> For the complete documentation index, see [llms.txt](https://docs.dropzone.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.dropzone.ai/integrations/data/googlesecops_data.md).

# Google Security Operations

{% hint style="info" %}
Google Security Operations is an SIEM integration. SIEM integrations are used to perform analysis of any SIEM generated alerts, and/or to use generated data as part of investigation analysis. They are optional, but enabling more integrations enhances Dropzone analysis.
{% endhint %}

Dropzone integrates with [Google Security Operations](https://cloud.google.com/security/products/security-operations) to investigate different security alerts across many of Google's security products.

## Integration Overview

To enable these integrations you will perform the following actions:

* Identify your service account address
* Grant IAM access to the Dropzone service account
* Obtain your Google Account Details
* Complete Google Cloud Mapping
* Enable the Alert and Data sources

Alternatively, Dropzone also supports [Service Account Impersonation](https://docs.cloud.google.com/iam/docs/service-account-impersonation) as a method of authentication. This allows an already-authenticated principal to temporarily act as a target service account and use its permissions, often by requesting short-lived credentials instead of downloading long-lived keys. See Google Cloud's [documentation](https://docs.cloud.google.com/docs/authentication/use-service-account-impersonation) for further information.

{% hint style="info" %}
If you choose to use Service Account Impersonation, be sure to grant (or ask your administrator to grant) the principal you're using the [Service Account Token Creator](https://docs.cloud.google.com/iam/docs/roles-permissions/iam#iam.serviceAccountTokenCreator) role.
{% endhint %}

## Identify your service account email address

To obtain the email address of your Dropzone service account, do the following:

* Navigate to your Dropzone AI tenant home page e.g. https\://*mycompany*.dropzone.app
* In the bottom left hand corner, navigate to Settings > Integrations

<figure><img src="/files/zN02u3HObDaemUY8E1kD" alt=""><figcaption><p>Integrations Dropdown</p></figcaption></figure>

* Click "Library"

{% hint style="info" %}
If you have previously integrated this application, click "Configured"
{% endhint %}

<figure><img src="/files/QySQeLXXUC5SLjaXyamH" alt=""><figcaption><p>Click Library</p></figcaption></figure>

* In the Search bar, search Google Security Operations, then click "Configure"

<figure><img src="/files/7KI64qtojWxIco9PVALt" alt=""><figcaption><p>The Google SecOps Tile</p></figcaption></figure>

* Copy the "SERVICE ACCOUNT EMAIL" field for use in the Google Console interface

<figure><img src="/files/zoqV89980XI4lPCjAj8a" alt="" width="320"><figcaption><p>Copy the service account email</p></figcaption></figure>

## Grant IAM Access to Dropzone AI

* Navigate to the Google Console page of the project your SecOps instance is in
* In the upper left hand corner, open the navigation menu

<figure><img src="/files/MZxgKryMsfjPIGg0PrmC" alt=""><figcaption><p>Open the navigation menu</p></figcaption></figure>

* Navigate to IAM & Admin > IAM

<figure><img src="/files/yuJsgHqdiasRnCFoCv7i" alt=""><figcaption><p>Navigate to IAM</p></figcaption></figure>

* Under "View by principals," click "Grant Access"

{% hint style="info" %}
To be able to complete this step, you will need the `resourcemanager.projects.setIamPolicy` permission.
{% endhint %}

<figure><img src="/files/7nUYn0CIHkWERBDtlwEx" alt=""><figcaption><p>Click "Grant Access"</p></figcaption></figure>

* Under "New principals," input the email address you copied earlier from the Dropzone UI "SERVICE ACCOUNT EMAIL"

<figure><img src="/files/JlwJAp89wkRDp0lTR5Px" alt=""><figcaption><p>Input the email address from the Dropzone UI Service Account Email</p></figcaption></figure>

* Click "Select a role"

<figure><img src="/files/Dm12Cp9FGA3Wzs3J2cxi" alt=""><figcaption><p>Click "Select a role"</p></figcaption></figure>

* Search the "[Chronicle API Viewer](https://docs.cloud.google.com/iam/docs/roles-permissions/chronicle#chronicle.viewer)" role, then click it

{% hint style="info" %}
If you want Dropzone to be able to edit Cases/Alerts after investigation (e.g. by changing stages, modifying priority, or adding comments) select the Chronicle API Editor role.
{% endhint %}

<figure><img src="/files/mrdamGFcavSuQNlU2BeV" alt=""><figcaption><p>Assign the Chronicle API Viewer role</p></figcaption></figure>

