Google Cloud Pemberi Rekomendasi

Dokumen ini memberikan panduan untuk membantu Anda mengonfigurasi dan mengintegrasikan Google Cloud Recommender dengan Google Security Operations.

Catatan: Versi integrasi: 5.0

Prasyarat

Pastikan Anda menyelesaikan semua langkah prasyarat sebelum mengonfigurasi integrasi.

Membuat dan mengonfigurasi peran IAM

1. Di konsol Google Cloud , buka halaman IAM Roles.

   Buka Peran IAM

2. Klik Buat peran untuk membuat peran kustom dengan izin yang diperlukan untuk integrasi.

3. Untuk peran khusus baru, berikan Judul, Deskripsi, dan ID unik.

4. Tetapkan Role Launch Stage ke General Availability.

5. Tambahkan izin berikut ke peran yang dibuat:

   • iam.roles.create
   • iam.roles.delete
   • iam.roles.get
   • iam.roles.list
   • iam.roles.undelete
   • iam.roles.update
   • iam.serviceAccounts.create
   • iam.serviceAccounts.delete
   • iam.serviceAccounts.disable
   • iam.serviceAccounts.enable
   • iam.serviceAccounts.get
   • iam.serviceAccounts.getIamPolicy
   • iam.serviceAccounts.list
   • iam.serviceAccounts.setIamPolicy
   • iam.serviceAccounts.undelete
   • iam.serviceAccounts.update
   • recommender.iamPolicyInsights.get
   • recommender.iamPolicyInsights.list
   • recommender.iamPolicyLateralMovementInsights.get
   • recommender.iamPolicyLateralMovementInsights.list
   • recommender.iamPolicyRecommendations.get
   • recommender.iamPolicyRecommendations.list
   • recommender.iamPolicyRecommendations.update
   • recommender.iamServiceAccountInsights.get
   • recommender.iamServiceAccountInsights.list
   • recommender.locations.get
   • recommender.locations.list
   • resourcemanager.folders.get
   • resourcemanager.folders.getIamPolicy
   • resourcemanager.folders.setIamPolicy
   • resourcemanager.organizations.get
   • resourcemanager.organizations.getIamPolicy
   • resourcemanager.organizations.setIamPolicy
   • resourcemanager.projects.get
   • resourcemanager.projects.getIamPolicy
   • resourcemanager.projects.list
   • resourcemanager.projects.setIamPolicy
   • securitycenter.assets.list
   • securitycenter.findings.group
   • securitycenter.findings.list
   • securitycenter.findings.listFindingPropertyNames
   • securitycenter.findings.setMute
   • securitycenter.findings.setState
   • securitycenter.sources.get
   • securitycenter.sources.list
   • securitycenter.userinterfacemetadata.get

6. Klik Buat.

Membuat akun layanan

1. Untuk membuat akun layanan, ikuti prosedur membuat akun layanan.

   Penting: Pastikan untuk memberikan peran IAM kustom Anda ke akun layanan di bagian Beri akun layanan ini akses ke project.

2. Setelah membuat akun layanan, download akun tersebut sebagai file JSON. Anda harus memberikan konten file JSON yang didownload saat mengonfigurasi parameter integrasi.

Mengintegrasikan Google Cloud Recommender dengan Google SecOps

Untuk mendapatkan petunjuk mendetail tentang cara mengonfigurasi integrasi di Google SecOps SOAR, lihat Mengonfigurasi integrasi.

Input integrasi

Untuk mengonfigurasi integrasi, gunakan parameter berikut:

Parameter
API Root	Wajib Root API dari Google Cloud layanan Recommender. Nilai defaultnya adalah https://recommender.googleapis.com/v1/
Organization ID	Opsional ID organisasi yang harus digunakan dengan integrasi Pemberi Rekomendasi. Google Cloud
User's Service Account	Wajib Konten akun layanan Recommender Google Cloud . Pastikan untuk memberikan konten lengkap file JSON akun layanan yang telah Anda download saat membuat akun layanan.
Verify SSL	Opsional Jika dicentang, parameter akan memverifikasi apakah sertifikat SSL untuk menghubungkan ke server Google Cloud Recommender valid. Dicentang secara default.

