GCP Manual Onboarding Guide - GCP Manual Onboarding Guide

GCP Manual Onboarding Guide
Project Scope
Overview of the onboarding process: Project scope
Prerequisites
P.1 Grant required admin GCP permissions for Cortex onboarding
P.2 Enable necessary APIs in GCP
P.2.1 Enable APIs using Cloud Shell
P.3 Identify and set your target project
Phase 1: Create GCP cloud instance in Cortex
1.1 Start the GCP onboarding wizard
1.1.2 Access the GCP onboarding wizard in Cortex Cloud:
1.1.3 Select the scope
1.1.4 Choose the scan mode
1.1.5 Configure advanced settings
1.2 Download the customized identifiers file
Phase 2: Platform service accounts
2.1 Create the Platform Service Account (Required)
2.2 Grant predefined managed roles to the Platform Service Account (Required)
2.3 Create the Custom Role and grant it to the Platform Service Account (Required)
2.3.1 Create the Custom Role
2.3.2 Grant the Custom Role to the Platform Service Account
2.4 Grant the Service Account Token Creator role to the Outpost Service Account (Required)
2.5 Agentless Disk Scanning (ADS) (Optional)
2.5.1 Create the ADS Connector Role
2.5.2 Grant the ADS Connector role to the Platform Service Account
2.5.3 Create the ADS Outpost role
2.5.4 Grant the ADS Outpost role to the Outpost Service Account
2.6 Automation (Optional)
2.6.1 Create the Automation role
2.6.2 Grant the Automation role to the Platform Service Account
2.7 DSPM: Platform Service Account (Optional)
2.7.1 Create the DSPM Connector role
2.7.2 Grant the DSPM Connector role to the Platform Service Account
Phase 3: Scanner Service Account
3.1 Create the Scanner Service Account (Required)
3.2 Grant the Viewer role to the Scanner Service Account (Required)
3.3 DSPM: Scanner Service Account (Optional)
3.3.1 Create the DSPM Outpost role
3.3.2 Grant the DSPM Outpost role to the Outpost Service Account
3.3.3 Create the DSPM Scanner Connector role
3.3.4 Grant the DSPM Scanner Connector role to the Scanner Service Account
3.3.5 Grant the Storage Object Viewer role to the Scanner Service Account
3.3.6 Grant the Service Account Token Creator role to the DSPM Scanner Service Account
3.4 Registry Scanning (Optional)
3.4.1 Create the Registry Scanner role
3.4.2 Grant the Registry Scanner role to the Scanner Service Account
3.4.3 Grant the Service Account Token Creator role to the Registry Scanner Service Account
3.5 Serverless Scanning (Optional)
3.5.1 Create the Serverless Scanner role
3.5.2 Grant the Serverless Scanner role to the Scanner Service Account
3.5.3 Grant the Service Account Token Creator role to the Serverless Scanner Service Account
Phase 4: Audit Logs
4.1 Create a Pub/Sub Topic to collect and stream audit logs
4.2 Create a Pub/Sub Subscription for the audit log topic
4.3 Create a Logging Sink to export audit logs to your Pub/Sub topic
4.3.1 Retrieve the Writer Identity (Service Account) generated for your new Logging Sink
4.4 Grant the Pub/Sub Publisher role to the Writer Identity
4.5 Create the Audit Logs Service Account
4.6 Grant the Pub/Sub Subscriber role to the Audit Service Account
4.7 Grant the Service Account Token Creator role to the SaaS Collector Service Account
Phase 5: Complete the GCP onboarding wizard in Cortex
5.1 Enter the GCP scope details and service accounts in Cortex
5.1.2 Automated upload
5.1.3 Manual configuration
5.2 Complete onboarding
5.2.1 Troubleshooting
Configuration values reference
Folder Scope
Overview of the onboarding process: Folder scope
Prerequisites: Folder scope
P.1 Grant required admin GCP permissions for Cortex onboarding
P.2 Enable necessary APIs in GCP
P.2.1 Enable APIs using Cloud Shell
P.3 Identify and set your host project
Phase 1: GCP onboarding wizard
1.1 Start the GCP onboarding wizard
1.1.1 Access the GCP onboarding wizard in Cortex Cloud:
1.1.2 Select the GCP environment
1.1.3 Select the scope
1.1.4 Choose the scan mode
1.1.5 Configure advanced settings
1.2 Download the customized identifiers file
Phase 2: Platform service accounts
2.1 Create the Platform Service Account (Required)
2.2 Grant predefined managed roles to the Platform Service Account (Required)
2.3 Create the Custom Role and grant it to the Platform Service Account (Required)
2.3.1 Create the Custom Role
2.3.2 Grant the Custom Role to the Platform Service Account
2.4 Grant the Service Account Token Creator role to the Outpost Service Account (Required)
2.5 Agentless Disk Scanning (ADS) (Optional)
2.5.1 Create the ADS Connector Role
2.5.2 Grant the ADS Connector role to the Platform Service Account
2.5.3 Create the ADS Outpost role
2.5.4 Grant the ADS Outpost role to the Outpost Service Account
2.6 Automation (Optional)
2.6.1 Create the Automation role
2.6.2 Grant the Automation role to the Platform Service Account
2.7 DSPM: Platform Service Account (Optional)
2.7.1 Create the DSPM Connector role
2.7.2 Grant the DSPM Connector role to the Platform Service Account
Phase 3: Scanner Service Account
3.1 Create the Scanner Service Account (Required)
3.2 Grant the Viewer role to the Scanner Service Account (Required)
