> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/google-cloud-platform-manual-onboarding/gcp-manual-onboarding/gcp-manual-onboarding-guide-project-scope/overview-of-the-onboarding-process.md). # Overview of the Onboarding Process The following table lists every step in the procedure for manually onboarding Google Cloud Platform (GCP). Use it as a checklist to track your progress. Steps marked as **Required** must be completed for every onboarding. Optional steps depend on the Cortex security capabilities you choose to enable. | Step | Procedure | Required? | Required for capability | Platform | | ------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------- | -------------------------------------------- | -------- | | **Prerequisites** | | | | | | P.1 | [Required admin GCP permissions](/google-cloud-platform-manual-onboarding/gcp-manual-onboarding/gcp-manual-onboarding-guide-project-scope/prerequisites.md#p1-grant-required-admin-gcp-permissions-for-cortex-onboarding) | Required | — | GCP | | P.2 | [Enable necessary APIs in GCP](/google-cloud-platform-manual-onboarding/gcp-manual-onboarding/gcp-manual-onboarding-guide-project-scope/prerequisites.md#p2-enable-necessary-apis-in-gcp) | Required | — | GCP | | P.3 | [Identify and set your target project](/google-cloud-platform-manual-onboarding/gcp-manual-onboarding/gcp-manual-onboarding-guide-project-scope/prerequisites.md#p3-identify-and-set-your-target-project) | Required | — | GCP | | **Phase 1** | [**Create GCP cloud instance in Cortex**](/google-cloud-platform-manual-onboarding/gcp-manual-onboarding/gcp-manual-onboarding-guide-project-scope/phase-1-gcp-onboarding-wizard.md) | | | | | 1.1 | [Start the GCP onboarding wizard](/google-cloud-platform-manual-onboarding/gcp-manual-onboarding/gcp-manual-onboarding-guide-project-scope/phase-1-gcp-onboarding-wizard.md#11-start-the-gcp-onboarding-wizard) | Required | — | Cortex | | 1.2 | [Download the customized identifiers file](/google-cloud-platform-manual-onboarding/gcp-manual-onboarding/gcp-manual-onboarding-guide-project-scope/phase-1-gcp-onboarding-wizard.md#12-download-the-customized-identifiers-file) | Required | — | Cortex | | **Phase 2** | [**Deploy platform service account**](/google-cloud-platform-manual-onboarding/gcp-manual-onboarding/gcp-manual-onboarding-guide-project-scope/phase-2-platform-service-accounts.md) | | | | | 2.1 | [Create the Platform Service Account](/google-cloud-platform-manual-onboarding/gcp-manual-onboarding/gcp-manual-onboarding-guide-project-scope/phase-2-platform-service-accounts.md) | Required | — | GCP | | 2.2 | [Grant predefined managed roles to the Platform Service Account](/google-cloud-platform-manual-onboarding/gcp-manual-onboarding/gcp-manual-onboarding-guide-project-scope/phase-2-platform-service-accounts.md) | Required | Assets Discovery | GCP | | 2.3 | [Create the Custom role and grant it to the Platform Service Account](/google-cloud-platform-manual-onboarding/gcp-manual-onboarding/gcp-manual-onboarding-guide-project-scope/phase-2-platform-service-accounts.md) | Required | Assets Discovery | GCP | | 2.4 | [Grant the Service Account Token Creator role to the Outpost Service Account](/google-cloud-platform-manual-onboarding/gcp-manual-onboarding/gcp-manual-onboarding-guide-project-scope/phase-2-platform-service-accounts.md) | Required | — | GCP | | 2.5 | [Agentless Disk Scanning (ADS)](/google-cloud-platform-manual-onboarding/gcp-manual-onboarding/gcp-manual-onboarding-guide-project-scope/phase-2-platform-service-accounts.md) | Optional | Agentless Disk Scanning | GCP | | 2.5.1 | [Create the ADS Connector Role](/google-cloud-platform-manual-onboarding/gcp-manual-onboarding/gcp-manual-onboarding-guide-project-scope/phase-2-platform-service-accounts.md) | Optional | Agentless Disk Scanning | GCP | | 2.5.2 | [Grant the ADS Connector role to the Platform Service