Google Cloud SCC v2.1.31

This pack leverages the features of Google Cloud Security to provide an organization-wide framework for detection and response.

Author:
GoogleCloudSCC
Support:
partner
URL:
https://cloud.google.com/security-command-center
agentixxsiam
Cloud Service Provider

Classifiers (2)

Incident fields (94)

Incident types (1)

Integrations (1)

Layouts (1)

Modeling rules (1)

Parsing rules (1)

README

<!DOCTYPE html>

Google Cloud Security Command Center

<~XSOAR> Google Cloud SCC XSOAR integration </~XSOAR>

Overview

Google Cloud Security Command Center is a platform that offers deep visibility into cloud infrastructure.
It identifies security threats, and provides proactive measures to mitigate risks.
It consolidates security-related data, offers real-time monitoring and alerts, enables continuous security assessment, and provides recommendations to improve cloud security posture.

<~XSIAM>

What does this pack do?

The Google Cloud Security Command Center content pack helps organizations to monitor, identify and prevent security events on Google Cloud Platform, detects vulnerabilities on Google Cloud environments and provides instructions and recommendations to improve cloud security.


Log normalization supports the following data:

Finding — A record of a threat, vulnerability, or misconfiguration that a certain service was found in a Google Cloud environment. Findings show the issue that was detected, the resource that is affected by the issue, and guidance on how you can address the issue.

For Google Cloud audit logs normalization , follow this procedure:

Ingest logs and data from a GCP Pub/Sub

1. Go to Marketplace and search for Google Cloud Logging</i>.
2. Install Google Cloud Logging</i>.
3. Go to Data Sources</i> and Add New Instance</i>.
4. Connect the Google Cloud Platform</i> data source.
5. Insert subscription name.
6. Insert credentials file.
7. Select Flow or Audit Logs</i>.
8. Go to the Query builder and use the dataset - google_cloud_logging_raw.
</p>

Note

To include audit logs related to Google Cloud Security Command Center only, you need to add an inclusion filter on the log router sink.
Add the filter protoPayload.serviceName="securitycenter.googleapis.com"</i>
as describe in section 2.c.
</p> </details>

For sample use cases click here.

Use Cases

1. Vulnerability findings - Public bucket ACL: When a cloud storage bucket is detected as publicly accessible (that means that anyone can read/ edit the content of the bucket) the user will be notified about this event and will get a recommendation on how to act regarding this issue.
Usually for this type of event, you will need to remove users from the bucket's members list.

2. Vulnerability findings - Open RDP Port: When a firewall configuration is set to have an open RDP port that allows connections from all IP addresses on TCP | UDP port 3389.
The recommendation will be to restrict firewall rules.


Configure Google Cloud Security Command Center

To configure ingestion of data from Google Cloud Security Command Center follow the procedure in:
Ingest logs and data from a GCP Pub/Sub


Configure Cortex XSIAM

1. Go to Marketplace and install the Google Cloud SCC pack.
2. Go to Data Sources</i> and Add New Instance</i>.
3. Connect the Google Cloud Platform</i> data source.
4. Insert the subscription name (Ingest logs and data from a GCP Pub/Sub section 3).
5. Insert the credentials file (Ingest logs and data from a GCP Pub/Sub section 4).
6. Select Log Type Generic</i>.
7. Select Log Format JSON</i>.
8. Insert Vendor = Google</i> and Product = SCC</i>.
</p>

Notes

* To configure Google Cloud Security Command Center you must be a user with the corresponding permissions, for example:
1. Pub/ Sub Admin.
2. Security Center Admin Viewer.
3. View Service Accounts.
* To create Continuous Exports, go to Security -> Settings -> CONTINUOUS EXPORTS -> CREATE PUB/ SUB EXPORT</i>
After naming the continuous Exports</i> and describing it (optional) select or create the topic.
The default Finding</i> query returns all findings in the active</i> state and that are not muted</i> (mute - hides finding from default view).
For more Finding Query information, see this documentation
* For general Google Cloud</i> audit logs ingestion, you might need additional or a different configuration on Google Cloud Platform Pub/Sub. </p>
</body> </html> </~XSIAM>