Hi everyone,
I’ve been lurking here for a while, reading up on SIEM and SOAR platforms as we look to modernize our legacy setup. As part of our formal procurement process, we just wrapped up a fairly extensive proof-of-concept with Google Chronicle, and I wanted to share some of the raw performance data we gathered, specifically on query speeds. I’m hoping to get some validation from the community on whether our findings are typical or if we missed something in our configuration.
Our POC was structured around a 30-day log ingestion period, pulling in about 1.2 TB of data from our primary data sources (firewalls, endpoints, cloud audit logs). We used the Chronicle API and the built-in search interfaces for testing. Our test environment was the standard Chronicle offering, no special provisioning was discussed.
Here are the average query response times we observed for different types of searches. We ran each query type multiple times at different points in the day to get a decent average:
* **Simple IOC lookup** (e.g., a single IP address or domain): Consistently fast, between 2 to 4 seconds. This was impressive.
* **Moderate UDM search** (a specific event type over a 7-day window): Times varied more here, ranging from 8 to 15 seconds.
* **Complex, multi-clause query** (joining across entity types with multiple conditions over the full 30 days): This is where we saw significant variance. The fastest run was 45 seconds, but several queries hit the 2-minute mark before we stopped them. One particularly complex query for a hypothetical investigation timeline timed out after 5 minutes.
My main questions for those of you with production experience are:
* Do these performance numbers align with what you see in your environments, especially for the more complex, investigative queries?
* We didn't extensively play with pre-computed summaries or rules. In your experience, does heavy reliance on real-time, ad-hoc complex searches become a bottleneck during incident response, or is there a workflow to mitigate this?
* How much does query performance depend on the underlying data structure? Our log sources weren't normalized beyond what the default parsers did. Should we have invested more POC time in data modeling upfront to see better performance?
I'm also keenly aware that performance feeds directly into Total Cost of Ownership—slower investigations mean more analyst hours. We’re still waiting for the final pricing proposal, but understanding these operational nuances is critical for our vendor evaluation matrix.
Any insights on your implementation timelines and whether query performance changed as you onboarded more data sources would also be incredibly helpful. We have a follow-up meeting with the Chronicle team scheduled, and I want to make sure we’re asking the right questions about scalability and expected performance in a full production rollout.