Google Cloud Platform Compute Engine (via Codeless Connector Framework)

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Connectors Index

Attribute	Value
Connector ID	`GCPComputeEngineLogsCCPDefinition`
Publisher	Microsoft
Used in Solutions	Google Cloud Platform Compute Engine
Collection Method	CCF
Connector Definition Files	GCPComputeEngineLog_ConnectorDefinition.json
DCR Definition Files	GCPComputeEngineLog_DCR.json
CCF Configuration	GCPComputeEngineLog_PollerConfig.json
CCF Capabilities	`GCP`
Microsoft Learn	View on Learn

The Google Cloud Platform Compute Engine data connector provides the capability to ingest Compute Engine Audit logs into Microsoft Sentinel using the Google Cloud Compute Engine API. Refer to Cloud Compute Engine API documentation for more information.

Tables Ingested

This connector ingests data into the following tables:

Table	Transformations	Ingestion API	Lake-Only
`GCPComputeEngine`	✓	✓	✓

💡 Tip: Tables with Ingestion API support allow data ingestion via the Azure Monitor Data Collector API, which also enables custom transformations during ingestion.

Permissions

Resource Provider Permissions:

Workspace (Workspace): Read and Write permissions are required.

Setup Instructions

⚠️ Note: These instructions were automatically generated from the connector's user interface definition file using AI and may not be fully accurate. Please verify all configuration steps in the Microsoft Sentinel portal.

1. Connect GCP Compute Engine to Microsoft Sentinel

1. Setup the GCP environment

Ensure to have the following resources from the GCP Console: Project ID, Project Name, GCP Subscription name for the project, Workload Identity Pool ID, Workspace Identity Provider ID, and a Service Account to establish the connection. For more information, refer the Connector tutorial for log setup and authentication setup tutorial. Log set up script: Click Here Authentication set up script: Click here

Government Cloud:

1. Setup the GCP environment

Tenant ID: A unique identifier that is used as an input in the Terraform configuration within a GCP environment.: TenantId

Note: The value above is dynamically provided when these instructions are presented within Microsoft Sentinel.

2. Enable Compute Engine logs

In the Google Cloud Console, enable Compute Engine API, if not enabled previously, and save the changes.

3. Connect new collectors

To enable Compute Engine Logs for Microsoft Sentinel, click on Add new collector button, provide the required information in the pop up and click on Connect. GCP Collector Management

📊 View GCP Collectors: A management interface displays your configured Google Cloud Platform data collectors.

➕ Add New Collector: Click "Add new collector" to configure a new GCP data connection.

💡 Portal-Only Feature: This configuration interface is only available in the Microsoft Sentinel portal.

GCP Connection Configuration

When you click "Add new collector" in the portal, you'll be prompted to provide:

Project ID: Your Google Cloud Platform project ID
Service Account: GCP service account credentials with appropriate permissions
Subscription: The Pub/Sub subscription to monitor for log data

💡 Portal-Only Feature: This configuration form is only available in the Microsoft Sentinel portal.

Additional Documentation

📄 Source: [Google Cloud Platform Compute Engine\Data Connectors\GCPComputeEngineReadme.md](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Google Cloud Platform Compute Engine\Data Connectors\GCPComputeEngineReadme.md)

Integrating Google Cloud Platform Compute Engine into Microsoft Sentinel

Introduction
Prerequisites
Steps to execute Terraform Scripts for log setup
Steps to execute Terraform Scripts for Authentication setup

Introduction

The Google Cloud Platform Compute Engine Codeless Connector for Microsoft Sentinel enables seamless integration of Compute Engine logs with Microsoft Sentinel without the need for custom code. Developed as part of the Codeless Connector Platform(CCP), this connector simplifies the process of collecting and ingesting Compute Engine audit logs from Google Cloud Platform into Sentinel.

Prerequisites

The below mentioned resources are required to connect GCP with Sentinel.

Project ID
Project Number
GCP Subscription Name
Workload Identity Pool ID
Service Account
Workload Identity Provider ID

To generate the above resources, you must execute the following terraform scripts.

Log Setup File
Authentication setup file

Steps to execute Terraform scripts for Log Setup

To access the terraform script for Log Setup Click here.

Launch the cloud shell in Google Cloud Console.
Execute the below mentioned commands.
create a directory
```
mkdir <dir_name>
```
Navigate to the directory
```
cd <dir_name>
```
Copy the github raw link of the Terraform script and get the content of the file into a shell using the following command:
```
wget <raw link of the file> -O <filename.tf>
```
Initializes your terraform working directory, downloads provider plugins, and configures the backend for state storage.
```
terraform init
```
Creates an execution plan to show what actions terraform will take to achieve the desired state of your infrastructure.
```
terraform plan
```
Once you execute this command it will ask to "Enter your project ID". Please enter your GCP Project ID.
Executes the actions proposed in the Terraform plan to create, update, or destroy resources in your infrastructure.
```
terraform apply
```
Once you execute this command it will again ask to "Enter your project ID". Please enter your GCP Project ID one more time.
After successfully executing the Log Setup file, topic name, subscription name is generated in the GCP Project. Save those details for future reference.