Skip to content

Commit 538abca

Browse files
v-dvedakv-dvedak
authored
Merge pull request #12319 from Azure/v-hkopparala-IAM
Standard table changes to Google Cloud Platform IAM
2 parents e7a3f6f + b1a9c7f commit 538abca

File tree

9 files changed

+164
-276
lines changed

9 files changed

+164
-276
lines changed

‎Solutions/GoogleCloudPlatformIAM/Data Connectors/GCPIAMLog_CCP/GCPIAMLog_ConnectorDefinition.json‎

Lines changed: 105 additions & 105 deletions
Original file line numberDiff line numberDiff line change
@@ -1,111 +1,111 @@
11
{
2-
"name": "GCPIAMCCPDefinition",
3-
"apiVersion": "2022-09-01-preview",
4-
"type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
5-
"location": "{{location}}",
6-
"kind": "Customizable",
7-
"properties": {
8-
"connectorUiConfig": {
9-
"id": "GCPIAMCCPDefinition",
10-
"title": "Google Cloud Platform IAM (via Codeless Connector Platform) (Preview)",
11-
"publisher": "Microsoft",
12-
"descriptionMarkdown": "The Google Cloud Platform IAM data connector provides the capability to ingest the Audit logs relating to Identity and Access Management (IAM) activities within Google Cloud into Microsoft Sentinel using the Google IAM API. Refer to [GCP IAM API](https://cloud.google.com/iam/docs/reference/rest) documentation for more information.",
13-
"graphQueriesTableName": "GCP_IAMV2_CL",
14-
"graphQueries": [
15-
{
16-
"metricName": "Total incident logs received",
17-
"legend": "GCP IAM logs",
18-
"baseQuery": "{{graphQueriesTableName}}"
19-
}
20-
],
21-
"sampleQueries": [
22-
{
23-
"description": "Get sample of GcpIAM logs",
24-
"query": "{{graphQueriesTableName}}\n| take 10"
25-
}
26-
],
27-
"dataTypes": [
28-
{
29-
"name": "{{graphQueriesTableName}}",
30-
"lastDataReceivedQuery": "{{graphQueriesTableName}}\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
31-
}
32-
],
33-
"connectivityCriteria": [
34-
{
35-
"type": "HasDataConnectors"
36-
}
37-
],
38-
"availability": {
39-
"status": 1,
40-
"isPreview": false
41-
},
42-
"permissions": {
43-
"resourceProvider": [
44-
{
45-
"provider": "Microsoft.OperationalInsights/workspaces",
46-
"permissionsDisplayText": "Read and Write permissions are required.",
47-
"providerDisplayName": "Workspace",
48-
"scope": "Workspace",
49-
"requiredPermissions": {
50-
"read": true,
51-
"write": true,
52-
"delete": true,
53-
"action": false
54-
}
55-
}
56-
]
57-
},
58-
"instructionSteps": [
59-
{
60-
"instructions": [
61-
{
62-
"type": "Markdown",
63-
"parameters": {
64-
"content": ">**NOTE:** If both Azure Function and CCP connector are running parallelly, duplicate data is populated in the tables."
65-
}
66-
},
67-
{
68-
"type": "MarkdownControlEnvBased",
69-
"parameters": {
70-
"prodScript": "#### 1. Setup the GCP environment \n Ensure to have the following resources from the GCP Console:\n Project ID, Project Name, GCP Subscription name for the project, Workload Identity Pool ID, Workspace Identity Provider ID, and a Service Account to establish the connection.\n For more information, refer the [Connector tutorial](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/GoogleCloudPlatformIAM/Data%20Connectors/README.md) for log setup and authentication setup tutorial.\n Log set up script: [Click Here](https://github.com/Azure/Azure-Sentinel/tree/master/DataConnectors/GCP/Terraform/sentinel_resources_creation/GCPIAMCCPLogsSetup)\nAuthentication set up script: [Click here](https://github.com/Azure/Azure-Sentinel/tree/master/DataConnectors/GCP/Terraform/sentinel_resources_creation/GCPInitialAuthenticationSetup)",
71-
