[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-21。"],[[["\u003cp\u003eGoogle SecOps is bound to a single Google Cloud project within your organization, creating a control layer for managing access and data.\u003c/p\u003e\n"],["\u003cp\u003eThe designated Google Cloud project stores sensitive security telemetry, and it is recommended to use a new project for this purpose, although an existing one can be used with awareness of potential permission impacts.\u003c/p\u003e\n"],["\u003cp\u003eTo enable Google SecOps functionality, you must enable the Chronicle API in the designated Google Cloud project and configure Essential Contacts for notifications.\u003c/p\u003e\n"],["\u003cp\u003eThe project allows you to set up permissions for Google SecOps to access Chronicle APIs and handle the read and write of data.\u003c/p\u003e\n"],["\u003cp\u003eThe logs produced by Google SecOps are written to the designated Google Cloud Project, incurring Cloud Logging costs.\u003c/p\u003e\n"]]],[],null,["# Configure a Google Cloud project for Google SecOps\n==================================================\n\nSupported in: \nGoogle secops [SIEM](/chronicle/docs/secops/google-secops-siem-toc)\n\nA Google Cloud project acts as a control layer for the linked\nGoogle SecOps instance. It stores customer-specific data such as\nsecurity telemetry, audit logs, ingestion alerts, and other sensitive\ninstance-level information.\n\nThe following sections describe how to configure your Google Cloud project.\n\nPrerequisites\n-------------\n\nEach new Google SecOps instance should be linked to a single\nGoogle Cloud project. You can either link to an existing Google Cloud project or\ncreate a new one, depending on your organizational setup and requirements:\n\n- We recommend creating a new, dedicated Google Cloud project for each\n Google SecOps instance. This approach helps isolate sensitive\n security telemetry and audit data specific to the\n Google SecOps instance.\n\n To create a new Google Cloud project, see\n [Create a Google Cloud project](/chronicle/docs/onboard#create-gcp-project).\n- If you link your Google SecOps instance to an existing\n Google Cloud project, review any existing permissions and restrictions that\n could affect the instance's behavior or access.\n\n For details, see [Grant permissions to the Google SecOps instance](/chronicle/docs/onboard#grant-permissions).\n\nConfigure a Google Cloud project\n--------------------------------\n\nThe following sections describe how to enable the Chronicle API in the Google Cloud project and configure Essential Contacts.\n\n### Enable the Chronicle API in the Google Cloud project\n\nTo allow the Google SecOps instance to read from and write to the\nlinked Google Cloud project, do the following:\n\n1. Go to the **Manage resources** page in the Google Cloud console.\n\n [Go to the Manage Resources page](https://console.cloud.google.com/cloud-resource-manager)\n2. At the top, click the **Project picker** and select your **Organization** resource.\n3. Select the newly created project.\n4. Go to **APIs \\& Services**.\n5. Click **+ ENABLE APIS AND SERVICES**.\n6. Search for **Chronicle API** and select it.\n7. Click **Enable** to enable the Chronicle API for the project.\n\nFor more detail, see [Enabling an API in your Google Cloud project](/endpoints/docs/openapi/enable-api).\n\n### Configure Essential Contacts\n\nConfigure Essential Contacts to receive targeted notifications from\nGoogle Cloud. Perform the steps in\n[Managing contacts for notifications](/resource-manager/docs/managing-notification-contacts).\n\nNew service account in your project\n-----------------------------------\n\nA new service account is added to your project. The service account is managed\nby Google SecOps and has following attributes:\n\n- The service account naming pattern is as follows, where the `PROJECT_NUMBER` is unique to the project:\n\n `service-`\u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e`@gcp-sa-chronicle.iam.gserviceaccount.com`\n- The account has the **Chronicle Service Agent** role.\n\n- An IAM permission is granted to the project.\n\n To see details of the IAM permission, do the following:\n 1. Go to the **IAM** page of your Google Cloud project.\n 2. At the top right, select the **Include Google-provided role grants** checkbox.\n\n If you don't see the new service account, check that the\n **Include Google-provided role grants** button is enabled on the IAM page.\n\nWhat's next\n-----------\n\nAfter completing the steps in this document, perform the following:\n\n- Apply security and compliance controls to the project to satisfy your business\n use case and organization policies. For more information about how to do this,\n see the [Assured Workloads documentation](/assured-workloads/docs/overview).\n\n | **Note:** Compliance restrictions required by your Google Cloud organization are not applied by default. You must configure them manually.\n- Integrate your Google SecOps instance with an Identity Provider\n (IdP), either [Cloud identity](/chronicle/docs/onboard/configure-cloud-authentication) or a\n [third-party identity provider](/chronicle/docs/onboard/configure-authentication).\n\n- The Google Cloud project serves as a control layer for you to do the\n following:\n\n - Enable, inspect, and manage access to audit logs generated by Google SecOps and stored in Cloud Audit Logs.\n - Set up custom ingestion outage alerts using Cloud Monitoring.\n - Store exported historical data.\n\n Enable Google SecOps audit logging by following the steps in\n [Google Security Operations audit logging information](/chronicle/docs/preview/audit-logging/audit-logging).\n Google SecOps writes Data Access and Admin Activity logs to the project.\n | **Note:** You cannot disable Data Access logging using the Google Cloud console. To request to disable it, contact your Google SecOps representative.\n | **Important:** If audit logging was previously enabled using the steps in the Google SecOps audit logging guide, when you complete the steps in this document, the log output redirects to the new Google Security Operations-bound project.\n\n**Need more help?** [Get answers from Community members and Google SecOps professionals.](https://security.googlecloudcommunity.com/google-security-operations-2)"]]
