Chrome OS Connector

The following is not supported in Tenable FedRAMP Moderate environments. For more information, see the Tenable FedRAMP Product Offering.

Google Chrome Enterprise manages ChromeOS devices centrally through the Google Admin console, where every enrolled device is available through the Google Admin SDK.

The following steps allow you to configure this connector for use with Tenable Exposure Management from start to finish.

Tip: For more information on how third-party integrations work, see Connectors.

Connector Details

Tenable Exposure Management ingests managed ChromeOS device assets from Google Workspace through the Google Admin SDK Directory API. Ingested data includes hardware identity, operating system version, network identifiers, organizational unit, enrollment lifecycle, and security hardware details.

Details Description

Supported products

Any Google Workspace plan (Business Starter and above)

Chrome Enterprise Core

A Chrome Enterprise Premium license is not required.

Category

Asset Inventory
Ingested data Assets

Ingested Asset Classes

Device

Integration type

UNI directional (data is transferred from the connector to Tenable Exposure Management in one direction)

Supported version and type

SaaS (latest)

Prerequisites and User Permissions

Before you begin configuring the connector, make sure to:

  1. Confirm that you manage your ChromeOS devices through a Google Workspace plan (Business Starter or above) or through Chrome Enterprise Core.

  2. Confirm that you have access to a Google Cloud project and to the Google Admin console with super administrator privileges.

  3. Enable the Admin SDK API.

  4. Create a service account and download the JSON key file.

  5. Grant domain-wide delegation to the service account.

  6. Identify the super administrator account that the connector impersonates.

  7. Verify the service account permissions.

Enable the Admin SDK API

The connector retrieves ChromeOS device data through the Google Admin SDK Directory API. The Google Cloud project that owns the service account must have the Admin SDK API enabled. If this API is not enabled, the connector cannot retrieve devices, even when domain-wide delegation is configured correctly.

  1. In the Google Cloud console, select or create the project that you want to use for the connector.

  2. Go to APIs & Services > Enabled APIs & services.

  3. Confirm that Admin SDK API appears in the list of enabled APIs.

    If Admin SDK API does not appear in the list, click Enable APIs and Services, search for Admin SDK API, then click Enable.

Note: Create the service account in this same project. If you create the service account in a project where the Admin SDK API is not enabled, the connectivity test fails.

Create a service account and download the JSON key file

The connector authenticates to the Google Admin SDK with OAuth 2.0, using a Google service account with domain-wide delegation.

  1. In the Google Cloud console, select the project in which you enabled the Admin SDK API.

  2. Go to IAM & Admin > Service Accounts.

  3. Click Create Service Account.

  4. Type a name for the service account and, optionally, a description.

  5. Click Create and Close.

  6. Locate the service account, expand the Actions menu, then click Manage Keys.

  7. Click Add Key > Create new key.

  8. Select JSON, then click Create.

    Google downloads the service account JSON key file.

  9. Store the JSON key file in a safe location. You need this file to configure the connector.

    Tip: The JSON key file also contains the client_id value that you need to grant domain-wide delegation.

Grant domain-wide delegation to the service account

Domain-wide delegation authorizes the service account to read ChromeOS device data on behalf of a Google Workspace super administrator. You authorize the service account by its numeric client ID, not by its email address.

  1. Open the service account JSON key file that you downloaded, then copy the value of the client_id field to a safe location.

    Note: The client ID is a numeric value, for example 123456789012345678901. Do not use the email address of the service account. Domain-wide delegation does not apply to the service account unless you authorize its numeric client ID.
    Tip: You can also find this value in the Google Cloud console. Go to IAM & Admin > Service Accounts, click the Email value of the service account to open Service Account Details, then copy the numeric Unique ID. The Unique ID and the client_id value are identical.

  2. In the Google Admin console, go to Security > Access and data control > API controls > Domain-wide delegation.

  3. Click Add New.

  4. In the Client ID text box, type the numeric client ID of the service account.

  5. In the OAuth scopes text box, type the following scope:

    https://www.googleapis.com/auth/admin.directory.device.chromeos.readonly

  6. Click Authorize.

  7. Confirm that the client ID of the service account appears in the Domain-wide delegation list with the scope that you typed.

