Accenture MDR Quick Start Guide for Google Cloud Platform (GCP)

This quick start guide will help Accenture MDR customers configure Google Cloud Platform to allow log collection from the Log Collection Platform (LCP).

The document includes the following topics:

Supported Versions

A list of supported versions is available in the Accenture MDR Supported Products List document (Accenture_MDR_Supported_Products_List.xlsx) which can be found in Accenture MDR Portal.

Port Requirements

Table 1-1: Port requirements for LCP communication.

Configuring Google Cloud Platform

Prerequisite: 

Data Access audit logs - except for BigQuery Data Access audit logs - are disabled by default because audit logs can be quite large.

If you want Data Access audit logs to be written for Google Cloud services other than BigQuery, you must explicitly enable them. Enabling the logs might result in your Cloud project being charged for the usage of the additional log. For instructions on enabling and configuring Data Access audit logs, see Configuring Data Access logs.

1. In the GCP Console, navigate to Logging under the Operations section and then click on Logs Explorer.

Open

2. In the Query field run the following query after filling the Project_ID field

Open

3. Click on the Action drop-down button and select Create Sink

4. Provide a unique name for the sink and description in Sink details and click Next. In Sink Destination, select Cloud Pub/Sub topic and click on CREATE A TOPIC in Select a Cloud Pub/Sub topic drop-down menu

5. Provide a unique topic-id and click CREATE TOPIC

6. Choose logs to include in the sink field, will be pre-populated. Click Next, and then click CREATE SINK.

7. Navigate to Pub/Sub option in the Big Data Section navigation pane and then select Subscriptions

8. Click CREATE SUBSCRIPTION

9. Provide a Subscription name (This will be required by MDR for log monitoring configuration)

• Select the topic created previously.

• Choose Delivery type as Pull and minimum recommended Message retention duration is 1 day. 

• Set Expiration period to Never Expire and sey Acknowledgment Deadline to 600 Seconds

• Enable Retry Policy as Retry Immediately and then click Create.

10. Navigate to IAM & Admin section and under service accounts, click CREATE SERVICE ACCOUNT

11. Provide a unique name and description for the Service account details and click CREATE AND CONTINUE.

12. Select Role as Pub/Sub Subscriber and Pub/Sub Viewer and click CONTINUE 

13. Click Done.

14. Click on the Service account email on next screen.

15. Click on the keys tab and then Add Key and then create a new key

16. Select JSON and click Create

17. It will allow you to download a file, save that, and share it with MDR for log monitoring configuration.

LCP Configuration Parameters

Table 1-2: The Google Cloud Platform Audit event collector (Custom – 3950) properties to be configured by MDR are shown in the table.