Google SecOps Remote Agent (SOAR) Network Requirements

Please take a look at this doc to see if it helps.

Hi, I’ve seen this document before, but unfortunately, it doesn’t provide the URLs or IP addresses. Therefore, it won’t be helpful for me to configure my firewall rules.

Hi @tnxtr , Specific URLs, For both SIEM and SOAR agents:

• Port 443 (TCP): This port is used for communication between the agent and the Google Security Operations Publisher (a proxy server managed by Google). You will need to allow outbound connections on this port to the following Google Cloud hosts:
• malachiteingestion-pa.googleapis.com
• Regional variations of malachiteingestion-pa.googleapis.com (e.g., asia-northeast1-malachiteingestion-pa.googleapis.com, europe-west2-malachiteingestion-pa.googleapis.com, etc.). The specific regional endpoints will depend on your Google Cloud region.
• accounts.google.com
• oauth2.googleapis.com.   Additional URLs for SOAR agents:
  Depending on the specific integrations and connectors used with your SOAR agents, additional URLs may be required. The documentation does not provide a comprehensive list of all possible URLs, but it does mention that connectors support proxies. You should consult the documentation for each specific integration to determine any additional URLs or ports that need to be allowed.
  Proxy Configuration:
  The SecOps remote agents support proxy configurations. The exact method for configuring a proxy depends on whether you are using the installer or Docker agent. Refer to the documentation on "Installer and Docker agent configuration" for detailed instructions on how to configure proxy settings for your specific agent type. The documentation mentions using environment variables like PROXY_ADDRESS, HTTP_PROXY, HTTPS_PROXY, and NO_PROXY.