> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/google-cloud-platform-cloud-onboarding/how-to-onboard-google-cloud-platform.md).

# How to onboard Google Cloud Platform

After completing the prerequisites, follow these instructions to onboard your Google Cloud Platform (GCP) environment to Cortex Cloud.

## Access the GCP onboarding wizard in Cortex Cloud:

1. In Cortex Cloud, select Settings → Data Sources & Integrations.
2. On the Data Sources & Integrations page, click + Add New.
3. On the Add Data Sources or Integrations page, search for Google Cloud Platform (GCP), then hover over it and click Add.

## Select the GCP environment

* In the GCP onboarding wizard, select the type of GCP environment:
  * **Government:** GCP GovCloud environments for compatibility with FedRAMP-certified tenants.
  * **Commercial:** (Default) Standard cloud deployment typically used for private and public sector organizations that do not require isolated government-specific infrastructure.

## Select the scope

* Select the scope for this cloud instance:
  * **Organization:** (Default) A collection of GCP projects that are managed centrally.
  * **Folder:** A GCP folder can contain projects, folders, or a combination of both projects and folders.
  * **Project:** A specific GCP project.

## Choose the scan mode

* Specify the scanning infrastructure for your cloud instance by selecting one of the following scan modes:
  * **Cloud Scan:** (Recommended) Security scanning is performed in the Cortex Cloud cloud environment.
  * **Scan with Outpost:** Security scanning is performed on infrastructure deployed to a cloud account owned by you. If you select this option, choose the outpost account to use for this instance.

    <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><h4>Note</h4><p>Scanning with an outpost may require additional GCP permissions and may incur additional CSP costs.</p></div>

## Configure advanced settings (optional)

* Click Show advanced settings to define the following advanced settings:

  * **Instance Name:** Enter a unique instance name or leave it empty to be automatically populated. The automatic naming convention is ``GCP- or `GCP-`<organizationID>``. Cortex Cloud does not prevent you from reusing instance names, but it is best practice to use a unique name for every cloud instance.
  * **Scope Modifications:** Use these settings to fine-tune your GCP scope. You can modify the scope by including or excluding specific regions. Additionally, if you selected an organization or folder as the scope, you can modify the scope by including or excluding specific folders or projects. For more details, see [Apply region or account filters](file:///document/preview/1642776#UUID-45e9eb08-9a94-b8bc-5ef5-f8763c8d7a75_bridgehead-id235452944278033).
  * **Additional Security Capabilities:** Choose which security capabilities you want to benefit from. Some security capabilities are enabled by default and can be modified. Adding security capability typically requires additional cloud provider permissions. For detailed information on the permissions required, see [Cloud service provider permissions](broken://pages/d19b7289157770ec21d718943eac53b9f84259e9#UUID-36ad5711-3213-c242-4fac-e5af26b5ffa7).
    * **Data security posture management:** An agentless data security scanner that discovers, classifies, protects, and governs sensitive data.
    * **Registry scanning:** A container registry scanner that scans registry images for vulnerabilities, malware, and secrets. For more details, see [Configure registry scanning for cloud accounts](/cortex-cloud-posture-management/cortex-cloud-data-sources-and-connectors/cloud-posture-and-runtime-security-data-sources/container-registry-scanning/configure-registry-scanning-for-cloud-accounts.md).
    * **Serverless functions scanning:** Implement serverless scanning to detect and remediate vulnerabilities within serverless functions during the development lifecycle. Seamless integration into CI/CD pipelines enables automated security scans for a continuously secure pre-production environment.
    * **Automation:** Use automation to pre-configure a list of integrations and associated commands to automate security issue responses. Commands can be utilized individually or as part of custom playbooks for issue remediation.
      * **Log Level:** (Optional - for Automation only) Configure the automation integration logging level. Possible values are:
        * Off (Default)
        * Debug
        * Verbose
    * **Agentless disk scanning:** (Recommended) Implement agentless disk scanning to remotely detect and remediate vulnerabilities during the development lifecycle.
  * **Cloud Tags:** Define tags and tag values to be added to any new resource created by Cortex Cloud in GCP. Note: The `managed_by = paloaltonetworks` tag is automatically added to all resources. This tag is mandatory. You cannot edit or remove this tag.
  * **Log Collection Configuration:** To maximize security coverage, include the collection of audit logs (GCP Pub/Sub). This may require additional cloud service provider permissions. For detailed information on the permissions required, see [Cloud service provider permissions](broken://pages/d19b7289157770ec21d718943eac53b9f84259e9#UUID-36ad5711-3213-c242-4fac-e5af26b5ffa7).
  * Connect to GCP Workspace: Gain a comprehensive view of your Google Workspace identities and security. This provides you with detailed information on your users, groups, and organizational units, and collects security event logs to help you detect threats, improve your security posture, and meet compliance requirements.

    <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><h4>Note</h4><p>If you want to connect to your GCP Workspace, you must first complete onboarding with the option disabled. Once the GCP cloud instance is created, perform the steps detailed in <a href="/pages/cace9b37daa87572b5f890f81c690f3a55c9b39c">Connect Google Workspace with your GCP cloud instance</a>.</p></div>
  * **Upload unknown files to WildFire:** Use this option to upload unknown files scanned during registry image scans to WildFire for detonation analysis.
This option expands malware detection by allowing WildFire to analyze new samples found in your registry images. When a detonation result returns a malicious verdict, the system re-evaluates the relevant registry image and creates a malware finding.

  <figure><img src="/files/nPVhM9bV8rboGglkKBcV" alt=""><figcaption></figcaption></figure>

  <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><h4>Notes</h4><ul><li>The file types sent for WildFire analysis depend on the platform type. WildFire accepts files up to 300 MB in size.</li><li>This setting applies only to registry image scans and is enabled by default for new GCP instances. For existing instances, this setting is disabled by default to preserve the current behavior. You can enable it at any time by editing the instance configuration.</li><li>Your cloud provider may charge standard outbound data transfer (egress) fees when scanning with an <a href="/pages/UmlxKNkwOHiyB4LgrOiz">Outpost</a>.</li></ul></div>

## Save the configuration and download the template

1. Click Save. Cortex Cloud generates a Terraform authentication template based on the settings you configured in the GCP onboarding wizard. Cortex Cloud creates an instance in the pending state. For details on pending instances, see [Lifecycle and expiration](file:///document/preview/1642663#UUID-726c45a9-65b6-7e0d-3407-25ca37a41df9_bridgehead-id235452961383613).
2. Click Download Terraform to download the template file and then click Close.

   The Terraform authentication template is reusable and can be applied as many times as you want to create new instances with the settings you defined in the GCP onboarding wizard. The Terraform authentication template is valid for seven days from when it was created.

**Next step:** Deploy the Terraform authentication template in GCP.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/google-cloud-platform-cloud-onboarding/how-to-onboard-google-cloud-platform.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.