service account

[vanitharaj1208]

Hi All, 

i have questions while configuring google chronicle , google cloud compute integrations its asks for service account json file.

is it created by us or google provides us?

if it is created by us what and and permissions has be be given ?

is permissions differ by integration?

i did not find any documents 

Regards,

vanitha

[_K_O]

Hi @vanitharaj1208 is this the Google Cloud Compute Marketplace integration? The Docs for the integration contains information about the SA, permissions, etc. : https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/google-cloud-compute 

[vanitharaj1208]

Hi @_K_O ,

thank you but what about  google chronicle and Google Cloud API in these 2 integration doc ... user service account has which permissions?

[ylandovskyy]

Hey @vanitharaj1208,.

Google Cloud API integration - is a generic integration. It requires only the permissions that you are going to use within the integration itself. Meaning that if you are going to use Google Cloud API integration to work with Compute -> need Compute permissions on SA.

Google Chronicle SA that comes with deployment has only permissions to interact with SIEM API.

[vanitharaj1208]

so which permissions should i assign to service account to interact with SIEM API. for Google chronicle integration?

when i compare other integration documents they have specified which permissions needs to be given and its clear .

[arjohnson]

To set up the Chronicle SIEM Integration in SOAR, you historically needed the backstory API key provided from your Google Rep.
99% of the time recently, especially with up to date Chronicle integrations and the Unified SecOps, you may not need to enter any key if it is a 1:1 relationship with SIEM & SOAR. 

If you're trying to send data to Google SecOps SIEM, it would be the ingestion api found in SIEM Settings https://cloud.google.com/chronicle/docs/reference/ingestion-api