Share via

Collect GCP Armor logs to Microsoft Sentinel

Sergy Lopez 161 Reputation points
2022-11-02T17:45:04.52+00:00

We are trying to forward logs generated by GCP Armor to Sentinel to use it as our SIEM.

does any one know if there is a way to do that, in that moment we are thinking that could be exporting the logs to a storage account on GCP and use AZcopy to move it to Blob storage and them charge to Sentinel..

Microsoft Security | Microsoft Entra | Other
Microsoft Security | Microsoft Sentinel
0 comments
Accepted answer
  1. Clive Watson 7,866 Reputation points MVP Volunteer Moderator
    2023-03-07T10:44:04.3+00:00

    Wouldn't you use https://cloud.google.com/armor/docs/monitoring and the Rest api (most, if not all of the Sentinel Solutions for Google leverage the api's). Caveat - I'm not a Google expert!

    You can then use a custom or codeless connector to bring it into Sentinel https://learn.microsoft.com/en-us/azure/sentinel/create-custom-connector (assuming the data you need is exposed via this api).

    1 person found this answer helpful.
    0 comments

2 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Sergy Lopez 161 Reputation points
    2022-11-03T14:54:44.667+00:00

    Thanks for the Answear @David Broggy we will work on it, an I will let you know if it works for us.

    1 person found this answer helpful.
  2. David Broggy 6,371 Reputation points MVP Volunteer Moderator
    2022-11-03T14:06:28.127+00:00

    Hi Sergy,
    The only methods for log collection from GCP that I'm aware of are listed here:
    803891

    256851-image.png

    You may need some experience with LogStash for some of these methods.

    Maybe @Clive Watson or @Ofer Gal _Shezaf have some insight/updates into this.

    0 comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.