Prerequisites to Configure the Google Security Operations Cloud Collector

Before you configure the Google Security Operations Cloud Collector, complete the following prerequisites.

Get administrative rights – Ensure that you have administrative access to manage your Google Cloud Platform and Google Security Operations (SecOps) platform.
Add accounts for Google cloud collectors.
Obtain a Service Credentials JSON file – Create a JSON key for Google Security Operations GCP project. You must enter the JSON file content in the SERVICE CREDENTIALS JSON field while adding a new Google Service account during the Cloud Collector configuration.
Provide Chronicle API Admin role to the Service Account. For more information about service accounts, see Creating and managing service accounts in the Google documentation.
Obtain Project Number, GCP Project Region, GCP Project ID, and Customer ID..

Use the following steps to obtain the project number, GCP project region, GCP project IS and the customer ID.

On the Google Security Operations (SecOps) console, navigate to Settings > SIEM Settings > Profile.
Record the Customer ID, GCP Project Number, and GCP Project ID from the Profile page. Use this information while configuring the Google Security Operations Cloud Collector.

Use the following steps to create a service account and obtain a project ID.

To create a service account in the project in which the Pub/Sub subscription has been created, in the Google Cloud console, navigate to IAM & Admin > Service Accounts > CREATE SERVICE ACCOUNT page.
Select a Cloud project if you already created a project. If not, create a Cloud project.
Enter the project name and edit the automatically generated project ID. Note the Project ID that you set while creating the Google service account. You require to use the project ID while configuring the Cloud Collector.
For more information and relevant steps, see Creating and managing service accounts in the Google documentation.

CollectorsCloud Collectors Administration Guide