403 Forbidden when sending logs from Bindplane to Google SecOps (gRPC)

Hi Melissa,

Sounds like you are using all the right settings.  A few things you can check:

• Verify is that there are no new lines or spaces at the end of your json when pasting.
• Check the time on your collector
• Verify that you do not have something in the path making changes (proxy,firewall)

Hi ​@TheBindplaneDude ,

thanks a lot for your reply.

I’ve double-checked the ingestion JSON: it’s clean (no extra characters, no spaces or new lines after the final }), and I re-pasted it from the original file just to be sure.

I also tested the other method in Bindplane (using the file path to the ingestion JSON instead of pasting it directly), and I still get the exact same error:
Permanent error: 403 Forbidden from the Chronicle exporter.

Time on the collector is correct and NTP-synced, and there is no proxy in the path.

Is there anything else on the Chronicle / tenant side that could cause a 403 with a valid ingestion auth file?

​@melissagr Honestly, this sounds like there is a problem with the auth token.  You could open a google ticket and see if they can regenerate it for you.  The other option is to create a service account in the project and use https as the protocol version.

https://docs.bindplane.com/how-to-guides/google-secops/google-secops-configuring-the-https-dataplane-api-protocol

You also have more control over your tokens if you go this route.

Hi ​@melissagr were you able to get this working?

Hi ​@TheBindplaneDude  Not yet the person who manages GCP access on our side is still working on getting the correct key, so I haven’t been able to test the HTTPS Dataplane setup yet. I’ll update here as soon as I can try it. Thanks again!