My setup for monitoring third-party vendor access using Chronicle.

Hi everyone. I'm setting up my first security monitoring pipeline and chose Chronicle to track third-party vendor access to our cloud environment. We had an incident last month (false alarm, thankfully 😅) and I wanted something more structured than manual log reviews.

My current setup:
* Chronicle ingesting logs from GCP Audit Logs (focus on `setIamPolicy` and service account key creations).
* A simple Python script that runs daily to check for new vendor-related findings.

```python
# This runs as a Cloud Function triggered by Chronicle alerts
from google.cloud import chronicle

def check_vendor_access(event, context):
client = chronicle.ChronicleClient()
# Query for IAM changes in the last 24h where principalEmail contains vendor domains
rule = 'principal.email rcontains "vendor-example.com"'
results = client.list_events(rule=rule, start_time="24h")
# ... logic to filter and send to Slack ...
```

It's basic, but it works. My next step is to make this a proper pipeline. I'm thinking:
1. Use Airbyte to move Chronicle findings to BigQuery for history.
2. Use dbt to model the data (e.g., "vendor_access_trends").
3. Maybe use Airflow to orchestrate the whole check?

Has anyone done something similar? I'm especially unsure about:
* The best way to structure the recurring Chronicle queries.
* If I should process the findings in Chronicle itself first, or just send everything to the warehouse.

Any advice on pitfalls or better patterns would be really appreciated. The documentation is great, but real-world examples are hard to find.