Project Google Cloud berfungsi sebagai lapisan kontrol untuk instance Google SecOps yang ditautkan. Cloud Audit Logs menyimpan data khusus pelanggan seperti
telemetri keamanan, log audit, pemberitahuan penyerapan, dan informasi sensitif
tingkat instance lainnya.
Bagian berikut menjelaskan cara mengonfigurasi project Google Cloud Anda.
Prasyarat
Setiap instance Google SecOps baru harus ditautkan ke satu projectGoogle Cloud . Anda dapat menautkan ke project Google Cloud yang sudah ada atau
membuat project baru, bergantung pada penyiapan dan persyaratan organisasi Anda:
Sebaiknya buat project Google Cloud baru khusus untuk setiap instance Google SecOps. Pendekatan ini membantu mengisolasi data audit dan telemetri keamanan sensitif yang khusus untuk instance SecOps Google.
Jika Anda menautkan instance Google SecOps ke projectGoogle Cloud yang ada, tinjau izin dan batasan yang ada yang dapat memengaruhi perilaku atau akses instance.
Mengonfigurasi Kontak Penting untuk menerima notifikasi yang ditargetkan dari
Google Cloud. Lakukan langkah-langkah di
Mengelola kontak untuk notifikasi.
Akun layanan baru di project Anda
Akun layanan baru ditambahkan ke project Anda. Akun layanan dikelola oleh Google SecOps dan memiliki atribut berikut:
Pola penamaan akun layanan adalah sebagai berikut, dengan PROJECT_NUMBER yang unik untuk project:
Untuk melihat detail izin IAM, lakukan langkah berikut:
Buka halaman IAM di Google Cloud project Anda.
Di kanan atas, centang kotak Include Google-provided role grants.
Jika Anda tidak melihat akun layanan baru, periksa apakah tombol
Sertakan pemberian peran yang disediakan Google diaktifkan di halaman IAM.
Langkah berikutnya
Setelah menyelesaikan langkah-langkah dalam dokumen ini, lakukan hal berikut:
Terapkan kontrol keamanan dan kepatuhan pada project untuk memenuhi kasus penggunaan bisnis dan kebijakan organisasi Anda. Untuk mengetahui informasi selengkapnya tentang cara melakukannya, lihat dokumentasi Assured Workloads.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-08-21 UTC."],[[["\u003cp\u003eGoogle SecOps is bound to a single Google Cloud project within your organization, creating a control layer for managing access and data.\u003c/p\u003e\n"],["\u003cp\u003eThe designated Google Cloud project stores sensitive security telemetry, and it is recommended to use a new project for this purpose, although an existing one can be used with awareness of potential permission impacts.\u003c/p\u003e\n"],["\u003cp\u003eTo enable Google SecOps functionality, you must enable the Chronicle API in the designated Google Cloud project and configure Essential Contacts for notifications.\u003c/p\u003e\n"],["\u003cp\u003eThe project allows you to set up permissions for Google SecOps to access Chronicle APIs and handle the read and write of data.\u003c/p\u003e\n"],["\u003cp\u003eThe logs produced by Google SecOps are written to the designated Google Cloud Project, incurring Cloud Logging costs.\u003c/p\u003e\n"]]],[],null,["# Configure a Google Cloud project for Google SecOps\n==================================================\n\nSupported in: \nGoogle secops [SIEM](/chronicle/docs/secops/google-secops-siem-toc)\n\nA Google Cloud project acts as a control layer for the linked\nGoogle SecOps instance. It stores customer-specific data such as\nsecurity telemetry, audit logs, ingestion alerts, and other sensitive\ninstance-level information.\n\nThe following sections describe how to configure your Google Cloud project.\n\nPrerequisites\n-------------\n\nEach new Google SecOps instance should be linked to a single\nGoogle Cloud project. You can either link to an existing Google Cloud project or\ncreate a new one, depending on your organizational setup and requirements:\n\n- We recommend creating a new, dedicated Google Cloud project for each\n Google SecOps instance. This approach helps isolate sensitive\n security telemetry and audit data specific to the\n Google SecOps instance.\n\n To create a new Google Cloud project, see\n [Create a Google Cloud project](/chronicle/docs/onboard#create-gcp-project).