Tindakan

Catatan: Beberapa tindakan hanya berfungsi dengan rekomendasi tertentu.

Menerapkan rekomendasi IAM

Terapkan rekomendasi IAM berdasarkan input yang diberikan.

Tindakan ini hanya berfungsi dengan google.iam.policy.Recommender rekomendasi.

Entity

Tindakan tidak dijalankan pada entity.

Input tindakan

Untuk mengonfigurasi tindakan, gunakan parameter berikut:

Parameter
IAM Recommendations JSON	Wajib Hasil JSON rekomendasi. Hasil JSON dapat diberikan sebagai placeholder dari tindakan List recommendations atau Get recommendation.

Output tindakan

Jenis output tindakan
Lampiran repositori kasus	T/A
Link repositori kasus	T/A
Tabel repositori kasus	T/A
Tabel pengayaan	T/A
Insight entitas	T/A
Insight	T/A
Hasil JSON	Tersedia
Widget OOTB	T/A
Hasil skrip	Tersedia

Hasil skrip

Nama hasil skrip	Nilai
is_success	Benar/Salah

Hasil JSON

{
  "applied_recommendations": [
    {
      "name": "projects/PROJECT_ID/locations/global/recommenders/google.iam.policy.Recommender/recommendations/217d3019-bae5-4a52-9968-787fdd546a53",
      "description": "Replace the current role with a smaller role to cover the permissions needed.",
      "lastRefreshTime": "2023-07-28T07:00:00Z",
      "primaryImpact": {
        "category": "SECURITY",
        "securityProjection": {
          "details": {
            "revokedIamPermissionsCount": 610
          }
        }
      },
      "content": {
        "operationGroups": [
          {
            "operations": [
              {
                "action": "add",
                "resourceType": "cloudresourcemanager.googleapis.com/Project",
                "resource": "//cloudresourcemanager.googleapis.com/projects/PROJECT_ID",
                "path": "/iamPolicy/bindings/*/members/-",
                "value": "[e-mail]",
                "pathFilters": {
                  "/iamPolicy/bindings/*/condition/expression": "",
                  "/iamPolicy/bindings/*/role": "roles/compute.instanceAdmin"
                }
              },
              {
                "action": "remove",
                "resourceType": "cloudresourcemanager.googleapis.com/Project",
                "resource": "//cloudresourcemanager.googleapis.com/projects/PROJECT_ID",
                "path": "/iamPolicy/bindings/*/members/*",
                "pathFilters": {
                  "/iamPolicy/bindings/*/condition/expression": "",
                  "/iamPolicy/bindings/*/members/*": "[e-mail]",
                  "/iamPolicy/bindings/*/role": "roles/compute.admin"
                }
              }
            ]
          }
        ],
        "overview": {
          "resource": "//cloudresourcemanager.googleapis.com/projects/PROJECT_ID",
          "member": "user:[e-mail]",
          "removedRole": "roles/compute.admin",
          "addedRoles": [
            "roles/compute.instanceAdmin"
          ],
          "minimumObservationPeriodInDays": "0"
        }
      },
      "stateInfo": {
        "state": "SUCCEEDED",
        "stateMetadata": {
          "applied_by": "bulk_apply_by_automated_script-2023-08-11"
        }
      },
      "etag": "\"892d57ee41baa03e\"",
      "recommenderSubtype": "REPLACE_ROLE",
      "associatedInsights": [
        {
          "insight": "projects/PROJECT_ID/locations/global/insightTypes/google.iam.policy.Insight/insights/INSIGHT_ID"
        }
      ],
      "priority": "P4"
    },
    {
      "name": "projects/PROJECT_ID/locations/global/recommenders/google.iam.policy.Recommender/recommendations/RECOMMENDATION_ID",
      "description": "Replace the current role with a smaller role to cover the permissions needed.",
      "lastRefreshTime": "2023-07-28T07:00:00Z",
      "primaryImpact": {
        "category": "SECURITY",
        "securityProjection": {
          "details": {
            "revokedIamPermissionsCount": 19
          }
        }
      },
      "content": {
        "operationGroups": [
          {
            "operations": [
              {
                "action": "add",
                "resourceType": "cloudresourcemanager.googleapis.com/Project",
                "resource": "//cloudresourcemanager.googleapis.com/projects/PROJECT_ID",
                "path": "/iamPolicy/bindings/*/members/-",
                "value": "user:[e-mail]",
                "pathFilters": {
                  "/iamPolicy/bindings/*/condition/expression": "",
                  "/iamPolicy/bindings/*/role": "roles/storage.objectAdmin"
                }
              },
              {
                "action": "remove",
                "resourceType": "cloudresourcemanager.googleapis.com/Project",
                "resource": "//cloudresourcemanager.googleapis.com/projects/PROJECT_ID",
                "path": "/iamPolicy/bindings/*/members/*",
                "pathFilters": {
                  "/iamPolicy/bindings/*/condition/expression": "",
                  "/iamPolicy/bindings/*/members/*": "user:[e-mail]",
                  "/iamPolicy/bindings/*/role": "roles/storage.admin"
                }
              }
            ]
          }
        ],
        "overview": {
          "resource": "//cloudresourcemanager.googleapis.com/projects/PROJECT_ID",
          "member": "user:[e-mail]",
          "removedRole": "roles/storage.admin",
          "addedRoles": [
            "roles/storage.objectAdmin"
          ],
          "minimumObservationPeriodInDays": "0"
        }
      },
      "stateInfo": {
        "state": "SUCCEEDED",
        "stateMetadata": {
          "applied_by": "bulk_apply_by_automated_script-2023-08-11"
        }
      },
      "etag": "\"af7635ffeb512998\"",
      "recommenderSubtype": "REPLACE_ROLE",
      "associatedInsights": [
        {
          "insight": "projects/PROJECT_ID/locations/global/insightTypes/google.iam.policy.Insight/insights/INSIGHT_ID"
        }
      ],
      "priority": "P4"
    }
  ],
  "failed_recommendations": []
}

