It seems like your browser didn't download the required fonts. Please revise your security settings and try again.
Barracuda Campus Barracuda Campus
Barracuda XDR
Overview Documentation Materials

Setting up ATR for Google Workspace

  • Last updated on

The documentation below outlines the requirements for the Barracuda XDR Automated Threat Response (ATR) for Google Workspace.

For additional information, see https://campus.barracuda.com/doc/488014493/ .

Requirements

You must have:

  • Access to the Barracuda XDR Dashboard set up and working properly

  • Access to Google Workspace set up and working properly

Setting up ATR for Google Workspace

To set up ATR for Google Workspace, do the following procedures:

  • To create a service account and add a new Private key

  • To enable the Google Workspace Admin SDK

  • To enable SOAR in the XDR Dashboard

To create a service account and add a new Private key

  1. Using a web browser, log in to the Google Cloud Console using the admin account.

  2. Do one of the following:

    • Choose an existing project.

    • Create a new project.

      Project Info.png

  3. In the left sidebar, navigate to IAM & Admin > Service Accounts.

    Service Account.png

  4. Click Create Service Account.

    Create Service Account.png

  5. Type a Name and Description for the service account.

    Name Picture.png

  6. Assign the Service Account User and Service Account Admin roles to the admin ID.

  7. Click the three dots next to the newly created account, then click Manage Keys.

    Manage Keys.png

  8. Click Add Key > Create New Key.

    Create Private Key.png

  9. Copy the key and save it in a safe place.
    You will use the key in the To configure XDR Dashboard procedure, below.

If you get an error that says “Service account key creation is disabled”, navigate to IAM & Admin > Organization Policies. Check for any policies mentioned in the error that may prevent you from downloading the API key. Modify or remove these policies with caution.

To enable the Google Workspace Admin SDK

  1. Using a web browser, navigate to https://console.cloud.google.com/apis/library.

  2. Search for Admin SDK API, then click it.

  3. If Admin SDK API isn't enabled, enable it.

  4. When Admin SDK API is enabled, validate it.

    Enable SDK.png
To update Domain Wide Delegation

  1. Using a web browser, log in to the Google Cloud Console using the admin account.

  2. Navigate to Security > API Controls > Manage Domain Wide Delegation.

  3. Click Add New and type the Client ID of your service account.

  4. Add the required scopes:

    • https://www.googleapis.com/auth/admin.directory.user

    • https://www.googleapis.com/auth/admin.directory.user.security

To configure XDR Dashboard

  1. In Barracuda XDR Dashboard, click SOAR Settings > Cloud.

  2. In the table, click Google Workspace.

  3. Click Edit Config.

  4. Do the following:

    • In Service Account ID, type the account id created in the previous setup steps.

    • In Administrator Account Email, type the email address of the admin account that was assigned the Service Account Admin role for the service account.

    • In Service Account Private Key, enter the API key of the service account in this field.

  5. Click Save.

    Edit Config.png

  6. In the left navigation bar, click SOAR Settings > Cloud.

  7. In the table, click Google Workspace.

  8. Click Disable/Enable User.

    EnableDisableUser1.png

  9. Click one of the following:

    • Disable

    • Enable

  10. In Disable/Enable, type the User ID of the user you wish to disable or enable.

    EnableDisableUser2.png

  11. Click Submit.

Tracking Progress

To monitor the progress of the Enable/Disable action, navigate to Administration > Audit Log. This log provides details on the actions taken and their current status.

TrackProgress1.png