Configure the Integration
The Cyware Intel Exchange integration with Google SecOps SIEM requires setup on both platforms. This includes generating Cyware Intel Exchange API credentials, configuring Google Cloud resources, deploying the Cloud Function, and connecting the integration to ingest threat intelligence.
Once configured, the integration allows Cyware IOCs to flow into Google SecOps, making them available for dashboards, detection rules, and SIEM search.
Before you Start
Ensure that the following prerequisites are met before starting configuration:
Access to the Cyware Intel Exchange platform.
Access to the Google SecOps platform, including the Rules & Detection and Dashboard sections, to view and correlate ingested threat intelligence.
Your GCP project must have the service account permissions assigned so the Cloud Function and related resources can be deployed and run successfully. Assign the following roles to the service account used for deploying and running the integration:
Storage Admin
Chronicle API Editor
Cloud Run Admin
Project IAM Admin
Secret Manager Admin
Service Account User
Cloud Functions Developer
Cloud Scheduler Admin
Secret Manager Secret Accessor
Cloud Scheduler Job Runner
Your GCP project must have the required services enabled so that the Cloud Function and related resources can run successfully. Ensure the following Google APIs are enabled in your project:
Cloud Run Function (4-core CPU or higher is recommended)
GCS bucket
Secret Manager
Cloud Scheduler
Steps
To set up the integration and start ingesting Cyware threat intelligence into Google SecOps, follow these steps: