Integrate Google Cloud Platform (GCP) with Zscaler MDR

To integrate your Organization with Zscaler MDR, you’ll need to collect a few pieces of information:

• Organization ID

• Provisioning Project ID

• Provisioning Project Number

1. In the Zscaler MDR portal, click Integrations.

   

2. From the Integrations section, locate and then click Google Cloud Platform.

   

3. Enter a name for your new GCP integration.

4. Choose the scope of your integration by selecting Organization or Project.

   

Organization

1. If you selected Organization, enter your Organization ID.

   1. To locate your Organization ID, navigate to your GCP cloud console and then select your Organization from the resource browser.

   2. Copy your Organization ID, and then paste it into Zscaler MDR.

      

2. Enter your Provisioning Project ID.

   Note: The Provisioning Project can be any Project within your Organization; you can use an existing Project or create a new one. This setup provisions a Pub/Sub Topic and Subscription within this Project to use as the destination for log routing.

   1. To locate your Provisioning Project ID, navigate to your GCP cloud console and select your Project in the resource explorer.

   2. Copy your Project ID, and then paste it into Zscaler MDR.

      

3. From Zscaler MDR, enter any Excluded Projects; this step is optional.

   Note: Excluded Projects is a comma-separated list of project ID(s) that will be excluded from the Zscaler MDR scan.

4. From Zscaler MDR, click Next.

Project

1. If you selected Project, enter your Project ID.

   

   1. To locate your Provisioning Project ID, navigate to your GCP cloud console and then select your Project in the resource explorer.

   2. Copy your Project ID, and then paste it into Zscaler MDR.

      

2. From Zscaler MDR, click Next.

Enabling Data Access logs ensures Zscaler MDR can monitor activity in your GCP environment.

1. From Zscaler MDR, select I need to enable Data Access Logs.

   1. To complete this process, navigate to your GCP Audit Logs.

   2. Select your Organization or Project from the resource browser.

   3. Click Set Default Configuration.

   4. Select Admin Read, Data Read, and Data Write.

   5. Click Save.

      

2. From Zscaler MDR, select I’ve enabled Data Access logs.

   Note: To prevent unnecessary charges from GCP, ensure to opt out of data storage. GCP automatically directs logs to a default storage sink for storage. For our purposes, we require only the routing of these logs, not their storage.

   

3. Click Next.

Zscaler MDR provides setup files to provision resources in your GCP environment to enable the integration process.

The integration process can be completed in two different ways:

• Bash

• Terraform

From Zscaler MDR, choose the scope of your integration by selecting Bash or Terraform.

Bash

1. Click setup files to download the files that Zscaler MDR has provided.

   

2. Unzip the files you downloaded in the previous step.

3. Navigate to your GCP Cloud Shell, and then click Activate Cloud Shell.

   

4. Upload the setup files to your GCP Cloud Shell.

   

5. Use the following command to grant execution permissions to the setup file:

   1. For Organization

      chmod +x organization_provisioning.sh

   2. For Project

      chmod +x project_provisioning.sh

6. Initiate the setup files with the following command to allocate the necessary resources for this integration:

   1. For Organization

      ./organization_provisioning.sh --organization-id ORGANIZATION_ID --provisioning-project-id PROVISIONING_PROJECT_ID

   2. For Project

      ./project_provisioning.sh --provisioning-project-id PROJECT_ID

7. If you receive an Authorization confirmation pop-up, click Authorize.

8. From Zscaler MDR, select I’ve completed the provisioning steps.

   

9. Click Save.

Terraform

1. If you selected Terraform, click setup files to download the files that Zscaler MDR has provided.

   

2. Integrate the Terraform template downloaded in the previous step into your Infrastructure as Code (IaaC) pipeline. Follow your pipeline’s standard process for deploying Terraform templates.

   1. It’s essential to edit the terraform files by replacing all instances of information contained in ‘<>’ with the necessary information. This step is crucial as it ensures the correct configuration for the organization or project-level integration.
      This process includes:
      - The Project ID of your provisioning Project
      - The region where resources will be created in your provisioning Project
      - Organization ID or Project ID
      - Project Number

      

   2. Add the Terraform template to your IAC.

   3. From your command line, enter the code below:
      terraform plan

      Note: When you plan your terraform, ensure that there are no unexpected errors, resources being created, or resources being deployed.

   4. From your command line, enter the code below:
      terraform apply

3. From Zscaler MDR, select I’ve completed the provisioning steps.

   

4. Click Save.

Zscaler MDR ingests Google Cloud Platform (GCP) Audit logs from GCP environments. Additionally, Zscaler MDR integrates with GCP to scan your environment regularly to discover new projects and resources.

Environments covered

• Google Cloud Platform

Ingest details (GCP Cloud Audit Logs)

Zscaler MDR ingests the following type of activity from GCP Cloud Audit Logs:

• Admin Activity

• Data Access

• Policy Denied

• System Events

Currently, Zscaler MDR doesn’t collect Security Command Center alerts from GCP.

Finally, Zscaler MDR integrates with GCP to scan your environment regularly to discover new projects and resources. This integration is established via the Cloud Asset API and the IAM Custom Role configured during onboarding, enabling Zscaler MDR to read your GCP environment. The API method used is SearchAllResources, which requires the cloudasset.assets.searchAllResources permission, ensuring comprehensive visibility into your projects and resources.