The Google Cloud Security Community will be in read-only mode July 16 - July 22 as we migrate platforms. Read more and check out our FAQ.

[Donald_Munengiw]

I have a question:
When Ingesting from GCS buckets using feeds management UI, it mentions that chronicle doesn’t need authentication for the bucket because it has internal user, is this user a global user or specific to that cloud account? Can i ingest arbitrary bucket i don’t own but know the address to without authentication as unstructured logs and be able to view some bucket contents in chronicle?

[Dmitry_Sarakeev]

hi @Donald_Munengiw , this is a SIEM, not a SOAR question, it would be better to ask it in the specific chat)

[Alex_Glowacki]

Hi Donald,

If the bucket is public, then yes you would be able to connect to that GCS Bucket and configure the feed to ingest. However, it would be best practice on the GCS Bucket owner to supply permission restrictions on the bucket such that only authenticated users can access this bucket. If you would like your Chronicle tenant to connect to a bucket with restricted access, then a member with the appropriate permissions in a project where that GCS Bucket exists would need to add the principal service account in Google Cloud IAM with Chronicle's ingest API service account, then give it read access to that GCS bucket. Hope this answers your question.