公开指南

Deploy Network Sensor on GCP

Stream live traffic using Packet Mirroring, deploy sensor VM with Terraform, and ingest findings via the managed SIEM connector. 受众: Platform engineers, GCP administrators, security engineers. 典型配置时长: 15 minutes.

quickstart

适用场景

Stream live traffic using Packet Mirroring, deploy sensor VM with Terraform, and ingest findings via the managed SIEM connector.

目标受众: Platform engineers, GCP administrators, security engineers预计耗时: 15 minutes

开始之前

  • You have a GCP project with production VMs running workloads.
  • You have created an ingestion API key in Settings → API Keys with Ingestion scope.
  • You have the gcloud CLI configured with appropriate permissions to create compute resources.

快捷路径

复制开箱即用的入门配置，在您的环境中运行，然后返回此处查看详细的深度配置。

Demonstration only

This configuration is designed for ease of use. To deploy scanner clients at scale, please plan your deployment architecture accordingly or contact us for enterprise best practices.

Get the source bundle

Download the exact source files referenced on this page, or run the one-command installer to write them locally before following the deployment steps.

GCP network sensor Terraform source

Creates the GCP Terraform project under `deploy/gcp-network-sensor/` with the current platform API URL prefilled for packet mirroring-based network telemetry ingestion.

deploy/gcp-network-sensor/
bash
BLACKSHIELD_NETWORK_SENSOR_IMAGE=public.ecr.aws/blackshield-security/network-sensor:1.0.11 \
BLACKSHIELD_API_URL=https://api.blackshield.chaplau.com \
bash <(curl -fsSL https://blackshield.chaplau.com/source-bundles/gcp-network-sensor.sh)
cd deploy/gcp-network-sensor
Download source

运行命令

gcp-packet-mirroring.sh

bash
#!/bin/bash
# Complete GCP Packet Mirroring setup

PROJECT_ID="my-project"
REGION="us-central1"
SUBNET="my-subnet"
NETWORK="my-vpc"
SENSOR_MIG="network-sensor-mig" # The Instance Group from your Terraform deployment

echo "1. Creating Health Check & Backend Service..."
gcloud compute health-checks create tcp network-sensor-hc --port=8080 --project="$PROJECT_ID"

gcloud compute backend-services create network-sensor-backend \
  --region="$REGION" \
  --health-checks=network-sensor-hc \
  --load-balancing-scheme=INTERNAL \
  --protocol=TCP \
  --project="$PROJECT_ID"

gcloud compute backend-services add-backend network-sensor-backend \
  --region="$REGION" \
  --instance-group="$SENSOR_MIG" \
  --project="$PROJECT_ID"

echo "2. Creating Forwarding Rule (Mirroring Target)..."
gcloud compute forwarding-rules create network-sensor-fr \
  --region="$REGION" \
  --network="$NETWORK" \
  --subnet="$SUBNET" \
  --load-balancing-scheme=INTERNAL \
  --backend-service=network-sensor-backend \
  --is-mirroring-collector \
  --project="$PROJECT_ID"

echo "3. Creating Packet Mirroring Policy..."
gcloud compute packet-mirrorings create prod-workload-mirror \
  --region="$REGION" \
  --network="$NETWORK" \
  --collector-ilb=network-sensor-fr \
  --mirrored-subnets="$SUBNET" \
  --project="$PROJECT_ID"

echo "Success! Packet mirroring policy active."

gcp-terraform-deploy.sh

bash
# 1. Configure Terraform Variables
cat > deploy/gcp-network-sensor/terraform.tfvars << EOF
gcp_project_id         = "my-project-id"
gcp_region             = "us-central1"
vpc_network_name       = "default"
api_key                = "sp_your_ingestion_key"
EOF

# 2. Deploy Infrastructure
cd deploy/gcp-network-sensor
terraform init
terraform apply -auto-approve

network-sensor.tf

terraform
# GCP Terraform snippet for Network Sensor Deployment
resource "google_compute_instance" "network_sensor" {
  name         = "blackshield-network-sensor"
  machine_type = "e2-medium"
  zone         = "us-central1-a"

  boot_disk {
    initialize_params {
      image = "ubuntu-os-cloud/ubuntu-2204-lts"
    }
  }

  network_interface {
    network    = var.vpc_network_name
    subnetwork = var.monitoring_subnet_name
  }

  metadata = {
    startup-script = templatefile("${path.module}/startup.sh.tftpl", {
      api_url      = "https://api.blackshield.chaplau.com"
      sensor_type  = "suricata"
      min_severity = "high"
    })
  }

  service_account {
    scopes = ["cloud-platform"]
  }
}

原理解析与进阶定制

当您需要深度定制部署、验证资产归属或安全扩大部署范围时，请参考下方详细指引步骤。

1

步骤 1

Deploy Sensor VM with Terraform

Use the provided Terraform module to deploy the sensor VM (or Managed Instance Group). This acts as the destination for your mirrored traffic.

  • Use the source bundle below to download the GCP network sensor Terraform project into `deploy/gcp-network-sensor/`.
  • Copy `terraform.tfvars.example` to `terraform.tfvars` and customize your GCP project ID, region, VPC network, subnet, and API key.
  • Run `terraform init` and `terraform apply`.
  • Note the generated Managed Instance Group (MIG) name from the Terraform output — you'll need this to set up the Internal Load Balancer target.

达成目标状态

Note the generated Managed Instance Group (MIG) name from the Terraform output — you'll need this to set up the Internal Load Balancer target.

Download source bundle
2

步骤 2

Configure GCP Packet Mirroring

Create a packet mirroring policy to duplicate traffic from your production VMs and route it to the sensor instances via an Internal Load Balancer.

  • Create a regional Backend Service and attach your Sensor MIG.
  • Create an Internal Forwarding Rule that acts as the mirroring target (`--is-mirroring-collector`).
  • Define a Packet Mirroring Policy targeting your source workloads (using network, subnet, or tags).
  • Verify the mirroring policy status is 'ACTIVE' in the GCP Console.

达成目标状态

Verify the mirroring policy status is 'ACTIVE' in the GCP Console.

GCP Deployment Guide

辅助背景信息

GCP Packet Mirroring Overview
3

步骤 3

Verify Ingestion

Confirm the sensor container is running properly on your VM and receiving the mirrored VXLAN traffic.

  • SSH into the sensor VM: `gcloud compute ssh [instance-name] --zone [zone]`.
  • Check the container logs using `docker logs -f $(docker ps -q)`. Look for 'capture interface ready' and 'findings sent'.
  • Check the platform Findings view to see network-based alerts within 5 minutes.

达成目标状态

Check the platform Findings view to see network-based alerts within 5 minutes.

View Findings · 需要登录

达成目标状态

  • Findings are flowing to the platform with scanner=network (GCP) in the Findings view.
  • Packet mirroring policy shows 'ACTIVE' status in the GCP Console.
  • Sensor VM CPU and memory utilization remain within expected ranges.

下一步

Keep your rollout moving with the next recommended step.

审查并确定发现优先级
Deploy Network Sensor on GCP | BlackShield Docs