"govScript": "#### 1. Setup the GCP environment \n Ensure to have the following resources from the GCP Console:\n Project ID, Project Name, GCP Subscription name for the project, Workload Identity Pool ID, Workspace Identity Provider ID, and a Service Account to establish the connection.\n For more information, refer the [Connector tutorial](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/GoogleCloudPlatformIAM/Data%20Connectors/README.md) for log setup and authentication setup tutorial.\n Log set up script: [Click Here](https://github.com/Azure/Azure-Sentinel/tree/master/DataConnectors/GCP/Terraform/sentinel_resources_creation_gov/GCPIAMCCPLogsSetup)\nAuthentication set up script: [Click here](https://github.com/Azure/Azure-Sentinel/tree/master/DataConnectors/GCP/Terraform/sentinel_resources_creation_gov/GCPInitialAuthenticationSetupGov)"
72-
}
73-
},
74-
{
75-
"type": "CopyableLabel",
76-
"parameters": {
77-
"label": "Tenant ID: A unique identifier that is used as an input in the Terraform configuration within a GCP environment.",
78-
"fillWith": [
79-
"TenantId"
80-
],
81-
"name": "TenantId",
82-
"disabled": true
83-
}
84-
},
85-
{
86-
"type": "Markdown",
87-
"parameters": {
88-
"content": "#### 2. To enable IAM logs \n In your GCP account, navigate to the IAM section. From there, you can either create a new user or modify an existing user's role that you want to monitor. Be sure to save your changes..\n\nFor more information: [Link to documentation](https://cloud.google.com/assured-workloads/docs/iam-roles?hl=en)"
89-
}
90-
},
91-
{
92-
"type": "Markdown",
93-
"parameters": {
94-
"content": "#### 3. Connect new collectors \n To enable GCPIAM Logs for Microsoft Sentinel, click the Add new collector button, fill the required information in the context pane and click on Connect."
95-
}
2+
"name": "GCPIAMCCPDefinition",
3+
"apiVersion": "2022-09-01-preview",
4+
"type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
5+
"location": "{{location}}",
6+
"kind": "Customizable",
7+
"properties": {
8+
"connectorUiConfig": {
9+
"id": "GCPIAMCCPDefinition",
10+
"title": "Google Cloud Platform IAM (via Codeless Connector Framework) (Preview)",
11+
"publisher": "Microsoft",
12+
"descriptionMarkdown": "The Google Cloud Platform IAM data connector provides the capability to ingest the Audit logs relating to Identity and Access Management (IAM) activities within Google Cloud into Microsoft Sentinel using the Google IAM API. Refer to [GCP IAM API](https://cloud.google.com/iam/docs/reference/rest) documentation for more information.",
13+
"graphQueriesTableName": "GCPIAM",
14+
"graphQueries": [
15+
{
16+
"metricName": "Total incident logs received",
17+
"legend": "GCP IAM logs",
18+
"baseQuery": "{{graphQueriesTableName}}"
19+
}
20+
],
21+
"sampleQueries": [
22+
{
23+
"description": "Get sample of GcpIAM logs",
24+
"query": "{{graphQueriesTableName}}\n| take 10"
25+
}
26+
],
27+
"dataTypes": [
28+
{
29+
"name": "{{graphQueriesTableName}}",
30+
"lastDataReceivedQuery": "{{graphQueriesTableName}}\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
31+
}
32+
],
33+
"connectivityCriteria": [
34+
{
35+
"type": "HasDataConnectors"
36+
}
37+
],
38+
"availability": {
39+
"status": 1,
40+
"isPreview": false
9641
},
97-
{
98-
"type": "GCPGrid",
99-
"parameters": {}
42+
"permissions": {
43+
"resourceProvider": [
44+
{
45+
"provider": "Microsoft.OperationalInsights/workspaces",
46+
"permissionsDisplayText": "Read and Write permissions are required.",
47+
"providerDisplayName": "Workspace",
48+
"scope": "Workspace",
