Skip to main content

How to Get Credentials for Google SecOps and Set up WIF

S
Written by Sergey Bayrachny

  1. Ensure you've received the credentials of the Microsoft Azure authentication app created and managed by SOC Prime. This app acts as an Identity Provider: the trust relationship is established between it and your Google Cloud. Here are the credentials you need:

    • Azure Tenant ID

    • Azure Client ID

    • Azure Client Secret

    • Issuer URL

    If you haven't received these credentials, please contact your SOC Prime Platform account manager.

  2. In your Google Cloud Console, ensure the following APIs are enabled. These APIs are required for the WIF authentication to work:

    1. IAM Service Account Credentials API.

    2. Security Service Token API.

    3. Chronicle API.

  3. Create a service account that will issue dynamic temporary access tokens (STS tokens) to the Microsoft Azure app.

    1. Set a meaningful account name and, optionally, description.

    2. Set the following roles in the Permissions section:

      1. Chronicle API Editor role if you are going to use it for automation/deploy or Chronicle API Viewer if it's intended for Attack Detective.

      2. Service Usage Consumer (this role is required for using WIF).

    3. Leave the section Principals with access empty.

  4. Set up Workload Identity Federation.

    1. Create an Identity pool and set a meaningful name for it.

    2. Create a provider to pool:

      1. Select OpenID Connect (OIDC) as the provider.

      2. Set a meaningful provider name.

      3. Enter the URL provided by SOC Prime as the Issuer URL.

      4. Leave the JWK file field empty.

      5. In the Audiences section, select Allowed audiences and enter the Azure Client ID provided to you by SOC Prime (see step 1) in the Audience 1 field.

    3. Configure provider attributes by entering assertion.sub in the OICD 1 field.

  5. Assign a principal to the service account created at step 3:

    1. Open the Principals with access tab of the service account.

    2. In the New principals field, enter the following value: principalSet://iam.googleapis.com/projects/{PROJECT_NUMBER}/locations/global/workloadIdentityPools/{IDENTITY_POOL_NAME}/*

      where:

      {PROJECT_NUMBER} replace with your Google SecOps project number (you can find it on the Settings tab of the project)

      {IDENTITY_POOL_NAME} replace with the name of the identity pool you've set at step 4-a

    3. In the Role dropdown, select the Workload Identity User option.

  6. Configure a Data Plane on the SOC Prime Platform:

    1. Choose Cloud Chronicle API with WIF as the environment type for your Google SecOps Data plane.

    2. Fill in the required parameters:

      1. Google SecOps Project Number – Copy the Project number from the Settings tab of your Google SecOps project.

      2. Google SecOps Service Account Email – Copy the value of the Email field of the service account you've created at step 3.

      3. Region – select the region of your Google SecOps from the dropdown. You can find your region on the Google SecOps → Overview tab.

      4. Instance ID – Copy the Customer ID value from the Google SecOps → Overview tab.

      5. Project ID – Copy the Project ID from the Settings tab of your Google SecOps project.

      6. Azure Tenant ID – use the value provided by SOC Prime (see step 1).

      7. Azure Client ID – use the value provided by SOC Prime (see step 1).

      8. Azure Client Secret – use the value provided by SOC Prime (see step 1).

      9. WIF Pool ID – Identity pool name you've set at step 4-a.

      10. WIF Provider ID – Identity provider name you've set at step 4-b-ii.

Did this answer your question?