[MUSIC PLAYING]
MEGAN YAHYA: Welcome to the Google Cloud Security Showcase,
a special live series where we we'll
focus on security use cases that customers
can solve with Google Cloud.
My name is Megan Yahya, and I'm Product Manager
at Google Cloud.
Today, we'll be walking through one of the top questions we
get from customers.
How can I detect network-based threats
in my Google Cloud environment?
Cloud IDS is Google Cloud's network-based threat-detection
technology that detects malware, spyware,
command-and-control attacks, and many other classes of exploits.
It provides fully-managed network threat detection
with high levels of security efficacy and low noise.
It's quick and easy to deploy, fully managed, scaled,
and operated by Google with high performance
and availability built in.
We have partnered with our friends at Palo Alto Networks
to embed their industry-leading threat-detection technologies
to make sure we have industry-leading detection
both in breadth of coverage and efficacy,
backed by their expert production-proven technologies
and world-class threat-intelligence teams.
Here is a broad overview of how Cloud IDS works.
Cloud IDS is a fully managed cloud-native product
that receives the mirrored traffic from customers' network
and runs threat detection technology from Palo Alto
Networks under the hood.
Cloud IDS may be applied via packet mirroring
to any and all traffic to or from a workload.
Whether it's a compute engine in GCE or a container in GKE,
Cloud IDS moves threat detection closer to the workload.
Not just VPC to internet or VPC to VPC,
but also intra-VPC traffic are inspected
for full north-south and east-west visibility
and detection.
This dramatically simplifies the fulfillment
of the IDS requirement common to several compliance marks.
It also fills in the east-west blindspots suffered by most
SOCs in cloud environments.
Cloud IDS also integrates with SOAR,
which is the Security Orchestration and Automated
Response solutions, such as Palo Alto Networks XSOAR product.
This enables customers to set up automated threat responses
based on Cloud IDS's alerts.
We have built integrations with third-party SIEM solutions
which provide security information and event
management to our customers.
Leveraging these partner solutions
in conjunction with cloud IDS gives customers
additional visibility into network threats and security
analytics on Cloud IDS alerts.
We are also building integrations
with Chronicle security analytics
platform and SCC, the security management platform on GCP.
Now, let me show you how you can use
Cloud IDS to detect network-based threats
in your Google Cloud environment.
Here is how Cloud IDS looks like inside GCP environment.
It is located under Network Security section
next to Cloud Armor and SSL policies products.
Once you click on Cloud IDS, it browse you
to the Dashboard page, where you can
see a summary of top threats and IP addresses that have been
detected within your alerts.
You can customize the dashboard using the time
filters at the top by selecting the time
period you're interested in.
In order to get started, you first
need to create Cloud IDS endpoints.
An endpoint is a cluster of VMs that
are running Palo Alto Networks threat-detection
technology under the hood.
So first, I enter the endpoint name.
Then enter the network that you want to inspect.
If you have a shared VPC, this would be the host product.
Cloud IDS creates a peered VPC network
attached to the network you specify here.
The next step allows you to specify minimum threat severity
alerts you would like to see, such as Low and above, where
Low is for minor threats with little impact on organization's
infrastructure, and Critical is a serious alert.
Once you create this endpoint, you're
going to see it under Endpoints tab.
Now you have an IDS endpoint that
is ready to receive and inspect traffic and generate threats,
but it is not receiving any traffic
yet until you attach a packet mirroring policy to it that
will mirror the traffic from the associated VPC.
Click Attach to set up your packet-mirroring policy.
Now, traffic from the specified source
is mirrored to the IDS endpoint for inspection.
So you give the policy a name.
And you picked the mirrored sources.
And you press Submit.
The policy is going to show up next to your endpoint,
such as this policy that I had created before.
And that's it.
Now, you have your endpoint, and you have
the packet-mirroring policy.
So the traffic is flowing to the endpoint,
and the detection is happening.
So you can go to the Threats tab to see the reported threats.
The Time filter on top allows you
to view threats for a specific time period.
You can also use the Filter menu to filter
by other threat properties, such as severity or source IP
addresses.
You can now click on a specific threat
to get more details about that threat.
Once you click on View threat details,
it's going to take you to Threat Details page.
Threat Details page also shows the application
based on Application Identification technology,
App ID.
It also shows you information about the CV, severity,
threat type, and more description about the alert.
If you go back, you can see that, alternatively, you
can click on View threat logs.
That will take you to a new tab with threat information
in Cloud Logging.
Cloud Logging also enables downstream integrations
with your SIEM tools such as Splunk or SOAR
tools such as Palo Alto XSOAR.
You can also create custom workflows
to take remediation action based on alerts, such as creating
a Cloud Function that triggers on an alert
and generates a firewall rule to block the IP address.
Thank you for tuning in.
Please visit cloud.google.com/security
for more content from Google Cloud experts.
[MUSIC PLAYING]