Google Compute Engine

Integration version: 9.0

This document provides guidance on how to integrate Compute Engine with Google Security Operations SOAR.

Use cases

The integration for Compute Engine helps you solve the following use cases:

  • Automated incident response: use Google SecOps capabilities to automatically isolate an instance from the network using playbooks upon detecting a compromised Compute Engine instance. Isolating an instance limits the spread of the attack and reduces potential damage. An automated incident response helps you accelerate the incident response time and reduces the workload on your security team.

  • Threat hunting and investigation: use Google SecOps capabilities to automate the collection of logs and security telemetry from Compute Engine instances across multiple projects. You can analyze the collected data for suspicious activity and potential threats to proactively hunt threats and speed up investigations by automating data collection.

  • Vulnerability management: integrate vulnerability scanning tools with Google SecOps to automatically scan Compute Engine instances for known vulnerabilities. You can use Google SecOps capabilities to automatically generate tickets for remediation or even patch the vulnerabilities directly to reduce the risk of exploitation and improve the security posture of your organization.

  • Compliance automation: use Google SecOps capabilities to automate the collection of audit logs and configuration data from Compute Engine instances and comply with regulatory requirements. You can use collected data to generate reports and dashboards for auditors to simplify compliance reporting and reduce the manual effort required to analyze data.

  • Security orchestration: orchestrate security workflows across multiple Google Cloud services, including Compute Engine. For example, Google SecOps can trigger the creation of a new firewall rule in response to a security event detected on a Compute Engine instance. The security orchestration provides you with a more coordinated and automated security posture by integrating different security tools and services.

Before you begin

To use the integration, you need a custom IAM role and Google Cloud service account. You can use an existing service account or create a new one.

Create and configure the IAM role

To create a and configure a custom IAM role for the integration. complete the following steps:

  1. In the Google Cloud console, go to the IAM Roles page.

    Go to IAM Roles

  2. Click Create role to create a custom role with permissions required for the integration.

  3. For a new custom role, provide the Title, Description, and a unique ID.

  4. Set the Role Launch Stage to General Availability.

  5. Add the following permissions to the created role:

    • compute.instances.list
    • compute.instances.start
    • compute.instances.stop
    • compute.instances.delete
    • compute.instances.setLabels
    • compute.instances.getIamPolicy
    • compute.instances.setIamPolicy
    • compute.instances.get
    • compute.zones.list

Create a service account

For guidance on creating a service account, see Create service accounts. Make sure to grant your custom IAM role to the service account under Grant this service account access to project.

If you don't run workloads on Google Cloud, you need to create a service account key in JSON after you create a service account. If you don't use a Workload Identity Federation for GKE email, you need to provide the content of the downloaded JSON file when configuring the integration parameters.

For security reasons, we recommend using the Workload Identity Federation for GKE email addresses instead of service account JSON keys. For more information about the workload identities, see Identities for workloads.

Integrate Compute Engine with Google SecOps

The integration requires the following parameters:

Parameters Description
Account Type Optional

The type of Google Cloud account.

Provide the value that is set in the type parameter of the service account key JSON file.

The default value is service_account.
Project ID Optional

The project ID of the Google Cloud account.

Provide the value that is set in the project_id parameter of the service account key JSON file.
Private Key ID Optional

The private key ID of the Google Cloud account.

Provide the value that is set in the private_key_id parameter of the service account key JSON file.
Private Key Optional

The private key of the Google Cloud account.

Provide the value that is set in the private_key parameter of the service account key JSON file.
Client Email Optional

The client email address of the Google Cloud account.

Provide the value that is set in the client_email parameter of the service account key JSON file.
Client ID Optional

The client ID of the Google Cloud account.

Provide the value that is set in the client_id parameter of the service account key JSON file.
Auth URI Optional

The authentication URI of the Google Cloud account.

Provide the value that is set in the auth_uri parameter of the service account key JSON file.

The default value is https://accounts.google.com/o/oauth2/auth.
Token URI Optional

The token URI of the Google Cloud account.

Provide the value that is set in the token_uri parameter of the service account key JSON file.

The default value is https://oauth2.googleapis.com/token.
Auth Provider X509 URL Optional

The authentication provider X.509 URL of the Google Cloud account.

Provide the value that is set in the auth_provider_x509_cert_url parameter of the service account key JSON file.

The default value is https://www.googleapis.com/oauth2/v1/certs.
Client X509 URL Optional

The client X.509 URL of the Google Cloud account.

Provide the value that is set in the client_x509_cert_url parameter of the service account key JSON file.
User Service Account JSON Optional

The content of the service account key JSON file.

You can configure either this parameter, or the Workload Identity Email parameter, or set all the preceding integration parameters.

To configure this parameter, provide the full content of the service account key JSON file that you have downloaded when creating a service account.
Workload Identity Email Optional

The client email address of your service account.

You can configure either this parameter or the User Service Account JSON parameter.