Repositori kasus

Tindakan ini memberikan pesan output berikut:

Pesan output	Deskripsi pesan
Successfully applied provided IAM recommendations.	Tindakan berhasil.
Successfully applied provided IAM recommendation, but some of the recommendations were not applied.	Tindakan berhasil.
No provided IAM recommendations were applied.	Rekomendasi gagal.
Error executing action ACTION_NAME.	Tindakan menampilkan error.

Mendapatkan rekomendasi

Mendapatkan rekomendasi tertentu dari layanan Google Cloud Recommender service.

Entity

Tindakan tidak dijalankan pada entity.

Input tindakan

Untuk mengonfigurasi tindakan, gunakan parameter berikut:

Parameter
Recommendation name	Wajib Menentukan nama rekomendasi yang akan ditampilkan. Tindakan ini menerima beberapa nilai sebagai string yang dipisahkan koma. Contoh input yang diharapkan: projects/projectname/locations/global/recommenders/google.iam.policy.Recommender/recommendations/0f262740-bf4a-4c3d-9573-0da3345cf3f7

Output tindakan

Jenis output tindakan
Lampiran repositori kasus	T/A
Link repositori kasus	T/A
Tabel repositori kasus	T/A
Tabel pengayaan	T/A
Insight entitas	T/A
Insight	T/A
Hasil JSON	Tersedia
Widget OOTB	T/A
Hasil skrip	Tersedia