Account](/google-cloud-platform-manual-onboarding/gcp-manual-onboarding/gcp-manual-onboarding-guide-project-scope/phase-2-platform-service-accounts.md) | Optional | Agentless Disk Scanning | GCP | | 2.5.3 | [Create the ADS Outpost role](/google-cloud-platform-manual-onboarding/gcp-manual-onboarding/gcp-manual-onboarding-guide-project-scope/phase-2-platform-service-accounts.md) | Optional | Agentless Disk Scanning | GCP | | 2.5.4 | [Grant the ADS Outpost role to the Outpost Service Account](/google-cloud-platform-manual-onboarding/gcp-manual-onboarding/gcp-manual-onboarding-guide-project-scope/phase-2-platform-service-accounts.md) | Optional | Agentless Disk Scanning | GCP | | 2.6 | [Automation](/google-cloud-platform-manual-onboarding/gcp-manual-onboarding/gcp-manual-onboarding-guide-project-scope/phase-2-platform-service-accounts.md) | Optional | Automation | GCP | | 2.6.1 | [Create the Automation role](/google-cloud-platform-manual-onboarding/gcp-manual-onboarding/gcp-manual-onboarding-guide-project-scope/phase-2-platform-service-accounts.md) | Optional | Automation | GCP | | 2.6.2 | [Grant the Automation role to the Platform Service Account](/google-cloud-platform-manual-onboarding/gcp-manual-onboarding/gcp-manual-onboarding-guide-project-scope/phase-2-platform-service-accounts.md) | Optional | Automation | GCP | | 2.7 | [DSPM: Platform Service Account](/google-cloud-platform-manual-onboarding/gcp-manual-onboarding/gcp-manual-onboarding-guide-project-scope/phase-2-platform-service-accounts.md) | Optional | DSPM | GCP | | 2.7.1 | [Create the DSPM Connector role](/google-cloud-platform-manual-onboarding/gcp-manual-onboarding/gcp-manual-onboarding-guide-project-scope/phase-2-platform-service-accounts.md) | Optional | DSPM | GCP | | 2.7.2 | [Grant the DSPM Connector role to the Platform Service Account](/google-cloud-platform-manual-onboarding/gcp-manual-onboarding/gcp-manual-onboarding-guide-project-scope/phase-2-platform-service-accounts.md) | Optional | DSPM | GCP | | **Phase 3** | [**Deploy scanner service account**](/google-cloud-platform-manual-onboarding/gcp-manual-onboarding/gcp-manual-onboarding-guide-project-scope/phase-3-scanner-service-account.md) | | | | | 3.1 | [Create the Scanner Service Account](/google-cloud-platform-manual-onboarding/gcp-manual-onboarding/gcp-manual-onboarding-guide-project-scope/phase-3-scanner-service-account.md) | Required if any scanning capability is enabled | Registry Scanning, DSPM, Serverless Scanning | GCP | | 3.2 | [Grant the Viewer role to the Scanner Service Account](/google-cloud-platform-manual-onboarding/gcp-manual-onboarding/gcp-manual-onboarding-guide-project-scope/phase-3-scanner-service-account.md) | Required if any scanning capability is enabled | Registry Scanning, DSPM, Serverless Scanning | GCP | | 3.3 | [DSPM: Scanner Service Account](broken://spaces/j1t3RTnPu7E0wVVRxQSW/pages/VLhiJ6nrjIYI9CZQ6ZJB#33-dspm-scanner-service-account-optional) | Optional | DSPM | GCP | | 3.3.1 | [Create the DSPM Outpost role](broken://spaces/j1t3RTnPu7E0wVVRxQSW/pages/VLhiJ6nrjIYI9CZQ6ZJB#331-create-the-dspm-outpost-role) | Optional | DSPM | GCP | | 3.3.2 | [Grant the DSPM Outpost role to the Outpost Service Account](broken://spaces/j1t3RTnPu7E0wVVRxQSW/pages/VLhiJ6nrjIYI9CZQ6ZJB#332-grant-the-dspm-outpost-role-to-the-outpost-service-account) | Optional | DSPM | GCP | | 3.3.3 | [Create the DSPM Scanner Connector role](broken://spaces/j1t3RTnPu7E0wVVRxQSW/pages/VLhiJ6nrjIYI9CZQ6ZJB#333-create-the-dspm-scanner-connector-role) | Optional | DSPM | GCP | | 3.3.4 | [Grant the DSPM Scanner Connector role to the Scanner Service Account](broken://spaces/j1t3RTnPu7E0wVVRxQSW/pages/VLhiJ6nrjIYI9CZQ6ZJB#334-grant-the-dspm-scanner-connector-role-to-the-scanner-service-account) | Optional | DSPM | GCP | | 3.3.5 | [Grant the Storage Object Viewer role to the Scanner Service