Export Data to Google BigQuery

Set up continuous export of assets, vulnerabilities, and scan results from Mondoo to a Google BigQuery dataset using one-click Workload Identity Federation, manual WIF, or a service account key.

Export your Mondoo security data to Google BigQuery so you can run SQL queries across your assets, vulnerabilities, and scan results. BigQuery is ideal for custom dashboards, trend analysis, and joining Mondoo data with other datasets in your warehouse. For how exports work in general, read Continuous Data Exports.

Requirements

A GCP project with the BigQuery API enabled
Editor or Owner access to the Mondoo space from which you want to export data
Permission in GCP to create service accounts, Workload Identity Pools, and IAM policy bindings

Create a BigQuery dataset

Your BigQuery integration needs a dataset to which Mondoo exports data. To learn about BigQuery datasets, read Introduction to datasets in the Google documentation.

Create a new GCP BigQuery dataset for the Mondoo integration to use. For instructions, read Creating datasets in the Google documentation.

Note the dataset ID (in the format PROJECT_ID.DATASET_ID). You need it when you configure the integration.

Choose an authentication method

Mondoo can authenticate to GCP in three ways:

One-click Workload Identity Federation (WIF) (recommended): Keyless. You give Mondoo your project ID and project number, and Mondoo hands you a ready-to-run gcloud script that creates everything WIF needs in your project. Nothing to rotate, and no values to copy back into Mondoo.
Manual WIF: Also keyless, but you create the Workload Identity Pool, OIDC provider, and service account yourself, then paste the audience URL and service account email into Mondoo. Use this path when your organization requires specific resource names, or when a pool already exists.
Service account key: A static JSON key file. Simplest to set up, but you're responsible for securely storing and regularly rotating the key.

With WIF, Mondoo acts as an OIDC identity provider. When it's time to export, Mondoo issues a short-lived OIDC token and presents it to GCP. GCP validates the token against Mondoo's public signing keys (fetched from Mondoo's OIDC discovery endpoint), then issues temporary GCP credentials that Mondoo uses to write data to BigQuery. No static keys are stored or transmitted.

In the one-click flow, Mondoo generates the setup script for you. The script creates these resources in your project:

Resource	Name
Workload Identity Pool	`mondoo-pool`
OIDC provider	`mondoo-provider`
Export service account	`mondoo-export@PROJECT_ID.iam.gserviceaccount.com`

It also grants the export service account the BigQuery Data Editor (roles/bigquery.dataEditor) and BigQuery Job User (roles/bigquery.jobUser) roles on the project, and authorizes the pool to impersonate that service account.

The script is safe to run more than once. Every resource it creates is idempotent, so if a step fails you can run the whole script again.

Step 1: Find your project ID and project number

Both values appear on your Google Cloud console dashboard. Neither is the project's display name.

The project ID is the unique ID string, for example my-project-123.
The project number is the auto-assigned numeric ID, for example 123456789012.

To retrieve them from the CLI:

gcloud projects describe PROJECT_ID --format='value(projectId,projectNumber)'

Step 2: Create the BigQuery export integration in Mondoo

In the Mondoo App, navigate to the space from which you want to export data.
In the side navigation bar, select Integrations. Under Exports, select BigQuery.
In the Choose an integration name box, enter a name for the integration.
In the Dataset ID box, enter your BigQuery dataset ID (in the format PROJECT_ID.DATASET_ID). To find this value, read Listing datasets in the Google documentation.
Select the Workload Identity Federation (recommended) tab.
In the Project ID box, enter your project ID. In the Project number box, enter your project number.
Select Generate setup.

Mondoo creates the integration and shows you the setup script. No data is exported yet.

Step 3: Run the setup script in Google Cloud

Select Open in Google Cloud Shell. Cloud Shell opens in a new tab, scoped to the project you entered.
Copy the script from Mondoo, paste it into Cloud Shell, and press Enter.
Wait for the script to print Mondoo GCP export setup complete. If you don't see that line, the script didn't finish. Run it again.

You can also run the script from any workstation with the GCP CLI (gcloud) installed and authenticated to the target project.

Step 4: Run the first export

Return to the Mondoo tab and select Run first export.

New GCP permissions can take a few minutes to propagate. If the first export fails with a permissions error, wait a moment and try again.

Step 5: Verify the integration

On the integration details page, wait for the export to complete. If the status changes to active, the setup is working correctly.
Exports then run automatically approximately every 24 hours.

If the export fails, double-check:

The setup script finished successfully in the same project whose ID and number you entered in Mondoo.
The dataset ID is correct and the dataset exists in that project.
The mondoo-export service account has both the BigQuery Data Editor and BigQuery Job User roles.

Manage this integration

After it's created, find your integration under Integrations in your space's side navigation. Select it to open the detail page, where you can:

Trigger a manual export. Exports run automatically about every 24 hours. To export immediately, select SCHEDULE NOW.
Check the status. active means the integration is healthy and exporting on schedule. pending means Mondoo hasn't attempted the first export yet. error means the last export failed.
Remove the integration. Select the trash can icon and confirm. Mondoo stops future exports but does not delete data that has already been exported.