If you're having trouble at any stage please contact us at support@skyformation.com.
Preface
Google Cloud Platform (GCP) is a suite of cloud services platform, provides Infrastructure as a Service (IaaS) and Platform as a Service (PaaS) services. GCP helps organizations consume compute power and needed services, all without the need to buy or manage hardware.
But at the same time, the IaaS and SaaS public services presents the organization with new security challenges.
The main challenges and needs are to:
- Get and retain full audit of activities in GCP account
- Retrieve the GCP account activities as admin login to GCP console, GCP compute changes and data flows, events from GCP services and many more.
- The granular activities should be available at the organization’s central log or event management system for compliance, investigation or forensic needs.
- Detect security threats and policy violations
What is it
SkyFormation Cloud Connector for GCP, is part of the SkyFormation Cloud Connectors module. It continuously ingests audit events from multiple audit sources in the GCP account, unify the events into a common application events format, enrich the events with needed detection context and send the events to any existing SIEM/SOC system.
How it works
SkyFormation Cloud Connector for GCP retrieves the events from the GCP service through its APIs. Before sending the events to the existing SIEM/SOC system the connector will
- Unify the events into the SkyFormation unified application events format
- Embed the origin event into the SkyFormation event
- Complement the event with missing information
- Enrich the event with detection context as AD identity information
- Encode the resulted event into a standard format as CEF
- Send the event to the existing SIEM/SOC system over syslog
GCP Audit Sources & Events Supported
| Audit Source (API) | Service/Module Covered | Event Types | Events included |
|---|---|---|---|
| Admin Activities | App Engine | Represents events related to admin activities in the app engine paas service | |
| BigQuery | Represents events related to admin activities in the bigquery service | ||
| Cloud Dataflow | Represents events related to admin activities in the cloud dataflow service | ||
| Cloud Dataproc | Represents events related to admin activities in the cloud dataproc service | ||
| Cloud DNS | Represents events related to admin activities in the cloud dns service | ||
| Cloud Identity and Access Management (IAM) | Represents events related to admin activities in the cloud iam service | ||
| Cloud Key Management System (KMS) | Represents events related to admin activities in the cloud kms service | ||
| Cloud Resource Manager | Represents events related to admin activities in the cloud resource manager service | ||
| Cloud SQL | Represents events related to admin activities in the cloud sql service | ||
| Cloud Storage | Represents events related to admin activities in the cloud storage service | ||
| Google Compute Engine (GCE) | Represents events related to admin activities in the compute engine service | ||
| Compute Engine Serial Port Access | Represents events related to admin activities in the Compute Engine Serial Port Access service | ||
| Google Service Management | Represents events related to admin activities in the Google Service Management service | ||
| Stackdriver Debugger | Represents events related to admin activities in the stackdriver debugger service | ||
| Stackdriver Debugger | Represents events related to admin activities in the stackdriver debugger service | ||
| Stackdriver Looging | Represents events related to admin activities in the stackdriver looging service | ||
| Data Access Logs | BigQuery | Represents events related to data access in the bigquery service | |
| Cloud Dataproc | Represents events related to data access in the cloud dataproc service | ||
| Cloud DNS | Represents events related to data access in the cloud dns service | ||
| Cloud Identity and Access Management (IAM) | Represents events related to data access in the cloud iam service | ||
| Cloud Key Management System (KMS) | Represents events related to data access in the cloud kms service | ||
| Cloud SQL | Represents events related to data access in the cloud sql service | ||
| Cloud Storage | Represents events related to data access in the cloud storage service | ||
| Google Compute Engine (GCE) | Request logs, Application logs, Runtime logs, Custom logs | Represents events related to data access in the compute engine service | |
| Google Service Management | Represents events related to data access in the Google Service Management service | ||
| Stackdriver Debugger | Represents events related to data access in the stackdriver debugger service | ||
| Stackdriver Debugger | Represents events related to data access in the stackdriver debugger service | ||
| Stackdriver Looging | Represents events related to data access in the stackdriver looging service |
Comments
0 comments
Please sign in to leave a comment.