SOC Transformation With RiverSafe And Google SecOps

In the course of its comprehensive SOC (Security Operations Center) transformation program, a global telecommunications company has transitioned to Google SecOps to enhance its threat detection and response capacities. Despite the new platform's sophisticated analytics and detection tools, the existing support processes remained largely manual, inconsistent, and challenging to manage.

YARA-L detection rules were individually deployed via the console, complicating governance and version control, which impeded consistent logic maintenance across various environments and slowed the deployment of new detections. Reference data, critical for detection logic, was kept in spreadsheets and local repositories. Analysts operated with their personal versions, leading to data discrepancies, duplications, and false positives. Moreover, configuring log forwarders involved repetitive manual tasks, with each new data source necessitating unique setup and permissions, resulting in delays and errors, thus limiting visibility.

The overall effect was a SOC equipped with the right tools but lacking the agility and reliability necessary for optimal usage. Changes were sluggish, governance was reactive, and visibility inconsistent.

Introducing DevOps Principles to SecOps

RiverSafe leveraged its SOC, SIEM, and DevSecOps proficiency to create a Terraform-based automation framework, marking a notable enterprise-scale deployment using the official Google SecOps Terraform provider.

This framework formed the base for a Detection-as-Code model that allowed detections, data, and log ingestion to be thoroughly version-controlled, governed, and reproducible.

Detection-as-Code Enhancement

RiverSafe developed Terraform modules for defining, validating, and deploying YARA-L rules directly from YAML

RiverSafe developed Terraform modules for defining, validating, and deploying YARA-L rules directly from YAML manifests stored in version-control. Automatic validation pipelines were integrated via GitHub Actions to ensure rule syntax compliance and prevent invalid logic deployment. Git tag–based versioning was implemented, tying each deployment to a specific, immutable version for easy traceability and rollback. Environment-based branching was also facilitated, supporting controlled promotions of reviewed detections from pre-production to production.

This approach allowed detection logic to be deployed in minutes instead of days, with full traceability and rollback capabilities. Consequently, the SOC could respond to emerging threats more rapidly, with complete confidence in the operational status of each environment.

Automated Reference Data Management

RiverSafe created Terraform resources for defining and maintaining shared reference lists, such as IP, domain, and hash intelligence. Efficient delta updates were implemented, ensuring only modified entries were applied to Google SecOps, which improved accuracy and auditability. Consistency and schema validation were enforced across multiple detection dependencies.

This process established reference data as a single source of truth, eliminating conflicting detections and false positives while enhancing alert reliability and reducing background noise within the SOC.

Forwarder and Log Ingestion Automation

RiverSafe automated the configuration of Google SecOps forwarders for essential data sources like firewall, proxy, and endpoint logs. Standardization of IAM setup, service accounts, and routing configuration ensured secure and repeatable onboarding of new data feeds.

This automation reduced onboarding time from hours to minutes, ensuring secure, consistent ingestion of new log sources, and faster access to essential telemetry throughout the enterprise.

Enhancements in Operations and Security

By embedding automation and DevOps methodologies into its SOC, the organization has realized significant improvements in efficiency, governance, and resilience:

• An 80% reduction in manual configurations, allowing analysts to prioritize threat hunting over maintenance tasks.
• Reduced configuration drift between environments, ensuring consistent coverage across global operations.
• Accelerated rule deployment—from hours or days to minutes—enhancing the SOC's threat response capabilities.
• Clear governance and rollback procedures, providing full tracking, testing, and trusted changes.

The SOC now operates faster, more leanly, and with greater assurance, equipped to function at an enterprise scale with automation as its core. This model exemplifies how modern enterprises can transition from traditional operations to automated, code-driven security on a large scale.