Skip to main content

Deploy Cloud Function Automatically

Use the provided bash script to quickly deploy the Cyware Intel Exchange ingestion function and all required resources in your GCP project. This automated process sets up the Cloud Function, Cloud Scheduler job, GCS bucket, and Secret Manager secrets, so you can start ingesting Cyware Intel Exchange data into Google SecOps without manually configuring each component.

Before you Start

Before running the deployment script, ensure the following:

  • You have access to a GCP project with sufficient permissions to enable APIs, create service accounts, IAM bindings, GCS buckets, Cloud Functions, Cloud Scheduler jobs, and Secret Manager secrets.

  • The Cloud Function source code ZIP is available on your local machine or accessible within the Cloud Shell environment.

Steps

To run the deployment script in your Cloud Shell and configure all necessary GCP resources for the integration automatically, follow these steps:

  1. Go to the Google Cloud Console and click Activate Cloud Shell in the top-right corner to open a terminal window.

  2. In Cloud Shell, create a new script file to hold the deployment commands. For example, name it cyware_deploy.sh. Open it using a text editor like nano by running the following command:

    nano cyware_deploy.sh

  3. Copy the provided bash script from the Git repository and paste it into the nano editor. In Cloud Shell, you can typically right-click and select Paste or use Ctrl+Shift+V (Command+Shift+V for Mac).

  4. Save the file and exit the editor by pressing Ctrl+X (Command+X for Mac), then Y to confirm, and Enter to keep the filename.

  5. If your Cloud Function ZIP file is not already in Cloud Shell, upload it using the vertical ellipsis in the terminal and selecting Upload.

  6. Make the script executable by running the following command:

    chmod +x cyware_deploy.sh

  7. Execute the script with the following command:

    ./cyware_deploy.sh

  8. When prompted by the script, enter the required configuration details for your environment. For more information about locating them, see Locate Environment Variables . The script may prompt you to provide the following values:

    • GCP Project ID

    • GCP Region

    • Local path to the Cloud Function ZIP file (for example, ./your-function.zip if it's the home directory)

    • Chronicle Customer ID

    • Chronicle Project Number

    • Chronicle Region

    • Local path to Chronicle Service Account (This is required only if you are using a custom service account for authentication.)

    • Cyware Base URL (for example, https://your-ctix-instance.com/ctixapi/)

    • Cyware Tenant Name

    • Cyware Access ID

    • Cyware Secret Key

    • Enable enrichment of indicators

    • Cyware Indicators Lookback Days

    • Cyware Saved Result Set Name

    • CRON Schedule (For more information about the format, see CRON Format and Examples.)

  9. Monitor the progress messages in the terminal. If any error occurs, the error message will appear in red. Review them carefully to troubleshoot as required.

  10. Once the script completes successfully, verify the following resources in the GCP Console:

    • Cloud Functions to see your deployed function.

    • Cloud Scheduler to see the scheduled job.

    • GCS for the bucket and the uploaded ZIP file.

    • Secret Manager for the Cyware Access ID and Secret Key secrets.

    • Cloud Logging for any function execution logs or errors.

CRON Format and Examples

A CRON expression defines when a scheduled job runs. It uses a five-field format to specify the exact time and frequency for execution. Each field represents a specific unit of time and together determines the schedule.

* * * * *
│ │ │ │ │
│ │ │ │ └── Day of week (0-6; or SUN to SAT; or 7 for Sunday)
│ │ │ └──── Month (1–12 or JAN–DEC)
│ │ └────── Day of month (1–31)
│ └──────── Hour (0–23)
└────────── Minute (0–59)

Use the table below to understand how each field controls a specific part of the schedule:

Field

Description

Valid Values

Minute

Specifies the minute within the hour when the job runs

0 – 59

Hour

Specifies the hour of the day (0 = midnight, 12 = noon)

0 – 23

Day of the Month

Specifies the calendar day of the month

1 – 31

Month

Specifies the month of the year

1–12 or JAN–DEC

Day of the Week

Specifies the day of the week

0–6 (SUN–SAT) or 7 (Sunday)

Common CRON Schedules

The following examples are commonly used schedules for recurring jobs:

Schedule

Cron Job Format

Description

Every minute

* * * * *

Runs every minute

Every hour

0 * * * *

Runs at the start of every hour

Every day

0 0 * * *

Runs daily at midnight

Every weekday

  • 0 0 * * 1-5

  • 0 0 * * MON-FRI

Runs Monday to Friday at midnight

Every week

  • 0 0 * * 0

  • 0 0 * * 7

  • 0 0 * * SUN

Runs every Sunday at midnight

Every month

0 0 1 * *

Runs on the first day of every month

Every quarter

  • 0 0 1 1,4,7,10 *

  • 0 0 1 JAN,APR,JUL,OCT *

Runs on the first day of each quarter

Every year

  • 0 0 1 1 *

  • 0 0 1 JAN *

Runs on January 1st each year

For more information, see Google Cloud Documentation.