Prerequisites for onboarding GCP

Before you begin onboarding GCP, you must review the following prerequisites.

Permissions

Before you begin to onboard GCP to Cortex XDR, ensure that you have the necessary permissions:

• In Cortex XDR, you must have a Cortex XDR role with Data Sources - View & Edit permissions (to add/configure cloud accounts in Cortex XDR). This role is included in the following built-in roles: Instance Administrator, Security Admin, and IT Admin.

• In GCP, you must have access to Google Cloud console and an admin user with the required GCP permissions.

Required APIs

Ensure you have enabled the required APIs in the GCP project you are onboarding.

Required admin GCP permissions for Cortex XDR onboarding

Use the following template to create a dedicated role with the permissions required for onboarding GCP to Cortex XDR:

{
  "title": "CortexCloudOnboarding",
  "description": "Custom role with permissions required for onboarding Cortex XDR",
  "stage": "GA",
  "includedPermissions": [
    "iam.roles.create",
    "iam.roles.delete",
    "iam.roles.get",
    "iam.roles.list",
    "iam.roles.update",
    "iam.serviceAccounts.create",
    "iam.serviceAccounts.delete",
    "iam.serviceAccounts.get",
    "iam.serviceAccounts.getIamPolicy",
    "iam.serviceAccounts.list",
    "iam.serviceAccounts.setIamPolicy",
    "iam.serviceAccounts.update",
    "logging.sinks.create",
    "logging.sinks.delete",
    "logging.sinks.get",
    "logging.sinks.update",
    "pubsub.subscriptions.create",
    "pubsub.subscriptions.delete",
    "pubsub.subscriptions.getIamPolicy",
    "pubsub.subscriptions.setIamPolicy",
    "pubsub.subscriptions.update",
    "pubsub.topics.create",
    "pubsub.topics.delete",
    "pubsub.topics.getIamPolicy",
    "pubsub.topics.setIamPolicy",
    "pubsub.topics.update",
    "resourcemanager.folders.get",
    "resourcemanager.folders.getIamPolicy",
    "resourcemanager.folders.list",
    "resourcemanager.folders.setIamPolicy",
    "resourcemanager.organizations.get",
    "resourcemanager.organizations.getIamPolicy",
    "resourcemanager.organizations.setIamPolicy",
    "resourcemanager.projects.get",
    "resourcemanager.projects.getIamPolicy",
    "resourcemanager.projects.list",
    "resourcemanager.projects.setIamPolicy"
  ]
}