To impersonate service accounts with the Workload Identity Federation for GKE email address, grant the Service Account Token Creator role to your service account. For more details about workload identities and how to work with them, see Identities for workloads.

For instructions about configuring an integration in Google SecOps, see Configure integrations.

You can make changes at a later stage if needed. After you configure an integration instance, you can use it in playbooks. For more information about configuring and supporting multiple instances, see Supporting multiple instances.

Actions

The Compute Engine integration includes the following actions:

Add Labels to Instance

Use the Add Labels to Instance action to add labels to the Compute Engine instance.

This action doesn't run on entities.

Action inputs

The Add Labels to Instance action requires the following parameters:

Parameters Description
Resource Name Optional

The resource name for the Compute Engine instance.

This parameter has higher priority over the combination of the Project ID, Instance Zone, and Instance ID parameters.

Provide the parameter value in the following format: /project/PROJECT_ID/zone/ZONE_ID/instances/INSTANCE_ID.
Project ID Optional

The name of the project for your Compute Engine instance.

If you set no value for this parameter, the integration retrieves the project ID from your Google Cloud service account.
Instance Zone Optional

The name of an instance zone to search for instances in.
Instance ID Optional

The ID of the instance to start.

You can retrieve the instance ID using the List Instances action.
Instance Labels Required

The instance label to add to an instance.

To configure this parameter, set the value in a following format: label_key_name:label_value, such as vm_label_key:label1.

This parameter accepts multiple values as a comma-separated string.

Action outputs

The Add Labels to Instance action provides the following outputs:

Action output type Availability
Case wall attachment Not available
Case wall link Not available
Case wall table Not available
Enrichment table Not available
JSON result Available
Output messages Available
Script result Available
JSON result

The following example describes the JSON result output received when using the Add Labels to Instance action:

{
   "id": "ID",
   "name": "operation-OPERATION_ID",
   "zone": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/zones/us-central1-a",
   "operationType": "setLabels",
   "targetLink": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/zones/us-central1-a/instances/INSTANCE_ID",
   "targetId": "INSTANCE_ID",
   "status": "RUNNING",
   "user": "user@example.com",
   "progress": 0,
   "insertTime": "2021-04-28T23:01:29.395-07:00",
   "startTime": "2021-04-28T23:01:29.397-07:00",
   "selfLink": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/zones/us-central1-a/operations/operation-OPERATION_ID",
   "kind": "compute#operation"
}
Output messages

The Add Labels to Instance action provides the following output messages:

Output message Message description

Labels LABEL_LIST were successfully added to Google Cloud Compute instance INSTANCE_ID.

Provided instance zone ZONE_ID is not valid.

Provided instance ID is not valid.

Labels were not added because provided label LABEL_ID has the key that already exist for the Google Cloud Compute instance INSTANCE_ID.

 Action succeeded.
Error executing action "Add Labels to Instance". Reason: ERROR_REASON

Action failed.

Check the connection to the server, input parameters, or credentials.
Script result

The following table describes the values for the script result output when using the Add Labels to Instance action:

Script result name Value
is_success True or False

Delete Instance

Use the Delete Instance action to delete Compute Engine instances.

Action inputs

The Delete Instance action requires the following parameters:

Parameters Description
Resource Name Optional

The resource name for the Compute Engine instance.

This parameter has higher priority over the combination of the Project ID, Instance Zone, and Instance ID parameters.

Provide the parameter value in the following format: /project/PROJECT_ID/zone/ZONE_ID/instances/INSTANCE_ID.
Project ID Optional

The name of the project for your Compute Engine instance.

If you set no value for this parameter, the integration retrieves the project ID from your Google Cloud service account.
Instance Zone Optional

The name of an instance zone to search for instances in.
Instance ID Optional

The ID of the instance to start.

You can retrieve the instance ID using the List Instances action.

Action outputs

The Delete Instance action provides the following outputs:

Action output type Availability
Case wall attachment Not available
Case wall link Not available
Case wall table Not available
Enrichment table Not available
JSON result Available
Output messages Available
Script result Available
JSON result

The following example describes the JSON result output received when using the Delete Instance action:

{
   "id": "ID",
   "name": "operation-OPERATION_ID",
   "zone": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/zones/us-central1-a",
   "operationType": "delete",
   "targetLink": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/zones/us-central1-a/instances/INSTANCE_ID",
   "targetId": "INSTANCE_ID",
   "status": "RUNNING",
   "user": "user@example.com",
   "progress": 0,
   "insertTime": "2021-04-28T23:01:29.395-07:00",
   "startTime": "2021-04-28T23:01:29.397-07:00",
   "selfLink": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/zones/us-central1-a/operations/operation-OPERATION_ID",
   "kind": "compute#operation"
}
Output messages

The Delete Instance action provides the following output messages:

Output message Message description

Google Cloud Compute instance INSTANCE_ID was deleted successfully.

