GCP Onboarding

Project

If you select Project, the deployment is quite straightforward. The only question is whether you want to define the scanning permissions manually, from the GCP console, or by running gcloud commands that you copy from the Panoptica console

For starters, enter the Project ID of the project you wish to onboard.

Note that CVE and Malware Scanning is greyed out, since that is only supported in Folder and Organization deployments.

As mentioned, there are two methods you can use to grant Panoptica permission to scan your GCP project: via the GCP console, or using gcloud commands.

Option A: Manually from GCP console

Follow these steps to manually grant Panoptica permission to perform a CSPM scan of your project.

1. Log into your GCP project in a new browser window, and select IAM & Admin in the navigation menu.
2. On the IAM tab, click GRANT ACCESS to pop up the overlay where you configure access.

3. Return to Panoptica's console UI, hopefully still displaying the Google Cloud Platform onboarding page.
   Click the Service Account link to copy the account details to your clipboard.

   
   

4. Now switch back to GCP and paste the Service Account details into the New principals field.

5. Add the following roles for the Panoptica service account. Click +Add Another Role to open additional rows.
   1. Role Viewer
   2. Security Reviewer

6. Click Save

Option B: Using gcloud commands

Follow these steps to automatically grant Panoptica permission to perform a CSPM scan of your project. This procedure will do exactly the same thing as the manual steps described above, using shell commands generated by the Panoptica console to automate the process.

1. From the Google Cloud Platform onboarding page in Panoptica's console UI, click on the word following to open a new overlay window with gcloud commands.

2. 

   Copy the customized gcloud commands in the pop-up window. For convenience, use the Copy button in the corner of the text window.

   For more information about the gcloud commands, please visit GCP Onboarding - Details

3. 

   Log into your GCP project in a new browser window, and launch Cloud Shell from the top navigation bar.

3. Paste the GCP Deployment Commands you copied from the Panoptica platform into the Cloud Shell terminal.
4. Run the commands to assign the required roles to the Panoptica service account principal.

Finally, back on the Panoptica's console UI, type the Display Name that you want to appear in Panoptica's platform.

Folder

If you select Folder as the deployment type, Panoptica will scan all the projects under the specified folder. With a folder deployment, you have the option of scanning for CVEs and malware, in addition to CSPM scans.

To get started, enter the Folder ID of the folder you wish to onboard, so it is automatically included in the gcloud commands that will be generated in a couple more steps.

Next, decide whether you want Panoptica to scan your GCP resources for CVEs and malware. If you forego the vulnerability and malware scanning, Panoptica will still scan your cloud security posture, providing inventory, attack path analysis, root cause analysis, and more.

If you enable CVE and Malware scanning, you will see the Project ID of the project that will host the CVE scans. The CVE scanner project ID is generated from the tenant id of the dedicated Panoptica service account and your folder ID: panoptica-ws-<short-tenant-id>-<Four last characters of your folder ID>

Whether or not you enabled CVE and Malware scanning, follow the next steps to generate customized gcloud commands that deploy Panoptica in your folder. These commands will do the following:

• Add read-only access to Panoptica's service account in your GCP account to facilitate CSPM scans of the projects in your folder
• Enable hierarchy discovery, so any future projects created in this folder will be included in the scans
• Create a project to host the CVE scans as well as a dedicated service account for the CVE scans
• Enable the CVE scanning (if selected)

For more information about the gcloud commands, please visit GCP Onboarding - Details .

1. From the Google Cloud Platform onboarding page in Panoptica's console UI, click on the word following to open a new overlay window with gcloud commands.

2. Copy the customized gcloud commands in the pop-up window. For convenience, use the Copy button in the corner of the text window.

   
   
   

3. Log into your GCP portal in a new browser window, and launch Cloud Shell from the top navigation bar.

3. Paste the GCP Deployment Commands you copied from the Panoptica platform into the Cloud Shell terminal.

4. Run the commands to assign the required roles to the Panoptica service account principal.

5. Finally, if CVE Scanning was enabled above, you need to enable the Compute Engine API. If this is not explicitly enabled, GCP disables the option to create and use compute resources that Panoptica requires to scan for CVEs and malware, such as creating a Disk, VM or VPC.

   1. Still in your GCP portal, launch Cloud Shell from the top navigation bar.

      

   2. Enter the following command, to make sure you are working in the context of the scanning project you created for this purpose.

      gcloud config set project <scanner project id>
      

   3. Enable the compute engine by running this command:

      gcloud services enable compute.googleapis.com
      

Organization

If you select Organization as the deployment type, Panoptica will scan all the projects under the specified organization. With an organization deployment, you also have the option of scanning for CVEs and malware, in addition to CSPM scans.

To get started, enter the Organization ID of the organization you wish to onboard, so it is automatically included in the gcloud commands or Terraform file that will be generated in a couple more steps.

Next, decide whether you want Panoptica to scan your GCP resources for CVEs and malware. If you forego the vulnerability and malware scanning, Panoptica will still scan your cloud security posture, providing inventory, attack path analysis, root cause analysis, and more.

Whether or not you enabled CVE and Malware scanning, follow the next steps to deploy Panoptica in your folder. There are two methods you can choose from: run gcloud commands in a cloud shell (Option A), or download and run a Terraform file (Option B). Both methods will do the following:

• Add read-only access to Panoptica's service account in your GCP account to facilitate CSPM scans of the projects in your organization
• Create a service account principal in your GCP account that will enable Panoptica to perform a CSPM scan of the projects in your folder
• Enable hierarchy discovery, so any future projects created in this folder will be included in the scans
• Create a project to host the CVE scans as well as a dedicated service account for the CVE scans
• Enable the CVE scanning (if selected)

Option A: Using gcloud commands

1. From the Google Cloud Platform onboarding page in Panoptica's console UI, click on the word following to open a new overlay window with gcloud commands.

2. Copy the customized gcloud commands in the pop-up window. For convenience, use the Copy button in the corner of the text window.

   
   
   

3. Log into your GCP portal in a new browser window, and launch Cloud Shell from the top navigation bar.

3. Paste the GCP Deployment Commands you copied from the Panoptica platform into the Cloud Shell terminal.
4. Run the commands to assign the required roles to the Panoptica service account principal.

Option B: Using Terraform

1. From the Google Cloud Platform onboarding page in Panoptica's console UI, click on the Terraform link to download the Terraform file.
2. Log into your GCP project and enter the gcloud shell. Create a new directory, and upload main.tf into it.
3. Initiate Terraform by running terraform init
4. Run terraform apply to create the required resources for the scanning.
   • If you have enabled CVE and malware scanning, make sure to set the variable cve_scan_enabled to True

     terraform apply --var cve_scan_enabled=True
     

     
     
   • If you have not enabled CVE and malware scanning, simply run

     terraform apply 
     

Finally, whether you chose gcloud or Terraform, you need to enable the compute engine API if CVE and Malware Scanning was enabled above. If the compute engine service is not explicitly enabled, GCP disables the option to create and use compute resources Panoptica requires to scan for CVEs and malware, such as creating a Disk, VM or VPC.

1. Still in your GCP portal, launch Cloud Shell from the top navigation bar.

2. Enter the following command, to make sure you are working in the context of the scanning project you created for this purpose.

gcloud config set project <scanner project id>

3. Enable the compute engine by running this command:

gcloud services enable compute.googleapis.com