Integrate Google Cloud Platform

You can integrate Google Cloud Platform (GCP) with Sophos XDR so that it sends data to Sophos for analysis.

Key steps

The key steps in a GCP integration are as follows:

• Create a Pub/Sub topic and subscription.
• Configure a logging sink to forward logs to Pub/Sub.
• Create a service account and grant the required permissions.
• Generate a JSON service account key.
• Configure the integration in Sophos XDR.

Requirements

The following is required for GCP configuration:

• An active Google Cloud account with an administrator role.
• A Google Cloud Project.
• One or more supported GCP log sources.

Supported GCP log types

Sophos XDR supports the following GCP log types:

• Cloud Audit Logs

  • Admin Activity
  • Data Access
  • System Event
  • Policy Denied

• Security Command Center Findings

• VPC Flow Logs
• GKE Dataplane V2

Add a GCP integration

To integrate GCP, you must first configure log forwarding through Google Cloud Pub/Sub, then provide the required details in Sophos XDR.

Create Pub/Sub topic and subscription

To create a Pub/Sub topic and subscription, do as follows:

1. In the Google Cloud console, go to Pub/Sub > Topics.
2. Click Create Topic.

3. Enter a Topic ID, then click Create.

   

4. Go to Pub/Sub > Subscriptions.

5. Click Create Subscription.

6. Enter a Subscription ID and select the topic you just created.

   

7. Set the Acknowledgement deadline to 300 seconds.

   Leave other fields at the default values.

   

8. Click Create.

Create sink

To create a sink, do as follows:

1. In the Google Cloud console, go to Logging > Log router.
2. Click Create Sink.

3. In Sink details, enter a name and description for the sink.

   

4. Click Next.

5. In Sink destination, select Cloud Pub/Sub topic as the sink service, then select the Pub/Sub topic you created in the previous section.

   

6. (Optional) To create inclusion filters that determine which logs are sent to the sink, see Select logs to send to Sophos XDR.

7. Click Create sink.

Create and configure a service account

To create a service account with permissions to read from the Pub/Sub topics, do as follows:

1. In the Google Cloud console, go to IAM & Admin > Service Accounts.
2. Click Create Service Account.
3. Enter a name and description for the service account.
4. Make note of the Service account ID email address, which you'll need in a later step.

5. Click Done.

   

6. Go to Pub/Sub > Subscriptions.

7. Click Edit on the subscription you created earlier.

8. Click Add Principal.

   

9. In the New principals field, enter the Service account ID email address you copied earlier.

10. Assign it the Pub/Sub Subscriber role.

    

11. Click Save.

Grant monitoring permission for the service account

To create a custom role with monitoring permissions, do as follows:

1. In the Google Cloud console, go to IAM & Admin > Roles.
2. Click Create Role.
3. Enter descriptive strings for the Title and ID.
4. Under Role launch stage, select General Availability.
5. Click Add Permissions.

6. From the list of permissions, choose monitoring.timeSeries.list and click Add.

   

7. Click Create.

8. Go to IAM & Admin > IAM.

9. Click Grant Access.

   

10. In the New principals field, enter the Service account ID email address you copied earlier.

11. Click the Role drop-down menu, choose Custom, then select the custom role you just created.

    

12. Click Save.

Create a service account key

To create a service account key, do as follows:

1. In the Google Cloud console, go to IAM & Admin > Service accounts.
2. Open the service account you created in the previous section.
3. Open the Keys tab and click Add Key.
4. Choose the JSON key type.

5. Click Create.

   The service account key .json file is downloaded.

   

Configure the integration in Sophos XDR

To integrate GCP with Sophos XDR, do as follows:

1. In Sophos Fusion, go to Security Operations > Integrations > Marketplace.

2. Click GCP.

   The GCP page opens. You can configure integrations here and see a list of any you've already configured.

3. In Configured integrations, click Add new.

4. In Add an integration, do as follows:

   1. Enter a name for the integration.
   2. Enter the GCP Project ID and the Pub/Sub Subscription ID.
   3. Click Upload Key File and attach the .json key file you downloaded from GCP.

5. Click Done.

The new integration appears under Configured integrations. If its status icon is a green tick, your data should appear in the Sophos Data Lake after validation.

Configuration notes

Some additional configuration options are available.

Select logs to send to Sophos XDR

To create inclusion filters that determine which logs are sent to the sink, do as follows:

1. Follow the steps in Google's own guide on building log inclusion filters: About resource hierarchy.

2. Choose a tab for instructions for the following supported log types:

   Cloud Audit LogsSecurity Command Center FindingsVPC Flow LogsGKE Dataplane V2

   See Google's document, Cloud Audit Logs, for more information.

