GCP VPC Flow Logs
Note: This integration is currently in beta and requires manual intervention from AlphaSOC. If you wish to integrate your GCP environment with Analytics Engine, please contact firstname.lastname@example.org beforehand.
Open the VPC networks dashboard and select the subnet for which you want to enable flow logs.
Configure logs and set aggregation interval to
5 sec and sample rate to
Logs Router dashboard and click
Enter sink details:
- Sink name and description
- Select Cloud Storage bucket as a sink destination
- Use the Cloud Storage bucket name provided by AlphaSOC.
- Logs filter:
logName="projects/PROJECT_ID/logs/compute.googleapis.com%2Fvpc_flows" AND jsonPayload.reporter="SRC"
To allow logs to be written to the GCS bucket provided by AlphaSOC, you will need to create a service account and provide its details to us so that we can grant necessary permissions to it.
Logs Router dashboard, open the context menu on the right side of the sink and select
View sink details.
Writer identity field from the window that opened and provide it to AlphaSOC.