demo · v137

Incident Timeline

The Chrome Enterprise use case Google called out: an admin investigating an incident wants to correlate a browser-side event (extension install, file download, navigation) with the actual network the user was on. Without IP logging, the SIEM has events with no IP; with v137, the connector includes the remote IP per event. Toggle the connector setting and watch the correlation graph fill in or fall apart.

probing…

chrome enterprise connector config

{ "service_provider": "google", "enabled_event_names": [ "browserCrashEvent", "extensionInstallEvent", "navigationEvent", "passwordReuseEvent" ], "include_remote_ip": true // new in Chrome 137 }

scenario: suspicious extension installs from VPN exit IP

browser-reported events (Chrome Enterprise connector)

click run scenario to populate

network firewall log

click run scenario to populate

SIEM correlation

awaiting run...

the code

// Admin policy (set via Google Admin console):
{
  "service_provider": "google",
  "enabled_event_names": [...],
  "include_remote_ip": true     // NEW: Chrome 137+
}

// SIEM payload, post-v137:
{
  "event": "extensionInstallEvent",
  "timestamp": "2026-05-31T14:02:11Z",
  "user": "alice@corp.example",
  "extension_id": "abcd...",
  "remote_ip": "198.51.100.42"   // <-- the new field
}

// Without it, the SIEM can match user+time, but not network -
// can't tell whether alice installed from the office or a VPN.

see also