3.3 DSPM: Scanner Service Account (Optional)
3.3.1 Create the DSPM Outpost role
3.3.2 Grant the DSPM Outpost role to the Outpost Service Account
3.3.3 Create the DSPM Scanner Connector role
3.3.4 Grant the DSPM Scanner Connector role to the Scanner Service Account
3.3.5 Grant the Storage Object Viewer role to the Scanner Service Account
3.3.6 Grant the Service Account Token Creator role to the DSPM Scanner Service Account
3.4 Registry Scanning (Optional)
3.4.1 Create the Registry Scanner role
3.4.2 Grant the Registry Scanner role to the Scanner Service Account
3.4.3 Grant the Service Account Token Creator role to the Registry Scanner Service Account
3.5 Serverless Scanning (Optional)
3.5.1 Create the Serverless Scanner role
3.5.2 Grant the Serverless Scanner role to the Scanner Service Account
3.5.3 Grant the Service Account Token Creator role to the Serverless Scanner Service Account
Phase 4: Audit Logs
4.1 Create a Pub/Sub Topic to collect and stream audit logs
4.2 Create a Pub/Sub Subscription for the audit log topic
4.3 Create a Logging Sink to export audit logs to your Pub/Sub topic
4.3.1 Retrieve the Writer Identity (Service Account) generated for your new Logging Sink
4.4 Grant the Pub/Sub Publisher role to the Writer Identity
4.5 Create the Audit Logs Service Account
4.6 Grant the Pub/Sub Subscriber role to the Audit Service Account
4.7 Grant the Service Account Token Creator role to the SaaS Collector Service Account
Phase 5: Complete the GCP onboarding wizard in Cortex
5.1 Enter the GCP scope details and service accounts in Cortex
5.1.2 Automated upload
5.1.3 Manual configuration
5.2 Complete onboarding
5.2.1 Troubleshooting
Configuration values reference
Organization Scope
Overview of the onboarding process
Prerequisites
Identify and set your host project
P.1 Grant required admin GCP permissions for Cortex onboarding
P.2 Enable necessary APIs in GCP
P.2.1 Enable APIs using Cloud Shell
P.3 Identify and set your host project
Phase 1: GCP onboarding wizard
1.1 Start the GCP onboarding wizard
1.1.1 Access the GCP onboarding wizard in Cortex Cloud:
1.1.2 Select the GCP environment
1.1.3 Select the scope
1.1.4 Choose the scan mode
1.1.5 Configure advanced settings
1.2 Download the customized identifiers file
Phase 2: Platform service accounts
2.1 Create the Platform Service Account (Required)
2.2 Grant predefined managed roles to the Platform Service Account (Required)
2.3 Create the Custom Role and grant it to the Platform Service Account (Required)
2.3.1 Create the Custom Role
2.3.2 Grant the Custom Role to the Platform Service Account
2.4 Grant the Service Account Token Creator role to the Outpost Service Account (Required)
2.5 Agentless Disk Scanning (ADS) (Optional)
2.5.1 Create the ADS Connector Role
2.5.2 Grant the ADS Connector role to the Platform Service Account
2.5.3 Create the ADS Outpost role
2.5.4 Grant the ADS Outpost role to the Outpost Service Account
2.6 Automation (Optional)
2.6.1 Create the Automation role
2.6.2 Grant the Automation role to the Platform Service Account
2.7 DSPM: Platform Service Account (Optional)
2.7.1 Create the DSPM Connector role
2.7.2 Grant the DSPM Connector role to the Platform Service Account
Phase 3: Scanner Service Account
3.1 Create the Scanner Service Account (Required)
3.2 Grant the Viewer role to the Scanner Service Account (Required)
3.3 DSPM: Scanner Service Account (Optional)
3.3.1 Create the DSPM Outpost role
3.3.2 Grant the DSPM Outpost role to the Outpost Service Account
3.3.3 Create the DSPM Scanner Connector role
3.3.4 Grant the DSPM Scanner Connector role to the Scanner Service Account
3.3.5 Grant the Storage Object Viewer role to the Scanner Service Account
3.3.6 Grant the Service Account Token Creator role to the DSPM Scanner Service Account
3.4 Registry Scanning (Optional)
3.4.1 Create the Registry Scanner role
3.4.2 Grant the Registry Scanner role to the Scanner Service Account
3.4.3 Grant the Service Account Token Creator role to the Registry Scanner Service Account
3.5 Serverless Scanning (Optional)
3.5.1 Create the Serverless Scanner role
3.5.2 Grant the Serverless Scanner role to the Scanner Service Account
3.5.3 Grant the Service Account Token Creator role to the Serverless Scanner Service Account
Phase 4: Audit Logs
4.1 Create a Pub/Sub Topic to collect and stream audit logs
4.2 Create a Pub/Sub Subscription for the audit log topic
4.3 Create a Logging Sink to export audit logs to your Pub/Sub topic
4.3.1 Retrieve the Writer Identity (Service Account) generated for your new Logging Sink
4.4 Grant the Pub/Sub Publisher role to the Writer Identity
4.5 Create the Audit Logs Service Account
4.6 Grant the Pub/Sub Subscriber role to the Audit Service Account
4.7 Grant the Service Account Token Creator role to the SaaS Collector Service Account
Phase 5: Complete the GCP onboarding wizard in Cortex
5.1 Enter the GCP scope details and service accounts in Cortex
5.1.2 Automated upload
5.1.3 Manual configuration
5.2 Complete onboarding
5.2.1 Troubleshooting
Configuration values reference

Back to home page