GCP

Manage and secure Google Cloud Platform resources. On Cortex Platform, authentication is handled automatically via the cloud connector. For Cortex XSOAR and Cortex XSIAM (version < 3.0), configure a GCP Service Account private key JSON and a default GCP Project ID.

Category

Cloud Services

Pack

GCP

Configuration parameters

• credentials — (required)
• project_id — GCP Project ID
• proxy — Use system proxy settings
• insecure — Trust any certificate (not secure)

Commands (45)

• gcp-bq-dataset-policy-remove — Removes an email from the BigQuery dataset policy. Required Permissions: bigquery.datasets.update, bigquery.datasets.get, bigquery.datasets.getIamPolicy, bigquery.datasets.setIamPolicy.
• gcp-compute-enable-private-ip-access-on-subnet-quick-action — Enables Private Google Access on a GCP subnet. Required permissions: compute.subnetworks.setPrivateIpGoogleAccess, compute.subnetworks.update, compute.subnetworks.get, compute.subnetworks.list.
• gcp-compute-firewall-get — Retrieves a specific firewall rule by name. Required permission: compute.firewalls.get.
• gcp-compute-firewall-insert — Creates a new firewall rule in a specific project. Required permission: compute.firewalls.create.
• gcp-compute-firewall-list — Lists the firewall rules in a specific project. Required permission: compute.firewalls.list.
• gcp-compute-firewall-patch — Updates a specific firewall rule with the data included in the request. Required permissions: compute.firewalls.update, compute.firewalls.get, compute.firewalls.list, compute.networks.updatePolicy, compute.networks.list.
• gcp-compute-firewall-patch-disable-gcp-default-firewall-rule-quick-action — Disables a default GCP firewall rule that is overly permissive (except HTTP and HTTPS). Required permissions: compute.firewalls.update, compute.firewalls.get, compute.firewalls.list, compute.networks.updatePolicy, compute.networks.list.
• gcp-compute-image-get — Returns a specific image. Required permission: compute.images.get.
• gcp-compute-instance-get — Returns a specific instance resource. To get a list of available instances, make a list() request. Required permission: compute.instances.get.
• gcp-compute-instance-group-get — Returns a specific instance group. Required permission: compute.instanceGroups.get.
• gcp-compute-instance-labels-set — Sets labels on an instance. Required permission: compute.instances.setLabels.
• gcp-compute-instance-service-account-remove — Removes the service account associated with a GCP Compute Engine VM instance. The instance must be stopped before the service account can be changed. Required permissions: compute.instances.setServiceAccount, compute.instances.get.
• gcp-compute-instance-service-account-set — Sets the service account for a GCP Compute Engine VM instance. The instance must be stopped before the service account can be changed. Required permissions: compute.instances.setServiceAccount, compute.instances.get.
• gcp-compute-instance-start — Starts an instance that was stopped using the instances().stop method. Required permission: compute.instances.start.
• gcp-compute-instance-stop — Stops and cleanly shuts down a running instance, allowing you to restart the instance at a later time. Stopped instances do not incur VM usage charges while they are stopped. However, resources that the VM is using such as persistent disks and static IP addresses will continue to be charged until they are deleted. Required permission: compute.instances.stop.
• gcp-compute-instances-aggregated-list-by-ip — Returns an aggregated list of instances across all zones that can be filtered by internal or external IP. Required permission: cloudasset.assets.searchAllResources.
• gcp-compute-instances-list — Retrieves the list of instances in the specified zone. Required permission: compute.instances.list.
• gcp-compute-network-get — Returns the specified network.
• gcp-compute-network-insert — Creates a network in the specified project using the data included in the request. Required permission: compute.networks.create.
• gcp-compute-network-tag-set — Adds a network tag to a VM instance (merges with existing tags). Required permission: compute.instances.setTags.
• gcp-compute-networks-list — Retrieves a list of networks available for the specified project. Required permission: compute.networks.list.
