> For the complete documentation index, see [llms.txt](https://docs.expel.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.expel.io/connect-your-technology/d-j-integrations/google/google-cloud-platform-setup-for-workbench.md).
# Google Cloud Platform Setup for Workbench
## Prerequisites
Before starting the procedure below, you must have:
1. A Google Cloud Platform admin account.
2. Elevated yourself to admin in Google Cloud Platform.
3. A [Google Workspace integration](/connect-your-technology/d-j-integrations/google/google-workspace-formerly-g-suite-setup-for-workbench.md) onboarded in Workbench. *This is essential, even if you are not a Google Workspace customer, as Google tracks OAuth 2.0 token grants for Google Cloud Platform in the Google Workspace Admin Audit Logs.*
4. GCloud command-line tool installed.
## Step 1: Create a Google Cloud Platform Project
Create a project and name it "expel-integration". Use it to host the rest of the integration's resources.
## Step 2: Activate the Cloud Asset API on the New Project
1. Go to .
2. Select the name of your new project.
3. If the Cloud Asset API isn't enabled, select **Enable**.
## Step 3: Create a Service Account
1. Log in to the **GCP console** and navigate to the **expel-integration project**.
2. From the navigation menu, go to **IAM & Admin > Service Accounts**.
3. Create a new service account and enter the details:
* **Service account name** - enter "expel-gcp-integration".
* **Service account ID** - \[auto-filled]
* **Service account description** - enter "used by Expel".
4. Grant the service account **Pub/Sub Subscriber** and **BigQuery Job User** permissions.
5. Generate a **JSON private key** and download it.
## Step 4: Create Cloud Asset Custom Role and Add to Service Account
Having read-only access to the interface of your technology allows Expel to dig deeper during incident investigations. Our device health team uses this access to investigate potential health issues with your tech. *Expel secures all login information our SOC analysts need about your devices in a MFA password product. Access to this login information is protected using our internal MFA processes.* [*Learn more about the IP addresses all Expel traffic comes from*](/workbench-setup/configure-an-ip-allow-list.md)*.*
1. Open Google Cloud Platform.
2. Make sure you are under the Organization and not a project.
3. Navigate to **IAM & Admin > Roles**.
4. Select **Create Role**.
5. Enter the Title, Description, and ID.
6. Select **Add Permissions**.
7. Add the following to the requested permissions:
* cloudasset.assets.listResource
* cloudasset.assets.listIamPolicy
* cloudasset.assets.listOrgPolicy
* cloudasset.assets.listAccessPolicy
* cloudasset.assets.listOSInventories
8. Select **Add**.
9. After you are done adding permissions, select **Create**.
10. The next step is adding the Service Account with the Role to IAM. You may need to log out and back in to see the new role as an option.
11. Verify you are still under the Organization and not a project.
12. Navigate to **IAM & Admin > IAM**.
13. Select **Add**.
14. Paste in the Service Account Email (`expel-gcp-integration@expel-integration.iam.gserviceaccount.com` if following this guide's nomenclature) as the new **Principal**.
## Step 5: Configure a PubSub Topic and Subscription
Configuring a PubSub topic and subscription creates a *middle-man* for the sink and Expel receiving alerts. WIthout this step, Expel Workbench can't receive alerts from Google Cloud.
1. Navigate to **Pub/Sub > Topics**.
2. Create a new topic:
* **Topic ID** - expel-integration-topic
* Select **Add a default subscription**. This creates a subscription that you change in the next step.
Make note of the full topic name as you will use it later. It follows this format: `projects/[project-id]/topics/expel-integration-topic`
3. Navigate to **Pub/Sub > Subscriptions**. The *expel-integration-topic-sub* subscription created in the previous step appears in your list of subscriptions.
4. Change the Acknowledgement deadline to **600** seconds and keep the default values for the rest of the options.
5. Make note of the full subscription name because you will use it later. It follows this format: `projects/[project-id]/subscriptions/expel-integration-topic-sub`
## Step 6: Create the Aggregated Organization Log Sinks
{% hint style="info" %}
Organization sinks can't be created from the Google Cloud console, so you'll use the gcloud command-line tool.
{% endhint %}
1. Log in to GCP.
```
$ gcloud auth login
```
2. List the organizations and **take note** of the org ID.
```
$ gcloud organizations list
```
3. Create the pub/sub org sink.
1. Use this command to filter activity logs:
```
$ gcloud logging sinks create expel-org-sink-pubsub pubsub.googleapis.com/projects/[project-id]/topics/expel-integration-topic --include-children --organization=[org-id] --log-filter="logName=~\"cloudaudit\.googleapis\.com\%2Factivity\" AND protoPayload.serviceName!=\"k8s\.io\""
```
This automatically creates a new service account which must be granted Pub/Sub Publisher permissions on the integration’s topic:\
*Created \[].*
2. Grant the newly created service account the Pub/Sub Publisher role on the topic.
\
[Learn more about sinks in Google's documentation.](https://docs.cloud.google.com/logging/docs/export/configure_export_v2)
4. From the console, navigate to **PubSub > Topics > expel-integration-topic**. Use the **Permissions** tab to add the service account created above as a member.
