Ingest Cloud Assets from Google Cloud Platform - Administrator Guide - Cortex XDR - Cortex XSIAM - Cortex - Security Operations

Open the GCP wizard in Cortex XDR.

1. Select Settings → Configurations → Data Collection → Collection Integrations.

2. In the Cloud Inventory configuration, click Add Instance to begin a new configuration.

3. Click Google Cloud Platform.

Define the Configure Account screen of the wizard.

Setting the connection parameters on the right-side of the screen is dependent on certain configurations in GCP as explained below.

1. Select the Organization Level as either Project (default), Folder, or Organization. The Organization Level that you select changes the instructions.

2. Register your application for Cloud Asset API in Google Cloud Platform, Select a project where your application will be registered, and click Continue.

   

   The Cloud Asset API is enabled.

   

3. Click Continue to open the GCP Cloud Console.

4. On the main menu, select the project menu.

5. In the window that opens, perform the following.

   

   1. From the Select from menu, select the organization that you want.

   2. The next steps to perform in Google Cloud Platform are dependent on the Organizational Level you selected in Cortex XDR - Project, Folder, or Organization.

      • Project or Folder Organization Level—In the table, copy one of the following IDs that you want to configure and paste it in the designated field in the Configure Account screen in Cortex XDR . The field in Cortex XDR is dependent on the Organizational Level you selected.

        -Project—Contains a project icon () beside it, and the ID should be pasted in the Project ID field in Cortex XDR.

        -Folder—Contains a folder icon () beside it, and the ID should be pasted in the Folder ID field in Cortex XDR.

        When you are finished, click CANCEL to close the window.

      • Organization is the Organization Level—Select the ellipsis icon () → Settings. In the Settings page, copy the Organization ID for the applicable organization that you want to configure and paste it in the Organization Id field in the Configure Account screen in Cortex XDR.

        

6. Select the Hamburger menu → Storage → Cloud Storage → Browser.

   

7. You can either use an existing bucket from the list or create a new bucket. Copy the Name of the bucket and paste it in the Bucket Name field in the Configure Account screen in Cortex XDR.

8. Define the following remaining connection parameters in the Configure Account screen in Cortex XDR.

   • Bucket Directory Name—You can either leave the default directory as Exported-Assets or define a new directory name that will be created for the exported assets collected for the bucket configured in GCP.

   • Cortex XDR Collection Name—Specify a name for your Cortex XDR collection that is displayed underneath the Cloud Inventory configuration for this GCP collection.

9. Click Next.

Define the Account Details screen of the wizard.

1. Download the Terraform script. The name of the file downloaded is dependent on the Organizational Level that you configured in the Configure Account screen of the wizard.

   • Folder—cortex-xdr-gcp-folder-ro.tf

   • Project—cortex-xdr-gcp-project-ro.tf

   • Organization—cortex-xdr-gcp-organization-ro.tf

2. Login to the Google Cloud Shell.

   

3. Click Continue to open the Cloud Shell Editor.

   

4. Select File → Open, and Open the Terraform script that you downloaded from Cortex XDR.

5. Use the following commands to upload the Terraform script, which you can copy from the Account Details screen in Cortex XDR using the copy icon ().

   1. terraform init—Initializes the Terraform script. You need to wait until the initialization is complete before running the next command as indicated in the image below.