Google Cloud integration
Pulls Google Cloud infrastructure, identity, and organization data to enable real-time incident response and compliance automation across GCP.
What it connects
- GCP organizations, projects, and folder hierarchies with parent-child relationships
- Compute Engine VM instances with status, zone, machine type, and resource labels
- Service accounts with keys, email addresses, and project-level IAM permissions
- GKE cluster status, node pools, locations, and Kubernetes resource configuration
What it automates
- Start, stop, reset, suspend, and resume Compute Engine instances for lifecycle management and cost control
- Disable, enable, or delete service account keys to respond to security compromises in minutes
- Set instance labels and metadata for governance tagging and operational context without manual updates
- Create snapshots of VM disks for forensic preservation during security incidents or outages
In practice
An unexpected spike in GCP compute costs triggers an investigation. STLabs surfaces all running instances with their labels and resource usage, automatically stopping test instances to halt billing.
Security team detects suspicious API activity from a service account. STLabs lists all active keys for that account, disables the compromised key, and creates a rotation workflow to redeploy services with new credentials.
A production VM experiences critical errors. STLabs creates a snapshot for forensic analysis, resets the instance to clear hung processes, and tags it with incident metadata for compliance tracking.
Compliance audit requires verification of organization hierarchy and IAM policies. STLabs pulls the full org structure, lists all projects and their assigned IAM roles, and generates a compliance report with permission baselines.