## Step 7: Enable Event Threat Detection (optional)
Event Threat Detection is a service offered by Google Cloud Platform at an additional cost (at the time of writing, it is included in the SCC Premium Tier). If you do not use this service, skip this section and proceed to [Step 8](#h_01hh480wh2n1jyhmdfa406xc4k). [Learn more about Event Threat Detection.](https://docs.cloud.google.com/security-command-center/docs/concepts-event-threat-detection-overview#log_types)
Linking Event Threat Detection with Expel Workbench is a two-part process. You must enable Continuous Exports to Cloud Logging directed at a specific project and then create a Log Sink that routes logs to the Expel Pub/Sub topic.
### Create Continuous Exports for Cloud Logging
To log findings:
1. In the Google Cloud console, navigate to the [Security Command Center page](https://console.cloud.google.com/security/command-center/no-org?pli=1).
2. Make sure you are under the Organization and not a project.
3. Select **Settings**.
4. Select the **Continuous Exports** tab.
5. Under Export name, select **Logging Export**.
6. Under Sinks, set Log Findings to **Logging**.
7. Review the destination Logging project, as there are different options depending on what is configured:
* If you have **no Logging Project currently defined**, set the Logging Project to the Expel project created in [Step 1](#h_01hh480wh2t612439xh1vws2c5).
* If you **have an existing Logging Project defined** and you want to use that existing project, don't change this setting, but do note the logging project name for use in the next section.
8. Select **Save**.
### Create a Sink for Event Threat Detection
1. If you are using an existing logging project for ETD findings, you should ensure you are under the existing project before following these steps. Otherwise, navigate to the Expel project created in [Step 1](#h_01hh480wh2t612439xh1vws2c5).
2. Navigate to **Log Router**.
3. Create a new sink:
1. **Name** - enter "ETD to Expel".
2. **Description** - enter "Send Event Threat Detection logs to Expel".
3. **Sink Destination** - select the Pub/Sub topic created previously in [Step 5](#h_01hh480wh2y7bv1rpnpz3qg05k).
4. **Choose logs to include in Log Sink** - use the filter `resource.type="threat_detector"`.
5. Preview the logs (this will open a new tab) to ensure previous steps were completed correctly and that you can verify the filter selects the threat\_detector (ETD) logs. If the preview shows the correct ETD logs, then go back to the original tab and select **Create Sink.**
6. Add the permission needed to allow either the existing or the new project to publish to the Expel pub/sub topic:
1. From the Console, navigate to **PubSub > Topics > expel-integration-topic**.
2. Select the **Permissions** tab.
* If you are using an **existing** logging project, add the role of Pub/Sub Publisher for the service account associated with the existing logging project.
* If you are using the **Expel project**, add the role of Pub/Sub Publisher for the service account associated with the Expel project.
### Verify Log Events are Flowing to the Pub/Sub Topic
1. Go to either the Expel project or existing project used for logging from the above steps.
2. Navigate to **Log Router** and locate the Log Sinks section.
3. Look for the Log Sink created in the above steps (“ETD to Expel”). Look at the Column named **Volume** and verify you see more than zero for volume to indicate the Log Sink is routing logs to the Pub/Sub topic.
## Step 8: Add Google Cloud Platform as a Security Device in Workbench
Now that you have the correct access configured and noted the credentials, you can integrate your tech with Workbench.
1. [Log in to Workbench](https://workbench.expel.io/auth/login?orig=%2F).
2. Navigate to **Organization Settings > Security Devices**.
3. Select **Add Security Device**.
4. Search for and select **Google Cloud Platform**.
5. Fill in the Connection Settings as follows:
* **Auth JSON** - enter the JSON key from [Step 3](#h_01hh480wh2bzapx76wjx5jj6zp).
* **Subscription Name** - enter the full PubSub subscription name from [Step 5](#h_01hh480wh2y7bv1rpnpz3qg05k).
* **Organization ID** - enter your [GCP Organization ID](https://docs.cloud.google.com/resource-manager/docs/creating-managing-organization#retrieving_your_organization_id).
6. Select **Save**.
Your device should be created successfully within a few seconds. A few reminders:
* After your connection is healthy, it will take some time for your device to begin polling and receiving data.
* To check on the status, select the downward arrow for your device in the first column and choose **View details**.
* Polling will happen first; data will be received after that. **You must refresh the page to see updates.**
* If your device does not begin polling within 15 minutes, and does not begin receiving data within 30 minutes, [contact our support team for help](/support/how-to-reach-us.md).
* To check if alerts are coming through, navigate to **Dashboards > Alert Analysis**. Scroll to the device you want to check, and select the **Expel Alerts** tab to reveal more alert information. It can take 36 to 72 hours for alerts to appear after setup, as we [tune your device](/workbench-reference/alerts/how-expel-alerts-work.md#device-tuning).
{% hint style="info" %}
Next, you may optionally enable **Data Access audit logs** to further support Expel in alert triage and investigation. [Learn more here](/connect-your-technology/d-j-integrations/google/google-cloud-platform-setup-for-workbench/google-cloud-platform-enable-data-access-log-support.md).
{% endhint %}
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.expel.io/connect-your-technology/d-j-integrations/google/google-cloud-platform-setup-for-workbench.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.