Hasil skrip

Nama hasil skrip	Nilai
is_success	Benar/Salah

Hasil JSON

[
  {
    "name": "name",
    "description": "This role has not been used during the observation window.",
    "lastRefreshTime": "2023-07-28T07:00:00Z",
    "primaryImpact": {
      "category": "SECURITY",
      "securityProjection": {
        "details": {
          "revokedIamPermissionsCount": 68
        }
      }
    },
    "content": {
      "operationGroups": [
        {
          "operations": [
            {
              "action": "remove",
              "resourceType": "cloudresourcemanager.googleapis.com/Project",
              "resource": "//cloudresourcemanager.googleapis.com/projects/PROJECT_ID",
              "path": "/iamPolicy/bindings/*/members/*",
              "pathFilters": {
                "/iamPolicy/bindings/*/condition/expression": "",
                "/iamPolicy/bindings/*/members/*": "serviceAccount:SERVICE_ACCOUNT_ID.iam.gserviceaccount.com",
                "/iamPolicy/bindings/*/role": "roles/monitoring.admin"
              }
            }
          ]
        }
      ],
      "overview": {
        "resource": "//cloudresourcemanager.googleapis.com/projects/PROJECT_ID",
        "member": "serviceAccount:SERVICE_ACCOUNT_ID.iam.gserviceaccount.com",
        "removedRole": "roles/monitoring.admin",
        "minimumObservationPeriodInDays": "0"
      }
    },
    "stateInfo": {
      "state": "ACTIVE"
    },
    "etag": "",
    "recommenderSubtype": "REMOVE_ROLE",
    "associatedInsights": [
      {
        "insight": "projects/PROJECT_ID/locations/global/insightTypes/google.iam.policy.Insight/insights/"
      }
    ],
    "priority": "P4"
  }
]

Repositori kasus

Tindakan ini memberikan pesan output berikut:

Pesan output	Deskripsi pesan
Successfully found recommendation in the Google Cloud Recommender service.	Tindakan berhasil.
No recommendations were found in the Google Cloud Recommender service.	Data tidak tersedia.
Error executing action ACTION_NAME.	Tindakan menampilkan error.

Daftar rekomendasi

Mencantumkan rekomendasi yang tersedia di layanan Pemberi Rekomendasi Google Cloud .

Catatan: Tindakan ini hanya menampilkan insight dari pemberi rekomendasi google.iam.policy.Recommender.

Entity

Tindakan tidak dijalankan pada entity.

Input tindakan

Untuk mengonfigurasi tindakan, gunakan parameter berikut:

Parameter
Recommendation Filter	Opsional Menentukan filter untuk mengambil rekomendasi. Parameter harus berupa string dalam salah satu format berikut: PROJECTS_OR_ORGANIZATIONS/ PROJECT_OR_ORGANIZATION_NAME_OR_ID //cloudresourcemanager.googleapis.com/ PROJECTS_OR_ORGANIZATIONS/ PROJECT_OR_ORGANIZATION_NAME_OR_ID Jika tidak ada nilai yang diberikan, tindakan akan mengambil project ID dari akun layanan yang dikonfigurasi.
Recommendation Location	Wajib Menentukan Google Cloud lokasi untuk mengambil rekomendasi. Default-nya adalah global.
Recommendation State	Opsional Menentukan status rekomendasi yang akan ditampilkan. Default-nya adalah Not Specified. Nilainya dapat berupa: Not Specified Active Dismissed
Recommendation Priority	Opsional Menentukan prioritas rekomendasi yang akan ditampilkan. Beberapa nilai dapat ditentukan sebagai string yang dipisahkan koma.
Recommender Subtype	Opsional Menentukan subjenis pemberi rekomendasi yang ditampilkan. Default-nya adalah Not Specified. Nilainya dapat berupa: Not Specified REMOVE_ROLE REPLACE_ROLE
Max Records To Return	Opsional Menentukan jumlah kumpulan data yang akan ditampilkan. Jika tidak ada nilai yang diberikan, tindakan akan menampilkan 50 data secara default.

