Google Cloud VPC Flow

About The Device

VPC Flow Logs records a sample of network flows sent from and received by VM instances. These logs can be used for network monitoring, forensics, real-time security analysis, and expense optimization.

You can view flow logs in Cloud Logging, and you can export logs to any destination that Cloud Logging export supports. 

Device Information

Collection Method

Device Configuration

Please follow the steps below to enable raw log telemetry.

Pre-Requisite:

1. Please create Cloud Storage Bucket.

2. Chronicle Service Account which will be provided by Adaptive MXDR Team.

Configure VPC flow logs:

1. Login to Google Cloud account using credentials.

2. On Welcome page, click VPC Network

Open

3.In VPC networks, click Default.

Open

4. In Subnets, select all logs and click Flow Logs > Configure.

5.Select Aggregation Interval and enter Sample Rate. (For example, enter 50%)

6.Click Save.
After saving, VPC logs start flowing into Chronicle

7. Next, search Logging in the search bar at the top and click Enter. By default, it navigates you to Log Explorer.

8. In Log Explorer, you can see all logs that come from multiple sources. Filter the logs by choosing VPC_flows in Log Name and click Apply.
   All VPC logs are sorted out in the page

9.Click More Actions and select Create Sink.

10. In Logs Router screen, in Create logs Routing Sink window, fill the following details:

• In Sink Details, enter Name & Description and click Next. (For example, test_gcp_vcp_flows & GCP Flows)

• In Sink Destination, in Select sink service, select Cloud Storage Bucket and in Cloud Storage Bucket, select bucket which you have created as mentioned in pre-requisite.

• In Choose Logs to include in Sink, a default log is populated once you select an option in Cloud Storage Bucket and click Next.

• (Optional) In Choose Logs to filter out of Sink, choose the logs that you would like not to sink

• Click Create Sink. All logs will be sinked and stored in Cloud Storage Bucket

Viewing VPC logs in Cloud Storage Bucket:

To view the VPC logs that are synchronized in cloud storage bucket, first you must grant the Chronicle access. You must add the email address of Chronicle Service Account to the permissions of the relevant Google Cloud Storage object(s). You must also perform the following actions from the Cloud Storage section in the Google Cloud Console.

• To grant read permission to a specific file, you can "Edit access" on that file and grant "Reader" access to Chronicle Service Account. This can only be done if you have not enabled uniform bucket-level access.

• If you configure the feed to delete source files (see below for how to do this), you must add Chronicle Service Account as a principle on your bucket and grant it the IAM role of Storage Object Admin.

• To grant read permission to multiple files you must grant access at the bucket level. Specifically, you must add Chronicle Service Account as a principle to your storage bucket and grant it the IAM role of Storage Object Viewer.

To enable permission to multiple files in a single bucket at a time, following steps help you achieve it.

1. Click on the bucket that you would like enable permissions.

2. In Permissions, click ADD

3. Mention CHRONICLE SERVICE ACCOUNT provided by Adaptive MXDR team in New Principals.

4. In Role, select Storage Object Viewer.

5. Click Save. A gsutil URL is generated for a storage bucket that you have enabled permissions

6. In order to ingest VPC logs into Chronicle, you must copy gsutil URL from the configuration tab of a storage bucket and paste it in the Input parameters of Chronicle Feeds.

Integration Parameters