ELIAS PINTO: Whoa, it's dark in here.
JASON BISSON: I'm glad we have these cave lights.
Did you charge yours?
ELIAS PINTO: Oh, of course not.
Geez, I guess we're going to be partially in the dark
here today.
JASON BISSON: You know who's personally in the dark?
Some of our cloud customers out there,
with multiple logging platforms.
And they're busy searching for who did what, where, and when.
The great news is, at Google Cloud,
we have a solution that will help our customers get out
of the dark by exporting those audit
events into a popular logging platform called Splunk.
You want to check it out?
ELIAS PINTO: Let's do it.
[MUSIC PLAYING]
JASON BISSON: So the first thing we're going to need to do
is create a topic.
In this case, we're just going to name it gcp2splunk.
We're going to click on the Create button.
And the topic is going to be created quite quickly.
The next step is to create the export sync.
To do this, we're going to open up a Cloud Shell.
And then we're going to download a script from a Google Cloud
Storage bucket that has the G Cloud commands
from our solution guide.
Now that the script is downloaded,
we're going to pass it the argument
of the organizational name.
And that's important to note because when
we run that command with the filter,
it will include the children records.
And that will include the folders and projects--
any events underneath the org.
Now you'll notice that from those G Cloud commands,
there's a couple of messages there.
And one is indicating a new service
account has been created.
And it's asking for that service account
to have the Pub/Sub publisher role.
The reason that it needs a Pub/Sub publisher
role is because those exported events from the sync
are going to go to the topic.
So now we'll go back to the Pub/Sub topic.
We'll click on Permissions, and we'll paste in the new service
account.
We're going to need to give it that Pub/Sub publisher role,
and we'll click on Add.
So now we have a topic.
We have an export sync.
The next step that we'll need to do is create a subscription.
And this is a subscription that Splunk
will have to pull those messages from the topic.
So we'll click on New Subscription.
We're going to name it splunk2gcp.
The delivery type is going to be Pull.
And then we'll click on Create.
And just like the topic, that happens pretty quickly.
So now we have a subscription for Splunk
to pull the messages.
The next thing we're going to need to do
is we're going to have to give Splunk permission
to come into the GCP platform and pull the messages.
We'll go up to the IAM roles.
We'll click on Service Accounts.
Then we'll click on Create Service Account.
And here, we're going to name it splunk2gcp.
And we're going to give it a couple of different roles
that are required.
One is going to be the project viewer role.
The second role will be, of course, the Pub/Sub subscriber
role.
So now we have two roles, a viewer, and Pub/Sub subscriber.
We're going to click on Furnish a New Private
Key, with a key type of JSON, and click Create.
You'll notice on the left-hand side
that that JSON key has been downloaded.
And we have a couple of warnings there
about protecting that key.
And it's very important that you consider
integrating this process into your secrets management
platform, because this will give access to the GCP platform.
And also shred any local copies that you have there.
So now that we understand that we have to secure this key,
we'll click Close.
And we'll head back to the topic and try to publish a message.
We'll click on Topics, and we'll click on Publish a Message.
And we'll type in, "Help, I'm in a cave with clowns,"
because that's not scary.
And we'll click on Publish.
The next thing we could do is we can leverage
the metrics to explore in Stackdriver to check out
that messages are being published successfully
and can be used for troubleshooting in the future.
So that's it.
We now have audit events from the Google Cloud Platform
ready to be pulled into your Splunk instance,
making it easier to answer the question of who did what,
where, and when.
ELIAS PINTO: So this does make it easy for security ops teams
to have one place to look for audit events.
JASON BISSON: You got it.
ELIAS PINTO: Don't forget to like, comment, and subscribe.
And if you're working on any cool projects
and would like to get in contact with us,
click on the link in the description.
Thanks for watching.
[MUSIC PLAYING]