Skip to main content

Collecting Evidence with Google Cloud Storage

Requirements​

  1. Access to the Keep Aware Console: Ensure you have valid login credentials and are logged in to the console.
  2. Google Cloud Storage (GCS) Bucket: A general-purpose GCS bucket to store evidence artifacts.
  3. IAM Permissions: The Service Account Key must have storage.buckets.get permission on the bucket, and storage.objects.create and storage.objects.get permissions on the bucket objects.

Setting up the GCS bucket​

To get started, navigate to the Integrations Page and select the Evidence Collection integration. This will open a modal where you can select Create New Integration and begin configuring the integration.

Integrations Page Image: Integrations:Evidence Page View in console

Configuring the integration​

Here we will configure each of the fields below:

  • Label: A unique name for the integration
  • Bucket: The name of the GCS bucket where evidence will be stored
  • Service Account JSON: JSON key for the service account with programmatic access to the GCS bucket
  • Readonly: The Readonly field prevents Keep Aware from accessing evidence and instead redirects to the bucket console
  • Capture Screenshot: Whether page screenshot artifacts will be captured and saved in the bucket
  • Capture Inputs: Whether input artifacts will be captured and saved in the bucket
  • Capture DOM: Whether the page's HTML DOM will be captured and saved in the bucket

Collecting evidence in a policy​

To enable evidence collection, navigate to the Integrations in the policy editor and select which integration should be used under Evidence Collection.

Integrations Page

Results​

When evidence is collected from an event, artifacts are stored in GCS with the following structure:

bucket-name/
└── {browser_id}/
    └── {event_id}/
        ├── input.txt
        └── screenshot.png

Each event captured is organized by the unique ID for the browser, then by the event ID. Evidence artifacts such as input data and screenshots are stored within the event folder.

Table of Contents