If you're having trouble at any stage please contact us at support@skyformation.com. 

Preface

Google Cloud Platform (GCP) is a suite of cloud services platform, provides Infrastructure as a Service (IaaS) and Platform as a Service (PaaS) services. GCP helps organizations consume compute power and needed services, all without the need to buy or manage hardware.

But at the same time, the IaaS and SaaS public services presents the organization with new security challenges. 

The main challenges and needs are to:

• Get and retain full audit of activities in GCP account
• Retrieve the GCP account activities as admin login to GCP console, GCP compute changes and data flows, events from GCP services and many more.
• The granular activities should be available at the organization’s central log or event management system for compliance, investigation or forensic needs.
• Detect security threats and policy violations

What is it

SkyFormation Cloud Connector for GCP, is part of the SkyFormation Cloud Connectors module. It continuously ingests audit events from multiple audit sources in the GCP account, unify the events into a common application events format, enrich the events with needed detection context and send the events to any existing SIEM/SOC system. 

How it works

SkyFormation Cloud Connector for GCP retrieves the events from the GCP service through its APIs. Before sending the events to the existing SIEM/SOC system the connector will

• Unify the events into the SkyFormation unified application events format
• Embed the origin event into the SkyFormation event
• Complement the event with missing information
• Enrich the event with detection context as AD identity information
• Encode the resulted event into a standard format as CEF
• Send the event to the existing SIEM/SOC system over syslog

GCP Audit Sources & Events Supported

How to on-board GCP Connector to SkyFormation

Adding GCP Connector To SkyFormation Platform