- Connector Migration Overview
- Cloud Collectors Overview
- Navigate the Cloud Collectors UI
- Which Collector to Use?
- Hybrid Deployment Experience
- Supported Regions for Cloud Collectors
- Access the Cloud Collectors Service
- Set up a New Cloud Connectors Instance
- Early Access Cloud Collectors
- Troubleshooting Cloud Collectors
Prerequisites to Configure Google Context Cloud Collector
Before you configure the Google Context Cloud Collector you must complete the following prerequisites:
Make sure a person with G Suite super-admin rights is present when onboarding the Google Context Cloud Collector.
Verify your Google Workspace edition is either Business or Enterprise. Your G Suite administrator can verify the edition type in the Billing tab of the Google Apps admin console. For more information about the Google Apps for Work editions access https://workspace.google.com/pricing.html.
Enable API access. As a G Suite administrator, navigate to Security > Access and data control > API controls in the Google Apps admin console.
Prepare an authorization file for use during the collector configuration for Service account authentication, as a G Suite administrator. For more information, see Authorize the Google Context Cloud Collector to Retrieve Events, and Create a Service-Credentials-Json File for the Google Workspace Cloud Collector.
Add Context-Aware Access (CAA) in Google Workspace.
Authorize the Google Context Cloud Collector to Retrieve Events
For Service-Account authentication, a G Suite administrator will need to create a file (called Service-Credentials-Json) that authorizes the Google Context Cloud Collector (or anyone else who possess it) to communicate with the G Suite account and retrieve relevant logs, events and data for the security monitoring.
To create the Service-Credentials-Json JSON file, ask the G Suite administrator to follow the instructions mentioned here Create a Service-Credentials-Json File for the Google Workspace Cloud Collector .
Use your preferred secured method of transport to send the JSON file to the Exabeam Cloud Collectors administrator to configure the Google Context Cloud Collector.
Create a Service-Credentials-Json File for the Google Workspace Cloud Collector
If you use the service-account authentication method, you need to set up communication between the cloud collector and the G-Suite account. To facilitate communication and enable to retrieve audit events, you must create a service-credentials-json file.
Note
To use the service account you are required to have a Domain-Wide Delegation of Authority. Since you need this delegation of authority to read reports about admin activity, the user, whose authority is being used, must have super-admin privileges to view admin report activity and read user and groups information. The service account is still bound by the permissions granted and thus cannot perform any action other than read access on the specified scopes.
To create the JSON file, use the following steps.
Note
While configuring the Google Workspace Cloud Collector, you must provide the email address of a Google Workspace super-admin user. The service account impersonate this email address via domain-wide delegation.
This email serves as the API call "subject"; if this email is not specified, the collector encounters a 401 Unauthorized error. Additionally, note that the super-admin account is required for Google Workspace and not for GCP.
Log in to the Google Cloud Console with an account that has super-admin permissions.
Create a new project or select an existing project by navigating to Select a Project > New Project.
Enter a project name and click Create.
Use the following steps to enable the Admin SDK API. Each project uses its own set of APIs. To use service-account authentication with the Google Workspace Cloud Collector, you must enable the Admin SDK API for your project.
Navigate to APIs & Services > Library.
Search for
Admin SDK APIusing the search box and clickAdmin SDK API.Click Enable.
Create the service account and enable Domain-wide Delegation.
Navigate to IAM & Admin > Service Accounts.
Click Create Service Account and enter a name and description for the account.
Click Create and Continue.
Click Done. Granting roles to the service account to define its permissions is optional. No specific role is required for domain-wide delegation.
Note the email address for the service account. For more information, see Service account credentials section in the Google Workspace Documentation.
On the Service accounts page, find and click the email address of the service account you just created.
Expand Show advanced settings.
Under Show domain-wide delegation, select the check box for Enable Google Workspace Domain-wide Delegation.
Copy the Client ID which is a unique ID represented by a long numeric string. Record the client ID for later use.
Create a JSON Key.
On the Service Accounts page of your project, navigate to Keys > Add Key.
Click Create new key.
Select JSON as the key type and click Create.
The JSON file containing the private key is downloaded.
Save the downloaded JSON file in a secure folder.
Configure Domain-Wide Delegation Scopes in Google Workspace Admin Console.
To configure domain-wide delegation scopes in the Google Workspace Admin Console, ensure that you log in as a Super Administrator.
On the Google Admin Console and navigate to Security > Access and data control > API controls.
In the Domain wide delegation pane, click Manage Domain Wide Delegation.
Click Add new.
Enter the Client ID of your service account. You obtained this unique ID from your service account by navigating to IAM & Admin > Service Accounts.
In OAuth scopes, enter the following comma-separated list of the specific API scopes that your application requires.
https://www.googleapis.com/auth/admin.directory.group.readonly,https://www.googleapis.com/auth/admin.directory.user.readonly,https://www.googleapis.com/auth/admin.directory.rolemanagement.readonly,https://www.googleapis.com/auth/admin.directory.orgunit.readonly,https://www.googleapis.com/auth/admin.reports.audit.readonly,https://www.googleapis.com/auth/admin.reports.usage.readonly,https://www.googleapis.com/auth/apps.alerts
Click Authorize.
Add Context-Aware Access (CAA) in Google Workspace
To add Context-Aware Access (CAA) in Google Workspace, first define the context rules, then assign the context rules to specific applications.
Use the following steps to add Context-Aware Access (CAA) in Google Workspace.
Set Access Levels
By defining the access levels, specify certain security requirements users should meet, such as connecting from an authorized IP range or using an encrypted device.
Log in to the Google Cloud Console with an account that has super-admin permissions.
Navigate to Security > Access and data control > Context-Aware Access.
Click Assign Access Levels.
Click Create Access Level and enter a name and description.
Add the required attributes in the basic mode and define access levels in the advanced mode using Common Expression Language (CEL).
For more information, see Create Context-Aware access levels in Google documentation.
Click Save.
Assign Access Levels
After you set the Context-Aware Access levels (rules), apply the access levels to the applications you want to protect.
Log in to the Google Cloud Console with an account that has super-admin permissions.
Navigate to Security > Access and data control > Context-Aware Access.
Click Assign Access Levels.
Select a specific application and select the Organizational Unit or Configuration Group for the assignment.
Select the action Monitor to assign access level without blocking users or Active to enforce the access levels or rules and block non-compliant access.
For more information, see Assign Context-Aware Access levels to apps in Google documentation.
Note
While setting access levels and rules for admin console, to prevent a permanent lockout, ensure that you have a a backup Super Admin account, and apply levels or rules to a specific Security Group and not the entire organization at once. Double-check the Access Levels.
Click Save.