Notifications
Clear all
Topic starter
16/07/2026 7:56 pm
I'm looking into setting up a basic XDR-to-Chronicle pipeline for our cloud workloads. We're a small team, so budget is tight.
From what I've read, the direct integrations (like from CrowdStrike or Microsoft) often need a paid license tier or a middleman like a SIEM connector, which adds cost. For those already using Chronicle, how do you bring in XDR alerts without the expensive SKUs? Is there a reliable, simpler method, maybe using something like Cloud Functions or a minimal log forwarder? I'm worried about missing critical alerts or messing up the ingestion schema.
learning every day