Google Cloud

One integration covers two things. You can set up either or both.

Part	What it does
Blocking	Blocks IP addresses in a VPC network from the Block dialog, policy rules and Pallas, with firewall rules Athena manages
Log collection	Collects Cloud Audit Logs and Security Command Center findings from a Pub/Sub subscription

The service account

Create a service account for Athena and give it only the roles for the parts you use:

Part	Role	Granted on
Blocking	Compute Security Admin (roles/compute.securityAdmin)	The project that holds the VPC network (for a Shared VPC, the host project)
Log collection	Pub/Sub Subscriber (roles/pubsub.subscriber)	The subscription Athena reads

PROJECT=acme-prod-123456
gcloud iam service-accounts create athena --project "$PROJECT" --display-name "Athena XDR"
SA=athena@$PROJECT.iam.gserviceaccount.com

# blocking
gcloud projects add-iam-policy-binding "$PROJECT" \
  --member "serviceAccount:$SA" --role roles/compute.securityAdmin

# a key for Athena (keep it safe; delete the file once it is saved in the console)
gcloud iam service-accounts keys create athena-key.json --iam-account "$SA"

If your organization blocks key creation (the iam.disableServiceAccountKeyCreation policy), ask your provider about running blocking with the server's own service account instead. Log collection always needs a key.

Log collection: the log sink

Athena reads from a Pub/Sub subscription. Create a topic and its subscription, send audit logs to the topic with a log sink, and let Athena pull from the subscription:

gcloud pubsub topics create athena-logs --project "$PROJECT"
gcloud pubsub subscriptions create athena-logs --topic athena-logs --project "$PROJECT" \
  --message-retention-duration 7d

# Cloud Audit Logs (admin activity, system events and policy denials)
gcloud logging sinks create athena-audit \
  "pubsub.googleapis.com/projects/$PROJECT/topics/athena-logs" --project "$PROJECT" \
  --log-filter 'logName:("cloudaudit.googleapis.com%2Factivity" OR "cloudaudit.googleapis.com%2Fsystem_event" OR "cloudaudit.googleapis.com%2Fpolicy")'

# the sink writes with its own identity: let it publish to the topic
WRITER=$(gcloud logging sinks describe athena-audit --project "$PROJECT" --format 'value(writerIdentity)')
gcloud pubsub topics add-iam-policy-binding athena-logs --project "$PROJECT" \
  --member "$WRITER" --role roles/pubsub.publisher

# Athena may pull from the subscription
gcloud pubsub subscriptions add-iam-policy-binding athena-logs --project "$PROJECT" \
  --member "serviceAccount:$SA" --role roles/pubsub.subscriber

To collect the logs of every project, create the sink on the folder or the organization instead (--organization ORG_ID --include-children). Data access audit logs are left out above because of their volume; add cloudaudit.googleapis.com%2Fdata_access to the filter if you want them.

Security Command Center findings go to the same topic through a notification config (organization level; needs Security Center Notification Configurations Editor):

gcloud scc notifications create athena-findings --organization ORG_ID \
  --pubsub-topic "projects/$PROJECT/topics/athena-logs" --filter 'state="ACTIVE"'

Depending on your gcloud version, add --location global.

Set up

In the console, Admin → Integrations → Google Cloud:

Field	Notes
Project id	The project of the network and of the subscription
Service-account key	Paste the content of athena-key.json as it is; Athena stores it encrypted and never shows it again
VPC network	Blocking: the network name, for example default. Shared VPC: projects/<host-project>/global/networks/<name>
Only instances with these tags	Blocking, optional: network tags, comma-separated; empty blocks for every instance in the network
Pub/Sub subscription	Log collection: the subscription id, for example athena-logs

Test connection signs in with the key and reads the network and the subscription (it changes nothing), then Save. The change is applied within a minute.

Where a setting is given outside the console (by your provider), the key is the base64 of the JSON file on one line: base64 -w0 athena-key.json (macOS: base64 -i athena-key.json).

How blocking works

Athena keeps two firewall rules of its own in the network and never touches any other rule:

Rule	Direction	Action
athena-block-in	Ingress, from the blocked addresses	Deny all, priority 100
athena-block-out	Egress, to the blocked addresses	Deny all, priority 100

Priority 100 comes before the usual allow rules (1000). A rule holds at most 5000 addresses; past that Athena adds athena-block-in-2, athena-block-out-2 and so on. Unblocking removes the address, and a rule left with no address is deleted. Do not edit these rules by hand: Athena rewrites them.

IPv4 and IPv6 addresses and ranges can be blocked, up to /16 (IPv4) or /48 (IPv6). Addresses on Protected IPs and approved addresses are never blocked. A block applies to the whole network: before blocking an internal address, make sure it is not one of your own servers.

Platform health shows the network and how many addresses are blocked.