Output tindakan

Jenis output tindakan
Lampiran repositori kasus	T/A
Link repositori kasus	T/A
Tabel repositori kasus	Tersedia
Tabel pengayaan	T/A
Insight entitas	T/A
Insight	T/A
Hasil JSON	Tersedia
Widget OOTB	T/A
Hasil skrip	Tersedia

Hasil skrip

Nama hasil skrip	Nilai
is_success	Benar/Salah

Hasil JSON

[
  {
    "name": "name",
    "description": "This role has not been used during the observation window.",
    "lastRefreshTime": "2023-07-27T07:00:00Z",
    "primaryImpact": {
      "category": "SECURITY",
      "securityProjection": {
        "details": {
          "revokedIamPermissionsCount": 68
        }
      }
    },
    "content": {
      "operationGroups": [
        {
          "operations": [
            {
              "action": "remove",
              "resourceType": "cloudresourcemanager.googleapis.com/Project",
              "resource": "//cloudresourcemanager.googleapis.com/projects",
              "path": "/iamPolicy/bindings/*/members/*",
              "pathFilters": {
                "/iamPolicy/bindings/*/condition/expression": "",
                "/iamPolicy/bindings/*/members/*": "serviceAccount:SERVICE_ACCOUNT_ID",
                "/iamPolicy/bindings/*/role": "roles/monitoring.admin"
              }
            }
          ]
        }
      ],
      "overview": {
        "resource": "//cloudresourcemanager.googleapis.com/",
        "member": "serviceAccount:SERVICE_ACCOUNT_ID",
        "removedRole": "roles/monitoring.admin",
        "minimumObservationPeriodInDays": "0"
      }
    },
    "stateInfo": {
      "state": "ACTIVE"
    },
    "etag": "",
    "recommenderSubtype": "REMOVE_ROLE",
    "associatedInsights": [
      {
        "insight": "projects/i/locations/global/insightTypes/"
      }
    ],
    "priority": "P4"
  },
  {
    "name": "name",
    "description": "This role has not been used during the observation window.",
    "lastRefreshTime": "2023-07-27T07:00:00Z",
    "primaryImpact": {
      "category": "SECURITY",
      "securityProjection": {
        "details": {
          "revokedIamPermissionsCount": 5
        }
      }
    },
    "content": {
      "operationGroups": [
        {
          "operations": [
            {
              "action": "remove",
              "resourceType": "cloudresourcemanager.googleapis.com/Project",
              "resource": "//cloudresourcemanager.googleapis.com/projects/PROJECT_ID",
              "path": "/iamPolicy/bindings/*/members/*",
              "pathFilters": {
                "/iamPolicy/bindings/*/condition/expression": "",
                "/iamPolicy/bindings/*/members/*": "user:[e-mail]",
                "/iamPolicy/bindings/*/role": "roles/chroniclesm.admin"
              }
            }
          ]
        }
      ],
      "overview": {
        "resource": "//cloudresourcemanager.googleapis.com/projects",
        "member": "user:[e-mail]",
        "removedRole": "roles/chroniclesm.admin",
        "minimumObservationPeriodInDays": "0"
      }
    },
    "stateInfo": {
      "state": "ACTIVE"
    },
    "etag": "",
    "recommenderSubtype": "REMOVE_ROLE",
    "associatedInsights": [
      {
        "insight": "projects"
      }
    ],
    "priority": "P4"
  }
]

Repositori kasus

Tindakan ini memberikan pesan output berikut:

Pesan output	Deskripsi pesan
Successfully found recommendations for the provided criteria in the Google Cloud Recommender service.	Tindakan berhasil.
No recommendations were found for the provided criteria in the Google Cloud Recommender service.	Data tidak tersedia.
Error executing action ACTION_NAME.	Tindakan menampilkan error.

Tindakan ini menyediakan tabel dinding kasus berikut:

Rekomendasi yang Tersedia
Kolom	Nama Deskripsi Kategori Subjenis Rekomendasi Prioritas Negara bagian/Provinsi Waktu Terakhir Dimuat Ulang

Ping

Uji konektivitas ke layanan Recommender dengan parameter yang diberikan di halaman konfigurasi integrasi pada tab Google SecOps Marketplace. Google Cloud

Entity

Tindakan tidak dijalankan pada entity.

