> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/google-cloud-platform-manual-onboarding/gcp-manual-onboarding/gcp-manual-onboarding-guide-organization-scope/phase-4-audit-logs.md). # Phase 4: Audit Logs Module: AUDIT\_LOGS This phase is only required if you enabled Audit Log collection in the GCP onboarding wizard in Cortex. ### 4.1 Create a Pub/Sub Topic to collect and stream audit logs Create in the host project: {% code overflow="wrap" %} ```bash gcloud pubsub topics create \ --project= \ --labels-managed_by=paloaltonetworks, ``` {% endcode %} Where: * `` is your chosen topic name (e.g., cortex-audit-logs-topic) * `` is the GCP host project ID where service accounts are created * `` is any additional labels you want added to all GCP resources Update your Identifiers file: Copy the resulting Topic ID and paste it into the "manual\_details" section of your identifiers JSON file. ### 4.2 Create a Pub/Sub Subscription for the audit log topic Create in the host project: {% code overflow="wrap" %} ```bash gcloud pubsub subscriptions create \ --topic= \ --project= \ --ack-deadline=600 \ --message-retention-duration=7d \ --labels managed_by=paloaltonetworks, ``` {% endcode %} Where: * `` is your chosen subscription name (e.g., cortex-audit-logs-subscription) * `` is your chosen topic name (e.g., cortex-audit-logs-topic) * `` is the GCP host project ID where service accounts are created * `` is any additional labels you want added to all GCP resources Update your Identifiers file: Copy the resulting Subscription ID and paste it into the "audit\_pubsub\_subscription" field in the "manual\_details" section of your identifiers JSON file. ### 4.3 Create a Logging Sink to export audit logs to your Pub/Sub topic Create an organization-level sink that includes all child resources: ```bash gcloud logging sinks create pubsub.googleapis.com/projects//topics/ \ --organization= \ --include-children \ --log-filter='protoPayload.@type="type.googleapis.com/google.cloud.audit.AuditLog" AND logName="logs/cloudaudit.googleapis.com%2Factivity"' ``` Where: * `` is your chosen sink name (e.g., cortex-audit-logs-sink) * `` is the GCP host project ID where service accounts are created * `` is your chosen topic name (e.g., cortex-audit-logs-topic) * `` is the numeric ID of the organization to onboard #### 4.3.1 Retrieve the Writer Identity (Service Account) generated for your new Logging Sink {% code overflow="wrap" %} ```bash gcloud logging sinks describe \ --organization= \ --format='value(writerIdentity)' ``` {% endcode %} Where: * `` is your chosen sink name (e.g., cortex-audit-logs-sink) * `` is the numeric ID of the organization to onboard Look for the field labeled Writer Identity in the output. It will be an email address starting with "service-" (e.g., service-\@gcp-sa-logging.iam.gserviceaccount.com). You will need the Writer Identity value in the next step. ### 4.4 Grant the Pub/Sub Publisher role to the Writer Identity {% code overflow="wrap" %} ```bash gcloud pubsub topics add-iam-policy-binding \ --project= \ --member="" \ --role="roles/pubsub.publisher" ``` {% endcode %} Where: * `` is your chosen topic name (e.g., cortex-audit-logs-topic) * `` is the GCP host project ID where service accounts are created * `` is the value of Writer Identity from the previous step ### 4.5 Create the Audit Logs Service Account Create in the host project: {% code overflow="wrap" %} ```bash gcloud iam service-accounts create \ --display-name="Cortex Platform Audit Logs Service Account" \ --project= ``` {% endcode %} Where: * `` is your chosen service account ID (e.g., cortex-audit-logs) * `` is the GCP host project ID where service accounts are created ### 4.6 Grant the Pub/Sub Subscriber role to the Audit Service Account ```bash gcloud pubsub subscriptions add-iam-policy-binding \ --project= \ --member="serviceAccount:@.iam.gserviceaccount.com" \ --role="roles/pubsub.subscriber" ``` Where: * `` is your chosen subscription name (e.g., cortex-audit-logs-subscription) * `` is your chosen service account ID (e.g., cortex-audit-logs) * `` is the GCP host project ID where service accounts are created ### 4.7 Grant the Service Account Token Creator role to the SaaS Collector Service Account ```bash gcloud iam service-accounts add-iam-policy-binding @.iam.gserviceaccount.com \ --member="serviceAccount:" \ --role="roles/iam.serviceAccountTokenCreator" ``` Where: * `` is your chosen service account ID (e.g., cortex-audit-logs) * `` is the GCP host project ID where service accounts are created * `` is the value listed in the identifiers JSON file --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/google-cloud-platform-manual-onboarding/gcp-manual-onboarding/gcp-manual-onboarding-guide-organization-scope/phase-4-audit-logs.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.