Identify the super administrator account that the connector impersonates

The connector impersonates a Google Workspace user account through domain-wide delegation. This account must have the Super Admin role. An account with any other administrator role cannot retrieve ChromeOS device data, and the connectivity test fails.

  1. In the Google Admin console, go to Account > Admin roles.

  2. Click Super Admin to view the accounts that are assigned to the role.

  3. Copy the email address of the account that you want the connector to impersonate to a safe location. You need this email address to configure the connector.

Verify the service account permissions

The following three conditions must be true before the connector can retrieve ChromeOS devices. Confirm all three before you configure the connector, and check them again if the connectivity test fails.

  • Domain-wide delegation is authorized. In the Google Admin console, go to Security > Access and data control > API controls > Domain-wide delegation. The numeric client ID of the service account appears in the list with the https://www.googleapis.com/auth/admin.directory.device.chromeos.readonly scope.

  • The impersonated account is a super administrator. In the Google Admin console, go to Account > Admin roles. The account has the Super Admin role and not another administrator role.

  • The Admin SDK API is enabled in the project that owns the service account. In the Google Cloud console, go to APIs & Services > Enabled APIs & services. Admin SDK API appears in the list of enabled APIs.

Add a Connector

To add a new connector:

  1. In the left navigation menu, click Connectors.

    The Connectors page appears.

  2. In the upper-right corner, click Add new connector.

    The Connector Library page appears.

  3. In the search box, type the name of the connector.

  4. On the tile for the connector, click Connect.

    The connector configuration options appear.

Configure the Connector

To configure the connector:

  1. (Optional) In the Connector's Name text box, type a descriptive name for the connector.

  2. Click Browse File, then select the service account JSON key file that you downloaded from the Google Cloud console.

  3. In the Impersonated Admin Email text box, type the email address of the Google Workspace super administrator account that the connector impersonates through domain-wide delegation.

    Note: This account must have the Super Admin role. The connector cannot retrieve ChromeOS devices with an account that has any other administrator role.

  4. Data pulling configuration: This configuration has dynamic settings tailored to the specific connector and integration type. Below are the configurations relevant to this connector.

    • In the Asset Retention text box, type the number of days after which you want assets to be removed from Tenable Exposure Management. If an asset has not been detected or updated within the specified number of days, it is automatically removed from the application, ensuring your asset inventory is current and relevant.

      Tip: For more information, see Asset Retention.

      For this connector, the default retention period is 460 days.

  5. In the Test connectivity section, click the Test Connectivity button to verify that Tenable Exposure Management can connect to your connector instance.

    • A successful connectivity test confirms that the platform can connect to the connector instance. It does not, however, guarantee that the synchronization process will succeed, as additional syncing or processing issues may arise.

    • If the connectivity test fails, an error message with details about the issue appears. Click Show tests for more information about the exact error.

    Tip: If the connectivity test fails, see Verify the service account permissions.

  6. In the Connector scheduling section, configure the time and day(s) on which you want connector syncs to occur.

    Tip: For more information, see Connector Scheduling.

  7. Click Create & Sync. Tenable Exposure Management begins syncing the connector. The sync can take some time to complete.

  8. To confirm the sync is complete, do the following:

Chrome OS in Tenable Exposure Management

Locate Connector Assets in Tenable Exposure Management

As the connector discovers assets, Tenable Exposure Management ingests those devices for reporting.

To view assets by connector:

  1. In Tenable Exposure Management, navigate to the Assets page.

  2. In the Filters section, under 3rd Party Connectors, click the connector name for which you want to view assets.

    The asset list updates to show only assets from the selected connector.

  3. Click on any asset to view Asset Details.

Data Mapping

Tenable Exposure Management integrates with the connector via API to retrieve relevant weakness and asset data, which is then mapped into the Tenable Exposure Management system. The following tables outline how fields and their values are mapped from the connector to Tenable Exposure Management.

