Simplify and Accelerate your Google Cloud Security Operations with Wiz and Gemini

Key Takeaways

Hello everyone. My name is David Shao. I'm a partner engineer at Google Cloud. Joining me today is Mason Yan, a senior partner solution engineer from Whiz. Today we're here to talk with you about how to leverage Google Seops, Whiz, and Gemini together to simplify and accelerate your security operations in Google Cloud. We will start by setting up the integration to ingest Whiz findings into Google Sack Ops. Then get WISH MCP server deployed from the marketplace to cloud run. Then we'll install the sec ops MCP server. And last but not least, we will use Gemini CLI as the agent to interact with the MCP servers. It's very exciting. So let's get started. With that, I will hand it over to Mason for the integration setup. >> Thanks, David. The W and Ops integration sends W issues and detections to Google Ops. Setup is simple. Get your secops customer ID and collection agent ingestion authentication file that will be used as a service account key when you create integration at tendant. Once you have the integration created, config the automation rule to send with issues and detections to Google secups. Now let's move on to deploying with MCP in GCP. We can pull the image and then use Docker CLI to push it to the artifact repository. Now that the image is in the artifact repository, we will go ahead and deploy it in Cloud Run. Select the image from the repository. Noting the WHIS credential is stored as secrets for security. Let's go ahead and deploy it as a service. It's worth noting that cloud run service by default requires IM authentication for security. So in the local console, we will use G-Cloud CLI to authenticate and connect to the remote WH MCP server. This will expose a local proxy for the agent client to connect to. Now let's install the SEC ops MCP server in the local environment. You can find all the setup instructions on GitHub and it's fairly straightforward to follow. With both MCP servers installed, we need to configure Gemini CLI. When the CLI configuration is done, we need to get application default credential for the SEC ops MCP server. Now it's time to launch Gemini CLI. And with that, I will hand it over to Mason. >> Thanks, David. I will start our demo right here in the Gemini CRI. For this scenario, I'll be playing the role of sack ops analyst. My first priority is to check for any worome threats in my Google cloud environment. Before we start, I'd like to show you the available MCP tools. Type /mcp to see the MCP tools in with and ops. I will simply ask Gemini search for any critical events in the last hour. In the background, Gemini translates my request and sends it to Google Cloud Sack Ops MCP server. This server has access to all the security data that Sack Ops has been ingesting and enriching. And just like that, we have our answer. Sack Ops has find two critical events. A DNS query for a known cryptomining domain and mware execution. This obviously urgent. Let's dig into more execution. I will continue my investigation right here in Gemini. I ask Gemini more details on mware execution. Sacops quickly provides a threat name specific mware detected. It tells me the infected resource was a container and actor was a service account. I need to know how this instance started. We use wis defend for threat detection, investigation and response in my Google cloud environment. I want to ask a whis how this incident started. This is where the integration truly shines. As an analyst, I don't have to stop loging to different console and manually search for the threat in WH because we have already config the W MCP server. Gemini can now query with investigation graph for deeper context. I just keep asking questions. I asked Gemini where get thread with a thread name from sack ops. Gemini returns with more detail on the mware and the locations. I need to help Gemini focus on the threat. I ask Gemini get detail of the critical threat in the last hour. Now Gemini responds with a level of the details that sacops alone won't have. It show the key detections that make up this single thread. I want to see all the detections. I asked Simmoni, show me the detections in the thread with uh return uh with five detections for the threat. I need to know the completed attack timeline. Ask Gemini, show me the timeline of the events. which generates a completed tech timeline. A privileged container was created which was immediately followed by a root user starting a interactive session. We see the Kubernetes service account token was accessed. A network scanning tool was executed. From there they download XM rig crypto miner and set up a outbound connection to start mining. In just a few second I have the full contest timeline the scope of this thread. So let's recap what we just saw. We went from a high level alert in Google sack ops to deep root cause analysis that use information from a way investigation graph. We use one single interface the Gemini CRI to trace the entire attack from the initial mobile alert all the way back to the creation of a privileges container. This is a powerful example of what is possible when you integrate two best-in-class products. By combining Google sack ops and the waste defy, the security team can understand, investigate, and act on cloud threats faster than ever before. David, back to you to close us out. >> Thanks, Mason. We are very excited about what Google Cloud and Whis can do together for our joint customers.