Overview

The Google Cloud Platform integration polls Cloud Logging and ingests:

  • Admin Activity audit logs (always on; covers IAM, project, and resource changes)
  • Data Access audit logs (when enabled per service)
  • System Event audit logs
  • Policy Denied audit logs
  • VPC flow logs and any other log streams routed to a Cloud Logging sink

Prerequisites

  • A GCP project (or organization) with the logs you want to ingest.
  • A service account with the Logs Viewer (roles/logging.viewer) role at the appropriate scope.

Step 1: Create a service account

  1. Open the Google Cloud Console and select your project.
  2. Go to IAM & Admin → Service Accounts → Create service account.
  3. Name it atatus-siem and click Create and continue.
  4. Grant the role Logs Viewer (roles/logging.viewer). For broader scope, also grant Private Logs Viewer (roles/logging.privateLogViewer) for Data Access logs.
  5. Click Done.
  6. Open the new service account → Keys tab → Add Key → Create new key → JSON. Download the JSON file securely.

Tip: To collect logs across multiple projects, grant the service account the role at the organization or folder level instead.

Step 2: Enable required APIs

  1. Go to APIs & Services → Library.
  2. Enable Cloud Logging API (and Cloud Audit Logs API if listed).

Step 3: (Optional) Enable Data Access logs

By default, Data Access audit logs are disabled.

  1. Go to IAM & Admin → Audit Logs.
  2. Select the services you want (for example, Cloud Storage, BigQuery).
  3. Enable Admin Read, Data Read, and Data Write as needed.
  4. Click Save.

Step 4: Connect Google Cloud Platform in Atatus

  1. In Atatus, go to Security → Cloud SIEM → Integrations.
  2. Locate the Google Cloud Platform card and click Connect.
  3. Fill in the form:
Field Description Example
Service Account JSON Paste the entire JSON key from Step 1. { "type": "service_account", ... }
GCP Project ID Project to read logs from. my-project-123
Poll Interval (minutes) How often to fetch new events. 5
Enabled Turn collection on. true
  1. Click Connect.

Verification

  • The Google Cloud Platform card shows Configured.
  • Audit log entries appear in Security → Cloud SIEM → Audit Logs → Events with source gcp_audit.