Google Cloud Platform Integration Guide🔗

The following instructions are for configuring an integration of Google Cloud Platform (GCP) to facilitate log ingestion into Secureworks® Taegis™ XDR. XDR receives logs from GCP via the Pub/Sub messaging service.

Supported Google Cloud Platform Log Types🔗

Cloud Audit Logs
- Admin Activity
- Data Access
- System Event
- Policy Denied
VPC Flow Logs
GKE Dataplane V2
Security Command Center Findings

Before You Begin🔗

Ensure the following prerequisites are met before proceeding:

An active Google Cloud account with an administrator role
A Google Cloud Project

Important

This guide assumes these prerequisite steps are complete before beginning setup.

Data Provided from Integrations🔗

	Normalized Data	Out-of-the-Box Detections	Vendor-Specific Detections
Google Cloud Platform	CloudAudit	Netflow	Thirdparty

Note

XDR detectors are not guaranteed to be triggered, even if a data source's logs are normalized to a schema associated with a given detector. However, you can create Custom Alert Rules to generate alerts based on normalized data from a data source.

Configure Log Forwarding Using the GCP Web Interface🔗

Create Pub/Sub Topic🔗

Navigate to Pub/Sub > Topics and select Create Topic.

Create Pub/Sub Topic
Enter a Topic ID, then select Create.

Enter Pub/Sub Topic ID

Create Pub/Sub Subscription🔗

Navigate to Pub/Sub > Subscriptions and select Create Subscription.

Create Pub/Sub Subscription
Enter a Subscription ID and select the topic created in Step 2.

Enter Pub/Sub Subscription ID
Set the Acknowledgement deadline to 300 seconds and select Create.

Enter Pub/Sub Subscription Acknowledgement Deadline

Create Sink🔗

Tip

To collect organization- and folder-level logs, follow the vendor documentation to create aggregated sinks.

Navigate to Logging > Log router and select Create Sink.

Create Sink
From Sink details, enter a Sink name and description, then select Next.

Add Sink Details
From Sink destination, select Cloud Pub/Sub topic as the sink service, then select the Pub/Sub topic created in Step 2.

Select Sink Service Type and Pub/Sub Topic

Note

See Select Logs to Send to XDR to create inclusion filters that determine which logs are sent to the sink.
Select Create sink.

Create a Service Account with Permissions to Read from the Pub/Sub Topic🔗

Navigate to IAM & Admin > Service Accounts and select Create Service Account.

Create a Service Account
Enter a Service account name and description. Copy the Service account ID email address for use in a subsequent step and select Done.

Enter Service Account Details
Navigate to Pub/Sub > Subscriptions and select Edit for the subscription created in Step 5.

Edit Pub/Sub Subscription
Select Add Principal.

Add Principal
Enter the service account email copied in Step 11 in the New principals field, and then select the Pub/Sub Subscriber Role.

Grant Access
Select Save.

Grant Monitoring Permission for the Service Account🔗

Create a Custom Role on GCP🔗

Navigate to IAM & Admin > Roles. Click on Create Role.
Fill in the required details:

Title (any descriptive string)
ID (any descriptive string)
Select General Availability as the Role launch stage

Add Role Permissions

Select Add Permissions.
Select the monitoring.timeSeries.list permission from the list of permissions.

Add Monitoring Role Permission
Click the Add button.

Create Monitoring Role
Click the Create button to complete creation of the Role.

Add the Custom Role to the Service Account🔗

Note

Customers with an existing GCP integration do not need to generate a new service account and key for the service account. The custom role can be granted to an existing service account.

Navigate to IAM & Admin > IAM.

Grant Monitoring Role
Click on Grant Access.
In the New principals text box, enter the service account email created previously in the Create a Service Account with Permissions to Read from the Pub/Sub Topic section.

Click the Role drop-down and select “Custom” and then select the custom role created in the above step.

Grant Role to Service Account
Click Save.

Create a Service Account Key🔗

Open the Service account created in the preceding section and navigate to the Keys tab.

Service Account Key
Select Add Key, choose the JSON type, and then select Create. Save the key in a secure location for use in Step 30.

Create Private Key

Complete the Integration in XDR🔗

Log in to XDR and navigate to Integrations → Cloud APIs.
Select Add an Integration from the top of the page.

Add an Integration
From the Optimized tab, select Google Cloud and enter the following in the configuration panel:

Taegis Integration Name — Any user-friendly name to uniquely identify this integration
Project ID — The GCP Project ID
Subscription ID — The GCP Subscription ID
Upload the JSON key generated in Step 27

Add Google Cloud Platform Integration

Select Logs to Send to XDR🔗

Reference the Google Cloud resource hierarchy to form the log inclusion filters.

To select the logs to be sent to XDR, refer to the Create Sink section and update the inclusion filter using the following Cloud Audit Logs, VPC Flow Logs, Google Kubernetes Engine (GKE) Dataplane V2, and Security Command Center Findings sections.