This article will walk through configuring the ZeroLock Management Console (ZMC) to send all data from the Activity Log to Google Security Operations (SecOps)

The data collected in an Activity Log is critical for system administrators in monitoring events, troubleshooting issues, and ensuring security. Everything from user activity, endpoint events, and information on alerts (Alert ID, Type of alert, links to specific alerts) is collected in the log. For example, an administrator can see detailed SSH-MFA alert data such as the success/failure of the attempts, the source IP address, and the hostname with the date and time of the event.

Google SecOps

  1. In Google SecOps, navigate to Settings → SOAR settings → Ingestion → Webhooks.Step_1A_SOAR Settings-1
    Step_1B_Webhooks-1
  2. Click the + icon to create a new webhook. Enter a name, description, and select an environment (the default environment is used in this example).Step_2_New Webhook Creation-1
  3. Hover over the Webhook URL field and click the copy icon. Save this URL—you’ll need it to configure ZMC to forward activity to Google SecOps.
    Step_3_Webhook URL-1
    Step_3_Note-Dec-17-2025-07-54-35-8926-PM
  4. Configure the HTTP transport fields in ZMC
    1. Navigate to System Configuration à Integrations in ZMC.
    2. From the Google SecOps webhook URL, copy only the server name (for example,
      \<SECOPS_HOSTNAME\>) and paste it into the HTTP Transport Hostname field in ZMC. Do not include the https:// prefix.
    3. From the same webhook URL, copy everything after the server name, starting with the first / and paste it into the Path field in ZMC.
    4. Select UPDATE to confirm changes.

      Step_4_HTTP Transport

  5. Upload a sample JSON alert from ZMC so you can map fields from the ZMC alert payload to the corresponding Google SecOps alert fields.Step_5_Sample JSON Alert-1
    Exercise: Download this sample JSON file to import into Google SecOps by clicking the Upload JSON sample button.  This will be used to perform the data mapping.
  6. Map the data from the sample alert to the required alert fields in Google SecOps.Step_6_Map Data_KB
  7. When you have finished mapping the data, click Save to store your mappings.Step_7_Save-1
  8. When alerts begin coming through from ZMC, verify that they appear on the Cases screen in Google SecOps. Their appearance indicates that the setup is successful.Step_8_Alerts Coming Though_KB

      You have successfully configured the ZeroLock Management Console to send activity data to Google SecOps.