Provided instance zone ZONE_ID is not valid.

Provided instance ID is not valid.

 Action succeeded.

Error executing action "Start Instance". Reason: ERROR_REASON

Provided resource RESOURCE_PATH is not valid

Action failed.

Check the connection to the server, input parameters, or credentials.
Script result

The following table describes the values for the script result output when using the Delete Instance action:

Script result name Value
is_success True or False

Enrich Entities

Use the Enrich Entities action to enrich Google SecOps IP Address entities with the instance information from Compute Engine.

This action runs on the IP Address entity.

Action inputs

The Enrich Entities action requires the following parameters:

Parameters Description
Project ID Optional

The name of the project for your Compute Engine instance.

If you set no value for this parameter, the integration retrieves the project ID from your Google Cloud service account.
Instance Zone Optional

The name of an instance zone to search for instances in.

Action outputs

The Enrich Entities action provides the following outputs:

Action output type Availability
Case wall attachment Not available
Case wall link Not available
Case wall table Available
Enrichment table Available
JSON result Available
Output messages Available
Script result Available
Case wall table

After completing execution, the Enrich Entities action provides the following table:

Table name: ENTITY Enrichment Table

Columns:

  • Entity Field
  • Value
Enrichment table

The Enrich Entities action supports the following entity enrichment:

Enrichment field Source (JSON key) Logic
Google_Compute_instance_id id Not available
Google_Compute_creation_timestamp creationTimestamp Not available
Google_Compute_instance_name name Not available
Google_Compute_description description Not available
Google_Compute_tags tags Provide the tags in a CSV list
Google_Compute_machine_type machineType Not available
Google_Compute_instance_status status Not available
Google_Compute_instance_zone zone Not available
Google_Compute_can_ip_forward canIpForward Not available
Google_Compute_instance_network_interfaces_name_INDEX networkInterfaces.name Expand if there are more network interfaces available
Google_Compute_instance_network_interfaces_name_access_configs_type_INDEX networkInterfaces.accessConfigs.type Expand if there are more network interfaces available
Google_Compute_instance_network_interfaces_name_access_configs_name_INDEX networkInterfaces.accessConfigs.name Expand if there are more network interfaces available
Google_Compute_instance_network_interfaces_name_access_configs_natIP_INDEX networkInterfaces.accessConfigs.natIP Expand if there are more network interfaces available
Google_Compute_instance_metadata metadata CSV list of values from instance metadata
Google_Compute_service_account_INDEX serviceAccounts.email Expand if there are more service accounts available
Google_Compute_service_account_scopes_INDEX serviceAccounts.scopes Expand if there are more service accounts available
Google_Compute_link_to_Google_Compute selfLink Not available
Google_Compute_labels labels Provide a CSV list of values
Google_Compute_instance_last_start_timestamp lastStartTimestamp Not available
Google_Compute_instance_last_stop_timestamp lastStopTimestamp Not available
JSON result

The following example describes the JSON result output received when using the Enrich Entities action:

{
    "id": "ID",
    "creationTimestamp": "2021-04-28T21:34:57.369-07:00",
    "name": "instance-1",
    "description": "",
    "tags": {
        "fingerprint": "VALUE"
    },
    "machineType": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/zones/us-central1-a/machineTypes/f1-micro",
    "status": "RUNNING",
    "zone": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/zones/us-central1-a",
    "canIpForward": false,
    "networkInterfaces": [
        {
            "network": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/global/networks/default",
            "subnetwork": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/regions/us-central1/subnetworks/default",
            "networkIP": "203.0.113.2",
            "name": "example",
            "accessConfigs": [
                {
                    "type": "ONE_TO_ONE_NAT",
                    "name": "External NAT",
                    "natIP": "198.51.100.59",
                    "networkTier": "PREMIUM",
                    "kind": "compute#accessConfig"
                }
            ],
            "fingerprint": "VALUE",
            "kind": "compute#networkInterface"
        }
    ],
    "disks": [
        {
            "type": "PERSISTENT",
            "mode": "READ_WRITE",
            "source": "https://www.googleapis.com/compute/v1/PROJECT_ID/zones/us-central1-a/disks/instance-1",
            "deviceName": "instance-1",
            "index": 0,
            "boot": true,
            "autoDelete": true,
            "licenses": [
                "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/global/licenses/LICENSE"
            ],
            "interface": "SCSI",
            "guestOsFeatures": [
                {
                    "type": "UEFI_COMPATIBLE"
                },
                {
                    "type": "VIRTIO_SCSI_MULTIQUEUE"
                }
            ],
            "diskSizeGb": "10",
            "kind": "compute#attachedDisk"
        }
    ],
    "metadata": {
        "fingerprint": "VALUE",
        "kind": "compute#metadata"
    },
    "serviceAccounts": [
        {
            "email": "user@example.com",
            "scopes": [
                "https://www.googleapis.com/auth/devstorage.read_only",
                "https://www.googleapis.com/auth/logging.write",
                "https://www.googleapis.com/auth/monitoring.write",
                "https://www.googleapis.com/auth/servicecontrol",
                "https://www.googleapis.com/auth/service.management.readonly",
                "https://www.googleapis.com/auth/trace.append"
            ]
        }
    ],
    "selfLink": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/zones/us-central1-a/instances/instance-1",
    "scheduling": {
        "onHostMaintenance": "MIGRATE",
        "automaticRestart": true,
        "preemptible": false
    },
    "cpuPlatform": "Intel Haswell",
    "labels": {
        "vm_test_tag": "tag1"
    },
    "labelFingerprint": "VALUE",
    "startRestricted": false,
    "deletionProtection": false,
    "reservationAffinity": {
        "consumeReservationType": "ANY_RESERVATION"
    },
    "displayDevice": {
        "enableDisplay": false
    },
    "shieldedInstanceConfig": {
        "enableSecureBoot": false,
        "enableVtpm": true,
        "enableIntegrityMonitoring": true
    },
    "shieldedInstanceIntegrityPolicy": {
        "updateAutoLearnPolicy": true
    },
    "confidentialInstanceConfig": {
        "enableConfidentialCompute": false
    },
    "fingerprint": "VALUE",
    "lastStartTimestamp": "2021-04-28T21:35:07.865-07:00",
    "kind": "compute#instance"
}
Output messages

