I have a question:
When Ingesting from GCS buckets using feeds management UI, it mentions that chronicle doesn’t need authentication for the bucket because it has internal user, is this user a global user or specific to that cloud account? Can i ingest arbitrary bucket i don’t own but know the address to without authentication as unstructured logs and be able to view some bucket contents in chronicle?
Ingesting from GCS buckets using feeds management UI
+2
+9hi @Donald_Munengiw , this is a SIEM, not a SOAR question, it would be better to ask it in the specific chat)
Hi Donald,
If the bucket is public, then yes you would be able to connect to that GCS Bucket and configure the feed to ingest. However, it would be best practice on the GCS Bucket owner to supply permission restrictions on the bucket such that only authenticated users can access this bucket. If you would like your Chronicle tenant to connect to a bucket with restricted access, then a member with the appropriate permissions in a project where that GCS Bucket exists would need to add the principal service account in Google Cloud IAM with Chronicle's ingest API service account, then give it read access to that GCS bucket. Hope this answers your question.
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.