Google Cloud Platform Integration Guide

cloud integrations google

The following instructions are for configuring an integration of Google Cloud Platform (GCP) to facilitate log ingestion into Secureworks® Taegis™ XDR. XDR receives logs from GCP via the Pub/Sub messaging service.

Supported Google Cloud Platform Log Types ⫘

• Cloud Audit Logs

  • Admin Activity
  • Data Access
  • System Event
  • Policy Denied

• VPC Flow Logs

• GKE Dataplane V2
• Security Command Center Findings

Before You Begin ⫘

Ensure the following prerequisites are met before proceeding:

• An active Google Cloud account with an administrator role
• A Google Cloud Project

Data Provided from Integrations ⫘

	Antivirus	Auth	CloudAudit	DHCP	DNS	Email	Encrypt	HTTP	Management	Netflow	NIDS	Thirdparty
Google Cloud Platform			Y							D		V

Y = Normalized | D = Out-of-the-Box Detections | V = Vendor-Specific Detections

Configure Log Forwarding Using the GCP Web Interface ⫘

Create Pub/Sub Topic ⫘

1. Navigate to Pub/Sub > Topics and select Create Topic.

Create Pub/Sub Topic

2. Enter a Topic ID, then select Create.

Enter Pub/Sub Topic ID

Create Pub/Sub Subscription ⫘

3. Navigate to Pub/Sub > Subscriptions and select Create Subscription.

Create Pub/Sub Subscription

4. Enter a Subscription ID and select the topic created in Step 2.

Enter Pub/Sub Subscription ID

5. Set the Acknowledgement deadline to 300 seconds and select Create.

Enter Pub/Sub Subscription Acknowledgement Deadline

Create Sink ⫘

6. Navigate to Logging > Log router and select Create Sink.

Create Sink

7. From Sink details, enter a Sink name and description, then select Next.

Add Sink Details

8. From Sink destination, select Cloud Pub/Sub topic as the sink service, then select the Pub/Sub topic created in Step 2.

Select Sink Service Type and Pub/Sub Topic

9. Select Create sink.

Create a Service Account with Permissions to Read from the Pub/Sub Topic ⫘

10. Navigate to IAM & Admin > Service Accounts and select Create Service Account.

Create a Service Account

11. Enter a Service account name and description. Copy the Service account ID email address for use in a subsequent step and select Done.

Enter Service Account Details

12. Navigate to Pub/Sub > Subscriptions and select Edit for the subscription created in Step 5.

Edit Pub/Sub Subscription

13. Select Add Principal.

Add Principal

14. Enter the service account email copied in Step 11 in the New principals field, and then select the Pub/Sub Subscriber Role.

Grant Access

15. Select Save.

Create a Service Account Key ⫘

16. Open the Service account created in the preceding section and navigate to the Keys tab.

Service Account Key

17. Select Add Key, choose the JSON type, and then select Create. Save the key in a secure location for use in Step 20.

Create Private Key

Complete the Integration in XDR ⫘

18. Log in to XDR and navigate to Integrations → Cloud APIs.
19. Select Set Up Google Cloud Platform.
20. In the XDR configuration panel, enter the following:

• Taegis Integration Name — Any user-friendly name to uniquely identify this integration
• Project ID — The GCP Project ID
• Subscription ID — The GCP Subscription ID
• Upload the JSON key generated in Step 17

Add Google Cloud Platform Integration

Select Logs to Send to XDR ⫘

Reference the Google Cloud resource hierarchy to form the log inclusion filters.

Google Cloud Resource Hierarchy

To select the logs to be sent to XDR, refer to the Create Sink section and update the inclusion filter using the following Cloud Audit Logs, VPC Flow Logs, Google Kubernetes Engine (GKE) Dataplane V2, and Security Command Center Findings sections.

Cloud Audit Logs ⫘

For more information on Cloud Audit Logs, see the Google documentation.

Configuration ⫘

1. In the Google Cloud console, navigate to IAM & Admin > Audit Logs. Select the services for which Data Access audit logs should be enabled.

Data Access Audit Logs

2. Create an inclusion filter to determine which logs are sent to the Pub/Sub topic. Refer to the following table to assist in the building of the inclusion filter for Cloud Audit logs.

	Admin Activity	Data Access	System Event	Policy Denied
Projects	projects/PROJECT_ID/logs/cloudaudit.googleapis.com%2Factivity	projects/PROJECT_ID/logs/cloudaudit.googleapis.com%2Fdata_access	projects/PROJECT_ID/logs/cloudaudit.googleapis.com%2Fsystem_event	projects/PROJECT_ID/logs/cloudaudit.googleapis.com%2Fpolicy
Folders	folders/FOLDER_ID/logs/cloudaudit.googleapis.com%2Factivity	folders/FOLDER_ID/logs/cloudaudit.googleapis.com%2Fdata_access	folders/FOLDER_ID/logs/cloudaudit.googleapis.com%2Fsystem_event	folders/FOLDER_ID/logs/cloudaudit.googleapis.com%2Fpolicy
Organization	organizations/ORGANIZATION_ID/logs/cloudaudit.googleapis.com%2Factivity	organizations/ORGANIZATION_ID/logs/cloudaudit.googleapis.com%2Fdata_access	organizations/ORGANIZATION_ID/logs/cloudaudit.googleapis.com%2Fsystem_event	organizations/ORGANIZATION_ID/logs/cloudaudit.googleapis.com%2Fpolicy

VPC Flow Logs ⫘

For more information on VPC Flow Logs, see the Google documentation.

Considerations ⫘

• VPC Flow logs can be enabled/disabled on a subnet level.

• When enabled on a subnet, logs will be collected for all the virtual machines within that subnet.

• Both the inbound and outbound network traffic will be sampled for log generation for TCP, UDP, ICMP, ESP, and GRE protocols. To learn more about sampling, see the Google documentation.

Configuration ⫘

1. In the Google Cloud console, navigate to VPC Network > VPC Networks, select the network for which you would like to enable VPC Flow Logs, and then select the Subnets tab.

VPC Flow Logs

2. On the subnet for which VPC Flow Logs are to be enabled, enter Edit mode. Under the Flow Logs section, select On.

Enable VPC Flow Logs

3. To route Flow Logs to the Log Router Sink created in the Create Sink section, edit the Sink and then update the Inclusion Filter.

Route VPC Flow Logs

Example Inclusion Filter:

logName="projects/gcp-dataflow-poc/logs/compute.googleapis.com%2Fvpc_flows"

Google Kubernetes Engine (GKE) Dataplane V2 ⫘

For more information on GKE Dataplane V2, see the Google documentation.

Configuration ⫘

1. Refer to the Google documentation to create a GKE cluster.

2. Refer to the Google documentation to enable network policy logging.

3. To route Flow Logs to the Log Router Sink created in the Create Sink section, edit the Sink and then update the Inclusion Filter.

Route VPC Flow Logs

Example Inclusion Filter:

logName="projects/gcp-dataflow-poc/logs/policy-action"

Security Command Center Findings ⫘

For more information on Security Command Center, see the Google documentation.

Configuration ⫘

1. Security Command Center can be activated at the Organization and Project levels.

Organization Level ⫘

Refer to the Google documentation to activate Security Command Center for an organization.

Project Level ⫘

Refer to the Google documentation to activate Security Command Center for a project.

2. In the Google Cloud console, navigate to Security > Security Command Center > Overview and select Edit Settings.

Edit SCC Settings

3. Select the Continuous exports tab.

4. Select Create Pub/Sub Export. Enter a user-friendly name and then select the Pub/Sub topic created in the Create Pub/Sub Topic section.

5. Select Save.