Configuring Google Cloud Pub/Sub to integrate with QRadar

Before you can add a log source in IBM QRadar, you must create a Pub/Sub Topic and Subscription, create a service account to access the Pub/Sub Subscription, and then populate the Pub/Sub topic with data.

1. Create a topic in the Pub/Sub tab on the Google Cloud Platform (https://console.cloud.google.com).
   For more information about creating topics, see Managing topics and subscriptions (https://cloud.google.com/pubsub/docs/admin).
2. Create a subscription
   For more information about creating subscriptions, see Managing topics and subscriptions (https://cloud.google.com/pubsub/docs/admin).
   Important: The following parameters need specific configuration to work with QRadar:

   • For the Delivery Type parameter, enable the Pull option.
   • To ensure that messages are processed only once, set the Acknowledgement Deadline to 60 seconds, and deselect the Retain acknowledged messages option.
3. Create a service account on the IAM & admin menu.
   For more information about service accounts, see Creating and managing service accounts (https://cloud.google.com/iam/docs/creating-managing-service-accounts).
   Tip: You do not need to make a service account if any of the following conditions apply to you:

   • You already have an account that you want to use.
   • You use GCP Managed Key as the Service Account Type option on your QRadar All-in-One appliance or QRadar Event Collector that collects events from a Google Cloud Platform Compute instance.
   If you use the User Managed Key option for the Service Account Key parameter when you configure a log source in QRadar, you must create a service account key. For more information, see Creating and managing service account keys (https://cloud.google.com/iam/docs/creating-managing-service-account-keys).
4. Assign permissions to your service account.
   For more information about service account permissions, see Manage access to service accounts (https://cloud.google.com/iam/docs/manage-access-service-accounts).
   Tip: You do not need to assign the permissions for the service account if any of the conditions from step 3 apply to you.
5. Populate the Pub/Sub topic with data by creating a Logging Sink.
   For more information about creating a Logging Sink, see Configure and manage sinks (https://cloud.google.com/logging/docs/export/configure_export_v2).