Phase 4: Audit Logs

Module: AUDIT_LOGS

This phase is only required if you enabled Audit Log collection in the GCP onboarding wizard in Cortex.

4.1 Create a Pub/Sub Topic to collect and stream audit logs

Create in the host project:

gcloud pubsub topics create <TOPIC_NAME> \
    --project=<HOST_PROJECT_ID> \
    --labels=managed_by=paloaltonetworks,<YOUR_ADDITIONAL_LABELS>

Where:

• <TOPIC_NAME> is your chosen topic name (e.g., cortex-audit-logs-topic)
• <HOST_PROJECT_ID> is the GCP host project ID where service accounts are created
• <YOUR_ADDITIONAL_LABELS> is any additional labels you want added to all GCP resources

Update your Identifiers file: Copy the resulting Topic ID and paste it into the "manual_details" section of your identifiers JSON file.

4.2 Create a Pub/Sub Subscription for the audit log topic

Create in the host project:

gcloud pubsub subscriptions create <SUBSCRIPTION_NAME> \
    --topic=<TOPIC_NAME> \
    --project=<HOST_PROJECT_ID> \
    --ack-deadline=600 \
    --message-retention-duration=7d \
    --labels=managed_by=paloaltonetworks,<YOUR_ADDITIONAL_LABELS>

Where:

• <SUBSCRIPTION_NAME> is your chosen subscription name (e.g., cortex-audit-logs-subscription)
• <TOPIC_NAME> is your chosen topic name (e.g., cortex-audit-logs-topic)
• <HOST_PROJECT_ID> is the GCP host project ID where service accounts are created
• <YOUR_ADDITIONAL_LABELS> is any additional labels you want added to all GCP resources

Update your Identifiers file: Copy the resulting Subscription ID and paste it into the audit_pubsub_subscription field in the "manual_details" section of your identifiers JSON file.

4.3 Create a Logging Sink to export audit logs to your Pub/Sub topic

Create a folder-level sink that includes all child resources:

gcloud logging sinks create <SINK_NAME> pubsub.googleapis.com/projects/<HOST_PROJECT_ID>/topics/<TOPIC_NAME> \
    --folder=<FOLDER_ID> \
    --include-children \
    --log-filter='protoPayload.@type="type.googleapis.com/google.cloud.audit.AuditLog" AND logName=~"logs/cloudaudit.googleapis.com%2Factivity$"'

Where:

• <SINK_NAME> is your chosen sink name (e.g., cortex-audit-logs-sink)
• <HOST_PROJECT_ID> is the GCP host project ID where service accounts are created
• <TOPIC_NAME> is your chosen topic name (e.g., cortex-audit-logs-topic)
• <FOLDER_ID> is the numeric ID of the folder to onboard

4.3.1 Retrieve the Writer Identity (Service Account) generated for your new Logging Sink

gcloud logging sinks describe <SINK_NAME> \
    --folder=<FOLDER_ID> \
    --format='value(writerIdentity)'

Where:

• <SINK_NAME> is your chosen sink name (e.g., cortex-audit-logs-sink)
• <FOLDER_ID> is the numeric ID of the folder to onboard

Look for the field labeled Writer Identity in the output. It will be an email address starting with "service-" (e.g., service-<PROJECT_NUMBER>@gcp-sa-logging.iam.gserviceaccount.com). You will need the Writer Identity value in the next step.

4.4 Grant the Pub/Sub Publisher role to the Writer Identity

gcloud pubsub topics add-iam-policy-binding <TOPIC_NAME> \
    --project=<HOST_PROJECT_ID> \
    --member="serviceAccount:<SINK_WRITER_IDENTITY>" \
    --role="roles/pubsub.publisher"

Where:

• <TOPIC_NAME> is your chosen topic name (e.g., cortex-audit-logs-topic)
• <HOST_PROJECT_ID> is the GCP host project ID where service accounts are created
• <SINK_WRITER_IDENTITY> is the value of Writer Identity from the previous step

4.5 Create the Audit Logs Service Account

Create in the host project:

gcloud iam service-accounts create <AUDIT_SA_NAME> \
    --display-name="Cortex Platform Audit Logs Service Account" \
    --project=<HOST_PROJECT_ID>

Where:

• <AUDIT_SA_NAME> is your chosen service account ID (e.g., cortex-audit-logs)
• <HOST_PROJECT_ID> is the GCP host project ID where service accounts are created

4.6 Grant the Pub/Sub Subscriber role to the Audit Service Account

gcloud pubsub subscriptions add-iam-policy-binding <SUBSCRIPTION_NAME> \
    --project=<HOST_PROJECT_ID> \
    --member="serviceAccount:<AUDIT_SA_NAME>@<HOST_PROJECT_ID>.iam.gserviceaccount.com" \
    --role="roles/pubsub.subscriber"

Where:

• <SUBSCRIPTION_NAME> is your chosen subscription name (e.g., cortex-audit-logs-subscription)
• <AUDIT_SA_NAME> is your chosen service account ID (e.g., cortex-audit-logs)
• <HOST_PROJECT_ID> is the GCP host project ID where service accounts are created

4.7 Grant the Service Account Token Creator role to the SaaS Collector Service Account

gcloud iam service-accounts add-iam-policy-binding <AUDIT_SA_NAME>@<HOST_PROJECT_ID>.iam.gserviceaccount.com \
    --member="serviceAccount:<SAAS_COLLECTOR_SERVICE_ACCOUNT_EMAIL>" \
    --role="roles/iam.serviceAccountTokenCreator"

Where:

• <AUDIT_SA_NAME> is your chosen service account ID (e.g., cortex-audit-logs)
• <HOST_PROJECT_ID> is the GCP host project ID where service accounts are created
• <SAAS_COLLECTOR_SERVICE_ACCOUNT_EMAIL> is the value listed in the identifiers JSON file