Mapping of audit logs with firewall logs

[cagarwal20]

Can we map the audit logs and firewall logs using some key in both the logs ?

[ruthseki]

Hi @cagarwal20,

Welcome to Google Cloud Community!

Yes, you can map audit logs and firewall logs in Google Cloud using a common key, primarily the resource.labels.instance_id. The idea is to identify a field or set of fields that exist in both the audit logs and firewall logs, and which uniquely identify the resource, usually a VM instance being affected.

The resource.labels.instance_id represents the unique instance ID of a Compute Engine VM. It's present in both Compute Engine Audit Logs and Firewall Logs when the firewall rule applies to a VM instance. It's specific and directly links the activity in the audit log to network activity recorded in the firewall logs.

Was this helpful? If so, please accept this answer as “Solution”. If you need additional assistance, reply here within 2 business days and I’ll be happy to help.

[cagarwal20]

Hi @ruthseki  , thanks for the reply , I have a small doubt , do we have a unique identifier that maps these logs , let's say some kind of connection_id, I also want to map dns logs , audit logs and firewall logs , using some identifier is there a way ?

Thanks in advance!