\n- If you link your Google SecOps instance to an existing\n Google Cloud project, review any existing permissions and restrictions that\n could affect the instance's behavior or access.\n\n For details, see [Grant permissions to the Google SecOps instance](/chronicle/docs/onboard#grant-permissions).\n\nConfigure a Google Cloud project\n--------------------------------\n\nThe following sections describe how to enable the Chronicle API in the Google Cloud project and configure Essential Contacts.\n\n### Enable the Chronicle API in the Google Cloud project\n\nTo allow the Google SecOps instance to read from and write to the\nlinked Google Cloud project, do the following:\n\n1. Go to the **Manage resources** page in the Google Cloud console.\n\n [Go to the Manage Resources page](https://console.cloud.google.com/cloud-resource-manager)\n2. At the top, click the **Project picker** and select your **Organization** resource.\n3. Select the newly created project.\n4. Go to **APIs \\& Services**.\n5. Click **+ ENABLE APIS AND SERVICES**.\n6. Search for **Chronicle API** and select it.\n7. Click **Enable** to enable the Chronicle API for the project.\n\nFor more detail, see [Enabling an API in your Google Cloud project](/endpoints/docs/openapi/enable-api).\n\n### Configure Essential Contacts\n\nConfigure Essential Contacts to receive targeted notifications from\nGoogle Cloud. Perform the steps in\n[Managing contacts for notifications](/resource-manager/docs/managing-notification-contacts).\n\nNew service account in your project\n-----------------------------------\n\nA new service account is added to your project. The service account is managed\nby Google SecOps and has following attributes:\n\n- The service account naming pattern is as follows, where the `PROJECT_NUMBER` is unique to the project:\n\n `service-`\u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e`@gcp-sa-chronicle.iam.gserviceaccount.com`\n- The account has the **Chronicle Service Agent** role.\n\n- An IAM permission is granted to the project.\n\n To see details of the IAM permission, do the following:\n 1. Go to the **IAM** page of your Google Cloud project.\n 2. At the top right, select the **Include Google-provided role grants** checkbox.\n\n If you don't see the new service account, check that the\n **Include Google-provided role grants** button is enabled on the IAM page.\n\nWhat's next\n-----------\n\nAfter completing the steps in this document, perform the following:\n\n- Apply security and compliance controls to the project to satisfy your business\n use case and organization policies. For more information about how to do this,\n see the [Assured Workloads documentation](/assured-workloads/docs/overview).\n\n | **Note:** Compliance restrictions required by your Google Cloud organization are not applied by default. You must configure them manually.\n- Integrate your Google SecOps instance with an Identity Provider\n (IdP), either [Cloud identity](/chronicle/docs/onboard/configure-cloud-authentication) or a\n [third-party identity provider](/chronicle/docs/onboard/configure-authentication).\n\n- The Google Cloud project serves as a control layer for you to do the\n following:\n\n - Enable, inspect, and manage access to audit logs generated by Google SecOps and stored in Cloud Audit Logs.\n - Set up custom ingestion outage alerts using Cloud Monitoring.\n - Store exported historical data.\n\n Enable Google SecOps audit logging by following the steps in\n [Google Security Operations audit logging information](/chronicle/docs/preview/audit-logging/audit-logging).\n Google SecOps writes Data Access and Admin Activity logs to the project.\n | **Note:** You cannot disable Data Access logging using the Google Cloud console. To request to disable it, contact your Google SecOps representative.\n | **Important:** If audit logging was previously enabled using the steps in the Google SecOps audit logging guide, when you complete the steps in this document, the log output redirects to the new Google Security Operations-bound project.\n\n**Need more help?** [Get answers from Community members and Google SecOps professionals.](https://security.googlecloudcommunity.com/google-security-operations-2)"]]
