> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/google-cloud-platform-manual-onboarding/gcp-manual-onboarding/gcp-manual-onboarding-guide-project-scope/phase-4-audit-logs.md).

# Phase 4: Audit Logs

Module: AUDIT\_LOGS

This phase is only required if you enabled Audit Log collection in the GCP onboarding wizard in Cortex.

### 4.1 Create a Pub/Sub Topic to collect and stream audit logs

```shell
gcloud pubsub topics create <TOPIC_NAME> \
    --labels=managed_by=paloaltonetworks,<YOUR_ADDITIONAL_LABELS>
```

Where:

* `<TOPIC_NAME>` is your chosen topic name (e.g., cortex-audit-logs-topic)
* `<YOUR_ADDITIONAL_LABELS>` is any additional labels you want added to all GCP resources

### 4.2 Create a Pub/Sub Subscription for the audit log topic

```shell
gcloud pubsub subscriptions create <SUBSCRIPTION_NAME> \
    --topic=<TOPIC_NAME> \
    --ack-deadline=600 \
    --message-retention-duration=7d \
    --labels=managed_by=paloaltonetworks,<YOUR_ADDITIONAL_LABELS>
```

Where:

* `<SUBSCRIPTION_NAME>` is your chosen subscription name (e.g., cortex-audit-logs-subscription)
* `<TOPIC_NAME>` is your chosen topic name (e.g., cortex-audit-logs-topic)
* `<YOUR_ADDITIONAL_LABELS>` is any additional labels you want added to all GCP resources

Update your Identifiers file: Copy the resulting Subscription ID and paste it into the "audit\_pubsub\_subscription" field in the "manual\_details" section of your identifiers JSON file.

### 4.3 Create a Logging Sink to export audit logs to your Pub/Sub topic

```shell
gcloud logging sinks create <SINK_NAME> \
    pubsub.googleapis.com/projects/<PROJECT_ID>/topics/<TOPIC_NAME> \
    --log-filter='protoPayload.@type="type.googleapis.com/google.cloud.audit.AuditLog" AND logName=~"logs/cloudaudit.googleapis.com%2Factivity$"'
```

Where:

* `<SINK_NAME>` is your chosen sink name (e.g., cortex-audit-logs-sink).
* `<PROJECT_ID>` is the ID of the GCP project you are onboarding to Cortex
* `<TOPIC_NAME>` is your chosen topic name (e.g., cortex-audit-logs-topic)

#### 4.3.1 Retrieve the Writer Identity (Service Account) generated for your new Logging Sink

```shell
gcloud logging sinks describe <SINK_NAME> --format='value(writerIdentity)'
```

Where:

* `<SINK_NAME>` is your chosen sink name (e.g., cortex-audit-logs-sink).

Look for the field labeled Writer Identity in the output. It will be an email address starting with "service-" (e.g., service-\<PROJECT\_ID>@gcp-sa-logging.iam.gserviceaccount.com). You will need the Writer Identity value in the next step.

### 4.4 Grant the Pub/Sub Publisher role to the Writer Identity

```shell
gcloud pubsub topics add-iam-policy-binding <TOPIC_NAME> \
    --member="serviceAccount:<SINK_WRITER_IDENTITY>" \
    --role="roles/pubsub.publisher"
```

Where:

* `<TOPIC_NAME>` is your chosen topic name (e.g., cortex-audit-logs-topic)
* `<SINK_WRITER_IDENTITY>` is the value of Writer Identity from the previous step

### 4.5 Create the Audit Logs Service Account

```shell
gcloud iam service-accounts create <AUDIT_SA_NAME> \
    --display-name="Cortex Platform Audit Logs Service Account"
```

Where:

* `<AUDIT_SA_NAME>` is your chosen service account ID (e.g., cortex-audit-logs).

### 4.6 Grant the Pub/Sub Subscriber role to the Audit Service Account

```shell
gcloud pubsub subscriptions add-iam-policy-binding <SUBSCRIPTION_NAME> \
    --member="serviceAccount:<AUDIT_SA_NAME>@<PROJECT_ID>.iam.gserviceaccount.com" \
    --role="roles/pubsub.subscriber"
```

Where:

* `<SUBSCRIPTION_NAME>` is your chosen subscription name (e.g., cortex-audit-logs-subscription)
* `<AUDIT_SA_NAME>` is your chosen service account ID (e.g., cortex-audit-logs)
* `<PROJECT_ID>` is the ID of the GCP project you are onboarding to Cortex

### 4.7 Grant the Service Account Token Creator role to the SaaS Collector Service Account

```shell
gcloud iam service-accounts add-iam-policy-binding \
    <AUDIT_SA_NAME>@<PROJECT_ID>.iam.gserviceaccount.com \
    --member="serviceAccount:<SAAS_COLLECTOR_SERVICE_ACCOUNT_EMAIL>" \
    --role="roles/iam.serviceAccountTokenCreator"
```

Where:

* `<AUDIT_SA_NAME>` is your chosen service account ID (e.g., cortex-audit-logs)
* `<PROJECT_ID>` is the ID of the GCP project you are onboarding to Cortex
* `<SAAS_COLLECTOR_SERVICE_ACCOUNT_EMAIL>` is the value listed in the identifiers JSON file


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/google-cloud-platform-manual-onboarding/gcp-manual-onboarding/gcp-manual-onboarding-guide-project-scope/phase-4-audit-logs.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.