Connect Google Cloud Platform - GCP#

Step 1 - Open the project selector#

Go to console.cloud.google.com and select the project picker in the Google Cloud header.

Step 2 - Select the project and copy its ID#

Choose the project whose Cloud Audit Logs you want to protect. After it opens, copy the Project ID from the welcome page.

Step 3 - Open Integrations in Jutsu#

Go to app.jutsu.ai and select Integrations in the left navigation. Open the Data Sources category if it is not already selected.

Step 4 - Select Google Cloud Platform#

In the Cloud section, select the Google Cloud Platform card or its connect icon.

This integration pulls Cloud Audit Logs for IAM changes, API calls, and resource activity across services such as Compute Engine, GKE, Cloud Storage, and BigQuery.

Step 5 - Enter the connection details#

Complete the connection form:

Name	A clear label for the project, such as Acme - GCP production.
GCP project ID	Paste the exact project ID copied from Google Cloud.
Pub/Sub subscription ID	Keep jutsu-audit-sub unless you have a deliberate naming requirement.
Setup method	Keep One-click selected. Cloud Shell is the recommended keyless path.

Step 6 - Start setup#

Review the project ID and subscription ID, then select Start setup. Jutsu creates a pending asset and prepares a single Cloud Shell command.

Step 7 - Open Cloud Shell and copy the command#

In the next dialog, select Open Cloud Shell. A new Google Cloud tab opens with the Google Cloud CLI already installed and signed in as your current Google identity.

Return to Jutsu and select Copy beside Step 2. Paste only the command generated for your own project. The exact asset ID, Jutsu service account, registration URL, and one-time secret are already filled in.

Step 8 - Run the setup script#

1. In Cloud Shell, paste the copied command and press Enter.
2. If prompted to authorize Cloud Shell or the Google Cloud CLI, review the account and project, then continue.
3. Wait while the script enables APIs, creates or reuses the named resources, applies the two IAM grants, and registers the asset.
4. Do not close Cloud Shell until the terminal prints Done - head back to Jutsu; the integration flips to Connected automatically.

Step 9 - Wait for Done#

A successful run ends after Registering the integration with Jutsu. The output also confirms the topic, subscription, sink writer grant, and Jutsu subscriber grant.

Step 10 - Confirm the asset in Jutsu#

Return to Jutsu and open Assets. The Google Cloud project appears as a connected pull integration. It can show Warming up for the first 5-10 minutes while Jutsu waits for the first qualifying event.

Select the asset to view connection details, 5-minute, 1-hour, and 24-hour event counts, source-type breakdown, and the 20 most recent events.

Verify the connection#

1. Open Assets, select the Google Cloud asset, and review Connection details. Confirm the project ID, subscription ID, and Authentication: IAM grant (keyless).
2. Use Test connection. A successful result reads Subscription reachable. The check performs a one-message pull without acknowledging any returned message, so it can be redelivered after the acknowledgement deadline.
3. Allow up to 15 minutes for the first event. A quiet project can show No events yet indefinitely without indicating a fault.
4. Check Source-type breakdown for gcp.audit and review the 20 most recent events after activity arrives.
5. Confirm Last event advances when new qualifying audit activity occurs.

Optional low-impact event test#

If the project is quiet, temporarily set the asset's minimum severity to All events (info), then create and delete a dedicated test topic. Replace the placeholder with the connected project ID.

Generate two Admin Activity events, then restore your preferred severity filter

Coverage and detection behavior#

The one-click sink matches Cloud Audit Log names across Google Cloud services. Google publishes four audit-log types: Admin Activity, Data Access, System Event, and Policy Denied.

Admin Activity	Always generated for configuration and metadata changes; the best source for initial validation.
System Event	Always generated for Google-initiated configuration changes.
Policy Denied	Generated by default when a security policy blocks access.
Data Access	Records reads and user-data access. Disabled by default for most services except BigQuery; enable deliberately after reviewing volume and cost.

High-signal normalization in Jutsu#

Google Cloud activity	Jutsu severity	Detection context
SetIamPolicy	High	Privilege Escalation - MITRE T1098.003
Service-account key creation	High	Persistence - MITRE T1098.001
Logging sink update or deletion	Critical	Defense Evasion - MITRE T1562.008
Firewall create, update, or delete	Medium or higher	Defense Evasion - MITRE T1562.007
Denied or failed API call	At least Medium	Failure status preserved for investigation

Alternative setup methods#

Manual IAM - existing sink and subscription#

1. Confirm the existing Logging sink routes Cloud Audit Logs to a Pub/Sub topic and that the sink's writer identity has roles/pubsub.publisher on that topic.
2. Confirm a pull subscription exists and note its project ID and subscription ID.
3. In the Jutsu connection dialog, choose Manual IAM. Enter the integration name, project ID, and subscription ID.
4. Run the displayed gcloud command to grant Jutsu's service account roles/pubsub.subscriber on that subscription.
5. Select Connect, then review the immediate subscription-access test.

