You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/sentinel/connect-google-cloud-platform.md
+14-14Lines changed: 14 additions & 14 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -32,16 +32,16 @@ Before you begin, verify that you have:
32
32
33
33
- The Microsoft Sentinel solution enabled.
34
34
- A defined Microsoft Sentinel workspace.
35
-
- A GCP environment collecting GCP Audit Logs.
35
+
- A GCP environment collecting GCP audit logs.
36
36
- The Microsoft Sentinel Contributor role.
37
37
- Access to edit and create resources in the GCP project.
38
38
39
-
###Set up GCP environment
39
+
## Set up GCP environment
40
40
41
41
You can set up the GCP environment in one of two ways:
42
42
43
43
-[Create GCP resources via the Terraform API](#create-gcp-resources-via-the-terraform-api): Terraform provides an API for the Identity and Access Management (IAM) that creates the resources: The topic, a subscription for the topic, a workload identity pool, a workload identity provider, a service account, and a role.
44
-
-[Set up GCP environment manually](#) via the GCP console
44
+
-[Set up GCP environment manually](#) via the GCP console.
45
45
46
46
### Create GCP resources via the Terraform API
47
47
@@ -65,8 +65,8 @@ You can set up the GCP environment in one of two ways:
65
65
```
66
66
67
67
1. Type your Microsoft tenant ID. Learn how to [find your tenant ID](../active-directory/fundamentals/active-directory-how-to-find-tenant.md).
68
-
1. When asked if a workload Identity Pool has already been created for Azure, type **yes** or **no**.
69
-
1. When asked if you want to create the resources listed, type **yes**.
68
+
1. When asked if a workload Identity Pool has already been created for Azure, type *yes* or *no*.
69
+
1. When asked if you want to create the resources listed, type *yes*.
70
70
1. Save the resources parameters for later use.
71
71
1. In a new folder, copy the Terraform `GCPAuditLogsSetup` script into a new file, and save it as a .tf file:
72
72
@@ -91,7 +91,7 @@ You can set up the GCP environment in one of two ways:
1. Enable the [health feature](enable-monitoring) for data connectors.
122
+
1. Enable the [health feature](enable-monitoring.md) for data connectors.
123
123
124
124
### Set up the GCP environment manually via the GCP portal
125
125
126
-
Alternatively, you can set up the environment [via the Terraform API](#create-gcp-resources-via-the-terraform-api).
126
+
This section shows you how to manually set up the GCP environment. Alternatively, you can set up the environment [via the Terraform API](#create-gcp-resources-via-the-terraform-api). If you already set up the environment via the API, skip this section.
127
127
128
128
#### Create the role
129
129
@@ -133,7 +133,7 @@ Alternatively, you can set up the environment [via the Terraform API](#create-gc
133
133
1. Filter the permissions by the **Pub/Sub Subscriber** and **Pub/Sub Viewer** roles, and select **pubsub.subscriptions.consume** and **pubsub.subscriptions.get** permissions.
134
134
1. To confirm, select **ADD**.
135
135
136
-
:::image type="content" source="media/connect-google-cloud-platform/gcp-create-role.png" alt-text="Screenshot of adding permissions when adding a GCP role.":::
136
+
:::image type="content" source="media/connect-google-cloud-platform/gcp-create-role.png" alt-text="Screenshot of adding permissions when adding a GCP role." lightbox="media/connect-google-cloud-platform/gcp-create-role.png":::
137
137
138
138
1. To create the role, select **Create**.
139
139
@@ -198,17 +198,17 @@ Alternatively, you can set up the environment [via the Terraform API](#create-gc
198
198
1. If needed, filter the logs by selecting specific logs to include. Otherwise, all logs are sent.
199
199
1. Select **Create sink**.
200
200
201
-
> [!NOTE]
202
-
> To ingest logs for the entire organization:
203
-
> 1. Select the organization under **Project**.
204
-
> 1. Repeat steps 2-4, and under **Choose logs to include in the sink** in the **Log Router** section, select **Include logs ingested by this organization and all child resources**.
201
+
> [!NOTE]
202
+
> To ingest logs for the entire organization:
203
+
> 1. Select the organization under **Project**.
204
+
> 1. Repeat steps 2-4, and under **Choose logs to include in the sink** in the **Log Router** section, select **Include logs ingested by this organization and all child resources**.
205
205
206
206
TBD - screenshot
207
207
208
208
#### Verify that GCP can receive incoming messages
209
209
210
210
1. In the GCP console, navigate to **Subscriptions**.
211
-
1. Select **Messages**, and select **PULL** button to initiate a manual pull.
211
+
1. Select **Messages**, and select **PULL** to initiate a manual pull.
0 commit comments