The Enrich Entities action provides the following output messages:

Output message Message description

Successfully enriched entities: ENTITY_ID.

Provided instance zone ZONE_ID is not valid.

Action was not able to find a match Google Cloud Compute to enrich provided entities: ENTITY_ID.

No entities were enriched.

 Action succeeded.
Error executing action "Enrich Entities". Reason: ERROR_REASON

Action failed.

Check the connection to the server, input parameters, or credentials.
Script result

The following table describes the values for the script result output when using the Enrich Entities action:

Script result name Value
is_success True or False

Get Instance IAM Policy

Use the Get Instance IAM Policy action to get the access control policy for a resource. If you assign no policy to the resource initially, the returned policy can be empty.

This action doesn't run on entities.

Action inputs

The Get Instance IAM Policy action requires the following parameters:

Parameters Description
Resource Name Optional

The resource name for the Compute Engine instance.

This parameter has higher priority over the combination of the Project ID, Instance Zone, and Instance ID parameters.

Provide the parameter value in the following format: /project/PROJECT_ID/zone/ZONE_ID/instances/INSTANCE_ID.
Project ID Optional

The name of the project for your Compute Engine instance.

If you set no value for this parameter, the integration retrieves the project ID from your Google Cloud service account.
Instance Zone Optional

The name of an instance zone to search for instances in.
Instance ID Optional

The ID of the instance to start.

You can retrieve the instance ID using the List Instances action.

Action outputs

The Get Instance IAM Policy action provides the following outputs:

Action output type Availability
Case wall attachment Not available
Case wall link Not available
Case wall table Not available
Enrichment table Not available
JSON result Available
Output messages Available
Script result Available
JSON result

The following example describes the JSON result output received when using the Get Instance IAM Policy action:

{
    "version": 1,
    "etag": "BwXBfsc47MI=",
    "bindings": [
        {
            "role": "roles/compute.networkViewer_withcond_2f0c00",
            "members": [
                "user:user@example.com"
            ]
        }
    ]
}
Output messages

The Get Instance IAM Policy action provides the following output messages:

Output message Message description

Google Cloud Compute instance INSTANCE_ID IAM policy was fetched successfully.

Provided instance zone ZONE_ID is not valid.

Provided instance ID is not valid.

 Action succeeded.
Error executing action "Get Instance IAM Policy". Reason: ERROR_REASON

Action failed.

Check the connection to the server, input parameters, or credentials.
Script result

The following table describes the values for the script result output when using the Get Instance IAM Policy action:

Script result name Value
is_success True or False

List Instances

Use the List Instances action to list Compute Engine instances based on the specified search criteria.

This action doesn't run on entities.

Action inputs

The List Instances action requires the following parameters:

Parameters Description
Project ID Optional

The name of the project to list instances.

If you set no value for this parameter, the integration retrieves the project ID from your Google Cloud service account.
Instance Zone Optional

The name of an instance zone to search for instances in.
Instance Name Optional

The instance name to search for.

This parameter accepts multiple values as a comma-separated string.
Instance Status Optional

The instance status to search for.

This parameter accepts multiple values as a comma-separated string.
Instance Labels Optional

The instance label to search for.

To configure this parameter, set the value in a following format: label_key_name:label_value, such as vm_label_key:label1.

This parameter accepts multiple values as a comma-separated string.
Max Rows to Return Optional

The number of instances to return for a single action run.

The default value is 50.

