Addition of new CCP data connector GCP VPC flow logs

DataConnectors/GCP/Terraform/sentinel_resources_creation/GCPVPCFlowLogsSetup/GCPVPCFlowLogSetup.tf

@@ -0,0 +1,101 @@
+terraform {
+  required_providers {
+    google = {
+      source  = "hashicorp/google"
+      version = "3.73.0"
+    }
+  }
+
+  required_version = ">= 0.15.0"
+}
+
+data "google_project" "project" {
+  project_id = "Enter Project Id"
+}
+
+variable "topic-name" {
+  type    = string
+  default = "sentinel-vpcflow-topic"
+  description = "Name of existing topic"
+}
+
+variable "organization-id" {
+  type    = string
+  default = ""
+  description = "Organization id"
+}
+
+resource "google_project_service" "enable-logging-api" {
+  service = "logging.googleapis.com"
+  project = data.google_project.project.project_id
+}
+
+resource "google_pubsub_topic" "sentinel-vpcflow-topic" {
+  count = "${var.topic-name != "sentinel-vpcflow-topic" ? 0 : 1}"
+  name = var.topic-name
+  project = data.google_project.project.project_id
+}
+
+resource "google_pubsub_subscription" "sentinel-subscription" {
+  project = data.google_project.project.project_id
+  name  = "sentinel-subscription-vpcflowlogs"
+  topic = var.topic-name
+  depends_on = [google_pubsub_topic.sentinel-vpcflow-topic]
+}
+
+resource "google_logging_project_sink" "sentinel-sink" {
+  project = data.google_project.project.project_id
+  count = var.organization-id == "" ? 1 : 0
+  name = "vpcflow-logs-sentinel-sink"
+  destination = "pubsub.googleapis.com/projects/${data.google_project.project.project_id}/topics/${var.topic-name}"
+  depends_on = [google_pubsub_topic.sentinel-vpcflow-topic]
+
+  filter = "resource.type=\"gce_subnetwork\" AND log_id(\"compute.googleapis.com/vpc_flows\")"
+  unique_writer_identity = true
+}
+
+resource "google_logging_organization_sink" "sentinel-organization-sink" {
+  count = var.organization-id == "" ? 0 : 1
+  name   = "vpcflow-logs-organization-sentinel-sink"
+  org_id = var.organization-id
+  destination = "pubsub.googleapis.com/projects/${data.google_project.project.project_id}/topics/${var.topic-name}"
+
+  filter = "resource.type=\"gce_subnetwork\" AND log_id(\"compute.googleapis.com/vpc_flows\")"
+  include_children = true
+}
+
+resource "google_project_iam_binding" "log-writer" {
+  count = var.organization-id == "" ? 1 : 0
+  project = data.google_project.project.project_id
+  role = "roles/pubsub.publisher"
+
+  members = [
+    google_logging_project_sink.sentinel-sink[0].writer_identity
+  ]
+}
+
+resource "google_project_iam_binding" "log-writer-organization" {
+  count = var.organization-id == "" ? 0 : 1
+  project = data.google_project.project.project_id
+  role = "roles/pubsub.publisher"
+
+  members = [
+    google_logging_organization_sink.sentinel-organization-sink[0].writer_identity
+  ]
+}
+
+output "Next_step"{
+  value = "Please copy the following values to Sentinel while adding new collector"
+}
+
+output "GCP_project_id" {
+  value       = data.google_project.project.project_id
+}
+
+output "GCP_project_number" {
+  value       = data.google_project.project.number
+}
+
+output "GCP_subscription_name" {
+  value       = google_pubsub_subscription.sentinel-subscription.name
+}

DataConnectors/GCP/Terraform/sentinel_resources_creation/GCPVPCFlowLogsSetup/readme.md

@@ -0,0 +1,36 @@
+# GCP VPC Flow Logs Data Connector Configuration Guide
+
+For ingesting data into Microsoft Sentinel , We need few of the resources created/ready on google console , Which will be done with the help of terraform script.
+
+### List of Resources required 
+
+* Topic
+* Subscription for the topic
+* Workload identity pool
+* Workload identity provider
+* Service account with permissions to get and consume from subscription.
+
+### Configurations steps
+1. Select the project from where the VPC Flow logs has to be collected
+2. Open the cloud shell , by clicking activate cloud shell button on the top right
+
+   ![image](https://github.com/user-attachments/assets/1666158e-8295-4c2f-a8c7-16ede37b8fb1)
+
+4. Open the Terraform script [GCPVPCFlowLogSetup](https://github.com/manishkumar1991/MonitorYourInfraHealth/blob/main/DataConnectors/GCP/Terraform/sentinel_resources_creation/GCPVPCFlowLogsSetup/GCPVPCFlowLogSetup.tf) and copy its contents
+5. Create a directory in your Cloud Shell environment, enter it, and create a new blank file.
+   mkdir {directory-name} && cd {directory-name} && touch initauth.tf
+6. Open initauth.tf in the Cloud Shell editor and paste the contents of the script file into it.
+7. Once you pasted the content of terraform script , do remember to change the project id inside terrform script at line number 13 and then save it
+
+   ![image](https://github.com/user-attachments/assets/e77ec777-ebad-4d6e-ba20-600a264c8967)
+
+8. Initialize Terraform in the directory you created by typing the following command in the terminal
+
+   _terraform init_
+
+10. When you receive the confirmation message that Terraform was initialized, run the script by typing the following command in the terminal
+
+    _terraform apply_
+
+12. When asked if you want to create the resources listed, type yes
+13. When the output from the script is displayed, save the resources parameters for later use.  

