topic Re: GCP workspace (gsuite) information in Prisma Cloud Discussions

GCP workspace (gsuite) information

CLimachi1 — Fri, 13 Jan 2023 13:48:34 GMT

Hello,

Enabled the IAM module and added the Google Workspace (GSuite) group reader role to the prisma service account but have been not able to find the query to get group members or other workspace information. Only information I currently get is the cloudresourcemanager api results.

Also is it possible to get from workspace reports which accounts have 2SV enabled?

Re: GCP workspace (gsuite) information

BCastillo — Fri, 13 Jan 2023 18:14:45 GMT

You must have administrator access to Google Workspace (GSuite) to grant Prisma Cloud Service Accounts the permissions to ingest data from groups on Google Workspace (GSuite). The permissions required for ingesting data on groups is either the predefined role Group Reader, or a custom role with groups:read permission.

Could you please provide me the RQL you are using.

Re: GCP workspace (gsuite) information

CLimachi1 — Fri, 13 Jan 2023 23:28:39 GMT

Hi,

Our administrator added group reader to the prisma account

But reading through the docs can´t find the RQL for getting the workspace specific information

https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-rql-reference/rql-reference/iam-query/iam-query-examples

For example changing the following with a group in workspace returns no results

config from iam where dest.cloud.type = 'GCP' and source.cloud.resource.type = 'user' and grantedby.cloud.entity.name = 'your group name'

Re: GCP workspace (gsuite) information

BCastillo — Tue, 17 Jan 2023 18:26:56 GMT

Hello ,

There was fix that was going on for this. Could you please give it a try again and see if you are able to get any results.

Regards,