Onboarding or migrating a Chronicle instance

Chronicle links to a customer-supplied Google Cloud project to integrate more closely with Google Cloud services, such as Identity and Access Management, Cloud Monitoring, and Cloud Audit Logs. Customers can use IAM and workforce identity federation to authenticate using their existing identity provider.

The following documents guide you through the process to onboard a new Chronicle instance or migrate an existing Chronicle instance.

  1. Configure a Google Cloud project for Chronicle
  2. Configure a third-party identity provider for Chronicle
  3. Link Chronicle to Google Cloud services
  4. Configure feature access control using IAM

Required roles

The following sections describe the permissions you need for each phase of the onboarding process, mentioned in the previous section.

Configure a Google Cloud project for Chronicle

To complete the steps in Configure a Google Cloud project for Chronicle, you need the following IAM permissions.

If you have the Project Creator (resourcemanager.projects.create permission at the organization level, then no additional permissions are required to create a project and enable the Chronicle API.

If you do not have this permission, you need the following permissions at the project level:

Configure a third-party identity provider Chronicle

To complete the steps in Configure a third-party identity provider for Chronicle, you need the following IAM permissions.

  • Project Editor permissions to the Chronicle-bound project you created previously.

  • IAM Workforce Pool Admin (roles/iam.workforcePoolAdmin) permission at either the project level or organization level.

    Use the following command as an example to set the roles/iam.workforcePoolAdmin role:

    gcloud organizations add-iam-policy-binding ORGANIZATION_ID \
    --member "user:USER_EMAIL" \
    --role roles/iam.workforcePoolAdmin
    

    Replace the following:

    • ORGANIZATION_ID: the numeric organization ID.
    • USER_EMAIL: the admin user's email address.

To complete the steps in Link Chronicle to Google Cloud services, you need the same permissions defined in the Configure a Google Cloud project for Chronicle section.

Configure feature access control using IAM

To complete the steps in Configure feature access control using IAM, you need the following IAM permission at the project level to grant and modify the project's IAM role bindings:

See Assign roles to users and groups for an example of how to do this.

If you plan to migrate an existing Chronicle instance to IAM, you need the same permissions defined in the Configure a third-party identity provider Chronicle section.

Chronicle advanced capabilities requirements

The following table lists Chronicle advanced capabilities and their dependencies on a customer-provided Google Cloud project and Google workforce identity federation.

Capability Google Cloud foundation Requires Google Cloud project? Requires workforce identity federation?
Cloud Audit Logs: administrative activities Cloud Audit Logs Yes Yes
Cloud Audit Logs: data access Cloud Audit Logs Yes Yes
Cloud Billing: online subscription or pay-as-you-go Cloud Billing Yes No
Chronicle APIs: general access, mint and manage credentials using third-party IdP Google Cloud APIs Yes Yes
Chronicle APIs: general access, mint and manage credentials using Cloud Identity Google Cloud APIs, Cloud Identity Yes Yes
Compliant controls: CMEK Cloud Key Management Service or Cloud External Key Manager Yes No
Compliant controls: FedRAMP High or above Assured Workloads Yes Yes
Compliant controls: Organization Policy Service Organization Policy Service Yes No
Compliant controls: VPC Service Controls VPC Service Controls Yes No
Contact management: legal disclosures Essential Contacts Yes No
Health monitoring: ingestion pipeline outages Cloud Monitoring Yes No
Ingestion: webhook, Pub/Sub, Azure Event Hub, Amazon Kinesis Data Firehose Identity and Access Management Yes No
Role-based access controls: data Identity and Access Management Yes Yes
Role-based access controls: features or resources Identity and Access Management Yes Yes
Support access: case submission, tracking Cloud Customer Care Yes No
Unified SecOps authentication Google workforce identity federation No Yes