Service-account key - fallback only#

• Create or reuse a dedicated Google service account and grant it roles/pubsub.subscriber on only the required subscription.
• Create a JSON key for that service account. Jutsu validates type=service_account plus client_email, private_key, and private_key_id.
• Choose Key in the connection dialog, paste the JSON, and select Connect.
• Store and rotate the key according to your credential-management policy. Delete any local downloaded copy after secure transfer.

Organization-wide coverage#

The one-click flow creates a project-level sink. Security teams that already operate an aggregated organization sink can route child-project Cloud Audit Logs into a shared topic and subscription, grant Jutsu subscriber access, and connect it with Manual IAM. Validate scope, tenancy, and log volume before using a shared subscription.

Troubleshooting#

The Cloud Shell script reports Permission denied#

• Confirm the active Cloud Shell account and the --project value in the copied command.
• Ask a project administrator for Service Usage Admin, Logs Configuration Writer, and Pub/Sub Admin, or run the setup with a Project Owner identity.
• If adding Jutsu's service account is rejected, check domain-restricted sharing and other organization policies that restrict external principals.
• After permissions are corrected, run the same command again before its 24-hour registration window expires.

The script finishes, but Jutsu stays Pending#

• Confirm the terminal reached Registering the integration with Jutsu and the final Done message.
• Verify that Cloud Shell can reach https://api.jutsu.ai and that a proxy or egress policy did not block the registration callback.
• Wait one polling interval, then refresh Assets or Integrations. The setup dialog checks status every 5 seconds while open.
• The registration secret expires after 24 hours. If it expired, start a fresh setup in Jutsu and run the new command. The Google Cloud resource creation is idempotent.

The integration is Connected, but no events appear#

• A quiet project is not an error. Admin Activity appears only when configuration changes occur, and most read operations require Data Access logging, which is off by default.
• Review the asset's Severity filter. Medium and above can intentionally hide routine successful API activity.
• Use Test connection to verify that Jutsu can consume the subscription.
• In Google Cloud Log Router, confirm jutsu-audit-sink points to pubsub.googleapis.com/projects/<PROJECT_ID>/topics/jutsu-audit-logs and uses the cloudaudit.googleapis.com filter.
• On the Pub/Sub topic, confirm the sink writer identity has roles/pubsub.publisher. On the subscription, confirm Jutsu's service account has roles/pubsub.subscriber.
• If a resource with a Jutsu default name existed before setup, inspect it carefully. The idempotent script reuses existing resources and does not overwrite a pre-existing sink's destination or filter.

Troubleshooting - connection test errors#

Message	Meaning	Action
pubsub API 403	Jutsu's principal cannot consume the subscription.	Grant roles/pubsub.subscriber on the exact subscription to the displayed Jutsu service account.
pubsub API 404	The project or subscription ID is wrong, or the subscription was deleted.	Compare Jutsu connection details with the Pub/Sub subscription resource.
metadata server unreachable	The Jutsu API probe lacks its own GCP workload identity.	Ingestion may still work. Check event arrival; contact Jutsu support if the probe remains unavailable.
No events yet	The subscription is reachable but no qualifying activity has arrived.	Wait for activity, review severity, or run the optional test.

Inspect the Google Cloud resources#

Read-only checks for destination and IAM bindings

Security and access#

• Jutsu receives roles/pubsub.subscriber on one subscription. It permits message consumption, not project administration or topic publishing.
• The Logging sink's Google-managed writer receives roles/pubsub.publisher only on the destination topic.
• The setup command returns a one-time registration secret. Jutsu stores only its SHA-256 hash; it expires after 24 hours and is consumed on registration.
• The subscription is the durable cursor. Jutsu acknowledges a message only after ingest accepts it; deterministic event IDs absorb redelivery duplicates.
• Key-mode credentials are encrypted at rest and written to a temporary, permission-restricted connector file at runtime. Keyless IAM avoids that credential lifecycle.

Pause, archive, or remove#

Pause	Disable the asset in Jutsu. The pull connector stops on its next reconciliation without deleting the saved configuration.
Archive	Stop ingestion and free the plan slot. Collected events and alerts remain available; Google Cloud resources stay in place.
Full teardown - IAM mode	After archiving, run Jutsu's Cloud Shell teardown command. It removes the sink, subscriber grant, subscription, and topic and is safe to re-run.
Full teardown - key mode	Delete the service-account key, then remove the dedicated sink, subscription, and topic if they are no longer required.

Related Google Cloud documentation#

• Route logs to Pub/Sub	• Cloud Audit Logs	• Enable Data Access logs
• Pub/Sub IAM	• Service Usage IAM