A. Fill in your Google SecOps instance details
Open the Google SecOps section in the Google Cloud console.
Go to the Overview tab and click Instance details.
Copy the Customer ID and paste it into the Instance ID field of your Data Plane on the SOC Prime Platform.
Check what region is shown for your instance and select the corresponding option in the Region drop-down of your Data Plane on the SOC Prime Platform.
B. Copy and paste the URL of your Google SecOps console.
C. Create a service account and configure its key:
Go to the Service Accounts section in your Google Cloud (after selecting the project with your Google SecOps instance) and click Create service account. If you don't have access to this section, contact your account administrator.
Enter the service account name and, optionally, add a description. The account ID field will be filled in automatically based on the name.
Click Create and continue.
Grant this service account the
Chronicle API Editorrole if you are going to use it for automation/deploy orChronicle API Viewerif it's intended for Attack Detective, and click Continue.Skip the Principals with access step unless you need to configure users or groups that need to perform actions as this service account, and click Done.
The created service account appears on the list with other accounts. Click on it to open its details.
Select the Keys tab and click Add key > Create new key.
In the modal that appears, select JSON key type and click Create.
Once prompted, save the key to your computer.
The JSON includes the following keys:
{
"type": "string",
"project_id": "string",
"private_key_id": "string",
"private_key": "string",
"client_email": "string",
"client_id": "string",
"auth_uri": "string",
"token_uri": "string",
"auth_provider_x509_cert_url": "string",
"client_x509_cert_url": "string",
"universe_domain": "string"
}Upload the JSON using the Import JSON button. All the key values from the file will be filled into the corresponding key fields.