Skip to content

Commit 2c42a2d

Browse files
v-prasadbokev-prasadboke
authored
Merge pull request #11390 from idoshabi07/gcp-firewall-package-solution
Gcp firewall package solution
2 parents 1aa8c2e + 95ed8f1 commit 2c42a2d

File tree

12 files changed

+929
-0
lines changed

12 files changed

+929
-0
lines changed

‎Solutions/Google Cloud Platform Firewall Logs/Data Connectors/GCPFirewallLogs_ccp/GCPFirewall_DCR.json‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
[
2+
{
3+
"name": "gcpFirewallLogsDCR",
4+
"apiVersion": "2021-09-01-preview",
5+
"type": "Microsoft.Insights/dataCollectionRules",
6+
"location": "{{location}}",
7+
"properties": {
8+
"destinations": {
9+
"logAnalytics": [
10+
{
11+
"workspaceResourceId": "{{workspaceResourceId}}",
12+
"name": "clv2ws1"
13+
}
14+
]
15+
},
16+
"dataFlows": [
17+
{
18+
"streams": [
19+
"Microsoft-GCPFirewallLogs"
20+
],
21+
"destinations": [
22+
"clv2ws1"
23+
]
24+
}
25+
],
26+
"dataCollectionEndpointId": "{{dataCollectionEndpointId}}"
27+
}
28+
}
29+
]

‎Solutions/Google Cloud Platform Firewall Logs/Data Connectors/GCPFirewallLogs_ccp/GCPFirewall_PollingConfig.json‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
[
2+
{
3+
"name": "GCPFirewallLogsTemplateConnections",
4+
"apiVersion": "2023-02-01-preview",
5+
"type": "Microsoft.SecurityInsights/dataConnectors",
6+
"location": "{{location}}",
7+
"kind": "GCP",
8+
"properties": {
9+
"connectorDefinitionName": "GCPFirewallLogsCCPDefinition",
10+
"dcrConfig": {
11+
"streamName": "SENTINEL_GCP_FIREWALL_LOGS",
12+
"dataCollectionEndpoint": "{{dataCollectionEndpoint}}",
13+
"dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}"
14+
},
15+
"dataType": "GCPFirewallLogs",
16+
"auth": {
17+
"serviceAccountEmail": "{{'GCPServiceAccountEmail'}}",
18+
"projectNumber": "{{'GCPProjectNumber'}}",
19+
"workloadIdentityProviderId": "{{'GCPWorkloadIdentityProviderId'}}"
20+
},
21+
"request": {
22+
"projectId": "{{'GCPProjectId'}}",
23+
"subscriptionNames": [
24+
"{{'GCPSubscriptionName'}}"
25+
]
26+
}
27+
}
28+
}
29+
]

‎Solutions/Google Cloud Platform Firewall Logs/Data Connectors/GCPFirewallLogs_ccp/GCP_ConnectorDefinition.json‎

