Map and authorize users using IAM

This article shows you how to authorize and map users using Identity and Access Management (IAM) with secure identification in the SOAR side of the Security Operations console.

Before you begin

Make sure you have defined and mapped users using IAM to the SIEM side of the Security Operations console. For more information, see Control feature access using IAM

Grant IAM roles in the Google Cloud console

Three predefined IAM roles have been added to your Security Command Center Enterprise project in the Google Cloud console.

  • Chronicle SOAR Admin (roles/chronicle.soarAdmin)
  • Chronicle SOAR Threat Manager (roles/chronicle.soarThreatManager)
  • Chronicle SOAR Vulnerability Manager (roles/chronicle.soarVulnerabilityManager)

The following procedure explains how to grant the IAM roles to users in the Google Cloud console.

  1. Open the console and select your Security Command Center.
  2. Click IAM & Admin.
  3. Select IAM from the navigation tree and then select Grant Access.
  4. In the Grant Access dialog box go to the Add Principals field, and enter the email addresses of users or user groups for one of the three IAM roles.
  5. In the Select a role field, search for the required role: Chronicle SOAR Admin, Chronicle SOAR Threat Manager, or Chronicle SOAR Vulnerability Manager.
  6. Repeat this process for all three roles or as needed.
  7. Click Save.

Control user access

In the SOAR settings of the Security Operations console, there are several different ways to determine which users have access to which aspects of the platform.

  • Permissions groups: Set permissions groups for user types which determine which modules and submodules will be visible or editable for users. For example, you can set permissions such that the user sees the cases and the workdesk but doesn't have access to the playbooks and settings. For more information, see Working with Permission Groups in the Google SecOps documentation.
  • SOC roles: Define the role of a group of users. You can set cases or actions or playbooks to a SOC role instead of a specific user. Users see cases that are assigned to them personally, or to their role, or to one of the additional roles. For more information, see Working with Roles in the Google SecOps documentation.
  • Environments: Set environments to be used by enterprises to manage different networks or business units within the same organization. Users only see data for those environments they have access to. For more information, see Adding an environment in the Google SecOps documentation.

Map the IAM roles in the SOAR side of the Security Operations console

  1. In the Security Operations console, go to Settings > SOAR Settings > Advanced > IAM Role mapping.
  2. Using the display name (e.g. Chronicle SOAR Admin), assign each IAM role to the corresponding SOC roles (Threat Manager, Vulnerability Manager or Admin), permission groups (select Admins permission group), and environments (select the default environment). Alternatively, add an email address instead of an IAM role.
  3. Click Save.
When each user logs in to the platform, they are automatically added to the User Management page (which is located in SOAR Settings > Organization ).

Sometimes users will try to log into the Security Operations console but their IAM role has not been mapped in the platform. In order for these users not to be rejected, we recommend enabling and setting the Default Access Settings on this page.