Action outputs

The List Instances action provides the following outputs:

Action output type Availability
Case wall attachment Not available
Case wall link Not available
Case wall table Available
Enrichment table Not available
JSON result Available
Output messages Available
Script result Available
Case wall table

The List Instances action provides the following table:

Table name: Google Cloud Compute Instances

Table columns:

  • Instance Name
  • Instance ID
  • Instance Creation Time
  • Instance Description
  • Instance Type
  • Instance Status
  • Instance Labels
JSON result

The following example describes the JSON result output received when using the List Instances action:

{ "id": "projects/PROJECT_ID/zones/us-central1-a/instances",
   "items": [
       {
           "id": "ID",
           "creationTimestamp": "2021-04-28T21:34:57.369-07:00",
           "name": "instance-1",
           "description": "",
           "tags": {
               "fingerprint": "VALUE"
           },
           "machineType": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/zones/us-central1-a/machineTypes/f1-micro",
           "status": "RUNNING",
           "zone": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/zones/us-central1-a",
           "canIpForward": false,
           "networkInterfaces": [
               {
                   "network": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/global/networks/default",
                   "subnetwork": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/regions/us-central1/subnetworks/default",
                   "networkIP": "192.0.2.2",
                   "name": "example",
                   "accessConfigs": [
                       {
                           "type": "ONE_TO_ONE_NAT",
                           "name": "External NAT",
                           "natIP": "203.0.113.59",
                           "networkTier": "PREMIUM",
                           "kind": "compute#accessConfig"
                       }
                   ],
                   "fingerprint": "VALUE",
                   "kind": "compute#networkInterface"
               }
           ],
           "disks": [
               {
                   "type": "PERSISTENT",
                   "mode": "READ_WRITE",
                   "source": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/zones/us-central1-a/disks/instance-1",
                   "deviceName": "instance-1",
                   "index": 0,
                   "boot": true,
                   "autoDelete": true,
                   "licenses": [
                       "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/global/licenses/LICENSE"
                   ],
                   "interface": "SCSI",
                   "guestOsFeatures": [
                       {
                           "type": "UEFI_COMPATIBLE"
                       },
                       {
                           "type": "VIRTIO_SCSI_MULTIQUEUE"
                       }
                   ],
                   "diskSizeGb": "10",
                   "kind": "compute#attachedDisk"
               }
           ],
           "metadata": {
               "fingerprint": "VALUE",
               "kind": "compute#metadata"
           },
           "serviceAccounts": [
               {
                   "email": "user@example.com",
                   "scopes": [
                       "https://www.googleapis.com/auth/devstorage.read_only",
                       "https://www.googleapis.com/auth/logging.write",
                       "https://www.googleapis.com/auth/monitoring.write",
                       "https://www.googleapis.com/auth/servicecontrol",
                       "https://www.googleapis.com/auth/service.management.readonly",
                       "https://www.googleapis.com/auth/trace.append"
                   ]
               }
           ],
           "selfLink": "https://www.googleapis.com/compute/v1/projects/PROJECT_IDzones/us-central1-a/instances/instance-1",
           "scheduling": {
               "onHostMaintenance": "MIGRATE",
               "automaticRestart": true,
               "preemptible": false
           },
           "cpuPlatform": "Intel Haswell",
           "labels": {
               "vm_test_tag": "tag1"
           },
           "labelFingerprint": "VALUE",
           "startRestricted": false,
           "deletionProtection": false,
           "reservationAffinity": {
               "consumeReservationType": "ANY_RESERVATION"
           },
           "displayDevice": {
               "enableDisplay": false
           },
           "shieldedInstanceConfig": {
               "enableSecureBoot": false,
               "enableVtpm": true,
               "enableIntegrityMonitoring": true
           },
           "shieldedInstanceIntegrityPolicy": {
               "updateAutoLearnPolicy": true
           },
           "confidentialInstanceConfig": {
               "enableConfidentialCompute": false
           },
           "fingerprint": "VALUE",
           "lastStartTimestamp": "2021-04-28T21:35:07.865-07:00",
           "kind": "compute#instance"
       }
   ]
}
Output messages

On a Case Wall, the List Instances action provides the following output messages:

Output message Message description

Successfully fetched Google Cloud Compute instances.

Provided instance zone ZONE_ID is not valid.

No instances were found in Google Cloud Compute.

 Action succeeded.
Error executing action "List Instances". Reason: ERROR_REASON

Action failed.

Check the connection to the server, input parameters, or credentials.
Script result

The following table describes the values for the script result output when using the List Instances action:

Script result name Value
is_success True or False

Ping

Use the Ping action to test connectivity to Compute Engine.

Action inputs

None.

