Google Cloud SCC Plugin for Log Shipper

This plugin uses Python libraries to authenticate with the Google Cloud API.

• Library: Google Authentication library for Python (google-auth).
• Usage: Google Authentication library for Python (google-auth) to authenticate to Google APIs.

Create a new session with credentials

self.gcp_scope = ["https://www.googleapis.com/auth/cloud-platform"]

self.creds = (
                service_account.Credentials.from_service_account_info(
                    json.loads(self.configuration["key_file"])
                )
            )
scoped = self.creds.with_scopes(self.gcp_scope)
self.gcp_session = request.AuthorizedSession(scoped)
self.gcp_session.proxies = self.proxy

Google Cloud GET API Request

response = self.gcp_session.get(
                url,
                headers=headers,
                params=params
)

Google Cloud POST API Request

response = self.gcp_session.post(
               url,
               params=param,
               json=data,
               headers=headers
)

Resource Manager API

API Endpoint	Method	Use Case
/v1/projects/{projectId}	GET	Retrieves the Project identified by the specified projectId.

The Base URL https://cloudresourcemanager.googleapis.com is the same for all Resource Manager APIs.

Get Project

API Endpoint: <Base URL>/v1/projects/{projectId}
Method: GET
Sample API Response:

{
  "projectNumber": "",
  "projectId": "",
  "lifecycleState": "ACTIVE",
  "name": "projectName",
  "createTime": "2024-04-04T10:01:07.553347Z",
  "parent": {
    "type": "organization",
    "id": ""
  }
}

Security Command Center APIs

API Endpoint	Method	Use Case
/v1/organizations/{organizationId}/sources/{sourceId}/findings	GET	Lists an organization or source’s findings.
/v1/organizations/{organizationId}/sources/{sourceId}/findings	POST	Creates a finding. The corresponding source must exist for finding creation to succeed.
/v1/organizations{organizationId}/sources/{sourceId}	GET	Get a source.
/v1/organizations/{organizationId}/sources/{sourceId}	POST	Creates a source.

The Base URL https://securitycenter.googleapis.com is the same for all Security Command Center APIs.

List Findings

API endpoint: <Base URL>/v1/organizations/{organizationId}/sources/{sourceId}/findings
Method: GET
Sample API Response:

{
  "listFindingsResults": [
    {
      "finding": {
        "name": "organizations//sources//findings/00087f8800a911ef94c60242c0a8f104",
        "parent": "organizations//sources/",
        "resourceName": "//cloudresourcemanager.googleapis.com/projects/",
        "state": "ACTIVE",
        "category": "ctep",
        "externalUri": "https://drive.google.com/open?id=14WLyjF82rGg",
        "sourceProperties": {
          "cci": "29",
          "timestamp": "1713791120",
          "url": "https://drive.google.com/open?id=14WLyjF82rGg",
          "alert_type": "ctep",
          "tenant_name": "CLS"
        },
        "securityMarks": {
          "name": "organizations//sources//findings/00087f8800a911ef94c60242c0a8f104/securityMarks"
        },
        "eventTime": "2024-04-22T13:05:20Z",
        "createTime": "2024-04-22T13:05:34.141Z",
        "canonicalName": "projects//sources//findings/00087f8800a911ef94c60242c0a8f104",
        "mute": "MUTED",
        "muteUpdateTime": "2024-04-22T13:05:35.371Z",
        "muteInitiator": "Muted by mute rule organizations//muteConfigs/rule8",
        "contacts": {
          "security": {
            "contacts": [
              {
                "email": "systems@abc.com"
              }
            ]
          },
          "technical": {
            "contacts": [
              {
                "email": "systems@abc.com"
              }
            ]
          }
        },
        "parentDisplayName": "test"
      },
      "resource": {
        "name": "//cloudresourcemanager.googleapis.com/projects/",
        "projectName": "//cloudresourcemanager.googleapis.com/projects/",
        "projectDisplayName": "",
        "parentName": "//cloudresourcemanager.googleapis.com/organizations/",
        "parentDisplayName": "abc.com",
        "type": "google.cloud.resourcemanager.Project",
        "displayName": "",
        "cloudProvider": "GOOGLE_CLOUD_PLATFORM",
        "organization": "organizations/",
        "service": "cloudresourcemanager.googleapis.com",
        "resourcePath": {
          "nodes": [
            {
              "nodeType": "GCP_PROJECT",
              "id": "projects/",
              "displayName": ""
            },
            {
              "nodeType": "GCP_ORGANIZATION",
              "id": "organizations/"
            }
          ]
        },
        "resourcePathString": "organizations//projects/"
      }
    }
  ],
  "readTime": "2024-04-22T13:31:00.144Z",
  "nextPageToken": "CsoD3cy7qgAx8Qqf…",
  "totalSize": 22210
}

Create Finding

API endpoint: <Base URL>/v1/organizations/{organizationId}/sources/{sourceId}/findings
Method: POST
Body:

{
  "name": "/findings/00087f8800a911ef94c60242c0a8f104",
  "parent": "",
  "resourceName": "//cloudresourcemanager.googleapis.com/projects/",
  "state": "ACTIVE",
  "category": "ctep",
  "eventTime": "2024-04-10T07:19:30Z",
  "createTime": "2024-04-10T07:19:31.208001Z",
   …
}

Sample API Response:

{
  "name": "organizations//sources//findings/00087f8800a911ef94c60242c0a8f104",
  "parent": "organizations//sources/",
  "resourceName": "//cloudresourcemanager.googleapis.com/projects/",
  "state": "ACTIVE",
  "category": "ctep",
  "securityMarks": {
    "name": "organizations//sources//findings/00087f8800a911ef94c60242c0a8f104/securityMarks"
  },
  "eventTime": "2024-04-10T07:19:30Z",
  "createTime": "2024-04-22T05:46:05.439Z",
  "canonicalName": "projects//sources//locations/global/findings/00087f8800a911ef94c60242c0a8f104",
  "mute": "MUTED",
  "muteUpdateTime": "2024-04-22T05:46:06.580Z",
  "muteInitiator": "Muted by mute rule organizations//muteConfigs/rule8",
  "contacts": {
    "security": {
      "contacts": [
        {
          "email": "systems@crestdatasys.com"
        }
      ]
    },
    "technical": {
      "contacts": [
        {
          "email": "systems@crestdatasys.com"
        }
      ]
    }
  },
  "parentDisplayName": "test"
}

Get a Source

API endpoint: <Base URL>/v1/organizations{organizationId}/sources/{sourceId}
Method: GET
Sample API Response:

{
  "name": "organizations//sources/",
  "displayName": "Source Name",
  "description": "Source description"
}

Create a Source

API Endpoint: <Base URL>/v1/organizations{organizationId}/sources/{sourceId}
Method: POST
Body:

{
  "name": "Name of source",
  "displayName": "Unique name of the source",
  "description": "Description of the source"
}

Sample API Response:

{
  "name": "organizations/<org_id>/sources/<source_id>",
  "displayName": "Unique source Name",
  "description": "Source description"
}