This quick start guide will help Accenture MDR customers configure Google Cloud Platform to allow log collection from the Log Collection Platform (LCP).
The document includes the following topics:
Supported Versions
A list of supported versions is available in the Accenture MDR Supported Products List document (Accenture_MDR_Supported_Products_List.xlsx) which can be found in Accenture MDR Portal.
Port Requirements
Table 1-1: Port requirements for LCP communication.
Source | Destination | Port | Description |
LCP | Google Cloud API | 443(https) | Default port |
Configuring Google Cloud Platform
Prerequisite:
Data Access audit logs - except for BigQuery Data Access audit logs - are disabled by default because audit logs can be quite large.
If you want Data Access audit logs to be written for Google Cloud services other than BigQuery, you must explicitly enable them. Enabling the logs might result in your Cloud project being charged for the usage of the additional log. For instructions on enabling and configuring Data Access audit logs, see Configuring Data Access logs.
In the GCP Console, navigate to Logging under the Operations section and then click on Logs Explorer.
2. In the Query field run the following query after filling the Project_ID field
logName=("projects/PROJECT_ID/logs/cloudaudit.googleapis.com%2Factivity" OR "projects/PROJECT_ID/logs/cloudaudit.googleapis.com%2Fdata_access" OR "projects/PROJECT_ID/logs/cloudaudit.googleapis.com%2Fsystem_event" OR "projects/PROJECT_ID/logs/cloudaudit.googleapis.com%2Fpolicy")
|
3. Click on the Action drop-down button and select Create Sink
4. Provide a unique name for the sink and description in Sink details and click Next. In Sink Destination, select Cloud Pub/Sub topic and click on CREATE A TOPIC in Select a Cloud Pub/Sub topic drop-down menu
5. Provide a unique topic-id and click CREATE TOPIC
6. Choose logs to include in the sink field, will be pre-populated. Click Next, and then click CREATE SINK.
7. Navigate to Pub/Sub option in the Big Data Section navigation pane and then select Subscriptions
8. Click CREATE SUBSCRIPTION
9. Provide a Subscription name (This will be required by MDR for log monitoring configuration)
Select the topic created previously.
Choose Delivery type as Pull and minimum recommended Message retention duration is 1 day.
Set Expiration period to Never Expire and sey Acknowledgment Deadline to 600 Seconds
Enable Retry Policy as Retry Immediately and then click Create.
10. Navigate to IAM & Admin section and under service accounts, click CREATE SERVICE ACCOUNT
11. Provide a unique name and description for the Service account details and click CREATE AND CONTINUE.
12. Select Role as Pub/Sub Publisher and Pub/Sub Viewer and click CONTINUE
13. Click Done.
14. Click on the Service account email on next screen.
15. Click on the keys tab and then Add Key and then create a new key
16. Select JSON and click Create
17. It will allow you to download a file, save that, and share it with MDR for log monitoring configuration.
LCP Configuration Parameters
Table 1-2: The Microsoft Azure App Gateway event collector (API – 3943) properties to be configured by MDR are shown in the table.
Property | Default Value | Description |
Storage Account Name | Custom Value | Azure Unique Storage Name mentioned in the Pre-Installation Questionnaire (PIQ). |
Account Key | Custom Value | Access Key to access storage account mentioned in the in the Pre-Installation Questionnaire (PIQ). |
Blob Container | insights-logs-applicationgatewayaccesslog insights-logs-applicationgatewayfirewalllog | Container name mentioned in the Pre-Installation Questionnaire (PIQ). |
Subscription | Custom Value | Subscription mentioned in the Pre-Installation Questionnaire (PIQ). Note: You can monitor All or specific Subscription ID's. |