> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/connect/connect-cloud-accounts/onboard-gcp/enable-flow-logs-for-gcp-organization.md). # Enable Flow Logs for GCP Organization Create and configure a sink to export the flow logs for your GCP organization. Prisma Cloud uses the traffic data in flow logs for your GCP organization or folder resource hierarchy to detect network threats such as cryptomining, data exfiltration, and host compromises. Before Prisma Cloud can analyze your flow log data, you must create a sink to export the flow logs to a Cloud Storage bucket. To configure a sink for your entire GCP organization or folder, use the gcloud command line tool. Enabling flow logs will incur high network egress costs. Prisma Cloud strongly recommends that you enable [Flow Logs Compression on GCP](/content-collections/connect/connect-cloud-accounts/onboard-gcp/flow-logs-compression.md) to significantly reduce the network egress costs associated with sending uncompressed GCP logs to the Prisma Cloud infrastructure. 1. Enable flow logs for each of your VPCs in each project of your organization that you want Prisma Cloud to monitor. 1. [Enable flow logs for your VPC networks on GCP.](/content-collections/connect/connect-cloud-accounts/onboard-gcp/enable-flow-logs-for-gcp-project.md) 2. [Add additional permissions to the bucket that is collecting VPC flow logs.](/content-collections/connect/connect-cloud-accounts/onboard-gcp/enable-flow-logs-for-gcp-project.md) 2. Gather the following information from your [GCP account](https://console.cloud.google.com): * Cloud Storage bucket name * Organization ID 3. Download and install the [Google Cloud SDK](https://cloud.google.com/sdk/docs/). During the SDK install, you must log in to your GCP account. This account must have these three permissions enabled at the organization level: * Billing Account Administrator * Logging Administrator * Organization Administrator 4. Run this command to create a service account needed to configure the sink for your Cloud Storage bucket but replace the **Bucket-name** with your Cloud Storage bucket name and **Organization ID** with your organization ID. Or you can also configure a sink using the GCP console as described in [Step 3 of Enable Flow Logs for GCP Project](/content-collections/connect/connect-cloud-accounts/onboard-gcp/enable-flow-logs-for-gcp-project.md) ``` $ gcloud logging sinks create storage.googleapis.com/ --include-children --organization= --log-filter="resource.type="gce_subnetwork" AND logName:"logs/compute.googleapis.com%2Fvpc_flows"" ```
gcp gcloud cli organization sink
If you are onboarding a GCP folder, you must have the [Folder Viewer](https://cloud.google.com/iam/docs/understanding-roles#resource-manager-roles) role and can use the command userinput:\[$ gcloud logging sinks create \ storage.googleapis.com/\ --include-children --folder=\ --log-filter="resource.type="gce\_subnetwork" AND logName:"logs/compute.googleapis.com%2Fvpc\_flows""] to create a service account needed to configure the sink for your Cloud Storage bucket. 5. Grant the service account permission to access your Cloud Storage bucket. 1. Select **Navigation menu > Storage** and select your Cloud Storage bucket. 2. Select **Permissions > Add members**. 3. Add the service account email address for **Members**, select **Storage > Storage Admin** and select **Add**.
gcp organization storage account access
6. Add the name of Cloud Storage bucket you created above in **Flow Logs Storage Bucket** when you [onboarded your GCP organization](/content-collections/connect/connect-cloud-accounts/onboard-gcp/onboard-gcp-org.md). 7. (tt:\[Optional]) Enable [Flow Logs Compression on GCP](/content-collections/connect/connect-cloud-accounts/onboard-gcp/flow-logs-compression.md). Enable flow logs compression on Prisma Cloud to automate the compression of flow logs using the Google Cloud Dataflow service. When enabled, the compressed logs are stored to the same Storage bucket as your flow logs and mitigates the network egress costs associated with sending uncompressed GCP logs to the Prisma Cloud infrastructure. 8. Navigate to **Investigate**, replace the name with your GCP cloud account name, and enter the following network query: ``` network from vpc.flow_record where source.publicnetwork IN ('Internet IPs', 'Suspicious IPs') AND bytes > 0 ``` This query allows you to list all network traffic from the Internet or from Suspicious IP addresses with over 0 bytes of data transferred to a network interface on any resource on any cloud environment. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.prismacloud.io/content-collections/connect/connect-cloud-accounts/onboard-gcp/enable-flow-logs-for-gcp-organization.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.