Skip to main content

Responses are generated using AI and may contain mistakes.

CollectorsGet Started with Collector Onboarding

Table of Contents

Prerequisites to Configure the Google Alert Center Cloud Collector

Before you configure the Google Alert Center cloud collector, complete the following prerequisites.

Create a Service Account and Obtain a Project ID

  1. To create a service account in the project in which the Pub/Sub subscription has been created, in the Google Cloud console, navigate to IAM & Admin > Service Accounts > CREATE SERVICE ACCOUNT page.

  2. Select a Cloud project if you already created a project. If not, create a Cloud project.

  3. Enter the project name and edit the automatically generated project ID. Note the Project ID that you set while creating the Google service account. You require to use the project ID while configuring the Cloud Collector.

  4. For more information and relevant steps, see Creating and managing service accounts in the Google documentation.

Obtain the Service Credentials JSON File

The GCP APIs are authenticated via a service account. You must obtain the service credentials JSON with the API key that you can use while configuring the GCP connector.

To obtain the service credentials JSON file:

  1. To create the service account key, in the Google cloud console, navigate to the APIs & Services > Credentials.

  2. In the Credentials section, click Create Credentials then click Service account.

  3. Specify the account name and description.

  4. Select the roles Logs Viewer and Private Logs Viewer.

  5. Click DONE.

  6. On the Service Accounts list page, click the name of the account that you created.

  7. Navigate to Keys > Add Key > Create New Key.

  8. In the Key type section, select JSON.

  9. Click Create. A JSON file is downloaded. For more information see the Google Cloud documentation.

  10. Save the JSON file at a secure location to use while configuring the GCP connector. Copy the JSON file contents to se it while creating a sharable Google account.

Authorize the Google Alert Center Cloud Collector to Retrieve Events

For Service-Account authentication, a G Suite administrator will need to create a file (called Service-Credentials-Json) that authorizes the Google Alert Center Cloud Collector (or anyone else who possess it) to communicate with the G Suite account and retrieve relevant logs, events and data for the security monitoring.

To create the Service-Credentials-Json JSON file, ask the G Suite administrator to follow the instructions mentioned here Create a Service-Credentials-Json File for the Google Alert Center Cloud Collector.

Use your preferred secured method of transport to send the JSON file to the Exabeam Cloud Collectors administrator to configure the Google Alert Center Cloud Collector.

Create a Service-Credentials-Json File for the Google Alert Center Cloud Collector

If you use the service-account authentication method, you need to set up communication between the cloud collector and the G-Suite account. To facilitate communication and enable to retrieve audit events, you must create a service-credentials-json file.

Note

To use the service account you are required to have a Domain-Wide Delegation of Authority. Since you need this delegation of authority to read reports about admin activity, the user, whose authority is being used, must have super-admin privileges to view admin report activity and read user and groups information. The service account is still bound by the permissions granted and thus cannot perform any action other than read access on the specified scopes.

To create the JSON file, use the following steps.

  1. Log in to the Google Cloud Console with an account that has super-admin permissions.

  2. Create a new project or select an existing project by navigating to Select a Project > New Project.

  3. Enter a project name and click Create.

  4. Use the following steps to enable the Admin SDK API. Each project uses its own set of APIs. To use service-account authentication with the Google Workspace Cloud Collector, you must enable the Admin SDK API for your project.

    1. Navigate to APIs & Services > Library.

    2. Search for Admin SDK API using the search box and click Admin SDK API.

    3. Click Enable.

  5. Create the service account and enable Domain-wide Delegation.

    1. Navigate to IAM & Admin > Service Accounts.

    2. Click Create Service Account and enter a name and description for the account.

    3. Click Create and Continue.

    4. Click Done. Granting roles to the service account to define its permissions is optional. No specific role is required for domain-wide delegation.

    5. Note the email address for the service account. For more information, see Service account credentials section in the Google Workspace Documentation.

    6. On the Service accounts page, find and click the email address of the service account you just created.

    7. Expand Show advanced settings.

    8. Under Show domain-wide delegation, select the check box for Enable Google Workspace Domain-wide Delegation.

    9. Copy the Client ID which is a unique ID represented by a long numeric string. Record the client ID for later use.

  6. Create a JSON Key.

    1. On the Service Accounts page of your project, navigate to Keys > Add Key.

    2. Click Create new key.

    3. Select JSON as the key type and click Create.

      The JSON file containing the private key is downloaded.

    4. Save the downloaded JSON file in a secure folder.

  7. Configure Domain-Wide Delegation Scopes in Google Workspace Admin Console.

    To configure domain-wide delegation scopes in the Google Workspace Admin Console, ensure that you log in as a Super Administrator.

    1. On the Google Admin Console and navigate to Security > Access and data control > API controls.

    2. In the Domain wide delegation pane, click Manage Domain Wide Delegation.

    3. Click Add new.

    4. Enter the Client ID of your service account. You obtained this unique ID from your service account by navigating to IAM & Admin > Service Accounts.

    5. In OAuth scopes, enter the following comma-separated list of the specific API scopes that your application requires.

      https://www.googleapis.com/auth/apps.alerts

    6. Click Authorize.

      Note

      While configuring the Google Alert Center Cloud Collector, you must provide the email address of a Google Workspace super-admin user. The service account impersonate this email address via domain-wide delegation.

      This email serves as the API call "subject"; if this email is not specified, the collector encounters a 401 Unauthorized error. Additionally, note that the super-admin account is required for Google Workspace and not for GCP.