Action outputs

The Ping action provides the following outputs:

Action output type Availability
Case wall attachment Not available
Case wall link Not available
Case wall table Not available
Enrichment table Not available
JSON result Not available
Output messages Available
Script result Available
JSON result

The following example describes the JSON result output received when using the Ping action:

Output messages

On a Case Wall, the Ping action provides the following output messages:

Output message Message description
Successfully connected to the Google Cloud Compute service with the provided connection parameters! Action succeeded.
Failed to connect to the Google Cloud Compute service! Error is ERROR_REASON

Action failed.

Check the connection to the server, input parameters, or credentials.
Script result

The following table describes the values for the script result output when using the Ping action:

Script result name Value
is_success True or False

Remove External IP Addresses

Use the Remove External IP Addresses action to remove external IP addresses on a Compute Engine instance.

This action runs asynchronously. Adjust the script timeout value in the Google SecOps IDE, if necessary.

This action doesn't run on entities.

Action inputs

The Remove External IP Addresses action requires the following parameters:

Parameters Description
Resource Name Optional

The resource name for the Compute Engine instance.

This parameter has higher priority over the combination of the Project ID, Instance Zone, and Instance ID parameters.

Provide the parameter value in the following format: /project/PROJECT_ID/zone/ZONE_ID/instances/INSTANCE_ID.
Project ID Optional

The name of the project for your Compute Engine instance.

If you set no value for this parameter, the integration retrieves the project ID from your Google Cloud service account.
Instance Zone Optional

The name of an instance zone to search for instances in.
Instance ID Optional

The ID of the instance to start.

You can retrieve the instance ID using the List Instances action.
Network Interface Optional

A comma-separated list of network interfaces to modify. If you leave this parameter empty or provide the * value, the action updates all network interfaces.

Action outputs

The Remove External IP Addresses action provides the following outputs:

Action output type Availability
Case wall attachment Not available
Case wall link Not available
Case wall table Not available
Enrichment table Not available
JSON result Available
Output messages Available
Script result Available
JSON result

The following example describes the JSON result output received when using the Remove External IP Addresses action:

[
    {
        "endTime": "2024-05-21T04:28:05.371-07:00",
        "id": "ID",
        "insertTime": "2024-05-21T04:28:04.176-07:00",
        "kind": "compute#operation",
        "name": "operation-OPERATION_ID",
        "operationType": "updateNetworkInterface",
        "progress": 100,
        "selfLink": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/zones/us-west1-a/operations/operation-OPERATION_ID",
        "startTime": "2024-05-21T04:28:04.190-07:00",
        "status": "DONE",
        "targetId": "TARGET_ID",
        "targetLink": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/zones/us-west1-a/instances/INSTANCE_ID",
        "user": "user@example.com",
        "zone": "us-west1-a",
        "networkInterface": "example"
    },
    {
        "endTime": "2024-05-21T04:28:06.549-07:00",
        "id": "2531200345768541098",
        "insertTime": "2024-05-21T04:28:05.419-07:00",
        "kind": "compute#operation",
        "name": "operation-OPERATION_ID",
        "operationType": "deleteAccessConfig",
        "progress": 100,
        "selfLink": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/zones/us-west1-a/operations/operation-OPERATION_ID",
        "startTime": "2024-05-21T04:28:05.430-07:00",
        "status": "DONE",
        "targetId": "3905740668247239013",
        "targetLink": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/zones/us-west1-a/instances/INSTANCE_ID",
        "user": "user@example.com",
        "zone": "us-west1-a",
        "networkInterface": "example"
    }
]
Output messages

The Remove External IP Addresses action provides the following output messages:

Output message Message description

Successfully removed external IP addresses from RESOURCE_PATH instance in INTEGRATION_NAME.

Waiting for the operation to finish execution on the RESOURCE_PATH instance in INTEGRATION_NAME.

 Action succeeded.

Error executing action "Remove External IP Addresses". Reason: ERROR_REASON

Action ran into a timeout during execution. Pending operations: PENDING_OPERATIONS. Please increase the timeout in IDE.

The following network interfaces were not found: INTERFACES on the RESOURCE_PATH in INTEGRATION_NAME. Please check the spelling.

Provided instance zone is not valid.

Provided instance ID is not valid.

Action failed.

Check the connection to the server, input parameters, or credentials.
Script result

The following table describes the values for the script result output when using the Remove External IP Addresses action:

Script result name Value
is_success True or False

Set Instance IAM Policy

Use the Set Instance IAM Policy action to sets the access control policy for the specified resource. The policy that you provide in the action replaces any existing policy.

This action doesn't run on entities.

Action inputs

The Set Instance IAM Policy action requires the following parameters:

Parameters Description
Resource Name Optional

The resource name for the Compute Engine instance.

This parameter has higher priority over the combination of the Project ID, Instance Zone, and Instance ID parameters.

Provide the parameter value in the following format: /project/PROJECT_ID/zone/ZONE_ID/instances/INSTANCE_ID.
Project ID Optional

The name of the project for your Compute Engine instance.

