Note: This integration is currently in beta and requires manual intervention from AlphaSOC. If you wish to integrate your GCP environment with Analytics Engine, please contact firstname.lastname@example.org beforehand.
Enable VPC flow logs
Open the VPC networks dashboard and select the subnet for which you want to enable flow logs.
Configure logs and set aggregation interval to
5 sec and sample rate to
Export logs to Google Cloud Storage
Logs Router dashboard and click
Enter sink details:
- Sink name and description
- Select Cloud Storage bucket as a sink destination
- Use the Cloud Storage bucket name provided by AlphaSOC.
- Logs filter:
logName="projects/PROJECT_ID/logs/compute.googleapis.com%2Fvpc_flows" AND jsonPayload.reporter="SRC"
Logs sink service account
To allow logs to be written to the GCS bucket provided by AlphaSOC, you will need to create a service account and provide its details to us so that we can grant necessary permissions to it.
Logs Router dashboard, open the context menu on the right side of the sink and select
View sink details.
Writer identity field from the window that opened and provide it to AlphaSOC.