Google Cloud Policy Intelligence

This document provides guidance to help you configure and integrate Google Cloud Policy Intelligence with Google Security Operations SOAR.

Prerequisites

Create and configure the IAM role

  1. In the Google Cloud console, go to the IAM Roles page.

    Go to IAM Roles

  2. Click Create role to create a custom role with permissions required for the integration.

  3. For a new custom role, provide the Title, Description, and a unique ID.

  4. Set the Role Launch Stage to General Availability.

  5. Add the following permission to the created role:

    • policyanalyzer.serviceAccountLastAuthenticationActivities.query

  6. Click Create.

Create a service account

  1. To create a service account, follow the procedure for creating a service account.

  2. After you have created a service account, download it as a JSON file. You need to provide the downloaded JSON file when configuring the integration parameters.

Integrate Google Cloud Policy Intelligence with Google Security Operations SOAR

For detailed instructions on how to configure an integration in Google Security Operations SOAR, see Configure integrations.

Integration inputs

To configure the integration, use the following parameters:

Parameters
API Root Required

API root of the Google Cloud Policy Intelligence instance.

Default value is https://policyanalyzer.googleapis.com
Organization ID Optional

Organization ID that should be used in the Google Cloud Policy Intelligence integration.
User's Service Account Required

Service account of the Google Cloud Policy Intelligence instance.

Make sure to provide the full content of the service account JSON file that you have downloaded when creating a service account.
Verify SSL Required

When checked, the parameter verifies if the SSL certificate for connecting to the Google Cloud Policy Intelligence server is valid.

Checked by default.

Actions

Ping

Test connectivity to Google Cloud Policy Intelligence with parameters provided at the integration configuration page in the Google Security Operations SOAR Marketplace tab.

Entities

The action does not run on entities.

Action inputs

N/A

Action outputs

Action output type
Case wall attachment N/A
Case wall link N/A
Case wall table N/A
Enrichment table N/A
Entity insight N/A
Insight N/A
JSON result N/A
OOTB widget N/A
Script result Available
Script result
Script result name Value
is_success True/False
Case wall

The action provides the following output messages:

Output message Message description
Successfully connected to the Google Cloud Policy Intelligence server with the provided connection parameters! Connection established successfully.
Failed to connect to the Google Cloud Policy Intelligence server! The action returned an error.

Search service account activity

Search activity related to service accounts in Google Cloud Policy Intelligence.

Entities

The action does not run on entities.

Action inputs

To configure the action, use the following parameters:

Parameters
Service Account Resource Name Required

Specifies a comma-separated list containing resource names of service accounts for which you fetch activity.
Max Activities To Return Required

Specifies how many activities to return per service account.

The max number is 1000.

By default, the action returns 50 activities.

Action outputs

Action output type
Case wall attachment N/A
Case wall link N/A
Case wall table N/A
Enrichment table N/A
Entity insight N/A
Insight N/A
JSON result Available
OOTB widget N/A
Script result Available
Script result
Script result name Value
is_success True/False
JSON result
[
  {
    "Entity": "//iam.googleapis.com/projects/chronicle-demo-env/serviceAccounts/cdir-scc-service-account@chronicle-demo-env.iam.gserviceaccount.com",
    "EntityResult": [
      {
        "fullResourceName": "//iam.googleapis.com/projects/chronicle-demo-env/serviceAccounts/cdir-scc-service-account@chronicle-demo-env.iam.gserviceaccount.com",
        "activityType": "serviceAccountLastAuthentication",
        "observationPeriod": {
          "startTime": "2023-05-23T07:00:00Z",
          "endTime": "2023-08-20T07:00:00Z"
        },
        "activity": {
          "lastAuthenticatedTime": "2023-08-20T07:00:00Z",
          "serviceAccount": {
            "serviceAccountId": "100969641053678159314",
            "projectNumber": "105111850896",
            "fullResourceName": "//iam.googleapis.com/projects/chronicle-demo-env/serviceAccounts/cdir-scc-service-account@chronicle-demo-env.iam.gserviceaccount.com"
          }
        }
      }
    ]
  }
]
Case wall

The action provides the following output messages:

Output message Message description
Successfully found activity for the following service accounts in Google Cloud Policy Intelligence: SERVICE_ACCOUNTS Action is successful.
No activity was found for the following service accounts in Google Cloud Policy Intelligence: SERVICE_ACCOUNTS The action could not find data for selected service accounts.
No activity was found for the provided service accounts in Google Cloud Policy Intelligence The action could not find data for any of the listed service accounts.
Error executing action "Search Service Account Activity". Reason: ERROR_REASON

The action returned an error.

Check connection to the server, input parameters, or credentials.
Error executing action "Search Service Account Activity". Reason: "Start Time" should be provided, when "Custom" is selected in "Time Frame" parameter.

The action returned an error.

Make sure to provide a Start Time for the Time Frame parameter.