If you set no value for this parameter, the integration retrieves the project ID from your Google Cloud service account.
Instance Zone Optional

The name of an instance zone to search for instances in.
Instance ID Optional

The ID of the instance to start.

You can retrieve the instance ID using the List Instances action.
Policy Required

The JSON policy document to set to the instance.

Action outputs

The Set Instance IAM Policy action provides the following outputs:

Action output type Availability
Case wall attachment Not available
Case wall link Not available
Case wall table Not available
Enrichment table Not available
JSON result Available
Output messages Available
Script result Available
JSON result

The following example describes the JSON result output received when using the Set Instance IAM Policy action:

{
    "version": 1,
    "etag": "BwXBftu99FE=",
    "bindings": [
        {
            "role": "roles/compute.networkViewer",
            "members": [
                "user:user@example.com"
            ]
        }
    ]
}
Output messages

The Set Instance IAM Policy action provides the following output messages:

Output message Message description

Successfully set new IAM policy for the Google Cloud Compute instance INSTANCE_ID.

Provided instance zone ZONE_ID is not valid.

Provided instance ID INSTANCE_ID is not valid.

Provided policy JSON document POLICY is not valid.

 Action succeeded.
Error executing action "Set Instance IAM Policy". Reason: ERROR_REASON

Provided resource RESOURCE is not valid.

Error executing action "Set Instance IAM Policy". Reason: Either "Resource Name" or "Instance Zone" and "Instance ID" needs to be provided.

Action failed.

Check the connection to the server, input parameters, or credentials.
Script result

The following table describes the values for the script result output when using the Set Instance IAM Policy action:

Script result name Value
is_success True or False

Start Instance

Use the Start Instance action to start a previously stopped Compute Engine instance.

The instance doesn't start running immediately.

This action doesn't run on entities.

Action inputs

The Start Instance action requires the following parameters:

Parameters Description
Resource Name Optional

The resource name for the Compute Engine instance.

This parameter has higher priority over the combination of the Project ID, Instance Zone, and Instance ID parameters.

Provide the parameter value in the following format: /project/PROJECT_ID/zone/ZONE_ID/instances/INSTANCE_ID.
Project ID Optional

The name of the project for your Compute Engine instance.

If you set no value for this parameter, the integration retrieves the project ID from your Google Cloud service account.
Instance Zone Optional

The name of an instance zone to search for instances in.
Instance ID Optional

The ID of the instance to start.

You can retrieve the instance ID using the List Instances action.

Action outputs

The Start Instance action provides the following outputs:

Action output type Availability
Case wall attachment Not available
Case wall link Not available
Case wall table Not available
Enrichment table Not available
JSON result Available
Output messages Available
Script result Available
JSON result

The following example describes the JSON result output received when using the Start Instance action:

{
   "id": "ID",
   "name": "operation-OPERATION_ID",
   "zone": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/zones/us-central1-a",
   "operationType": "start",
   "targetLink": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/zones/us-central1-a/instances/INSTANCE_ID",
   "targetId": "INSTANCE_ID",
   "status": "DONE",
   "user": "user@example.com",
   "progress": 100,
   "insertTime": "2021-04-28T23:01:29.395-07:00",
   "startTime": "2021-04-28T23:01:29.397-07:00",
   "endTime": "2021-04-28T23:01:29.397-07:00",
   "selfLink": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/zones/us-central1-a/operations/operation-OPERATION_ID",
   "kind": "compute#operation"
}
Output messages

The Start Instance action provides the following output messages:

Output message Message description

Google Cloud Compute instance RESOURCE_PATH was started successfully.

Provided instance zone ZONE_ID is not valid.

Provided instance ID is not valid.

 Action succeeded.

Error executing action "Start Instance". Reason: ERROR_REASON

Error executing action "Start Instance". Reason: You should provide either "Resource name" or "Instance Zone" and "Instance ID" parameters.

Error executing action "Start Instance". Reason: Given resource name string does not match expected pattern.

Action failed.

Check the connection to the server, input parameters, or credentials.
Script result

The following table describes the values for the script result output when using the Start Instance action:

Script result name Value
is_success True or False

Stop Instance

Use the Stop Instance action to stop a running Compute Engine instance. You can restart the instance at a later time.

The VM usage charges don't apply to the stopped instances. However, charges apply to the resources that the VM is using, such as persistent disks and static IP addresses, unless you delete the resources.

Action inputs

The Stop Instance action requires the following parameters:

Parameters Description
Resource Name Optional

The resource name for the Compute Engine instance.

This parameter has higher priority over the combination of the Project ID, Instance Zone, and Instance ID parameters.

Provide the parameter value in the following format: /project/PROJECT_ID/zone/ZONE_ID/instances/INSTANCE_ID.
Project ID Optional

The name of the project for your Compute Engine instance.

If you set no value for this parameter, the integration retrieves the project ID from your Google Cloud service account.
Instance Zone Optional

The name of an instance zone to search for instances in.
Instance ID Optional

The ID of the instance to start.

