​
Overview

The Google Cloud Platform integration polls Cloud Logging and ingests:
  • Admin Activity audit logs (always on; covers IAM, project, and resource changes)
  • Data Access audit logs (when enabled per service)
  • System Event audit logs
  • Policy Denied audit logs
  • VPC flow logs and any other log streams routed to a Cloud Logging sink

​
Prerequisites

  • A GCP project (or organization) with the logs you want to ingest.
  • A service account with the Logs Viewer (roles/logging.viewer) role at the appropriate scope.

​
Step 1: Create a service account

  1. Open the Google Cloud Console and select your project.
  2. Go to IAM & Admin → Service Accounts → Create service account.
  3. Name it atatus-siem and click Create and continue.
  4. Grant the role Logs Viewer (roles/logging.viewer). For broader scope, also grant Private Logs Viewer (roles/logging.privateLogViewer) for Data Access logs.
  5. Click Done.
  6. Open the new service account → Keys tab → Add Key → Create new key → JSON. Download the JSON file securely.
To collect logs across multiple projects, grant the service account the role at the organization or folder level instead.

​
Step 2: Enable required APIs

  1. Go to APIs & Services → Library.
  2. Enable Cloud Logging API (and Cloud Audit Logs API if listed).

​
Step 3: (Optional) Enable Data Access logs

By default, Data Access audit logs are disabled.
  1. Go to IAM & Admin → Audit Logs.
  2. Select the services you want (for example, Cloud Storage, BigQuery).
  3. Enable Admin Read, Data Read, and Data Write as needed.
  4. Click Save.

​
Step 4: Connect Google Cloud Platform in Atatus

  1. In Atatus, go to Security → Cloud SIEM → Integrations.
  2. Locate the Google Cloud Platform card and click Connect.
  3. Fill in the form:
  1. Click Connect.

​
Verification

  • The Google Cloud Platform card shows Configured.
  • Audit log entries appear in Security → Cloud SIEM → Audit Logs → Events with source gcp_audit.