-
Notifications
You must be signed in to change notification settings - Fork 3.1k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
1 parent
66a5975
commit 5de70f1
Showing
9 changed files
with
610 additions
and
430 deletions.
There are no files selected for viewing
97 changes: 97 additions & 0 deletions
97
...Cloud Platform Audit Logs/Data Connectors/GCPAuditLogs_ccp/data_connector_definition.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,97 @@ | ||
| { | ||
| "type": "Microsoft.SecurityInsights/dataConnectorDefinitions", | ||
| "apiVersion": "2022-09-01-preview", | ||
| "name": "{{workspace}}/Microsoft.SecurityInsights/GCPAuditLogsDefinition", | ||
| "kind": "Customizable", | ||
| "properties": { | ||
| "connectorUiConfig": { | ||
| "id": "GCPAuditLogsDefinition", | ||
| "title": "GCP Pub/Sub Audit Logs", | ||
| "publisher": "Microsoft", | ||
| "descriptionMarkdown": "The Google Cloud Platform (GCP) audit logs, ingested from Sentinel's connector, enable you to capture three types of audit logs: admin activity logs, data access logs, and access transparency logs. Google cloud audit logs record a trail that practitioners can use to monitor access and detect potential threats across Google Cloud Platform (GCP) resources.", | ||
| "graphQueriesTableName": "GCPAuditLogs", | ||
| "graphQueries": [ | ||
| { | ||
| "metricName": "Total events received", | ||
| "legend": "GCP Audit Logs", | ||
| "baseQuery": "{{graphQueriesTableName}}" | ||
| } | ||
| ], | ||
| "sampleQueries": [ | ||
| { | ||
| "description": "Get Sample of GCP Audit Logs", | ||
| "query": "{{graphQueriesTableName}}\n | take 10" | ||
| } | ||
| ], | ||
| "dataTypes": [ | ||
| { | ||
| "name": "{{graphQueriesTableName}}", | ||
| "lastDataReceivedQuery": "{{graphQueriesTableName}}\n | where TimeGenerated > ago(12h) | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" | ||
| } | ||
| ], | ||
| "connectivityCriteria": [ | ||
| { | ||
| "type": "HasDataConnectors" | ||
| } | ||
| ], | ||
| "availability": { | ||
| "status": 1, | ||
| "isPreview": false | ||
| }, | ||
| "permissions": { | ||
| "resourceProvider": [ | ||
| { | ||
| "provider": "Microsoft.OperationalInsights/workspaces", | ||
| "permissionsDisplayText": "Read and Write permissions are required.", | ||
| "providerDisplayName": "Workspace", | ||
| "scope": "Workspace", | ||
| "requiredPermissions": { | ||
| "read": true, | ||
| "write": true, | ||
| "delete": true, | ||
| "action": false | ||
| } | ||
| } | ||
| ] | ||
| }, | ||
| "instructionSteps": [ | ||
| { | ||
| "instructions": [ | ||
| { | ||
| "type": "MarkdownControlEnvBased", | ||
| "parameters": { | ||
| "prodScript": | ||
| "#### 1. Set up your GCP environment \n You must have the following GCP resources defined and configured: topic, subscription for the topic, workload identity pool, workload identity provider and service account with permissions to get and consume from subscription. \n Terraform provides API for the IAM that creates the resources. [Link to Terraform scripts](https://github.com/Azure/Azure-Sentinel/tree/master/DataConnectors/GCP/Terraform/sentinel_resources_creation).", | ||
| "govScript": | ||
| "#### 1. Set up your GCP environment \n You must have the following GCP resources defined and configured: topic, subscription for the topic, workload identity pool, workload identity provider and service account with permissions to get and consume from subscription. \n Terraform provides API for the IAM that creates the resources. [Link to Gov Terraform scripts](https://github.com/Azure/Azure-Sentinel/tree/master/DataConnectors/GCP/Terraform/sentinel_resources_creation_gov)." | ||
| } | ||
| }, | ||
| { | ||
| "type": "CopyableLabel", | ||
| "parameters": { | ||
| "label": "Tenant ID: A unique identifier that is used as an input in the Terraform configuration within a GCP environment.", | ||
| "fillWith": ["TenantId"], | ||
| "name": "TenantId", | ||