• gcp-compute-region-get — Returns a specific region resource. Required permission: compute.regions.get.
• gcp-compute-snapshot-get — Retrieves details for a specific snapshot. Required permission: compute.snapshots.get.
• gcp-compute-snapshots-list — Lists snapshots in a specific project. Required permission: compute.snapshots.list.
• gcp-compute-subnet-update — Enables flow logs or Private Google Access on a subnet. Required permissions: compute.subnetworks.setPrivateIpGoogleAccess, compute.subnetworks.update, compute.subnetworks.get, compute.subnetworks.list.
• gcp-compute-subnet-update-enable-gcp-subnet-flow-logs-quick-action — Enables VPC Flow Logs on a GCP subnet. Required permissions: compute.subnetworks.setPrivateIpGoogleAccess, compute.subnetworks.update, compute.subnetworks.get, compute.subnetworks.list.
• gcp-compute-zone-get — Returns a specific zone resource. Required permission: compute.zones.get.
• gcp-container-cluster-security-update — Configures security settings for GKE clusters, including access controls and visibility. Required permissions: container.clusters.update, container.clusters.get, container.clusters.list.
• gcp-container-cluster-security-update-enable-gke-cluster-intra-node-visibility-quick-action — Enables intra-node visibility on a GKE cluster for enhanced network monitoring. Required permissions: container.clusters.update, container.clusters.get, container.clusters.list.
• gcp-container-cluster-security-update-enable-master-authorized-networks-on-gke-quick-action — Enables Master Authorized Networks on a GKE cluster to restrict API server access. Required permissions: container.clusters.update, container.clusters.get, container.clusters.list.
• gcp-iam-project-policy-binding-remove — Removes a specified IAM role binding from a GCP project. Required permissions: resourcemanager.projects.getIamPolicy, resourcemanager.projects.setIamPolicy.
• gcp-storage-bucket-get — Retrieves information about a specific bucket. Required permission: storage.buckets.get.
• gcp-storage-bucket-list — Retrieves the list of buckets in the project associated with the client. Required permission: storage.buckets.list.
• gcp-storage-bucket-metadata-update — Updates Google Cloud Storage (GCS) bucket metadata, including settings such as versioning and Uniform Bucket-Level Access (UBLA). Required permission: storage.buckets.update.
• gcp-storage-bucket-metadata-update-enable-GCP-bucket-versioning-quick-action — Enables versioning on a GCP storage bucket to preserve object versions. Required permission: storage.buckets.update.
• gcp-storage-bucket-metadata-update-set-GCP-bucket-access-to-uniform-quick-action — Enables uniform bucket-level access on a GCP storage bucket for enhanced security. Required permission: storage.buckets.update.
• gcp-storage-bucket-object-policy-list — Retrieves the IAM policy for a specific object in a bucket. Required permission: storage.objects.getIamPolicy.
• gcp-storage-bucket-object-policy-set — Sets the IAM policy for a specific object in a bucket. Required permission: storage.objects.setIamPolicy.
• gcp-storage-bucket-objects-list — Retrieves the list of objects in a bucket. Required permission: storage.objects.list.
• gcp-storage-bucket-policy-delete — Removes an entity from a bucket's Access Control List. Required permissions: storage.buckets.getIamPolicy, storage.buckets.setIamPolicy.
• gcp-storage-bucket-policy-delete-make-gcp-bucket-private-quick-action — Revokes 'allUsers' and 'allAuthenticatedUsers' permissions access in a GCP storage bucket. Required permissions: storage.buckets.getIamPolicy, storage.buckets.setIamPolicy.
• gcp-storage-bucket-policy-delete-remove-AllAuthenticatedUser-access-quick-action — Revokes 'allAuthenticatedUsers' permission access in GCP storage buckets. Required permissions: storage.buckets.getIamPolicy, storage.buckets.setIamPolicy.
• gcp-storage-bucket-policy-delete-remove-allusers-access-quick-action — Revokes 'allUsers' permission access in GCP storage buckets. Required permissions: storage.buckets.getIamPolicy, storage.buckets.setIamPolicy.
• gcp-storage-bucket-policy-list — Retrieves the IAM policy for a bucket. Required permissions: storage.buckets.getIamPolicy, storage.buckets.get.
• gcp-storage-bucket-policy-set — Sets the IAM policy for a bucket. Required permission: storage.buckets.setIamPolicy.