For the complete documentation index, see llms.txt. Markdown versions of documentation pages are available by appending .md to page URLs; this page is available as Markdown.

Google GCP

This is a combined document for enabling the Dropzone AI Data Source and Alert Source for GCP (Google Cloud Platform).

The Dropzone AI platform integrates with GCP (Google Cloud Platform) APIs for ingesting alerts and enriching investigations with data from GCP such as VM and service account information. This document describes how to set up API credentials and install them into the Dropzone platform.

Integration Overview

To enable these integrations you will perform the following actions:

• Determine which section of your GCP environment to enable Dropzone visibility
• Grant IAM access to the Dropzone service account
• Enable the Alert and Data sources

Determine Dropzone Visibility Scope

Dropzone requires some IAM access to query your GCP environment.

You will later be granting the Dropzone service account access to a portion of your GCP environment, at either a folder level or for the whole organization.

For example, in the screenshot below, if you were to grant access via the production folder then Dropzone would have access to the Project FreezeRay project, and any other folders or projects you add to production in the future. However, it would not be available to alligator-apples. If you grant access via the top level org, example.net then it would apply to all folders and projects going forward.

When enabling the integration you will be supplying the ID of the top level folder or organization, and Dropzone will recurse through all objects thereunder when making Data Source queries.

When you've chosen your folder or org, record the ID value for use later in the Dropzone UI where it is called "Parent Resource".

Identify your service account email address

To obtain the email address of your Dropzone service account, do the following:

• Navigate to your Dropzone AI tenant home page e.g. https://mycompany.dropzone.app

• In the bottom left hand corner, navigate to Settings > Integrations

• Click "Available"

• In the Search bar, search GCP, then click "Configure"

• Record the "SERVICE ACCOUNT EMAIL" field for use in the GCP Console interface

Grant GCP Access to Dropzone Service Account

• Go to the GCP cloud console at https://console.cloud.google.com

• Click the current project dropdown

• Click "All"

• Select the organization or the folder you've chosen for Dropzone visibility

• From the left menu, navigate to IAM & Admin > IAM

• Under "New principals," input the email address you copied earlier from the Dropzone UI "SERVICE ACCOUNT EMAIL"

• Click "Select a role"

• Add the following roles:

• Continue adding roles via the "Add another role" button until complete

• Click "Save"

Enable GCP

The Data source integration allows Dropzone AI to interact with your GCP environment to gather information for use in investigation analysis and interactive chat.

You'll need the following information:

To enable the Data Source integration, do the following:

• Navigate to your Dropzone AI tenant home page e.g. https://mycompany.dropzone.app

• In the bottom left hand corner, navigate to Settings > Integrations

• Click "Available"

• In the Search bar, search GCP, then click "Configure"

• Under the Data Source heading, input the "Parent Resource" ID

• Select the "Parent Resource Type" that matches the resource you've selected

• Select the "Default Zone." This is used for queries (such as finding VMs) when a zone is not specified

• Click "Test & Save" to finish

If you have any errors engage your Dropzone AI support representative.