Configure Device Security and Cortex XSOAR

1. Log in to Device Security and then access the Google Workspace instance settings in Cortex XSOAR to configure the integration instance.

   1. Log in to Device Security and select IntegrationsIntegration ManagementManage Integrations.
   2. Launch Cortex XSOAR.
   3. Click Settings in the left navigation menu to go to IntegrationsInstances, and search for Google Workspace to locate it among other instances.
2. Configure the settings for a Google Workspace integration instance.

   1. Click the active integration instance settings icon, or click Add instance, to open the settings panel.
   2. Enter the following settings and leave the others at their default values:

      • Name: Use the default name or enter a new one to help you identify the instance.
      • User's Service Account JSON: Paste the full contents of the JSON key file you downloaded from the Google Cloud Console.
      • Admin Email: Enter the email address of the Google Workspace administrator that you used to configure domain-wide delegation for the API.
      • Customer ID: Enter your Google Workspace Customer ID.
      • Optional Last Seen: Enter the time window for retrieving devices synced within the past 1 minute to 7 days. You can enter a duration such as 30 minutes, 2 hours, or 7 days, or a whole number of minutes. The default is 7 days.
      • Chromebook Status Filter: Choose one or more statuses to filter Chromebook devices: ACTIVE, DISABLED, or DEPROVISIONED. The default is ACTIVE.
      • Mobile Status Filter: Choose one or more statuses to filter mobile devices: PENDING, APPROVED, or ACCOUNT_WIPED. The default is APPROVED.
      • Optional Include Software Data (Mobile): Enable this option to include installed application details from Google Workspace in mobile device results. Disabled by default. This does not apply to Chromebooks.
      • Optional Learn New Devices: Enable this option to automatically ingest new devices into Device Security. Enabled by default.
   3. When finished, click Test or Test resultsRun test to test the integration instance.

      If the test is successful, a Success message appears. If not, check that the settings were entered correctly, and then test the configuration again.

   4. After the test succeeds, click Save & exit to save your changes and close the settings panel.
3. Enable the Google Workspace integration instance.
4. Create a job for Cortex XSOAR to import devices from Google Workspace.

   Depending on the type of devices you want to import, select the appropriate playbook when configuring the job. If you want to run multiple playbooks, you must create separate jobs, one for each playbook.

   1. Click Jobs in the sidebar, and then click New Job to create a new Cortex XSOAR job.
   2. Configure the following settings in the New Job panel:

      • Recurring: Select this if you want to periodically run the job. Clear it if you want to run the job on-demand.
      • Optional Every: If you selected Recurring, enter a number and set the interval value (Minutes, Hours, Days, or Weeks) and select the days on which to run the job. If you don't select specific days, the job runs every day by default. You can configure Queue Handling to determine what happens if a new job starts while an old job is still running.
      • Name: Enter a name for the job.
      • Playbook: Select the playbook depending on the type of devices you're importing:
        • Import Chromebook Devices From Google Workspace To Device Security – Import ChromeOS and ChromeOS Flex devices.
        • Import Mobile Devices From Google Workspace To Device Security – Import Android and iOS devices.
      • Integration Instance Name: Enter the name of the Google Workspace integration instance.
5. Enable the job and run it.

   Check the Job Status for the job you created. If it's Disabled, select its checkbox and then click Enable.

   You can immediately run the job by selecting it and clicking Run now. Otherwise, if you scheduled a recurring job, then the enabled job will run as scheduled.
6. Return to Device Security and check the status of the Google Workspace integration instance.

   An integration instance can be in one of the following four states, which Device Security displays in the Status column on the Integrations page:

   • Active — the integration was configured and enabled and is functioning properly.
   • Disabled — either the integration was configured but intentionally disabled or it was never configured and a job that references it is enabled and running.
   • Error — the integration was configured and enabled but is not functioning properly, possibly due to a configuration error or network condition.
   • Inactive — the integration was configured and enabled but no job has run for at least the past 60 minutes.

   When you see that the status of an integration instance is Active, its setup is complete.