The Google Cloud Security Community is upgrading platforms! Read more and check out our FAQ.

[Zorghost]

Hello everyone,

If I provide access to the log ingestion API in chronicle, how can I make sure that an external application can only ingest logs to a specific log type and cannot tamper with the integrity of other log types ?

I am currently exploring a lead related to IAM conditions, can this be a viable solution ?

[JeremyLand · Accepted solution]

The ingestion API does not allow for that granularity of control, any api key with write access can write to any logtype. 

You should be able to achieve the desired result using a HTTPS webhook feed.  When you initially configure the webhook you create an API key and secret that can only be used with that feed, and specify the logtype to be used for all data received.  You can also apply ingestion labels there to ensure data from that feed can be distinguished from other data with the same logtype if it is ingested via a different route.

https://cloud.google.com/chronicle/docs/administration/feed-management#setup-webhook