topic Re: Google Cloud Platform in Spark Firewall (SMB)

Google Cloud Platform

JorgeCR — Tue, 24 Sep 2019 17:10:41 GMT

We are seeing lot of traffic to Google Cloud Platform in our network. Its primary category is Computers/Internet, but we are wondering what this traffic is since, as I said, it is a lot.

Re: Google Cloud Platform

PhoneBoy — Tue, 24 Sep 2019 18:42:15 GMT

As Google Cloud Platform is an Infrastructure as a Service offering that can host anything, it could be...anything.

Re: Google Cloud Platform

JorgeCR — Tue, 24 Sep 2019 19:10:19 GMT

Thanks a lot Phone Boy.

The fact that it is under Computers / Internet does not really help to set right permissions to users.

Re: Google Cloud Platform

PhoneBoy — Tue, 24 Sep 2019 19:30:03 GMT

I'm guessing the fairly generic classification here is because you're not using HTTPS Inspection.
Without that, you can only see what the TLS certificate indicates, which, again, could be anything, particularly if the certificate is wildcard (i.e. used for many different sites).
With HTTPS Inspection enabled, you can see exactly what URLs are being accessed and might get a different classification.

Re: Google Cloud Platform

JorgeCR — Tue, 24 Sep 2019 20:07:59 GMT

We have HTTPS Inspection enabled. We double checked and we are not doing HTTPS Bypass to any of the IP addresses associated with Google Cloud Platform in the logs.

Re: Google Cloud Platform

PhoneBoy — Thu, 26 Sep 2019 15:01:54 GMT

If you can provide a few sample log entries (full log card), it might provide some clues.
There may not be enough cues in the traffic to classify the traffic further than what it already is.