Um projeto Google Cloud atua como uma camada de controle para a instância vinculada do Google SecOps. Ele armazena dados específicos do cliente, como telemetria de segurança, registros de auditoria, alertas de ingestão e outras informações sensíveis no nível da instância.
As seções a seguir descrevem como configurar seu projeto do Google Cloud .
Pré-requisitos
Cada nova instância do Google SecOps precisa ser vinculada a um único projetoGoogle Cloud . É possível vincular a um projeto Google Cloud existente ou
criar um novo, dependendo da configuração e dos requisitos da organização:
Recomendamos criar um projeto Google Cloud dedicado para cada instância do Google SecOps. Essa abordagem ajuda a isolar dados de telemetria e auditoria de segurança sensíveis específicos da instância do Google SecOps.
Se você vincular sua instância do Google SecOps a um projeto do
Google Cloud , revise as permissões e restrições atuais que
podem afetar o comportamento ou o acesso da instância.
A conta tem o papel de Agente de serviço do Chronicle.
Uma permissão do IAM é concedida ao projeto.
Para conferir os detalhes da permissão do IAM, faça o seguinte:
Acesse a página IAM do seu Google Cloud projeto.
No canto superior direito, marque a caixa de seleção Incluir concessões de papel fornecidas pelo Google.
Se a nova conta de serviço não aparecer, verifique se o botão Incluir concessões de papel fornecidas pelo Google está ativado na página do IAM.
A seguir
Depois de concluir as etapas deste documento, faça o seguinte:
Aplique controles de segurança e compliance ao projeto para atender ao seu caso de uso comercial e às políticas da organização. Para mais informações sobre como fazer isso,
consulte a documentação do Assured Workloads.
[[["Fácil de entender","easyToUnderstand","thumb-up"],["Meu problema foi resolvido","solvedMyProblem","thumb-up"],["Outro","otherUp","thumb-up"]],[["Difícil de entender","hardToUnderstand","thumb-down"],["Informações incorretas ou exemplo de código","incorrectInformationOrSampleCode","thumb-down"],["Não contém as informações/amostras de que eu preciso","missingTheInformationSamplesINeed","thumb-down"],["Problema na tradução","translationIssue","thumb-down"],["Outro","otherDown","thumb-down"]],["Última atualização 2025-08-21 UTC."],[[["\u003cp\u003eGoogle SecOps is bound to a single Google Cloud project within your organization, creating a control layer for managing access and data.\u003c/p\u003e\n"],["\u003cp\u003eThe designated Google Cloud project stores sensitive security telemetry, and it is recommended to use a new project for this purpose, although an existing one can be used with awareness of potential permission impacts.\u003c/p\u003e\n"],["\u003cp\u003eTo enable Google SecOps functionality, you must enable the Chronicle API in the designated Google Cloud project and configure Essential Contacts for notifications.\u003c/p\u003e\n"],["\u003cp\u003eThe project allows you to set up permissions for Google SecOps to access Chronicle APIs and handle the read and write of data.\u003c/p\u003e\n"],["\u003cp\u003eThe logs produced by Google SecOps are written to the designated Google Cloud Project, incurring Cloud Logging costs.\u003c/p\u003e\n"]]],[],null,["# Configure a Google Cloud project for Google SecOps\n==================================================\n\nSupported in: \nGoogle secops [SIEM](/chronicle/docs/secops/google-secops-siem-toc)\n\nA Google Cloud project acts as a control layer for the linked\nGoogle SecOps instance. It stores customer-specific data such as\nsecurity telemetry, audit logs, ingestion alerts, and other sensitive\ninstance-level information.\n\nThe following sections describe how to configure your Google Cloud project.\n\nPrerequisites\n-------------\n\nEach new Google SecOps instance should be linked to a single\nGoogle Cloud project. You can either link to an existing Google Cloud project or\ncreate a new one, depending on your organizational setup and requirements:\n\n- We recommend creating a new, dedicated Google Cloud project for each\n Google SecOps instance. This approach helps isolate sensitive\n security telemetry and audit data specific to the\n Google SecOps instance.\n\n To create a new Google Cloud project, see\n [Create a Google Cloud project](/chronicle/docs/onboard#create-gcp-project).