Lines changed: 105 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,105 @@
1+
{
2+
"name": "GCPFirewallLogsCCPDefinition",
3+
"apiVersion": "2022-09-01-preview",
4+
"type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
5+
"location": "{{location}}",
6+
"kind": "Customizable",
7+
"properties": {
8+
"connectorUiConfig": {
9+
"id": "GCPFirewallLogsCCPDefinition",
10+
"title": "GCP Pub/Sub Firewall Logs",
11+
"publisher": "Microsoft",
12+
"descriptionMarkdown": "The Google Cloud Platform (GCP) firewall logs, enable you to capture network inbound and outbound activity to monitor access and detect potential threats across Google Cloud Platform (GCP) resources.",
13+
"graphQueriesTableName": "GCPFirewallLogs",
14+
"graphQueries": [
15+
{
16+
"metricName": "Total events received",
17+
"legend": "GCP Pub/Sub Firewall Logs",
18+
"baseQuery": "{{graphQueriesTableName}}"
19+
}
20+
],
21+
"sampleQueries": [
22+
{
23+
"description": "Get Sample of GCP Firewall Logs",
24+
"query": "{{graphQueriesTableName}}\n | take 10"
25+
}
26+
],
27+
"dataTypes": [
28+
{
29+
"name": "{{graphQueriesTableName}}",
30+
"lastDataReceivedQuery": "{{graphQueriesTableName}}\n | where TimeGenerated > ago(12h) | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
31+
}
32+
],
33+
"availability": {
34+
"status": 1,
35+
"isPreview": false
36+
},
37+
"connectivityCriteria": [
38+
{
39+
"type": "HasDataConnectors"
40+
}
41+
],
42+
"permissions": {
43+
"resourceProvider": [
44+
{
45+
"provider": "Microsoft.OperationalInsights/workspaces",
46+
"permissionsDisplayText": "Read and Write permissions are required.",
47+
"providerDisplayName": "Workspace",
48+
"scope": "Workspace",
49+
"requiredPermissions": {
50+
"read": true,
51+
"write": true,
52+
"delete": true,
53+
"action": false
54+
}
55+
}
56+
57+
]
58+
},
59+
"instructionSteps": [
60+
{
61+
"instructions": [
62+
{
63+
"type": "MarkdownControlEnvBased",
64+
"parameters": {
65+
"prodScript": "#### 1. Set up your GCP environment \n You must have the following GCP resources defined and configured: topic, subscription for the topic, workload identity pool, workload identity provider and service account with permissions to get and consume from subscription. \n Terraform provides API for the IAM that creates the resources. [Link to Terraform scripts](https://github.com/Azure/Azure-Sentinel/tree/master/DataConnectors/GCP/Terraform/sentinel_resources_creation)\n Connector tutorial: [Link to tutorial](https://learn.microsoft.com/en-us/azure/sentinel/connect-google-cloud-platform?tabs=terraform%2Cauditlogs#gcp-authentication-setup) .",
66+
"govScript": "#### 1. Set up your GCP environment \n You must have the following GCP resources defined and configured: topic, subscription for the topic, workload identity pool, workload identity provider and service account with permissions to get and consume from subscription. \n Terraform provides API for the IAM that creates the resources. [Link to Gov Terraform scripts](https://github.com/Azure/Azure-Sentinel/tree/master/DataConnectors/GCP/Terraform/sentinel_resources_creation_gov)\n Connector tutorial: [Link to tutorial](https://learn.microsoft.com/en-us/azure/sentinel/connect-google-cloud-platform?tabs=terraform%2Cauditlogs#gcp-authentication-setup)."
67+
}
68+
},
69+
{
70+
"type": "CopyableLabel",
71+
"parameters": {
72+
"label": "Tenant ID: A unique identifier that is used as an input in the Terraform configuration within a GCP environment.",
73+
"fillWith": [
74+
"TenantId"
75+
],
76+
"name": "TenantId",
77+
"disabled": true
78+
}
79+
},
80+
{
81+
"type": "Markdown",
82+
"parameters": {
83+
"content": "#### 2. Enable Firewall logs \nIn your GCP account, navigate to the Firewall section. Here, you can either create a new rule or edit an existing one that you want to monitor. Once you open the rule, switch the toggle button under the **Logs** section to **On**, and save the changes.\n\nFor more information: [Link to documentation](https://cloud.google.com/firewall/docs/using-firewall-rules-logging?_gl=1*1no0nhk*_ga*NDMxNDIxODI3LjE3MjUyNjUzMzc.*_ga_WH2QY8WWF5*MTcyNTUyNzc4MS4xMS4xLjE3MjU1MjgxNTIuNDYuMC4w)"
84+
}
85+
},
86+
{
87+
"type": "Markdown",
88+
"parameters": {
89+
"content": "#### 3. Connect new collectors \n To enable GCP Firewall Logs for Microsoft Sentinel, click the Add new collector button, fill the required information in the context pane and click on Connect."
90+
}
91+
},
92+
{
93+
"type": "GCPGrid",
94+
"parameters": {}
95+
},
96+
{
97+
"type": "GCPContextPane",
98+
"parameters": {}
99+
}
100+
]
101+
}
102+
]
103+
}
104+
}
105+
}

‎Solutions/Google Cloud Platform Firewall Logs/Data Connectors/GCPFirewallLogs_ccp/solutionMetadata.json‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
{
2+
"publisherId": "azuresentinel",
3+
"offerId": "azure-sentinel-solution-gcpfirewalllogs-api",
4+
"firstPublishDate": "2024-09-08",
5+
"providers": ["Google"],
6+
"categories": {
7+
"domains" : ["DevOps"],
8+
"verticals": []
9+
},
10+
"support": {
11+
"name": "Microsoft Corporation",
12+
"email": "support@microsoft.com",
13+
"tier": "Microsoft",
14+
"link": "https://support.microsoft.com"
15+
},
16+
"SolutionName":"GCP Pub/Sub Firewall Logs",
17+
"SolutionAuthor": "User",
18+
"SolutionVersion":"1.0.0",
19+
"packageIcon": "google_logo",
20+
"SolutionTier": "Microsoft",
21+
"PackageId":"gcpfirewalllogs-api",
22+
"ConnectorDefinitionTemplateVersion": "1.0.0",
23+
"DataConnectorsTemplateVersion": "1.0.0"
24+
}

