When ATR detects a Google Workspace account has been compromised, Barracuda XDR automatically responds by suspending the affected account through the API. This suspension restricts access to all Google services and triggers session invalidation, helping to contain threats in real time.
Requirements
You must have:
Access to the Barracuda XDR Dashboard set up and working properly
Access to Google Workspace set up and working properly
Setting up ATR for Google Workspace
To set up ATR for Google Workspace, do the following procedures:
To create a service account and add a new Private key
To enable the Google Workspace Admin SDK
To enable ATR in the XDR Dashboard
To create a service account and add a new Private key
Using a web browser, log in to the Google Cloud Console using the Super Admin account.
Do one of the following:
Choose an existing project.
Create a new project.
In the left sidebar, navigate to IAM & Admin > Service Accounts.
Click Create Service Account.
Type a Name and Description for the service account.
Assign the Service Account User and Service Account Admin roles to the admin ID.
Click the three dots next to the newly created account, then click Manage Keys.
Click Add Key > Create New Key.
Copy the key and save it in a safe place.
You will use the key in the To configure XDR Dashboard procedure, below.
To enable the Google Workspace Admin SDK
Using a web browser, navigate to https://console.cloud.google.com/apis/library.
Search for Admin SDK API, then click it.
If Admin SDK API isn't enabled, enable it.
When Admin SDK API is enabled, validate it.
To update Domain Wide Delegation
Using a web browser, log in to the Google Cloud Console using the Super Admin account.
Navigate to Security > API Controls > Manage Domain Wide Delegation.
Click Add New and type the Client ID of your service account.
Add the required scopes:
https://www.googleapis.com/auth/admin.directory.userhttps://www.googleapis.com/auth/admin.directory.user.security
To configure XDR Dashboard
In Barracuda XDR Dashboard, click ATR Settings > Cloud.
In the table, click Google Workspace.
Click Edit Config.
Do the following:
In Service Account ID, type the account id created in the previous setup steps.
In Administrator Account Email, type the email address of the Super Admin account that was assigned the Service Account Admin role for the service account.
In Service Account Private Key, enter the Private key (private_key) of the service account, which you downloaded in Step 9 of the To create a service account and add a new Private key procedure above.
NOTE The required value is private_key, not private_key_id.
Click Save.
In the left navigation bar, click ATR Settings > Cloud.
In the table, click Google Workspace.
Click Disable/Enable User.
Click one of the following:
Disable
Enable
In Disable/Enable, type the User ID of the user you wish to disable or enable.
Click Submit.
To test the integration
To test if Google Workspace ATR is working properly, a test user named test-cloud-integration@example.com is used. If this user doesn’t exist, it may appear that Google Workspace ATR isn’t working even if it is.
When you’re finished testing Google Workspace ATR, you can delete this user.
In Google Workspace, create a new user called
test-cloud-integration@example.com.In Barracuda XDR Dashboard, click ATR Settings > Cloud.
In the table, click Google Workspace.
Click Test.
Google Workspace blocks and unblocks thetest-cloud-integration@example.comuser.Click View Audit History to confirm that
test-cloud-integration@example.comwas blocked and unblocked successfully.
Tracking Progress
To monitor the progress of the Enable/Disable action, navigate to Administration > Audit Log. This log provides details on the actions taken and their current status.
