-
Notifications
You must be signed in to change notification settings - Fork 3k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
1 parent
9df4211
commit ea5d0ac
Showing
6 changed files
with
668 additions
and
313 deletions.
There are no files selected for viewing
225 changes: 102 additions & 123 deletions
225
...ogle Cloud Platform Security Command Center/Data Connectors/GCPSecurityCommandCenter.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,124 +1,103 @@ | ||
| { | ||
| "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", | ||
| "contentVersion": "1.0.0.0", | ||
| "parameters": { | ||
| "workspace": { | ||
| "type": "string", | ||
| "defaultValue": "" | ||
| } | ||
| }, | ||
| "resources": [ | ||
| { | ||
| "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentIdConnectorDefinition'))]", | ||
| "apiVersion": "2022-09-01-preview", | ||
| "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectorDefinitions", | ||
| "location": "[parameters('workspace-location')]", | ||
| "kind": "Customizable", | ||
| "properties": { | ||
| "connectorUiConfig": { | ||
| "title": "Google Security Command Center", | ||
| "publisher": "Microsoft", | ||
| "descriptionMarkdown": "The Google Cloud Platform (GCP) Security Command Center is a comprehensive security and risk management platform for Google Cloud, ingested from Sentinel's connector. It offers features such as asset inventory and discovery, vulnerability and threat detection, and risk mitigation and remediation to help you gain insight into your organization's security and data attack surface. This integration enables you to perform tasks related to findings and assets more effectively.", | ||
| "graphQueriesTableName": "GoogleCloudSCC", | ||
| "graphQueries": [ | ||
| { | ||
| "metricName": "Total events received", | ||
| "legend": "Google Security Command Center", | ||
| "baseQuery": "{{graphQueriesTableName}}" | ||
| } | ||
| ], | ||
| "sampleQueries": [ | ||
| { | ||
| "description": "Get Sample of Google SCC", | ||
| "query": "{{graphQueriesTableName}}\n | take 10" | ||
| } | ||
| ], | ||
| "dataTypes": [ | ||
| { | ||
| "name": "{{graphQueriesTableName}}", | ||
| "lastDataReceivedQuery": "{{graphQueriesTableName}}\n | where TimeGenerated > ago(12h) | where name_s == \"no data test\" | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" | ||
| } | ||
| ], | ||
| "connectivityCriteria": [ | ||
| { | ||
| "type": "HasDataConnectors", | ||
| "value": null | ||
| } | ||
| ], | ||
| "availability": { | ||
| "status": 1, | ||
| "isPreview": false | ||
| }, | ||
| "permissions": { | ||
| "tenant": null, | ||
| "licenses": null, | ||
| "resourceProvider": [ | ||
| { | ||
| "provider": "Microsoft.OperationalInsights/workspaces", | ||
| "permissionsDisplayText": "Read and Write permissions are required.", | ||
| "providerDisplayName": "Workspace", | ||
| "scope": "Workspace", | ||
| "requiredPermissions": { | ||
| "read": true, | ||
| "write": true, | ||
| "delete": true, | ||
| "action": false | ||
| } | ||
| }, | ||
| { | ||
| "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", | ||
| "permissionsDisplayText": "Read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key)", | ||
| "providerDisplayName": "Keys", | ||
| "scope": "Workspace", | ||
| "requiredPermissions": { | ||
| "read": false, | ||
| "write": false, | ||
| "delete": false, | ||
| "action": true | ||
| } | ||
| } | ||
| ] | ||
| }, | ||
| "instructionSteps": [ | ||
| { | ||
| "instructions": [ | ||
| { | ||
| "type": "Markdown", | ||
| "parameters": { | ||
| "content": "#### 1. Set up your GCP environment \n You must have the following GCP resources defined and configured: topic, subscription for the topic, workload identity pool, workload identity provider and service account with permissions to get and consume from subscription. \n Terraform provides API for the IAM that creates the resources. [Link to Terraform scripts](https://github.com/Azure/Azure-Sentinel/tree/master/DataConnectors/GCP/Terraform/sentinel_resources_creation)." | ||
| } | ||
| }, | ||
| { | ||
| "type": "CopyableLabel", | ||
| "parameters": { | ||
| "label": "Tenant ID: A unique identifier that is used as an input in the Terraform configuration within a GCP environment.", | ||
| "fillWith": [ | ||
| "TenantId" | ||
| ], | ||
| "name": "PoolId", | ||
| "disabled": true | ||
| } | ||
| }, | ||
| { | ||
| "type": "Markdown", | ||
| "parameters": { | ||
| "content": "#### 2. Connect new collectors \n To enable GCP SCC for Microsoft Sentinel, click the Add new collector button, fill the required information in the context pane and click on Connect." | ||
