With the announcement of auto-JSON parsing in Google SecOps, organizations can now leverage JSON data without the need to build a parser to make the data available. This example job can pull Google Cloud Monitoring metrics in to Google SecOps.
- Google Cloud Project - Metrics are retrieved at a project-level.
- Service Account JSON Key - To retrieve metrics, a service account credential must be created with the
monitoring.timeSeries.list
permission.
- Navigate to Releases in this repo and download the .zip package.
- In Chronicle SOAR/Security Operations, install the integration by opening the IDE and importing the package.
- Set up a job via the Job Scheduler, providing the project name, service account JSON, and the metric you wish to retrieve.
- You'll also need to provide your ingestion API credential (JSON format) and your SecOps cutomer ID
In this example, we're retrieving network utilization metrics for GCE workloads.