Google SecOps Remote Agent (SOAR) Network Requirements

[tnxtr]

Hi,

I couldn’t find any information regarding the network requirements for firewall rules related to the Remote Agent. Could someone provide the necessary addresses and details?

Thanks in advance!

[kentphelps]

Please take a look at this doc to see if it helps.

[tnxtr]

Hi, I’ve seen this document before, but unfortunately, it doesn’t provide the URLs or IP addresses. Therefore, it won’t be helpful for me to configure my firewall rules.

[rupinderv]

Hi @tnxtr , Specific URLs, For both SIEM and SOAR agents:

• Port 443 (TCP): This port is used for communication between the agent and the Google Security Operations Publisher (a proxy server managed by Google). You will need to allow outbound connections on this port to the following Google Cloud hosts:
• malachiteingestion-pa.googleapis.com
• Regional variations of malachiteingestion-pa.googleapis.com (e.g., asia-northeast1-malachiteingestion-pa.googleapis.com, europe-west2-malachiteingestion-pa.googleapis.com, etc.). The specific regional endpoints will depend on your Google Cloud region.
• accounts.google.com
• oauth2.googleapis.com.   Additional URLs for SOAR agents:
  Depending on the specific integrations and connectors used with your SOAR agents, additional URLs may be required. The documentation does not provide a comprehensive list of all possible URLs, but it does mention that connectors support proxies. You should consult the documentation for each specific integration to determine any additional URLs or ports that need to be allowed.
  Proxy Configuration:
  The SecOps remote agents support proxy configurations. The exact method for configuring a proxy depends on whether you are using the installer or Docker agent. Refer to the documentation on "Installer and Docker agent configuration" for detailed instructions on how to configure proxy settings for your specific agent type. The documentation mentions using environment variables like PROXY_ADDRESS, HTTP_PROXY, HTTPS_PROXY, and NO_PROXY.

[tnxtr · Accepted solution]

When I checked the agent’s Docker container logs, I noticed that it couldn’t reach <customerid>.siemplify-soar.com. After allowing access to this address, the issue was resolved. It seems that each Chronicle instance has its own dedicated Siemplify SOAR endpoint.