49+
"requiredPermissions": {
50+
"read": true,
51+
"write": true,
52+
"delete": true,
53+
"action": false
54+
}
55+
}
56+
]
10057
},
101-
{
102-
"type": "GCPContextPane",
103-
"parameters": {}
104-
}
105-
],
106-
"title": "Connect GCP IAM to Microsoft Sentinel"
58+
"instructionSteps": [
59+
{
60+
"instructions": [
61+
{
62+
"type": "Markdown",
63+
"parameters": {
64+
"content": ">**NOTE:** If both Azure Function and CCP connector are running parallelly, duplicate data is populated in the tables."
65+
}
66+
},
67+
{
68+
"type": "MarkdownControlEnvBased",
69+
"parameters": {
70+
"prodScript": "#### 1. Setup the GCP environment \n Ensure to have the following resources from the GCP Console:\n Project ID, Project Name, GCP Subscription name for the project, Workload Identity Pool ID, Workspace Identity Provider ID, and a Service Account to establish the connection.\n For more information, refer the [Connector tutorial](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/GoogleCloudPlatformIAM/Data%20Connectors/README.md) for log setup and authentication setup tutorial.\n Log set up script: [Click Here](https://github.com/Azure/Azure-Sentinel/tree/master/DataConnectors/GCP/Terraform/sentinel_resources_creation/GCPIAMCCPLogsSetup)\nAuthentication set up script: [Click here](https://github.com/Azure/Azure-Sentinel/tree/master/DataConnectors/GCP/Terraform/sentinel_resources_creation/GCPInitialAuthenticationSetup)",
71+
"govScript": "#### 1. Setup the GCP environment \n Ensure to have the following resources from the GCP Console:\n Project ID, Project Name, GCP Subscription name for the project, Workload Identity Pool ID, Workspace Identity Provider ID, and a Service Account to establish the connection.\n For more information, refer the [Connector tutorial](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/GoogleCloudPlatformIAM/Data%20Connectors/README.md) for log setup and authentication setup tutorial.\n Log set up script: [Click Here](https://github.com/Azure/Azure-Sentinel/tree/master/DataConnectors/GCP/Terraform/sentinel_resources_creation_gov/GCPIAMCCPLogsSetup)\nAuthentication set up script: [Click here](https://github.com/Azure/Azure-Sentinel/tree/master/DataConnectors/GCP/Terraform/sentinel_resources_creation_gov/GCPInitialAuthenticationSetupGov)"
72+
}
73+
},
74+
{
75+
"type": "CopyableLabel",
76+
"parameters": {
77+
"label": "Tenant ID: A unique identifier that is used as an input in the Terraform configuration within a GCP environment.",
78+
"fillWith": [
79+
"TenantId"
80+
],
81+
"name": "TenantId",
82+
"disabled": true
83+
}
84+
},
85+
{
86+
"type": "Markdown",
87+
"parameters": {
88+
"content": "#### 2. To enable IAM logs \n In your GCP account, navigate to the IAM section. From there, you can either create a new user or modify an existing user's role that you want to monitor. Be sure to save your changes..\n\nFor more information: [Link to documentation](https://cloud.google.com/assured-workloads/docs/iam-roles?hl=en)"
89+
}
90+
},
91+
{
92+
"type": "Markdown",
93+
"parameters": {
94+
"content": "#### 3. Connect new collectors \n To enable GCPIAM Logs for Microsoft Sentinel, click the Add new collector button, fill the required information in the context pane and click on Connect."
95+
}
96+
},
97+
{
98+
"type": "GCPGrid",
99+
"parameters": {}
100+
},
101+
{
102+
"type": "GCPContextPane",
103+
"parameters": {}
104+
}
105+
],
106+
"title": "Connect GCP IAM to Microsoft Sentinel"
107+
}
108+
]
107109
}
108-
]
109110
}
110-
}
111111
}

0 commit comments

Comments
 (0)