JupiterOne Starbase

Starbase uses a config.yaml file located at the project root to manage integrations and storage settings.

1. Create your configuration file by copying the example:

   cp config.yaml.example config.yaml

2. Edit config.yaml to provide values for each integration and your storage engine.

Note on Integrations: The specific configuration keys for individual integrations (e.g., PROJECT_ID, SERVICE_ACCOUNT_KEY_FILE) are defined within their respective graph-* repository projects. You must supply these values in the config.integrations[].config section.

integrations:
  - name: graph-google-cloud
    instanceId: testInstanceId
    directory: ./.integrations/graph-google-cloud
    gitRemoteUrl: https://github.com/JupiterOne/graph-google-cloud.git
    config:
      SERVICE_ACCOUNT_KEY_FILE: {}
      PROJECT_ID: '...'
      ORGANIZATION_ID: '...'
      CONFIGURE_ORGANIZATION_PROJECTS: false
storage:
  engine: neo4j
  config:
    username: neo4j
    password: devpass
    uri: bolt://localhost:7687

JupiterOne can automatically discover and configure integration instances for every project under a Google Cloud organization.

Setup Steps

1. Prepare a Main Project:
   • Create a service account in a single Google Cloud project.
   • Copy the service account email and generate a service account key.
   • Enable all required Service APIs in this 'main' project and all 'child' projects (except cloudasset.googleapis.com and iam.googleapis.com, which only need to be enabled in the 'main' project).
2. Configure Organization Permissions:
   • Create a custom role at the Organization level with these permissions:

     resourcemanager.folders.get
     resourcemanager.folders.list
     resourcemanager.organizations.get
     resourcemanager.projects.get
     resourcemanager.projects.list
     serviceusage.services.list
     resourcemanager.organizations.getIamPolicy
     cloudasset.assets.searchAllIamPolicies
     orgpolicy.policy.get

   • Add the service account email as a member of the Organization. Assign it the custom role created above plus roles/iam.securityReviewer.
3. Configure in JupiterOne:
   • Navigate to the Google Cloud integration configuration page.
   • Use the service account key from step 1.
   • Check Configure Organization Projects.
   • Enter your numerical Organization ID.
   • Click CREATE CONFIGURATION.

Note: Auto-configuration may take several minutes. Once complete, individual project instances will appear in your integration list.

The JupiterOne Google Cloud integration requires specific APIs to be enabled to ingest data. If an API is disabled, the integration will skip that specific data type.

Enabling via Google Cloud Console

1. Click the service name link in the reference table below.
2. Select your Google Cloud project from the dropdown.
3. Click Enable.

Enabling via gcloud CLI

You can enable all supported services using the gcloud services enable command. Note: You can only enable 20 services at a time.

gcloud services enable \
  accesscontextmanager.googleapis.com \
  apigateway.googleapis.com \
  appengine.googleapis.com \
  bigquery.googleapis.com \
  binaryauthorization.googleapis.com \
  privateca.googleapis.com \
  cloudasset.googleapis.com \
  dns.googleapis.com \
  cloudfunctions.googleapis.com \
  cloudkms.googleapis.com \
  logging.googleapis.com \
  memcache.googleapis.com \
  pubsub.googleapis.com \
  cloudresourcemanager.googleapis.com \
  run.googleapis.com \
  spanner.googleapis.com \
  sqladmin.googleapis.com \
  storage.googleapis.com \
  compute.googleapis.com \
  redis.googleapis.com \
  iam.googleapis.com \
  container.googleapis.com \
  serviceusage.googleapis.com \
  monitoring.googleapis.com

Once Azure is prepared, add the configuration in the JupiterOne UI:

1. In JupiterOne, go to the Gear Icon -> Integrations.
2. Select the Azure tile and click Add Configuration.
3. Fill in the following settings:
   • Account Name: A unique identifier for this account. If Tag with Account Name is checked, this value is stored in tag.AccountName.
   • Description: A description for your team.
   • Polling Interval: Frequency of updates (use DISABLED for manual execution).
   • Directory (tenant) ID: The Azure Tenant ID.
   • Application (client) ID: The Azure App Registration Client ID.
   • Application (client) Secret: The Azure App Registration Secret Value.
   • Ingest Active Directory: Enable this to ingest azure_user, azure_user_group, and azure_service_principal entities. (Enable in only one instance per Directory).
   • Scope Configuration:
     • To ingest all subscriptions: Select Configure Subscription Instances. This enables azure_management_group ingestion and automatically provisions instances for each subscription.
     • To ingest a single subscription: Enter the specific Subscription ID.