Integrate Akeyless with Google SecOps

This document explains how to integrate Akeyless with Google Security Operations.

Use cases

The Akeyless integration uses Google SecOps capabilities to support the following use cases:

  • Synchronize integration credentials: Automatically update credentials and sensitive parameters across Google SecOps integration instances, connectors, and jobs using secrets stored in Akeyless.

  • Retrieve secrets in playbooks: Fetch static secrets or specific secret versions from Akeyless on demand during playbook execution to authenticate with external services.

  • Automate credential rotation: Propagate rotated API keys, tokens, and passwords from Akeyless to Google SecOps integrations, connectors, and jobs by mapping parameters to the latest secret version, preventing disruptions caused by expired credentials.

  • Control credential updates with version pinning: Pin integration, connector, or job parameters to a specific secret version in Akeyless to validate credential changes or roll back to a previous version when needed.

  • Eliminate hardcoded secrets in workflows: Centralize sensitive credentials in Akeyless instead of embedding them directly in playbook inputs or custom scripts, reducing credential exposure across SOC workflows.

Before you begin

Before you configure the integration in the Google SecOps platform, verify that you have the following:

  • API key credentials: An Akeyless Access ID and Access Key for authentication.

    For more information, see Akeyless API Key Authentication.

  • Access permissions: Read permissions granted to your authentication method for the secrets that Google SecOps retrieves.

    For more information, see Akeyless Role-Based Access Control (RBAC).

  • Network connectivity: Network access from your Google SecOps instance or remote agent to your Akeyless API Gateway URL.

Integration parameters

The Akeyless integration requires the following parameters:

Parameter Description
API Gateway URL

Optional.

The URL of your Akeyless API Gateway.

The default value is https://api.akeyless.io.
Access ID

Required.

The access ID for your Akeyless API key authentication method.
Access Key

Required.

The access key associated with your Akeyless access ID.
Verify SSL

Required.

If selected, the integration validates the SSL certificate when connecting to the Akeyless server.

Enabled by default.

For instructions about how to configure an integration in Google SecOps, see Configure integrations.

You can make changes at a later stage, if needed. After you configure an integration instance, you can use it in playbooks. For more information about how to configure and support multiple instances, see Supporting multiple instances.

Actions

For more information about actions, see Respond to pending actions from Your Workdesk and Perform a manual action.

Get Secret Value

Use the Get Secret Value action to retrieve a secret value from Akeyless for use in playbooks.

This action doesn't run on Google SecOps entities.

Action inputs

The Get Secret Value action requires the following parameters:

Parameter Description
Secret Name

Required.

The name or path of the secret to retrieve from Akeyless.

To retrieve the latest version, enter SECRET_NAME or SECRET_NAME:latest.

To retrieve a specific version, enter SECRET_NAME:VERSION_NUMBER, where VERSION_NUMBER is a positive integer (for example, /prod/api-key:2).

Action outputs

The Get Secret Value action provides the following outputs:

Action output type Availability
Case wall attachment Not available
Case wall link Not available
Case wall table Not available
Enrichment table Not available
JSON result Available
Output messages Available
Script result Available
JSON result

The following example shows the JSON result output received when using the Get Secret Value action:

{
  "secret_name": "/secops/integrations/example-api-key",
  "version": "latest",
  "secret_value": "EXAMPLE_SECRET_VALUE"
}
Output messages

On the Case Wall, the Get Secret Value action provides the following output messages:

Output message Message description
Successfully retrieved secret 'SECRET_NAME' (version: 'SECRET_VERSION') from Akeyless Security. The action succeeded.
Failed to retrieve secret 'SECRET_NAME' (version: 'SECRET_VERSION') from Akeyless Security. Reason: ERROR_REASON

The action failed.

Verify that the secret path and version exist in Akeyless and that your authentication credentials have read access to the secret.
Error executing action 'Get Secret Value'. Reason: Invalid credential mapping format for value 'SECRET_NAME'. Expected format: 'secret_name' or 'secret_name:version' (where version is a positive integer or 'latest').

The action failed.

Verify the format of the Secret Name parameter.
Script result

The following table lists the value for the script result output when using the Get Secret Value action:

Script result name Value
is_success true or false

Ping

Use the Ping action to test connectivity to the Akeyless server.

This action doesn't run on Google SecOps entities.

Action inputs

None.

Action outputs

The Ping action provides the following outputs:

Action output type Availability
Case wall attachment Not available
Case wall link Not available
Case wall table Not available
Enrichment table Not available
JSON result Not available
Output messages Available
Script result Available
Output messages

On the Case Wall, the Ping action provides the following output messages:

Output message Message description
Successfully connected to the Akeyless server with the provided connection parameters! The action succeeded.
Failed to connect to the Akeyless server! Reason: ERROR_REASON

The action failed.

Verify your API Gateway URL, Access ID, Access Key, and SSL settings.
Script result

The following table lists the value for the script result output when using the Ping action:

Script result name Value
is_success true or false

Jobs

For more information on jobs, see Configure a new job and Advanced scheduling.

Sync Integration Credentials Job

Use the Sync Integration Credentials Job to automatically synchronize secrets stored in Akeyless with your configured Google SecOps integration instances, connectors, and jobs.

Job parameters

The Sync Integration Credentials Job requires the following parameters:

Parameter Description
API Gateway URL

Optional.

The URL of your Akeyless API Gateway.

The default value is https://api.akeyless.io.
Access ID

Required.

The access ID for your Akeyless API key authentication method.
Access Key

Required.

The access key associated with your Akeyless access ID.
Verify SSL

Required.

If selected, the integration validates the SSL certificate when connecting to the Akeyless server.

Enabled by default.
Environment Name

Required.

The Google SecOps environment where the target integration instances, connectors, and jobs are configured.

The default value is Default Environment.
Credential Mapping

Required.

A JSON or YAML dictionary that maps target integration instances, connectors, and jobs to the Akeyless secrets containing their parameter values.

Include at least one mapped parameter under the integration_instances, connectors, or jobs keys.

To see an example, see Example Credential Mapping.

The default value is {"integration_instances": {"Integration_Instance_Name": {"Parameter_Name": "Secret_Name"}}}.

Example Credential Mapping

The following example shows how to map parameters for integration instances, connectors, and jobs in the Credential Mapping parameter:

{
  "integration_instances": {
    "VirusTotal_Prod": {
      "API Key": "/secops/prod/virustotal-api-key"
    },
    "Jira_Instance_1": {
      "API Token": "/secops/prod/jira-api-token:2"
    }
  },
  "connectors": {
    "CrowdStrike Falcon Alerts Connector": {
      "Client Secret": "/secops/prod/crowdstrike-client-secret:latest"
    }
  },
  "jobs": {
    "ServiceNow Sync Closed Cases": {
      "Password": "/secops/prod/servicenow-password:1"
    }
  }
}

Need more help? Get answers from Community members and Google SecOps professionals.