* Click "Save"

<figure><img src="/files/dU5laYUIPdTCDfv7cQAS" alt=""><figcaption><p>Click "Save"</p></figcaption></figure>

## Obtain Account Details

To obtain your Instance Name, do the following:

* Return to the Google Console page of the project your SecOps instance is in
* In the upper left hand corner, open the navigation menu

<figure><img src="/files/MZxgKryMsfjPIGg0PrmC" alt=""><figcaption><p>Open the navigation menu</p></figcaption></figure>

* Navigate to Security > Detection and Controls > Google SecOps

<figure><img src="/files/EmPtS8BzJwrtWZnJJt2S" alt=""><figcaption><p>Navigate to Google SecOps</p></figcaption></figure>

* In the Google SecOps page, click the carrot next to "Instance Details"

<figure><img src="/files/C38x9OwvTLi4WagL0qGS" alt=""><figcaption><p>Reveal the Instance Details</p></figcaption></figure>

* Copy the Customer ID shown for use later in the Dropzone UI where it is called "Instance Name"

<figure><img src="/files/2LazT7IOChRmSPYeKTta" alt=""><figcaption><p>Copy the Instance Name</p></figcaption></figure>

To obtain your Project ID, do the following:

* In the upper left, click on the project icon

<figure><img src="/files/dXEF8882EAY40hffTpC9" alt=""><figcaption><p>Click the project icon</p></figcaption></figure>

* Using the search bar, locate the project your SecOps instance is in
* Under "ID," copy the ID value shown for use later in the Dropzone UI where it is called "Project ID"

<figure><img src="/files/GUYyeX9rnIkWFapXg0jG" alt=""><figcaption><p>Copy the Project ID</p></figcaption></figure>

## Cloud Identity Mapping

If you want Dropzone to be able to have SOAR access, (e.g. managing [cases](https://cloud.google.com/chronicle/docs/soar/investigate/working-with-cases/cases-overview)), you must map the service account to your platform's access control parameters. This will provide the service account with access to SOC Roles and Environments required to perform automated tasks or API operations.

To do Cloud Identity mapping, do the following:

* As an admin, log into your Google SecOps instance
* In the left sidebar, navigate to Settings > SOAR Settings
* Navigate to Advanced > Group Mapping
* Click "+ Add"
* In the IDP/User group field, enter the full service account email address or the workload identity principle string
* Assign the service account the appropriate [SOC role and Environments](https://docs.cloud.google.com/chronicle/docs/soar/admin-tasks/advanced/control-access-to-platform)

{% hint style="success" %}
Dropzone needs read access to all security event data and case/alert content in your tenant, plus the ability to comment on, tag, and change the status of cases and alerts it has been given for investigation.
{% endhint %}

* Click "Save"

## Enable Google SecOps

To enable the Data Source integration, you will need the following information:

| Dropzone Field | Source                                     |
| -------------- | ------------------------------------------ |
| Instance Name  | The "Customer ID" value you copied earlier |
| Project ID     | The "Project ID" value you copied earlier  |

To enable the Data Source integration, do the following:

* Navigate to your Dropzone AI tenant home page e.g. https\://*mycompany*.dropzone.app
* In the bottom left hand corner, navigate to Settings > Integrations

<figure><img src="/files/zN02u3HObDaemUY8E1kD" alt=""><figcaption><p>Integrations Dropdown</p></figcaption></figure>

* Click "Library"

{% hint style="info" %}
If you have previously integrated this application, click "Configured"
{% endhint %}

<figure><img src="/files/QySQeLXXUC5SLjaXyamH" alt=""><figcaption><p>Click Library</p></figcaption></figure>

* In the Search bar, search Google Security Operations, then click "Configure"

<figure><img src="/files/7KI64qtojWxIco9PVALt" alt=""><figcaption><p>The Google SecOps Tile</p></figcaption></figure>

* Under the Data Source heading, input the Instance Name and Project ID
* If you are using Service Account Impersonation, input the Customer-Owned Service Account value
* Input the maximum number of times you want Dropzone to attempt a [UDM](https://docs.cloud.google.com/chronicle/docs/investigation/udm-search) query if an error occurs

<figure><img src="/files/eh0vhxO9Wn2cL1aMXDzw" alt=""><figcaption><p>The Google SecOps Data Source Configuration</p></figcaption></figure>

* Click "Test & Save" to finish

If you have any errors engage your Dropzone AI support representative.