Solutions/Google Cloud Platform VPC Flow Logs/Data Connectors/GCPVPCFlowLogs_ccp/GCPVPC_ConnectorDefinition.json

@@ -0,0 +1,104 @@
+{
+  "name": "GCPVPCFlowLogsCCPDefinition",
+  "apiVersion": "2024-09-01",
+  "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
+  "location": "{{location}}",
+  "kind": "Customizable",
+  "properties": {
+      "connectorUiConfig": {
+          "id": "GCPVPCFlowLogsCCPDefinition",
+          "title": "GCP Pub/Sub VPC Flow Logs",
+          "publisher": "Microsoft",
+          "descriptionMarkdown": "The Google Cloud Platform (GCP) VPC Flow Logs enable you to capture network traffic activity at the VPC level, allowing you to monitor access patterns, analyze network performance, and detect potential threats across GCP resources.",
+          "graphQueriesTableName": "GCPVPCFlowLogsV2_CL",
+          "graphQueries": [
+              {
+                  "metricName": "Total events received",
+                  "legend": "GCP Pub/Sub VPC Flow Logs",
+                  "baseQuery": "{{graphQueriesTableName}}"
+              }
+          ],
+          "sampleQueries": [
+              {
+                  "description": "Get Sample of GCP VPC Flow Logs",
+                  "query": "{{graphQueriesTableName}}\n | take 10"
+              }
+          ],
+          "dataTypes": [
+              {
+                  "name": "{{graphQueriesTableName}}",
+                  "lastDataReceivedQuery": "{{graphQueriesTableName}}\n | where TimeGenerated > ago(12h) | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
+              }
+          ],
+          "availability": {
+              "status": 1,
+              "isPreview": false
+          },
+          "connectivityCriteria": [
+              {
+                  "type": "HasDataConnectors"
+              }
+          ],
+          "permissions": {
+              "resourceProvider": [
+                  {
+                      "provider": "Microsoft.OperationalInsights/workspaces",
+                      "permissionsDisplayText": "Read and Write permissions are required.",
+                      "providerDisplayName": "Workspace",
+                      "scope": "Workspace",
+                      "requiredPermissions": {
+                          "read": true,
+                          "write": true,
+                          "delete": true,
+                          "action": false
+                      }
+                  }
+              ]
+          },
+          "instructionSteps": [
+              {
+                  "instructions": [
+                      {
+                          "type": "MarkdownControlEnvBased",
+                          "parameters": {
+                              "prodScript": "#### 1. Set up your GCP environment \n You must have the following GCP resources defined and configured: topic, subscription for the topic, workload identity pool, workload identity provider, and service account with permissions to get and consume from the subscription. \n To configure this data connector, execute the following Terraform scripts:\n 1. Setup Required Resources: [Configuration Guide](https://github.com/manishkumar1991/MonitorYourInfraHealth/blob/main/DataConnectors/GCP/Terraform/sentinel_resources_creation/GCPVPCFlowLogsSetup/readme.md)\n 2. Setup Authentication: [Authentication tutorial](https://learn.microsoft.com/en-us/azure/sentinel/connect-google-cloud-platform?tabs=terraform%2Cauditlogs#gcp-authentication-setup). Note: If Authentication is already setup using another GCP data connector , kindly skip this step and use the existing service account and workload identity pool.",
+                              "govScript": "#### 1. Set up your GCP environment \n You must have the following GCP resources defined and configured: topic, subscription for the topic, workload identity pool, workload identity provider, and service account with permissions to get and consume from the subscription. \n To configure this data connector, execute the following Terraform scripts:\n 1. Setup Required Resources: [Configuration Guide](https://github.com/manishkumar1991/MonitorYourInfraHealth/blob/main/DataConnectors/GCP/Terraform/sentinel_resources_creation/GCPVPCFlowLogsSetup/readme.md)\n 2. Setup Authentication: [Authentication tutorial](https://learn.microsoft.com/en-us/azure/sentinel/connect-google-cloud-platform?tabs=terraform%2Cauditlogs#gcp-authentication-setup). Note: If Authentication is already setup using another GCP data connector , kindly skip this step and use the existing service account and workload identity pool."
+                          }
+                      },
+                      {
+                          "type": "CopyableLabel",
+                          "parameters": {
+                              "label": "Tenant ID: A unique identifier that is used as an input in the Terraform configuration within a GCP environment.",
+                              "fillWith": [
+                                  "TenantId"
+                              ],
+                              "name": "TenantId",
+                              "disabled": true
+                          }
+                      },
+                      {
+                          "type": "Markdown",
+                          "parameters": {
+                              "content": "#### 2. Enable VPC Flow Logs \nIn your GCP account, navigate to the VPC network section. Select the subnet you want to monitor and enable Flow Logs under the Logging section.\n\nFor more information: [Google Cloud Documentation](https://cloud.google.com/vpc/docs/using-flow-logs)"
+                          }
+                      },
+                      {
+                          "type": "Markdown",
+                          "parameters": {
+                              "content": "#### 3. Connect new collectors \n To enable GCP VPC Flow Logs for Microsoft Sentinel, click the Add new collector button, fill in the required information in the context pane, and click Connect."
+                          }
+                      },
+                      {
+                          "type": "GCPGrid",
+                          "parameters": {}
+                      },
+                      {
+                          "type": "GCPContextPane",
+                          "parameters": {}
+                      }
+                  ]
+              }
+          ]
+      }
+  }
+}