Collect JumpCloud Directory Insights logs

This document explains how to ingest JumpCloud Directory Insights logs into Google Security Operations using Google Cloud Storage V2.

JumpCloud is a cloud directory platform that provides identity management, SSO, and device management. Directory Insights delivers audit and activity logs covering user authentication, admin actions, and system events. The parser maps log fields to the Unified Data Model (UDM), handling event types such as user logins, resource changes, and security actions.

Before you begin

Make sure you have the following prerequisites:

• A Google SecOps instance
• A GCP project with Cloud Storage API enabled
• Permissions to create and manage GCS buckets and IAM policies
• A JumpCloud account with an Adminor Managerrole and a valid API key

Create Google Cloud Storage bucket

1. Go to the Google Cloud Console .
2. Select your project or create a new one.
3. In the navigation menu, go to Cloud Storage > Buckets.
4. Click Create bucket.

5. Provide the following configuration details:

   Setting	Value
   Name your bucket	Enter a globally unique name (for example, jumpcloud-directory-insights-logs )
   Location type	Choose based on your needs (Region, Dual-region, Multi-region)
   Location	Select the location (for example, us-central1 )
   Storage class	Standard (recommended for frequently accessed logs)
   Access control	Uniform (recommended)
   Protection tools	Optional: Enable object versioning or retention policy

6. Click Create.

Export JumpCloud Directory Insights logs to Google Cloud Storage

JumpCloud Directory Insights exposes events through the Directory Insights API . Use a scheduled script or Cloud Run function to pull events and write them to GCS.

1. Generate a JumpCloud API key:

   1. Sign in to the JumpCloud Admin Portal.
   2. Go to your profile icon and select My API Key.
   3. Copy the API key.

2. Create a Cloud Run function that queries the JumpCloud Directory Insights API, retrieves events, and writes them to GCS.

3. Trigger the function on a schedule using Cloud Scheduler and Pub/Sub.

• Ensure that the exported files retain their original JSON format.
• Each file should contain one or more event records.

Retrieve the Google SecOps service account

1. Sign in to the Google SecOps console.
2. Go to SIEM Settings > Feeds.
3. Click Add New Feed.
4. Click Configure a single feed.
5. Select Google Cloud Storage V2as the Source type.
6. Select JumpCloud Directory Insightsas the Log type.

7. Click Get Service Account. A unique service account email will be displayed, for example:

    chronicle-12345678@chronicle-gcp-prod.iam.gserviceaccount.com 
   

8. Copy this email address. You will use it in the next step.

Grant IAM permissions to the Google SecOps service account

1. Go to Cloud Storage > Buckets.
2. Click your bucket name.
3. Go to the Permissionstab.
4. Click Grant access.
5. Provide the following configuration details:
   • Add principals: Paste the Google SecOps service account email.
   • Assign roles: Select Storage Object Viewer.
6. Click Save.

Configure a feed in Google SecOps to ingest JumpCloud Directory Insights logs

1. Go to SIEM Settings > Feeds.
2. Click Add New Feed.
3. Click Configure a single feed.
4. In the Feed namefield, enter a name for the feed (for example, JumpCloud Directory Insights Logs ).
5. Select Google Cloud Storage V2as the Source type.
6. Select JumpCloud Directory Insightsas the Log type.
7. Click Next.

8. Specify values for the following input parameters:

   Field	Value
   Storage bucket URI	gs://jumpcloud-directory-insights-logs/jumpcloud/
   Source Deletion Option	Select the deletion option according to your preference
   Maximum File Age (Days)	Default is 180 days
   Asset namespace	The asset namespace
   Ingestion labels	The label to be applied to the events from this feed

   • Replace jumpcloud-directory-insights-logs with your actual GCS bucket name.
   • Always include the trailing slash ( / ) at the end of the URI.

9. Click Next.

10. Review your new feed configuration in the Finalizescreen, and then click Submit.

UDM mapping table

Need more help? Get answers from Community members and Google SecOps professionals.