\n- If you link your Google SecOps instance to an existing\n Google Cloud project, review any existing permissions and restrictions that\n could affect the instance's behavior or access.\n\n For details, see [Grant permissions to the Google SecOps instance](/chronicle/docs/onboard#grant-permissions).\n\nConfigure a Google Cloud project\n--------------------------------\n\nThe following sections describe how to enable the Chronicle API in the Google Cloud project and configure Essential Contacts.\n\n### Enable the Chronicle API in the Google Cloud project\n\nTo allow the Google SecOps instance to read from and write to the\nlinked Google Cloud project, do the following:\n\n1. Go to the **Manage resources** page in the Google Cloud console.\n\n [Go to the Manage Resources page](https://console.cloud.google.com/cloud-resource-manager)\n2. At the top, click the **Project picker** and select your **Organization** resource.\n3. Select the newly created project.\n4. Go to **APIs \\& Services**.\n5. Click **+ ENABLE APIS AND SERVICES**.\n6. Search for **Chronicle API** and select it.\n7. Click **Enable** to enable the Chronicle API for the project.\n\nFor more detail, see [Enabling an API in your Google Cloud project](/endpoints/docs/openapi/enable-api).\n\n### Configure Essential Contacts\n\nConfigure Essential Contacts to receive targeted notifications from\nGoogle Cloud. Perform the steps in\n[Managing contacts for notifications](/resource-manager/docs/managing-notification-contacts).\n\nNew service account in your project\n-----------------------------------\n\nA new service account is added to your project. The service account is managed\nby Google SecOps and has following attributes:\n\n- The service account naming pattern is as follows, where the `PROJECT_NUMBER` is unique to the project:\n\n `service-`\u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e`@gcp-sa-chronicle.iam.gserviceaccount.com`\n- The account has the **Chronicle Service Agent** role.\n\n- An IAM permission is granted to the project.\n\n To see details of the IAM permission, do the following:\n 1. Go to the **IAM** page of your Google Cloud project.\n 2. At the top right, select the **Include Google-provided role grants** checkbox.\n\n If you don't see the new service account, check that the\n **Include Google-provided role grants** button is enabled on the IAM page.\n\nWhat's next\n-----------\n\nAfter completing the steps in this document, perform the following:\n\n- Apply security and compliance controls to the project to satisfy your business\n use case and organization policies. For more information about how to do this,\n see the [Assured Workloads documentation](/assured-workloads/docs/overview).\n\n | **Note:** Compliance restrictions required by your Google Cloud organization are not applied by default. You must configure them manually.\n- Integrate your Google SecOps instance with an Identity Provider\n (IdP), either [Cloud identity](/chronicle/docs/onboard/configure-cloud-authentication) or a\n [third-party identity provider](/chronicle/docs/onboard/configure-authentication).\n\n- The Google Cloud project serves as a control layer for you to do the\n following:\n\n - Enable, inspect, and manage access to audit logs generated by Google SecOps and stored in Cloud Audit Logs.\n - Set up custom ingestion outage alerts using Cloud Monitoring.\n - Store exported historical data.\n\n Enable Google SecOps audit logging by following the steps in\n [Google Security Operations audit logging information](/chronicle/docs/preview/audit-logging/audit-logging).\n Google SecOps writes Data Access and Admin Activity logs to the project.\n | **Note:** You cannot disable Data Access logging using the Google Cloud console. To request to disable it, contact your Google SecOps representative.\n | **Important:** If audit logging was previously enabled using the steps in the Google SecOps audit logging guide, when you complete the steps in this document, the log output redirects to the new Google Security Operations-bound project.\n\n**Need more help?** [Get answers from Community members and Google SecOps professionals.](https://security.googlecloudcommunity.com/google-security-operations-2)"]]
