Enable Flow Logs for GCP Project

Enable flow logs for your VPC networks on GCP.
To analyze your network traffic, you must enable flow logs for each project you want Prisma Cloud to monitor.
Log in to GCP console and select your project.
Select
Navigation menu
VPC network
VPC networks
.

Select VPC network and click
EDIT
.
Select
Flow logs
On
to enable flow logs.

Select
Include metadata
.
This setting ensures that the log entries include metadata that is required to analyze traffic.
Set the
Aggregation Interval
to
15 min
.
Set the
Sample rate
to 100%.
Setting the aggregate interval and the sample rate as recommended above generates alerts faster on Prisma Cloud and reduces network costs you incur.
Save
your changes.
(
Required, if you are not using the Terraform template for adding your cloud account
) Add additional permissions to the bucket that is collecting VPC flow logs.
You must grant the Prisma Cloud service principal permissions to list objects in the storage bucket, and to read object data and metadata stored within the bucket. The permissions required are
storage.objects.list
and
storage.objects.get
. The Terraform template that Prisma Cloud provides to enable onboarding, includes these permissions in the role named
Prisma Cloud Flow Logs Viewer
, and this role is assigned to the service account on the bucket name that you provide the
Flow Log Storage Bucket
in the onboarding flow. If you want to manually add these permissions, refer to Google Cloud Storage documentation for instructions —https://cloud.google.com/storage/docs/access-control/using-iam-permissions#bucket-add.
Create a Sink to export flow logs.
You must create a sink and specify a Cloud Storage bucket as the export destination for VPC flow logs. You must configure a sink for every project that you want Prisma Cloud to monitor and configure a single Cloud Storage bucket as the sink destination for all projects. When you Onboard Your GCP Project, you must provide the Cloud Storage bucket from which the service can ingest VPC flow logs. As a cost reduction best practice, set a lifecycle to delete logs from your Cloud Storage bucket.
While authenticated into GCP, switch to the new Logs Explorer by selecting
Navigation menu
Logging
Legacy Logs Viewer
Upgrade
Upgrade to the new Logs Explorer
.
Create a sink.
Select
Logging
Logs Router
Create Sink
.

Enter the sink details.
Sink name
—An identifier for the sink.
(
Optional
) *Sink description
*—The use case for the sink.
Click
Next
.
Enter the sink destination.
Select the service type and the destination for logs to route to.
Select sink service
—Select the service that you want the logs to route to. If you want to create a sink for flowlogs then select
Cloud Storage Bucket
.
Sink destination
—Click
Browse
and
select
the bucket you want to use.
Click
Next
.
Choose logs to include in the sink.
Create an inclusion filter to determine the logs you want to include in the routing sink.+ In
Build inclusion filter
do the following:
Enter a filter expression
—Add a filter that matches the log entries you want to include. For example, if you want to build a filter to route all Data Access logs to a single logging bucket, the filter will look like the following:
logName:("projects/text-project-351281/logs/compute.googleapis.com%2Fvpc_flows") AND resource.labels.subnetwork_id:(5271207857644187590)
Verify your filter
—To verify you entered the correct filter, select
Preview logs
; the Logs Explorer opens in a new tab with the filter pre-populated.
Click
Next
.
Click
Create Sink
.
Add a lifecycle rule to limit the number of days you store flow logs on the Cloud Storage bucket.
By default, logs are never deleted. To manage cost, specify the threshold (in number of days) for which you want to store logs.
Select
Navigation Menu
Cloud Storage
Browser
.
Select the
Lifecycle
link for the storage bucket you want to modify.

Add rule
and Select object conditions to set
Age
to 30 days and Select Action as
Delete
.
Logs that are stored on your Cloud Storage bucket will be deleted in 30 days.
Select
Continue
and
Save
your changes.
Add the name of the Cloud Storage bucket you referenced above in
Flow Logs Storage Bucket
when you Onboard Your GCP Project.
(Optional)
Verify that your cloud storage bucket is being ingested.
You can review the status and take necessary actions to resolve any issues encountered during the onboarding process by viewing the
Cloud Accounts
page. To verify if the flow log data from your cloud storage buckets has been analyzed, you can run a network query on the
Investigate
page.
Onboard Your GCP Project.
Authenticate into Prisma Cloud and verify that your storage bucket is being ingested.
Select
Settings
Cloud Accounts
, filter for GCP cloud accounts. Click the
Edit
icon under the
Actions
column to view the results.
Navigate to
Investigate
, replace the name with your GCP cloud account name, and enter the following network query:
network from vpc.flow_record where cloud.account = ‘{{cloud account name}}’ AND source.publicnetwork IN (‘Internet IPs’, ‘Suspicious IPs’) AND bytes > 0
This query allows you to list all network traffic from the Internet or from Suspicious IP addresses with over 0 bytes of data transferred to a network interface on any resource on any cloud environment.