In this section:
Feedback:

Google SecOps

This document explains how you can configure Google SecOps to send alerts to Anomali using the Google SecOps API, and add Google SecOps as a log source in the Anomali platform.

Specifically, this configuration enables Anomali to periodically pull the following alerts from Google SecOps for enrichment, correlation, and downstream intelligence workflows:

  • Curated alerts: These are alerts produced by out-of-the-box detection rules that are authored, maintained, and updated by Google.

  • Custom alerts: These are alerts produced by rules you create inside Google SecOps.

Google SecOps API

You can use your existing Google Cloud service account or create a new service account to add a new log source in the Anomali platform.

Onboarding steps

Prerequisites

Before adding Google SecOps as a log source, you must fulfill the following prerequisites:-

Google SecOps prerequisites

  • An active Google SecOps tenant.

  • Permissions to:

    • Create or access a service account

    • Download service account credentials (in JSON format)

    • Read alerts via the Google SecOps API

  • Access to your:

    • Project ID

    • Instance ID (Customer ID)

    • Deployment location (region)

Regional Endpoints

Google SecOps APIs are region-specific. Select the endpoint that corresponds to your SecOps deployment region.

See Google SecOps Regional Endpoint documentation for more information.

Step 1: Download Google SecOps Service Account Credentials

In the Google SecOps platform:

  1. Create or select a service account with alert read permissions.

  2. Generate and download the service account key in JSON format.

Step 2: Retrieve Google SecOps Identifiers

From Google SecOps, retrieve the following identifiers:-

Field Description
Project ID

Google Cloud project associated with SecOps.
Instance ID

This is also the Customer ID.
Location

Region where SecOps is deployed.
Regional endpoint API endpoint corresponding to the region.

Step 3: Add Google SecOps as new log source

To add Google SecOps as a new log source on the Anomali platform and allow Anomali to correctly scope and authenticate API requests:

  1. Navigate to Search > Log Source Management.

  2. Click New to add a new log source.

  3. Enter a name for the log source.

  4. (Optional) Enter a description for the source type.

  5. Select Google SecOps as the log source.

  6. Select API as the ingestion method.

  7. Provide the Basic Configuration details:

    1. Regional Endpoint URL: Enter the regional endpoint URL from Step 2: Retrieve Google SecOps Identifiers.

    2. Project ID: Enter the Project ID from Step 2: Retrieve Google SecOps Identifiers.

    3. Location: Enter the deployment region from Step 2: Retrieve Google SecOps Identifiers.

    4. Service Account Credentials: Enter the service account credentials from Step 1: Download Google SecOps Service Account Credentials.

    5. Instance ID: Enter the Instance ID from Step 2: Retrieve Google SecOps Identifiers.

  8. (Optional) Click Show Advanced Options to:

    1. Enable custom alerts or curated alerts and send custom or curated alerts to Anomali.

    2. Set the ingestion interval value in minute, hour, or day. The default value is 10 minutes.

  9. Click Save to add the log source.

Step 4: Configure permissions

You can set permissions to decide which roles can view, add, or edit log sources. To do so, configure the following parameters:

  1. Owner: Select an owner of the view from the list of users. This is the email address of the owner.

  2. Type: Select the type of permission assigned to the view:

    1. Private: Only the owner has read and write privileges, that is, no other user can access or edit the view.

    2. Shared: Allows you to set the read-write privileges for a role that is mapped to different users, granting read-write permissions to all users assigned that role. You can also assign read or write permissions to everyone in your organization.

Step 5: Check log source status

Once added, the status of the log source becomes Create Requested. See Log Source Statuses to understand the different types statuses assigned to log sources.

Step 6: Receive confirmation email

You will receive a notification email from Anomali once you have created a new log source request. The Log Source Management page will show the status as Create Requested.

Once the log source has been provisioned and is ready for use, Anomali will send you another email and the Log Source Management page status for the log source will change to Active.