   1. In the Google Cloud console, go to IAM & Admin > Audit Logs.

   2. Select the services for which Data Access audit logs should be turned on.

      

   3. Create an inclusion filter to determine which logs are sent to the Pub/Sub topic. See the following table for assistance with building the inclusion filter for Cloud Audit logs.

      Scope	Admin Activity	Data Access	System Event	Policy Denied
      Projects	projects/PROJECT_ID/logs/cloudaudit.googleapis.com%2Factivity	projects/PROJECT_ID/logs/cloudaudit.googleapis.com%2Fdata_access	projects/PROJECT_ID/logs/cloudaudit.googleapis.com%2Fsystem_event	projects/PROJECT_ID/logs/cloudaudit.googleapis.com%2Fpolicy
      Folders	folders/FOLDER_ID/logs/cloudaudit.googleapis.com%2Factivity	folders/FOLDER_ID/logs/cloudaudit.googleapis.com%2Fdata_access	folders/FOLDER_ID/logs/cloudaudit.googleapis.com%2Fsystem_event	folders/FOLDER_ID/logs/cloudaudit.googleapis.com%2Fpolicy
      Organizations	organizations/ORGANIZATION_ID/logs/cloudaudit.googleapis.com%2Factivity	organizations/ORGANIZATION_ID/logs/cloudaudit.googleapis.com%2Fdata_access	organizations/ORGANIZATION_ID/logs/cloudaudit.googleapis.com%2Fsystem_event	organizations/ORGANIZATION_ID/logs/cloudaudit.googleapis.com%2Fpolicy

   See Google's document, Security Command Center Findings, for more information.

   Security Command Center considerations

   Security Command Center can be activated at the Organization and Project levels.

   To activate Security Command Center for an organization, see Overview of activating Security Command Center.

   To activate Security Command Center for a project, see Activate Security Command Center for a project.

   1. In the Google Cloud console, go to Security > Security Command Center > Overview.

   2. Click Edit Settings.

      

   3. Open the Continuous exports tab and click Create Pub/Sub Export.

   4. Enter a descriptive name, then select the Pub/Sub topic you created earlier.
   5. Click Save.

   See Google's document, VPC Flow Logs, for more information.

   VPC Flow logs considerations

   • VPC Flow logs can be turned on or off on a subnet level.
   • When turned on for a subnet, logs are collected for all virtual machines within that subnet.
   • Both the inbound and outbound network traffic will be sampled for log generation for TCP, UDP, ICMP, ESP, and GRE protocols. To learn more about sampling, see Log sampling and processing.

   1. In the Google Cloud console, go to VPC Network > VPC Networks.
   2. Select the network for which VPC Flow logs should be turned on.

   3. Open the Subnets tab.

      

   4. On the subnet for which VPC Flow Logs are to be turned on, enter Edit mode.

   5. In Flow Logs section, select On.

      

   6. To route VPC Flow logs to the sink you created earlier, edit the sink, then update the Inclusion Filter. See this example of a VPC Flow logs inclusion filter:

      logName="projects/gcp-dataflow-poc/logs/compute.googleapis.com%2Fvpc_flows"
      

   See Google's document, GKE Dataplane V2, for more information.

   1. Follow the steps in Google's own guide for creating a GKE cluster: Creating a GKE cluster with GKE Dataplane V2.

      Info

      GKE Dataplane V2 can only be turned on when creating a new cluster.

   2. Follow the steps in Google's own guide for turning on network policy logging: Use network policy logging.

   3. To route logs to the sink you created earlier, edit the sink, then update the Inclusion Filter. See this example of a GKE Dataplane V2 inclusion filter:

      logName="projects/gcp-dataflow-poc/logs/policy-action"
      

Key rotation

You may need to rotate your GCP keys for your service account periodically. Do as follows:

1. In the GCP management console, create a new JSON key for the service account.
2. Update the GCP integration in Sophos XDR with the newly created key.

3. Open the integration details page. Under the API Query Log tab, look for the log with the summary:

   secrets cache invalidated. Integration was updated. Restarting.
   

   This means the cache will be updated with the new key.

4. Wait for a few minutes to see the successful ingestion of log messages.

5. Delete the old key from the service account in the GCP management console.

Additional resources

For more information on configuring GCP, see the following documents:

• What is Pub/Sub?
• Cloud Audit Logs
• Security Command Center Findings
• Collate and route organization- and folder-level logs to supported destinations
• About resource hierarchy
• Overview of activating Security Command Center
• Activate Security Command Center for a project
• VPC Flow Logs
• GKE Dataplane V2