Integrating with Google Workspace

Overview

Blumira integrates with the Google Workspace productivity suite to stream security event logs and alerts to Blumira for threat detection and actionable response.

Required: Google Workspace licensing above Free Tier and an Administrator user account.

Configuring Google Workspace and gathering your credentials

Before you can configure the Blumira Cloud Connector in the app, you must complete the following procedures and gather your Google Workspace account credentials:

Create a GCP project for your organization's workspace

1. With Google Workspace Admin permissions, go to the GCP Console: https://console.cloud.google.com.
2. Next to the Google Cloud Platform header, click Select a project.
3. Click New Project.
4. In the Project Name box, type a unique project name.
5. In the Billing account box, select the appropriate account.
6. Verify that the default Organization and Location values are correct, or edit these if needed.
7. Click Create.

Create a service account and gather the JSON key file

To create a GCP Service Account in the newly created project for fetching logs:

1. In the Project dropdown menu, select the project you created.
2. On the left toolbar, select IAM & Admin > Service Accounts.
3. Select +Create Service Account at the top of the page.
4. Type a unique service account name.
5. Type a unique service account ID.
6. Type a service description.
7. Click Create and continue.
8. Select the dropdown Select A Role, then click Service Account in the left column and Service Account Token Creator in the right column.
9. Click Continue.
10. Click Done at the bottom.
11. Select your new service account from the list.
12. Click the KEYS tab.
13. Click Add Key, then click Create New Key.
    Note: If you see a "Service account key creation is disabled" error at this step, you can modify the policy as long as you have the Organization Policy Administrator role by doing the following:
    
    1. Navigate to the IAM & Admin and then click Organization Policy.
    2. Find the policy called Disable service account key creation.
    3. Click Manage Policy.
    4. In the Edit policy window, select Override parent’s policy. 
    5. Under Enforcement, select Off. 
    6. Click Set policy.
    7. Allow at least 15 minutes for the change to process in Google, then retry adding the key.
14. Select JSON format for the key. The JSON file should automatically download from your browser.
15. Open the JSON Key file on your local machine in a plain text editor.
    Note: You will copy and paste the entire contents of this JSON file into the Blumira Cloud Connector configuration window in Step 5 of Configuring Blumira, below.
16. Find the Client_ID and copy the number to use in Step 6 of Link APIs to the service account.

Enable Admin SDK and IAM APIs for the project

• Enable the Google Admin SDK API:
  1. From the GCP Main Console Page, select the project you created in the previous steps on the top left.
  2. Navigate to APIs & Services > Library.
  3. In the search bar, type Admin SDK.
  4. Select the Admin SDK API.
  5. Click Enable.
• Enable the Identity and Access Management (IAM) API:
  1. Return to the same API Library page as shown in the previous section.
  2. In the search bar, type IAM API.
  3. Select the Identity and Access Management (IAM) API.
  4. Click Enable.

Link APIs to the service account

1. Log in to https://admin.google.com as a global administrator.
2. In the left side toolbar, navigate to Security > Access and data control > API Controls.
3. Scroll to the bottom section called “Domain-Wide Delegation.”
4. Click Manage Domain Wide Delegation.
5. Click Add New.
6. In the Add a new Client ID window, enter the Client_ID number saved from the JSON file in the previous steps.
7. Copy and paste the following into the OAuth Scopes section: https://www.googleapis.com/auth/admin.reports.audit.readonly,https://www.googleapis.com/auth/iam
8. Click Authorize.

Important: Per Google's Delegation of Authority documentation, “Only users with access to the Admin APIs can access the Admin SDK Reports API, therefore your service account needs to impersonate one of those users to access the Admin SDK Reports API.” In other words, you must provide the email address of one of your Workspace users with admin console access so the module can use the account to fetch your Google logs.

Configuring the Blumira Cloud Connector

After you obtain your integration's configuration parameters, enable Blumira to collect your logs by configuring the Cloud Connector in the app.

Cloud Connectors automate the configuration of your integrations without requiring you to use a sensor. After you obtain your integration's configuration parameters, you can then enable Blumira to collect your logs.

To configure the Blumira Cloud Connector:

1. In the Blumira app, navigate to Settings > Cloud Connectors.
2. Click + Add Cloud Connector.
3. In the Available Cloud Connectors window, click the connector you want to add.
4. In the Cloud Connector Name box, type a name to help identify the specific integration. 
5. Enter the credentials that you collected in the previous steps.
6. Click Connect.

Note: Some Google event logs take longer to reach the Cloud connector than others. See Google's Data retention and lag time for a full list of log types and their lag times.

Testing detections

Now that your Cloud Connector is configured wait at least 15 minutes for detection rules to automatically be deployed to your account, then use our testing procedures to trigger test detections that you can resolve in the app. See Testing Google Workspace detections for steps.