Device Mapping

Tenable Exposure Management UI Field

Chrome OS Field
Asset ID

annotatedAssetId

deviceId
Asset Class DEVICE
Source chrome_os
Host Name

annotatedAssetId

deviceId
Device System Type chromeOsType
OT Model model
OT Serial Number serialNumber
OT Firmware firmwareVersion
OT Location annotatedLocation
Amount of RAM (MB) systemRamTotal
CPU Name cpuInfo.0.model
CPU Count cpuInfo.0.logicalCpus
MAC Addresses

macAddress

dockMacAddress

ethernetMacAddress

ethernetMacAddress0
IPv4 Addresses

ipAddress

lastKnownNetwork
IPv6 Addresses

ipAddress

lastKnownNetwork
OS Versions

osVersion

chromeOsType

platformVersion
External Tags

bootMode

deviceLicenseType

orgUnitPath

osVersionCompliance

status
First Observation Date firstEnrollmentTime
Last Observed At lastSync
Asset Custom Attributes

deviceId

orgUnitId

meid

orderNumber

willAutoRenew

supportEndDate

autoUpdateExpiration

autoUpdateThrough

manufactureDate

deprovisionReason

osUpdateStatus.state

osUpdateStatus.targetOsVersion

tpmVersionInfo.family

tpmVersionInfo.manufacturer

recentUsers.0.email

diskVolumeReports.0.volumeInfo.0.storageTotal

diskVolumeReports.0.volumeInfo.0.storageFree

lastKnownNetwork.0.wanIpAddress

extendedSupportEligible

Status Update Mechanisms

Every day, Tenable Exposure Management syncs with the vendor's platform to receive updates on existing assets and to retrieve new ones (if any were added).

The table below describes how the status update mechanism works in the connector for assets ingested into Tenable Exposure Management.

Update Type in Tenable Exposure Management

Mechanism (When?)

Archiving Assets

  • Asset that appears in Tenable Exposure Management and isn't returned on the next connector's sync.

  • Asset not seen for X days according to "Last Seen". See Asset Retention
Note: Updates on the vendor side are reflected in Tenable Exposure Management only when the next scheduled connector sync time is complete (once a day).

Uniqueness Criteria

Tenable Exposure Management uses defined uniqueness criteria to determine whether an ingested asset or finding should be recognized as a distinct record. These criteria help define how assets and findings are identified and counted from each connector.

Tip: To learn more about data deduplication and uniqueness criteria, See Third-Party Data Deduplication in Tenable Exposure Management.

The uniqueness criteria for this connector are as follows:

Data

Uniqueness Criteria

Asset

deviceId (the Google-assigned identifier that uniquely identifies an enrolled ChromeOS device)

API Endpoints in Use

API version: Google Admin SDK Directory API v1.

API

Use in Tenable Exposure Management

Permissions required

POST /token

Authenticates the connector and retrieves the access token that the connector uses for later requests.

Google service account with domain-wide delegation

Google Workspace super administrator account for impersonation

GET /admin/directory/v1/customer/my_customer/devices/chromeos

Retrieves the managed ChromeOS devices in your Google Workspace account to create device assets.

https://www.googleapis.com/auth/admin.directory.device.chromeos.readonly

Admin SDK API enabled in the Google Cloud project that owns the service account

Data Validation

This section shows how to validate and compare data between Tenable Exposure Management and Chrome OS.

Asset Data Validation

Objective: Ensure the number of managed devices in Chrome OS aligns with the number of device assets displayed in Tenable Exposure Management.

In the Google Admin console:

  1. Navigate to Devices > Chrome > Devices.

    Note the number of devices listed.

  2. (Optional) Click Export to generate a CSV file of the managed devices. The rows in this file represent the assets that Tenable Exposure Management ingests.

In Tenable Exposure Management:

  1. Locate your connector assets.

  2. Compare the total number of assets between Chrome OS and Tenable Exposure Management.

Expected outcome: The total numbers returned in Chrome OS and Tenable Exposure Management should match.

If an asset is not visible in Tenable Exposure Management, check the following conditions:

  • The asset is a ChromeOS device. The connector does not ingest other device types.

  • The asset shares an Asset ID with another device.

  • The asset was archived because its last seen date is older than the retention period configured for the connector.

  • The asset was archived because it did not return in the connector's last sync.

    Tip: To learn more on how assets are archived and findings change status, see Status Update Mechanisms.