Gemini Enterprise

Use Gemini Enterprise data with Cortex XSIAM.

The capabilities and sub-capabilities listed for this connector are available with any active Cortex Cloud Posture Security license.

This connector includes the following capabilities and sub-capabilities (if applicable):

• Agent Security Scanning: BEFORE YOU BEGIN - In the Google Cloud Console, on your target service account, grant access to the service account google-onboarding@{{project_id}}.iam.gserviceaccount.com and assign it the Service Account Token Creator role. Once completed, you can monitor and assess the security posture of your Gemini Enterprise agents.

How to configure the Gemini Enterprise connector

To access Gemini Enterprise, Cortex XSIAM requires the following information, which you will specify during the connection process:

• Service Account Email: A service account email in Gemini Enterprise is a special non-human account. Applications and virtual machines use this account to authenticate and access Google Cloud resources securely. It provides a secure identity for programmatic access to the Gemini for Google Cloud API and related services.
• Project ID: A Project ID in Gemini Enterprise is a unique identifier for a Google Cloud project. Gemini Enterprise uses the Google Cloud platform, so its services and resources are organized within the same project structure. A Project ID is needed for authentication, billing, and access control when working with Gemini models and related services.
• Location: In Google Cloud's Gemini Enterprise, a "location" is a specific geographic area for creating, processing, and storing data. Location selection allows enterprises to control data residency. This control is important for data privacy, compliance, and meeting requirements in different regions.

New locations created by Gemini Enterprise will be added by Cortex XSIAM in a phased manner.

Task 1: Configure Google Cloud Console

1. Go to your project home page (where you developed your agent) in the Google Cloud console. Copy your project ID and project number and have it available.
2. From the Google Cloud console, select Menu > APIs & Services > Enabled APIs & Services > +Enable APIs and services.
3. To create a new service account, select Menu > IAM & Admin > Service Accounts > +Create service account.
4. In the list of service accounts, click on the service account that you just created. The service account details are displayed. Copy the service account email address and have it available.
5. Select Principals with access > View by principals > Grant access.
6. In the Add principals section, specify the name of the principal.
7. In the Assign roles section, select the Service Account Token Creator role and click Save.

Task 2: Connect Gemini to Cortex XSIAM

1. In Cortex XSIAM, navigate to Settings → Data Sources & Integrations.
2. Click + Add new.
3. In the Add Data Sources or Integrations page, search for Gemini.
4. Under Recommended, hover over the new Gemini integration and click Add Instance to launch the configuration wizard.
5. Under the Capabilities tab, Enter a Name for your application.
6. Select Security Posture under Default Capabilities.
7. Click Next.
8. Under Connection, enter your Project ID (You can use either the project ID or the project number), and Service Account Email.
9. Under Configuration tab, select a Sync Interval. Choose a meaningful Tag to distinguish between various applications in different environments.
10. A confirmation message indicates that Gemini is successfully connected. Confirm the Summary details and click Save instance.