The platform
Everything an MSSP needs to run Google SecOps at fleet scale.
Nine modules, one console. Each one stands on its own — together they replace the spreadsheets, scripts, and separate logins most MSSP teams run Chronicle with today.
Fleet & Customer Management
Every customer tenant, one console.
- Integrated with Google's Partner API for end-to-end deployment and provisioning of a customer's SecOps instance — no manual setup in the Google Cloud console.
- Onboard and configure a customer's Chronicle instance — project, region, credentials, API keys — in one place.
Federated Threat Hunting
One query. Every customer. At once.
- Write one UDM query and run it across every customer instance simultaneously — not N times, logged in N times.
- Save and share hunts across the team, so a technique found at one customer gets checked everywhere immediately.
Case Overview
Every open case, every customer, one queue.
- A single queue of open cases across every customer instance, instead of a separate SOAR login per tenant.
- Priority, stage, and assignee visible at a glance, fleet-wide.
Content Hub
Deploy once. Keep every customer in sync.
- Deploy and sync SIEM content — detection rules, parsers, parser extensions — across customer instances from one place.
- Same for SOAR content: playbooks and integrations, deployed and enabled consistently instead of drifting customer to customer.
Marketplace
Field-tested detection content, ready to acquire and distribute among your customers.
- As of October 1, 2026: 23 detection rules spanning 6 data sources — Microsoft Entra ID, Fortinet, Google Cloud, GitLab, Microsoft 365, and OpenAI — every one mapped to its MITRE ATT&CK tactic and technique. The catalog keeps growing as new content ships, so these numbers are a snapshot, not a ceiling.
- Field-tested response playbooks, not simulated: Mandiant DTM Triage runs fully automatically, classifying alerts and enriching them against urlscan.io, Google Threat Intelligence, and Azure AD.
Agentic Operations
A first pass on every alert, before an analyst touches it.
- Triage and Investigation agents give a fast, rule-based first read on an alert — context, duplicates, related cases, entity enrichment — before an analyst opens it.
- A free-text chat agent (Gemini-powered) an analyst can ask open-ended questions, which reasons over the case and calls the right tools itself.
Detection Coverage
Describe a threat. See what you'd actually catch.
- Describe a threat in plain language — a CVE, an advisory, an attacker TTP — and Prairie breaks it into concrete detection opportunities.
- Generates realistic synthetic test events for each one, so coverage is tested against real-shaped data, not theory.
Analytics & Reporting
The fleet's numbers, not one customer's.
- Usage, detection, SOAR playbook-health, and ingestion dashboards rolled up across every customer at once.
- See which customers are trending toward their license limits before it becomes an urgent conversation.
Access & Audit
Who can do what, and a record of who did.
- Role-based access control, scoped per customer instance or across the whole fleet.
- SSO / identity-provider integration, so access follows the MSSP's own identity system.
Book a Demo
See Prairie on your own customer fleet.
30 minutes, no slide deck required — we'll walk through the modules most relevant to how you run SecOps today.