Input tindakan

T/A

Output tindakan

Jenis output tindakan
Lampiran repositori kasus	T/A
Link repositori kasus	T/A
Tabel repositori kasus	T/A
Tabel pengayaan	T/A
Insight entitas	T/A
Insight	T/A
Hasil JSON	T/A
Widget OOTB	T/A
Hasil skrip	Tersedia

Hasil skrip

Nama hasil skrip	Nilai
is_success	Benar/Salah

Repositori kasus

Tindakan ini memberikan pesan output berikut:

Pesan output	Deskripsi pesan
Successfully connected to the Google Cloud Recommender service with the provided connection parameters!	Tindakan berhasil.
Failed to connect to the Google Cloud Recommender service!	Tindakan menampilkan error.

Memperbarui rekomendasi

Perbarui rekomendasi di layanan Pemberi rekomendasi Google Cloud .

Entity

Tindakan tidak dijalankan pada entity.

Input tindakan

Gunakan parameter berikut untuk mengonfigurasi tindakan:

Parameter
Recommendation name	Wajib Menentukan nama rekomendasi yang akan diperbarui. Tindakan ini menerima beberapa nilai sebagai string yang dipisahkan koma. Contoh input yang diharapkan: projects/projectname/locations/global/recommenders/google.iam.policy.Recommender/recommendations/0f262740-bf4a-4c3d-9573-0da3345cf3f7
Recommendation State	Opsional Menentukan status rekomendasi yang akan diubah. Default-nya adalah Not Specified. Nilainya dapat berupa: Not Specified Claimed Dismissed
Recommendation Result	Opsional Menentukan hasil rekomendasi yang akan diubah. Default-nya adalah Not Specified. Nilainya dapat berupa: Not Specified Failed Succeeded

Output tindakan

Jenis output tindakan
Lampiran repositori kasus	T/A
Link repositori kasus	T/A
Tabel repositori kasus	T/A
Tabel pengayaan	T/A
Insight entitas	T/A
Insight	T/A
Hasil JSON	Tersedia
Widget OOTB	T/A
Hasil skrip	Tersedia

Hasil skrip

Nama hasil skrip	Nilai
is_success	Benar/Salah

Hasil JSON

[
  {
    "name": "name",
    "description": "This role has not been used during the observation window.",
    "lastRefreshTime": "2023-07-28T07:00:00Z",
    "primaryImpact": {
      "category": "SECURITY",
      "securityProjection": {
        "details": {
          "revokedIamPermissionsCount": 68
        }
      }
    },
    "content": {
      "operationGroups": [
        {
          "operations": [
            {
              "action": "remove",
              "resourceType": "cloudresourcemanager.googleapis.com/Project",
              "resource": "//cloudresourcemanager.googleapis.com/projects/PROJECT_ID",
              "path": "/iamPolicy/bindings/*/members/*",
              "pathFilters": {
                "/iamPolicy/bindings/*/condition/expression": "",
                "/iamPolicy/bindings/*/members/*": "serviceAccount:SERVICE_ACCOUNT_ID.iam.gserviceaccount.com",
                "/iamPolicy/bindings/*/role": "roles/monitoring.admin"
              }
            }
          ]
        }
      ],
      "overview": {
        "resource": "//cloudresourcemanager.googleapis.com/projects/PROJECT_ID",
        "member": "serviceAccount:SERVICE_ACCOUNT_ID.iam.gserviceaccount.com",
        "removedRole": "roles/monitoring.admin",
        "minimumObservationPeriodInDays": "0"
      }
    },
    "stateInfo": {
      "state": "ACTIVE"
    },
    "etag": "",
    "recommenderSubtype": "REMOVE_ROLE",
    "associatedInsights": [
      {
        "insight": "projects/PROJECT_ID/locations/global/insightTypes/google.iam.policy.Insight/insights/"
      }
    ],
    "priority": "P4"
  }
]

Repositori kasus

Tindakan ini memberikan pesan output berikut:

Pesan output	Deskripsi pesan
Successfully updated recommendation in the Google Cloud Recommender service.	Tindakan berhasil.
No recommendations were found in the Google Cloud Recommender service.	Data tidak tersedia.
Error executing action ACTION_NAME.	Tindakan menampilkan error.

Perlu bantuan lain? Dapatkan jawaban dari anggota Komunitas dan profesional Google SecOps.