| "disabled": true | ||
| } | ||
| }, | ||
| { | ||
| "type": "Markdown", | ||
| "parameters": { | ||
| "content": "#### 2. Connect new collectors \n To enable GCP Audit Logs for Microsoft Sentinel, click the Add new collector button, fill the required information in the context pane and click on Connect." | ||
| } | ||
| }, | ||
| { | ||
| "type": "GCPGrid", | ||
| "parameters":{} | ||
| }, | ||
| { | ||
| "type": "GCPContextPane", | ||
| "parameters":{} | ||
| } | ||
| ] | ||
| } | ||
| ] | ||
| } | ||
| } | ||
| } |
24 changes: 24 additions & 0 deletions
24
...gle Cloud Platform Audit Logs/Data Connectors/GCPAuditLogs_ccp/data_connector_poller.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,24 @@ | ||
| [{ | ||
| "type": "Microsoft.SecurityInsights/dataConnectors", | ||
| "apiVersion": "2022-10-01-preview", | ||
| "name": "{{workspace}}/Microsoft.SecurityInsights/GCPAuditLogs", | ||
| "kind": "GCP", | ||
| "properties": { | ||
| "connectorDefinitionName": "GCPAuditLogsDefinition", | ||
| "dataType": "GCPAuditLogs", | ||
| "dcrConfig": { | ||
| "streamName": "SENTINEL_GCP_AUDIT_LOGS" | ||
| }, | ||
| "auth": { | ||
| "serviceAccountEmail": "{{GCPServiceAccountEmail}}", | ||
| "projectNumber": "{{GCPProjectNumber}}", | ||
| "workloadIdentityProviderId": "{{GCPWorkloadIdentityProviderId}}" | ||
| }, | ||
| "request": { | ||
| "projectId": "{{GCPProjectId}}", | ||
| "subscriptionNames": [ | ||
| "{{GCPSubscriptionName}}" | ||
| ] | ||
| } | ||
| } | ||
| }] |
24 changes: 24 additions & 0 deletions
24
Solutions/Google Cloud Platform Audit Logs/Data Connectors/GCPAuditLogs_ccp/dcr.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,24 @@ | ||
| [{ | ||
| "name": "GCPAuditLogs", | ||
| "apiVersion": "2021-09-01-preview", | ||
| "type": "Microsoft.Insights/dataCollectionRules", | ||
| "properties": { | ||
| "destinations": { | ||
| "logAnalytics": [ | ||
| { | ||
| "name": "clv2ws1" | ||
| } | ||
| ] | ||
| }, | ||
| "dataFlows": [ | ||
| { | ||
| "streams": [ | ||
| "Microsoft-GCPAuditLogs" | ||
| ], | ||
| "destinations": [ | ||
| "clv2ws1" | ||
| ] | ||
| } | ||
| ] | ||
| } | ||
| }] |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -2,13 +2,12 @@ | |
| "Name": "Google Cloud Platform Audit Logs", | ||
| "Author": "Microsoft - [email protected]", | ||
| "Logo": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/Google%20Cloud%20Platform%20Audit%20Logs/logo/Google-Cloud-Branding.png\" width=\"75px\" height=\"75px\">", | ||
| "Description": "The Google Cloud Platform (GCP) audit logs, ingested from Sentinel's connector, enable you to capture and track all activity that occurs in your GCP environment. These audit logs provide valuable insights for monitoring user activity, troubleshooting issues, and ensuring compliance with security regulations. They serve as a record of events that practitioners can utilize to monitor access and identify potential threats across GCP resources.", | ||
| "Description": "The Google Cloud Platform (GCP) audit logs, ingested from Microsoft Sentinel's connector, enables you to capture and track all activity that occurs in your GCP environment. These audit logs provide valuable insights for monitoring user activity, troubleshooting issues, and ensuring compliance with security regulations. They serve as a record of events that practitioners can utilize to monitor access and identify potential threats across GCP resources.", | ||
| "Data Connectors": [ | ||
| "Data Connectors/GCPAuditLogs.json" | ||
| "Data Connectors/GCPAuditLogs_ccp/data_connector_definition.json" | ||
| ], | ||
| "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Google Cloud Platform Audit Logs", | ||
| "Version": "2.0.2", | ||
| "Version": "3.0.0", | ||
| "Metadata": "SolutionMetadata.json", | ||
| "TemplateSpec": true, | ||
| "Is1Pconnector": false | ||
| "TemplateSpec": true | ||
| } | ||
Binary file not shown.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.