Integration’s overview

Lumu Custom SecOps integration with Google Security Operations (SecOps) uses the Google Chronicle API to deliver Unified Data Model-formatted (UDM) events. Customers can then create correlation rules based on Lumu-reported events.

Preliminary Setup - Configure and collect information from your Google Security Operations instance

First, you need to configure and collect information from your Google Security Operations instance. Ask your Google Security Operations (SecOps) administrator to follow these steps.

The next sections outline the procedure for each step

Keep this data at hand. You need it to deploy the integration.

Enable the Chronicle API

You must ensure the API is enabled in the project associated with your Google Security Operations instance.

Create an integration custom role

Now, create a dedicated integration custom role following the principle of least privilege.

Create the integration service account

Let’s create the integration service account and assign the integration role created before.

Generate and download the JSON key

The last step is to generate and download the JSON key. This key will be used by the integration to send events to Google Security Operations.

Keep the service key file at hand. It will be needed to configure the integration.

Preliminary setup - Lumu portal

You must collect the following information from the Lumu portal:

• Lumu Defender API key
• Company UUID

Follow the steps in the sections below to collect the information.

Collect the Lumu Defender API key

To collect the Lumu Defender API key, please refer to the Defender API document.

Collect your Lumu company UUID

To collect your Lumu company UUID, log in to your Lumu portal. Once you are in the main window, copy the string below your company name.

Preliminary Setup - Docker-enabled host

For Windows users, follow the Install Docker Desktop for Windows documentation to install the Docker Engine.

Deploy the integration

The following section will guide you through the deployment process.

Set up the Management Script

Lumu prepared a short snippet to help you to manage your integration. Create a file named manage.sh in your integration host, in your integration folder. Copy and paste the following code into the file.

#!/usr/bin/env bash

RED='\033[0;31m'
GREEN='\033[0;32m'
CYAN='\033[0;36m'
YELLOW='\033[1;33m'
BOLD='\033[1m'
RESET='\033[0m'

info()    { echo -e "${CYAN}[INFO]${RESET}  $*"; }
success() { echo -e "${GREEN}[OK]${RESET}    $*"; }
warn()    { echo -e "${YELLOW}[WARN]${RESET}  $*"; }
error()   { echo -e "${RED}[ERROR]${RESET} $*" >&2; }
prompt()  { echo -e "${BOLD}${YELLOW}$*${RESET}"; }

IMG=lumutools/google-secops-siem:latest
INTEGRATION_NAME=lumu-google-secops-siem
INTEGRATION_DIR=${HOME}/ChronicleSecOps
VOLUME_DATA=${INTEGRATION_DIR}/data:/app/data
VOLUME_CONFIG=${INTEGRATION_DIR}/data/.config.toml:/app/.config.toml:ro

mkdir -p "${INTEGRATION_DIR}/data"
chmod -R o+w "${INTEGRATION_DIR}/data" > /dev/null 2>&1

run_config() {
    warn "${BOLD}Please ensure that the service account credentials file is present in '${YELLOW}${INTEGRATION_DIR}/data${RESET}${BOLD}' if required for the integration.${RESET}"
    info "Running configuration script ..."
    if docker run --rm -it -v "${INTEGRATION_DIR}/data:/app/data" "${IMG}" bash run_config; then
        success "Configuration completed."
    else
        error "Configuration script failed."; return 1
    fi
}

start_integration() {
    if [[ ! -f "${INTEGRATION_DIR}/data/.config.toml" ]]; then
        error "Please configure the integration first."; return 1
    fi

    info "Setting up integration '${INTEGRATION_NAME}' ..."
    if ! docker container inspect "${INTEGRATION_NAME}" &>/dev/null; then
        info "Integration '${INTEGRATION_NAME}' does not exist. Creating ..."
        if ! docker create \
            -v "${VOLUME_DATA}" \
            -v "${VOLUME_CONFIG}" \
            --restart unless-stopped \
            --log-driver json-file \
            --log-opt max-size=30m \
            --log-opt max-file=3 \
            --name "${INTEGRATION_NAME}" \
            "${IMG}" bash run_component; then
            error "Failed to create integration."; return 1
        fi
    else
        warn "Integration '${INTEGRATION_NAME}' already exists. Skipping create."
    fi
    if docker start "${INTEGRATION_NAME}"; then
        success "Integration started."
    else
        error "Failed to start integration."; return 1
    fi
}

