Phase 4: Audit Logs

Module: AUDIT_LOGS

This phase is only required if you enabled Audit Log collection in the GCP onboarding wizard in Cortex.

4.1 Create a Pub/Sub Topic to collect and stream audit logs

gcloud pubsub topics create <TOPIC_NAME> \
    --labels=managed_by=paloaltonetworks,<YOUR_ADDITIONAL_LABELS>

Where:

• <TOPIC_NAME> is your chosen topic name (e.g., cortex-audit-logs-topic)

• <YOUR_ADDITIONAL_LABELS> is any additional labels you want added to all GCP resources

4.2 Create a Pub/Sub Subscription for the audit log topic

gcloud pubsub subscriptions create <SUBSCRIPTION_NAME> \
    --topic=<TOPIC_NAME> \
    --ack-deadline=600 \
    --message-retention-duration=7d \
    --labels=managed_by=paloaltonetworks,<YOUR_ADDITIONAL_LABELS>

Where:

• <SUBSCRIPTION_NAME> is your chosen subscription name (e.g., cortex-audit-logs-subscription)

• <TOPIC_NAME> is your chosen topic name (e.g., cortex-audit-logs-topic)

• <YOUR_ADDITIONAL_LABELS> is any additional labels you want added to all GCP resources

Update your Identifiers file: Copy the resulting Subscription ID and paste it into the "audit_pubsub_subscription" field in the "manual_details" section of your identifiers JSON file.

4.3 Create a Logging Sink to export audit logs to your Pub/Sub topic

gcloud logging sinks create <SINK_NAME> \
    pubsub.googleapis.com/projects/<PROJECT_ID>/topics/<TOPIC_NAME> \
    --log-filter='protoPayload.@type="type.googleapis.com/google.cloud.audit.AuditLog" AND logName=~"logs/cloudaudit.googleapis.com%2Factivity$"'

Where:

• <SINK_NAME> is your chosen sink name (e.g., cortex-audit-logs-sink).

• <PROJECT_ID> is the ID of the GCP project you are onboarding to Cortex

• <TOPIC_NAME> is your chosen topic name (e.g., cortex-audit-logs-topic)

4.3.1 Retrieve the Writer Identity (Service Account) generated for your new Logging Sink

gcloud logging sinks describe <SINK_NAME> --format='value(writerIdentity)'

Where:

• <SINK_NAME> is your chosen sink name (e.g., cortex-audit-logs-sink).

Look for the field labeled Writer Identity in the output. It will be an email address starting with "service-" (e.g., service-<PROJECT_ID>@gcp-sa-logging.iam.gserviceaccount.com). You will need the Writer Identity value in the next step.

4.4 Grant the Pub/Sub Publisher role to the Writer Identity

gcloud pubsub topics add-iam-policy-binding <TOPIC_NAME> \
    --member="serviceAccount:<SINK_WRITER_IDENTITY>" \
    --role="roles/pubsub.publisher"

Where:

• <TOPIC_NAME> is your chosen topic name (e.g., cortex-audit-logs-topic)

• <SINK_WRITER_IDENTITY> is the value of Writer Identity from the previous step

4.5 Create the Audit Logs Service Account

gcloud iam service-accounts create <AUDIT_SA_NAME> \
    --display-name="Cortex Platform Audit Logs Service Account"

Where:

• <AUDIT_SA_NAME> is your chosen service account ID (e.g., cortex-audit-logs).

4.6 Grant the Pub/Sub Subscriber role to the Audit Service Account

gcloud pubsub subscriptions add-iam-policy-binding <SUBSCRIPTION_NAME> \
    --member="serviceAccount:<AUDIT_SA_NAME>@<PROJECT_ID>.iam.gserviceaccount.com" \
    --role="roles/pubsub.subscriber"

Where:

• <SUBSCRIPTION_NAME> is your chosen subscription name (e.g., cortex-audit-logs-subscription)

• <AUDIT_SA_NAME> is your chosen service account ID (e.g., cortex-audit-logs)

• <PROJECT_ID> is the ID of the GCP project you are onboarding to Cortex

4.7 Grant the Service Account Token Creator role to the SaaS Collector Service Account

gcloud iam service-accounts add-iam-policy-binding \
    <AUDIT_SA_NAME>@<PROJECT_ID>.iam.gserviceaccount.com \
    --member="serviceAccount:<SAAS_COLLECTOR_SERVICE_ACCOUNT_EMAIL>" \
    --role="roles/iam.serviceAccountTokenCreator"

Where:

• <AUDIT_SA_NAME> is your chosen service account ID (e.g., cortex-audit-logs)

• <PROJECT_ID> is the ID of the GCP project you are onboarding to Cortex

• <SAAS_COLLECTOR_SERVICE_ACCOUNT_EMAIL> is the value listed in the identifiers JSON file