‎Solutions/Google Cloud Platform Firewall Logs/Data/Solution_GoogleFirewallLogs.json‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
{
2+
"Name": "Google Cloud Platform Firewall Logs",
3+
"Author": "Microsoft - support@microsoft.com",
4+
"Logo": "<img src =\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/google_logo.svg\" width=\"75px\" height=\"75px\">",
5+
"Description": "The Google Cloud Platform (GCP) firewall logs, ingested from Sentinel's connector, enable you to capture and track all network activity that occurs in your GCP intances. These firewall logs provide valuable insights for monitoring user activity, troubleshooting issues, and ensuring compliance with security regulations. They serve as a record of events that practitioners can utilize to monitor access and identify potential threats across GCP resources.",
6+
"Data Connectors": [
7+
"Data Connectors/GCPFirewallLogs_ccp/GCP_ConnectorDefinition.json"
8+
],
9+
"BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Google Cloud Platform Firewall Logs",
10+
"Version": "3.0.0",
11+
"Metadata": "SolutionMetadata.json",
12+
"TemplateSpec": true,
13+
"Is1PConnector": false
14+
}

‎Solutions/Google Cloud Platform Firewall Logs/Package/3.0.0.zip‎

6.55 KB
Binary file not shown.

‎Solutions/Google Cloud Platform Firewall Logs/Package/createUiDefinition.json‎

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
{
2+
"$schema": "https://schema.management.azure.com/schemas/0.1.2-preview/CreateUIDefinition.MultiVm.json#",
3+
"handler": "Microsoft.Azure.CreateUIDef",
4+
"version": "0.1.2-preview",
5+
"parameters": {
6+
"config": {
7+
"isWizard": false,
8+
"basics": {
9+
"description": "<img src =\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/google_logo.svg\" width=\"75px\" height=\"75px\">\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Google%20Cloud%20Platform%20Firewall%20Logs/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe Google Cloud Platform (GCP) firewall logs, ingested from Sentinel's connector, enable you to capture and track all network activity that occurs in your GCP intances. These firewall logs provide valuable insights for monitoring user activity, troubleshooting issues, and ensuring compliance with security regulations. They serve as a record of events that practitioners can utilize to monitor access and identify potential threats across GCP resources.\n\n**Data Connectors:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)",
10+
"subscription": {
11+
"resourceProviders": [
12+
"Microsoft.OperationsManagement/solutions",
13+
"Microsoft.OperationalInsights/workspaces/providers/alertRules",
14+
"Microsoft.Insights/workbooks",
15+
"Microsoft.Logic/workflows"
16+
]
17+
},
18+
"location": {
19+
"metadata": {
20+
"hidden": "Hiding location, we get it from the log analytics workspace"
21+
},
22+
"visible": false
23+
},
24+
"resourceGroup": {
25+
"allowExisting": true
26+
}
27+
}
28+
},
29+
"basics": [
30+
{
31+
"name": "getLAWorkspace",
32+
"type": "Microsoft.Solutions.ArmApiControl",
33+
"toolTip": "This filters by workspaces that exist in the Resource Group selected",
34+
"condition": "[greater(length(resourceGroup().name),0)]",
35+
"request": {
36+
"method": "GET",
37+
"path": "[concat(subscription().id,'/providers/Microsoft.OperationalInsights/workspaces?api-version=2020-08-01')]"
38+
}
39+
},
40+
{
41+
"name": "workspace",
42+
"type": "Microsoft.Common.DropDown",
43+
"label": "Workspace",
44+
"placeholder": "Select a workspace",
45+
"toolTip": "This dropdown will list only workspace that exists in the Resource Group selected",
46+
"constraints": {
47+
"allowedValues": "[map(filter(basics('getLAWorkspace').value, (filter) => contains(toLower(filter.id), toLower(resourceGroup().name))), (item) => parse(concat('{\"label\":\"', item.name, '\",\"value\":\"', item.name, '\"}')))]",
48+
"required": true
49+
},
50+
"visible": true
51+
}
52+
],
53+
"steps": [
54+
{
55+
"name": "dataconnectors",
56+
"label": "Data Connectors",
57+
"bladeTitle": "Data Connectors",
58+
"elements": [
59+
{
60+
"name": "dataconnectors1-text",
61+
"type": "Microsoft.Common.TextBlock",
62+
"options": {
63+
"text": "This Solution installs the data connector for Google Cloud Platform Firewall Logs. You can get Google Cloud Platform Firewall Logs data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view."
64+
}
65+
},
66+
{
67+
"name": "dataconnectors-link2",
68+
"type": "Microsoft.Common.TextBlock",
69+
"options": {
70+
"link": {
71+
"label": "Learn more about connecting data sources",
72+
"uri": "https://docs.microsoft.com/azure/sentinel/connect-data-sources"
73+
}
74+
}
75+
}
76+
]
77+
}
78+
],
79+
"outputs": {
80+
"workspace-location": "[first(map(filter(basics('getLAWorkspace').value, (filter) => and(contains(toLower(filter.id), toLower(resourceGroup().name)),equals(filter.name,basics('workspace')))), (item) => item.location))]",
81+
"location": "[location()]",
82+
"workspace": "[basics('workspace')]"
83+
}
84+
}
85+
}

0 commit comments

Comments
 (0)