check_status() {
    info "Checking status of integrations ..."
    if [[ ! -f "${INTEGRATION_DIR}/data/.status.ndjson" ]]; then
        error "Status check failed. Verify if your integration has been deployed."; return 1
    fi
    if docker run --rm -it -v "${VOLUME_DATA}":ro "${IMG}" bash run_status; then
        success "Status check completed."
    else
        error "Status check failed."; return 1
    fi
}

show_logs() {
    info "Showing logs for '${INTEGRATION_NAME}' ..."
    docker logs --tail 100 -f "${INTEGRATION_NAME}"
}

usage() {
    echo ""
    prompt "  Google Security Operations INTEGRATION MANAGEMENT"
    echo -e "  ${BOLD}Usage:${RESET} $0 "
    echo ""
    echo -e "  ${CYAN}config${RESET}   Run configuration"
    echo -e "  ${CYAN}start${RESET}    Start integration"
    echo -e "  ${CYAN}status${RESET}   Check integration status"
    echo -e "  ${CYAN}logs${RESET}     Show integration logs"
    echo ""
}

case "${1}" in
    config) run_config ;;
    start)  start_integration ;;
    status) check_status ;;
    logs)   show_logs ;;
    *)      usage
            [[ -n "${1}" ]] && error "Unknown command '${1}'."
            exit 1 ;;
esac

Using the Management Script

With the management script, you can:

• Configure the integration.
• Start the integration.
• Check the status of the integration.
• Check the audit logs of the integration.

You can check these options by running the following command:

When running the configuration options, a wizard will guide you through a series of prompts. If the provided credentials are correct, the wizard will confirm this. If the credentials fail, you will receive an error message and have the option to re-enter the credentials or proceed despite the error.

Set up the configuration parameters

Execute the following command and type in all parameters gathered during the Preliminary Setup of the third-party solution. Fix any errors in your inputs if prompted.

We strongly recommend correcting any errors before attempting to start the integration using the start command.

Copy the service account key file

Copy the service account key file downloaded in step 4 from the Generate and download the JSON key section into the integration folder ~/GoogleSecOps/data/. This folder is created during the configuration phase.

Ensure you name your service account key file as the name given when asked by the configuration wizard

Run the integration

Run the integration by running this command:

If you have run this process before, you may receive warning messages about the existence of running components. To ensure you have the latest version of the integration, we recommend removing the existing integration containers before entering the start command.

Show Logs

We kindly request you to, when issuing a support case, attach the integration logs collected using the steps described in this section.

The logs option allows you to view the integration's logs. Run this command to show the latest events from the integration component.

Expected results

You can check Lumu events in your Google Security Operations (SecOps) instance. Open your console and follow these steps:

Further steps

After ingesting Lumu detections and operating events, you can create your own rule to raise Lumu detections within your Chronicle SIEM deployment. You can use the following YARA-L rule to raise detections based on the destination and the incident ID, grouping all events related to new incidents and new contacts into a single detection, and within a timeframe.

rule Lumu_detections {
  // This rule matches Lumu-related events

  meta:
    author = "Lumu Technologies, Inc."
    description = "Rule to detect new contacts based on Lumu ingested events"
    version = "1.0"

  events:
    // Let's select the events based on the Vendor name, and product event type
    // Then, calculate the destination and incidentId fields. These will be used for grouping events into detections
    $e.metadata.vendor_name = "Lumu"
    $e.metadata.product_event_type = /NewIncidentCreated|IncidentUpdated/
    strings.coalesce($e.target.hostname, $e.target.ip) = $destination
    $e.metadata.product_log_id = $incidentId

  match:
    // Group detections based on the destination and incidentId values collected in the previous step
    // Let's group them within a 2 hours timeframe
    $destination, $incidentId over 2h

  outcome:
    // Define additional conditions. These will be used for the alerting section
    $risk_score = max(50)

  condition:
    $e
}

After setting up your detection rule, you can see a detection dashboard like this: