Hi @vanitharaj1208 is this the Google Cloud Compute Marketplace integration? The Docs for the integration contains information about the SA, permissions, etc. : https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/google-cloud-compute 

Hi @_K_O ,

thank you but what about  google chronicle and Google Cloud API in these 2 integration doc ... user service account has which permissions?

Hey @vanitharaj1208,.

Google Cloud API integration - is a generic integration. It requires only the permissions that you are going to use within the integration itself. Meaning that if you are going to use Google Cloud API integration to work with Compute -> need Compute permissions on SA.

Google Chronicle SA that comes with deployment has only permissions to interact with SIEM API.

so which permissions should i assign to service account to interact with SIEM API. for Google chronicle integration?

when i compare other integration documents they have specified which permissions needs to be given and its clear .

To set up the Chronicle SIEM Integration in SOAR, you historically needed the backstory API key provided from your Google Rep.
99% of the time recently, especially with up to date Chronicle integrations and the Unified SecOps, you may not need to enter any key if it is a 1:1 relationship with SIEM & SOAR. 

If you're trying to send data to Google SecOps SIEM, it would be the ingestion api found in SIEM Settings https://cloud.google.com/chronicle/docs/reference/ingestion-api