Google Security Operations

Google Security Operations is an SIEM integration. SIEM integrations are used to perform analysis of any SIEM generated alerts, and/or to use generated data as part of investigation analysis. They are optional, but enabling more integrations enhances Dropzone analysis.

Dropzone integrates with Google Security Operations to investigate different security alerts across many of Google's security products.

Integration Overview

To enable these integrations you will perform the following actions:

• Identify your service account address

• Grant IAM access to the Dropzone service account

• Obtain your Google Account Details

• Complete Google Cloud Mapping

• Enable the Alert and Data sources

Alternatively, Dropzone also supports Service Account Impersonation as a method of authentication. This allows an already-authenticated principal to temporarily act as a target service account and use its permissions, often by requesting short-lived credentials instead of downloading long-lived keys. See Google Cloud's documentation for further information.

If you choose to use Service Account Impersonation, be sure to grant (or ask your administrator to grant) the principal you're using the Service Account Token Creator role.

Identify your service account email address

To obtain the email address of your Dropzone service account, do the following:

• Navigate to your Dropzone AI tenant home page e.g. https://mycompany.dropzone.app

• In the bottom left hand corner, navigate to Settings > Integrations

Integrations Dropdown

• Click "Library"

If you have previously integrated this application, click "Configured"

Click Library

• In the Search bar, search Google Security Operations, then click "Configure"

The Google SecOps Tile

• Copy the "SERVICE ACCOUNT EMAIL" field for use in the Google Console interface

Copy the service account email

Grant IAM Access to Dropzone AI

• Navigate to the Google Console page of the project your SecOps instance is in

• In the upper left hand corner, open the navigation menu

Open the navigation menu

• Navigate to IAM & Admin > IAM

Navigate to IAM

• Under "View by principals," click "Grant Access"

To be able to complete this step, you will need the resourcemanager.projects.setIamPolicy permission.

Click "Grant Access"

• Under "New principals," input the email address you copied earlier from the Dropzone UI "SERVICE ACCOUNT EMAIL"

Input the email address from the Dropzone UI Service Account Email

• Click "Select a role"

Click "Select a role"

• Search the "Chronicle API Viewer" role, then click it

If you want Dropzone to be able to edit Cases/Alerts after investigation (e.g. by changing stages, modifying priority, or adding comments) select the Chronicle API Editor role.

Assign the Chronicle API Viewer role

• Click "Save"

Click "Save"

Obtain Account Details

To obtain your Instance Name, do the following:

• Return to the Google Console page of the project your SecOps instance is in

• In the upper left hand corner, open the navigation menu

Open the navigation menu

• Navigate to Security > Detection and Controls > Google SecOps

Navigate to Google SecOps

• In the Google SecOps page, click the carrot next to "Instance Details"

Reveal the Instance Details

• Copy the Customer ID shown for use later in the Dropzone UI where it is called "Instance Name"

Copy the Instance Name

To obtain your Project ID, do the following:

• In the upper left, click on the project icon

Click the project icon

• Using the search bar, locate the project your SecOps instance is in

• Under "ID," copy the ID value shown for use later in the Dropzone UI where it is called "Project ID"

Copy the Project ID

Cloud Identity Mapping

If you want Dropzone to be able to have SOAR access, (e.g. managing cases), you must map the service account to your platform's access control parameters. This will provide the service account with access to SOC Roles and Environments required to perform automated tasks or API operations.

To do Cloud Identity mapping, do the following:

• As an admin, log into your Google SecOps instance

• In the left sidebar, navigate to Settings > SOAR Settings

• Navigate to Advanced > Group Mapping

• Click "+ Add"

• In the IDP/User group field, enter the full service account email address or the workload identity principle string

• Assign the service account the appropriate SOC role and Environments

Dropzone needs read access to all security event data and case/alert content in your tenant, plus the ability to comment on, tag, and change the status of cases and alerts it has been given for investigation.

• Click "Save"

Enable Google SecOps

To enable the Data Source integration, you will need the following information:

Dropzone Field	Source
Instance Name	The "Customer ID" value you copied earlier
Project ID	The "Project ID" value you copied earlier

To enable the Data Source integration, do the following:

• Navigate to your Dropzone AI tenant home page e.g. https://mycompany.dropzone.app

• In the bottom left hand corner, navigate to Settings > Integrations

Integrations Dropdown

• Click "Library"

If you have previously integrated this application, click "Configured"

Click Library

• In the Search bar, search Google Security Operations, then click "Configure"

The Google SecOps Tile

• Under the Data Source heading, input the Instance Name and Project ID

• If you are using Service Account Impersonation, input the Customer-Owned Service Account value

• Input the maximum number of times you want Dropzone to attempt a UDM query if an error occurs

The Google SecOps Data Source Configuration

• Click "Test & Save" to finish

If you have any errors engage your Dropzone AI support representative.