| } | ||
| }, | ||
| { | ||
| "type": "GCPGrid", | ||
| "parameters": {} | ||
| }, | ||
| { | ||
| "type": "GCPContextPane", | ||
| "parameters": {} | ||
| } | ||
| ] | ||
| } | ||
| ], | ||
| "isConnectivityCriteriasMatchSome": false | ||
| } | ||
| } | ||
| }] | ||
| } | ||
|
|
||
| "id": "GoogleSCCDefinition", | ||
| "title": "Google Security Command Center", | ||
| "publisher": "Microsoft", | ||
| "descriptionMarkdown": "The Google Cloud Platform (GCP) Security Command Center is a comprehensive security and risk management platform for Google Cloud, ingested from Sentinel's connector. It offers features such as asset inventory and discovery, vulnerability and threat detection, and risk mitigation and remediation to help you gain insight into your organization's security and data attack surface. This integration enables you to perform tasks related to findings and assets more effectively.", | ||
| "graphQueriesTableName": "GoogleCloudSCC", | ||
| "graphQueries": [ | ||
| { | ||
| "metricName": "Total events received", | ||
| "legend": "Google Security Command Center", | ||
| "baseQuery": "{{graphQueriesTableName}}" | ||
| } | ||
| ], | ||
| "sampleQueries": [ | ||
| { | ||
| "description": "Get Sample of Google SCC", | ||
| "query": "{{graphQueriesTableName}}\n | take 10" | ||
| } | ||
| ], | ||
| "dataTypes": [ | ||
| { | ||
| "name": "{{graphQueriesTableName}}", | ||
| "lastDataReceivedQuery": "{{graphQueriesTableName}}\n | where TimeGenerated > ago(12h) | where name_s == \"no data test\" | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" | ||
| } | ||
| ], | ||
| "connectivityCriteria": [ | ||
| { | ||
| "type": "HasDataConnectors", | ||
| "value": null | ||
| } | ||
| ], | ||
| "availability": { | ||
| "status": 1, | ||
| "isPreview": false | ||
| }, | ||
| "permissions": { | ||
| "tenant": null, | ||
| "licenses": null, | ||
| "resourceProvider": [ | ||
| { | ||
| "provider": "Microsoft.OperationalInsights/workspaces", | ||
| "permissionsDisplayText": "Read and Write permissions are required.", | ||
| "providerDisplayName": "Workspace", | ||
| "scope": "Workspace", | ||
| "requiredPermissions": { | ||
| "read": true, | ||
| "write": true, | ||
| "delete": true, | ||
| "action": false | ||
| } | ||
| }, | ||
| { | ||
| "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", | ||
| "permissionsDisplayText": "Read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key)", | ||
| "providerDisplayName": "Keys", | ||
| "scope": "Workspace", | ||
| "requiredPermissions": { | ||
| "read": false, | ||
| "write": false, | ||
| "delete": false, | ||
| "action": true | ||
| } | ||
| } | ||
| ] | ||
| }, | ||
| "instructionSteps": [ | ||
| { | ||
| "instructions": [ | ||
| { | ||
| "type": "Markdown", | ||
| "parameters": { | ||
| "content": "#### 1. Set up your GCP environment \n You must have the following GCP resources defined and configured: topic, subscription for the topic, workload identity pool, workload identity provider and service account with permissions to get and consume from subscription. \n Terraform provides API for the IAM that creates the resources. [Link to Terraform scripts](https://github.com/Azure/Azure-Sentinel/tree/master/DataConnectors/GCP/Terraform/sentinel_resources_creation)." | ||
| } | ||
| }, | ||
| { | ||
| "type": "CopyableLabel", | ||
| "parameters": { | ||
| "label": "Tenant ID: A unique identifier that is used as an input in the Terraform configuration within a GCP environment.", | ||
| "fillWith": [ | ||
| "TenantId" | ||
| ], | ||
| "name": "PoolId", | ||
| "disabled": true | ||
| } | ||
| }, | ||
| { | ||
| "type": "Markdown", | ||
| "parameters": { | ||
| "content": "#### 2. Connect new collectors \n To enable GCP SCC for Microsoft Sentinel, click the Add new collector button, fill the required information in the context pane and click on Connect." | ||
| } | ||
| }, | ||
| { | ||
| "type": "GCPGrid", | ||
| "parameters": {} | ||
| }, | ||
| { | ||
| "type": "GCPContextPane", | ||
| "parameters": {} | ||
| } | ||
| ] | ||
| } | ||
| ] | ||
| } |
2 changes: 1 addition & 1 deletion
2
... Security Command Center/Data/Solution_Google Cloud Platform Security Command Center.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
2 changes: 1 addition & 1 deletion
2
Solutions/Google Cloud Platform Security Command Center/Data/system_generated_metadata.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Binary file modified
BIN
+1.96 KB
(150%)
Solutions/Google Cloud Platform Security Command Center/Package/3.0.0.zip
Binary file not shown.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.