Account](broken://spaces/j1t3RTnPu7E0wVVRxQSW/pages/VLhiJ6nrjIYI9CZQ6ZJB#335-grant-the-storage-object-viewer-role-to-the-scanner-service-account) | Optional | DSPM | GCP | | 3.3.6 | [Grant the Service Account Token Creator role to the DSPM Scanner Service Account](broken://spaces/j1t3RTnPu7E0wVVRxQSW/pages/VLhiJ6nrjIYI9CZQ6ZJB#336-grant-the-service-account-token-creator-role-to-the-dspm-scanner-service-account) | Optional | DSPM | GCP | | 3.4 | [Registry Scanning](broken://spaces/j1t3RTnPu7E0wVVRxQSW/pages/VLhiJ6nrjIYI9CZQ6ZJB) | Optional | Registry Scanning | GCP | | 3.4.1 | [Create the Registry Scanner role](broken://spaces/j1t3RTnPu7E0wVVRxQSW/pages/VLhiJ6nrjIYI9CZQ6ZJB) | Optional | Registry Scanning | GCP | | 3.4.2 | [Grant the Registry Scanner role to the Scanner Service Account](broken://spaces/j1t3RTnPu7E0wVVRxQSW/pages/VLhiJ6nrjIYI9CZQ6ZJB) | Optional | Registry Scanning | GCP | | 3.4.3 | [Grant the Service Account Token Creator role to the Registry Scanner Service Account](broken://spaces/j1t3RTnPu7E0wVVRxQSW/pages/VLhiJ6nrjIYI9CZQ6ZJB) | Optional | Registry Scanning | GCP | | 3.5 | [Serverless Scanning](broken://spaces/j1t3RTnPu7E0wVVRxQSW/pages/VLhiJ6nrjIYI9CZQ6ZJB) | Optional | Serverless Scanning | GCP | | 3.5.1 | [Create the Serverless Scanner role](broken://spaces/j1t3RTnPu7E0wVVRxQSW/pages/VLhiJ6nrjIYI9CZQ6ZJB) | Optional | Serverless Scanning | GCP | | 3.5.2 | [Grant the Serverless Scanner role to the Scanner Service Account](broken://spaces/j1t3RTnPu7E0wVVRxQSW/pages/VLhiJ6nrjIYI9CZQ6ZJB) | Optional | Serverless Scanning | GCP | | 3.5.3 | [Grant the Service Account Token Creator role to the Serverless Scanner Service Account](broken://spaces/j1t3RTnPu7E0wVVRxQSW/pages/VLhiJ6nrjIYI9CZQ6ZJB) | Optional | Serverless Scanning | GCP | | **Phase 4: Connect audit logs** | | | | | | 4 | [Audit Logs](broken://spaces/j1t3RTnPu7E0wVVRxQSW/pages/B9bRn6eNhUNJNDwjKgbu) | Optional | Audit Logs | GCP | | 4.1 | [Create a Pub/Sub Topic to collect and stream audit logs](broken://spaces/j1t3RTnPu7E0wVVRxQSW/pages/B9bRn6eNhUNJNDwjKgbu) | Optional | Audit Logs | GCP | | 4.2 | [Create a Pub/Sub Subscription for the audit log topic](broken://spaces/j1t3RTnPu7E0wVVRxQSW/pages/B9bRn6eNhUNJNDwjKgbu) | Optional | Audit Logs | GCP | | 4.3 | [Create a Logging Sink to export audit logs to your Pub/Sub topic](broken://spaces/j1t3RTnPu7E0wVVRxQSW/pages/B9bRn6eNhUNJNDwjKgbu) | Optional | Audit Logs | GCP | | 4.3.1 | [Retrieve the Writer Identity (Service Account) generated for your new Logging Sink](broken://spaces/j1t3RTnPu7E0wVVRxQSW/pages/B9bRn6eNhUNJNDwjKgbu) | Optional | Audit Logs | GCP | | 4.4 | [Grant the Pub/Sub Publisher role to the Writer Identity](broken://spaces/j1t3RTnPu7E0wVVRxQSW/pages/B9bRn6eNhUNJNDwjKgbu) | Optional | Audit Logs | GCP | | 4.5 | [Create the Audit Logs Service Account](broken://spaces/j1t3RTnPu7E0wVVRxQSW/pages/B9bRn6eNhUNJNDwjKgbu) | Optional | Audit Logs | GCP | | 4.6 | [Grant the Pub/Sub Subscriber role to the Audit Service Account](broken://spaces/j1t3RTnPu7E0wVVRxQSW/pages/B9bRn6eNhUNJNDwjKgbu) | Optional | Audit Logs | GCP | | 4.7 | [Grant the Service Account Token Creator role to the SaaS Collector Service Account](broken://spaces/j1t3RTnPu7E0wVVRxQSW/pages/B9bRn6eNhUNJNDwjKgbu) | Optional | Audit Logs | GCP | | **Phase 5: Complete the onboarding wizard** | | | | | | 5.1 | [Enter the GCP scope details and service accounts in Cortex](broken://spaces/j1t3RTnPu7E0wVVRxQSW/pages/1KTJLjcvxXvFyCiA1jUY) | Required | — | Cortex | | 5.2 | [Complete onboarding](broken://spaces/j1t3RTnPu7E0wVVRxQSW/pages/1KTJLjcvxXvFyCiA1jUY) | Required | — | Cortex | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/google-cloud-platform-manual-onboarding/gcp-manual-onboarding/gcp-manual-onboarding-guide-project-scope/overview-of-the-onboarding-process.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.