Onboarding orgs to chronicle

[AfvanJaffer]

how can I onboard logs from two organizations into the chronicle?

I have an organization that is currently set up native ingestion to chronicle, and everything is fine there. 

I have a requirement to send logs from a different organization now to the same chronicle instance, how can I do that?

[Rene_Figueroa · Accepted solution]

Hi @AfvanJaffer you can onboard another GCP organization by obtaining another one-time code from us. Simply open a support case and mention you need another one-time code to link another GCP org to Chronicle.

[Rene_Figueroa · Accepted solution]

Hi @AfvanJaffer you can onboard another GCP organization by obtaining another one-time code from us. Simply open a support case and mention you need another one-time code to link another GCP org to Chronicle.

[AfvanJaffer]

@Rene_Figueroa 

Hey, thanks for the prompt reply.

here the situation is, we don't want to interrupt transfer of logs from the existing organization.

we want to collect logs from both the organizations simultaneously into the same chronicle instance.

[Rene_Figueroa · Accepted solution]

Hi @AfvanJaffer there should be no interruption to the existing connected org. When you get a new one-time code, you will set that connection in the new GCP organization. We have multiple customers who send data from multiple GCP orgs without any interruption. 

[AfvanJaffer]

Understood!

so I believe we can follow the steps outlined in this documentation on the new organization:

Ingest GCP Logs

Could you please confirm if these are the exact steps we need to follow for the new organization?

[AfvanJaffer]

@Rene_Figueroa .

[Mustache]

A new capability was just released that allows you to now configure this on your own without a one-time code from Google! 
Note, I haven't tested this  yet, but here are the latest released documents: 
https://cloud.google.com/chronicle/docs/ingestion/cloud/ingest-gcp-logs#enable-direct-ingestion
Based on: https://cloud.google.com/chronicle/docs/release-notes#August_01_2024

[Rene_Figueroa]

@AfvanJaffer please see above.