falcon-integration-gateway

GCP Backend

Integration with Google Cloud Platform - Security Command Center.

Example Configuration file

config/config.ini configures Falcon Integration Gateway. Below is a minimal configuration example for GCP:

[main]
# Cloud backends that are enabled. The gateway will push events to the cloud providers specified below
backends=AZURE

[gcp]
# GCP section is applicable only when GCP backend is enabled in the [main] section.

# Use GOOGLE_APPLICATION_CREDENTIALS env variable to configure GCP Backend. GOOGLE_APPLICATION_CREDENTIALS
# is an environment variable used to configure GCP Service accounts, it should point out to the credentials
# file for given service account.

Developer Guide

• Build the image

  docker build . -t falcon-integration-gateway
  

• Run the application

  docker run -it --rm \
      -e FALCON_CLIENT_ID="$FALCON_CLIENT_ID" \
      -e FALCON_CLIENT_SECRET="$FALCON_CLIENT_SECRET" \
      -e FALCON_CLOUD_REGION="us-1" \
      -e GOOGLE_APPLICATION_CREDENTIALS=/gcloud/gcloud-secret-falcon-integration-gateway.json \
      -v ~/.config/gcloud:/gcloud/ \
      falcon-integration-gateway:latest
  

Developer Resources

• Google Cloud Python Client
• Understanding Google Cloud Resource hierarchy
• GCP SCC: API Explorer
• GCP SCC: How to Create & manage Security Findings

This site is open source. Improve this page.