You can retrieve the instance ID using the List Instances action.

Action outputs

The Stop Instance action provides the following outputs:

Action output type Availability
Case wall attachment Not available
Case wall link Not available
Case wall table Not available
Enrichment table Not available
JSON result Available
Output messages Available
Script result Available
JSON result

The following example describes the JSON result output received when using the Stop Instance action:

{
   "id": "ID",
   "name": "operation-OPERATION_ID",
   "zone": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/zones/us-central1-a",
   "operationType": "stop",
   "targetLink": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/zones/us-central1-a/instances/INSTANCE_ID",
   "targetId": "INSTANCE_ID",
   "status": "RUNNING",
   "user": "user@example.com",
   "progress": 100,
   "insertTime": "2021-04-28T23:01:29.395-07:00",
   "startTime": "2021-04-28T23:01:29.397-07:00",
   "selfLink": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/zones/us-central1-a/operations/operation-OPERATION_ID",
   "kind": "compute#operation"
}
Output messages

The Stop Instance action provides the following output messages:

Output message Message description

Google Cloud Compute instance INSTANCE_ID was stopped successfully.

Provided instance zone ZONE_ID is not valid.

Provided instance ID is not valid.

 Action succeeded.
Error executing action "Stop Instance". Reason: ERROR_REASON

Action failed.

Check the connection to the server, input parameters, or credentials.
Script result

The following table describes the values for the script result output when using the Stop Instance action:

Script result name Value
is_success True or False

Update Firewall Rule

Use the Update Firewall Rule action to update a firewall rule with the provided parameters in Compute Engine.

This action is asynchronous. Adjust the script timeout value in the Google SecOps IDE, if necessary.

This action doesn't run on entities.

Action inputs

The Update Firewall Rule action requires the following parameters:

Parameters Description
Resource Name Optional

The resource name for the Compute Engine instance.

This parameter has higher priority over the combination of the Project ID and Firewall Rule parameters.

Provide the parameter value in the following format: /project/PROJECT_ID/global/firewall/FIREWALL.
Project ID Optional

The name of the project for your Compute Engine instance.

If you set no value for this parameter, the integration retrieves the project ID from your Google Cloud service account.
Firewall Rule Optional

A firewall rule name to update.
Source IP Ranges Optional

A comma-separated list of source IP ranges. This parameter supports the none value.

If you provide the none value, the action deletes all existing values for the firewall rule. If you provide no value, the action doesn't update the existing value.
Source Tags Optional

A comma-separated list of source tags. This parameter supports the none value.

If you provide the none value, the action deletes all existing values for the firewall rule. If you provide no value, the action doesn't update the existing value.
Source Service Accounts Optional

A comma-separated list of source service accounts. This parameter supports the none value.

If you provide the none value, the action deletes all existing values for the firewall rule. If you provide no value, the action doesn't update the existing value.
TCP Ports Optional

A comma-separated list of TCP ports. If you configure this parameter, the action uses the parameter value to update and determine allowlists and denylists.

This parameter supports the all and none values.
UDP Ports Optional

A comma-separated list of UDP ports. If you configure this parameter, the action uses the parameter value to update and determine allowlists and denylists.

This parameter supports the all and none values.
Other Protocols Optional

A comma-separated list of other protocols.

This parameter supports the none value.

Action outputs

The Update Firewall Rule action provides the following outputs:

Action output type Availability
Case wall attachment Not available
Case wall link Not available
Case wall table Not available
Enrichment table Not available
JSON result Available
Output messages Available
Script result Available
JSON result

The following example describes the JSON result output received when using the Update Firewall Rule action:

{
  "endTime": "2024-05-20T09:42:09.381-07:00",
  "id": "ID",
  "insertTime": "2024-05-20T09:42:05.150-07:00",
  "kind": "compute#operation",
  "name": "operation-OPERATION_ID",
  "operationType": "patch",
  "progress": 100,
  "selfLink": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/global/operations/operation-OPERATION_ID",
  "startTime": "2024-05-20T09:42:05.164-07:00",
  "status": "DONE",
  "targetId": "7886634413370691799",
  "targetLink": "https://www.googleapis.com/compute/v1/projects/PROJECT_ID/global/firewalls/default-allow-rdp",
  "user": "user@example.com"
}
Output messages

The Update Firewall Rule action provides the following output messages:

Output message Message description
Successfully updated firewall rule in Cloud Compute.

Updating firewall rule in Cloud Compute.

 Action succeeded.
Error executing action "Update Firewall Rule". Reason: ERROR_REASON

Provided firewall name is not valid.

Action ran into a timeout during execution. Please increase the timeout in IDE.

You must provide at least some parameter to update the firewall rule with.

Action failed.

Check the connection to the server, input parameters, or credentials.
Script result

The following table describes the values for the script result output when using the Update Firewall Rule action:

Script result name Value
is_success True or False