Professional Cloud Network Engineer
Exporting and filtering firewall logs is the process of capturing network security event data and sending specific parts of it to storage or analysis platforms. This is done to meet audit requirements and to enable automated threat detection. Virtual Private Cloud (VPC) firewall rules and the Cloud Next Generation Firewall (Cloud NGFW) generate detailed logs about connection attempts and rule matches. Administrators use Cloud Logging to collect this data and then route selected logs through log sinks to destinations like BigQuery, Cloud Storage, Pub/Sub, or external security information and event management (SIEM) systems.
Firewall log entries contain specific details about network traffic that tries to pass through a firewall rule. Each log includes connection information like source and destination IP addresses and ports, the protocol used, and the final action taken by the firewall (such as ALLOW or DENY). For Cloud NGFW logs, which perform deeper Layer 7 inspection, the log also includes application-layer details like URLs and threat detection results, and the resource type is identified as a firewall endpoint.
To find specific security events, you can create filters in the Logs Explorer. You can filter logs by the type of resource, such as resource.type="networksecurity.googleapis.com/FirewallEndpoint" for NGFW logs. You can also filter on specific actions like DENY or on connection details like a source IP address. This allows you to isolate logs for a particular traffic flow or a specific security event across your VPC networks.
Routing logs involves setting up export sinks in Cloud Logging. A sink defines a destination—like a Cloud Storage bucket for long-term retention or a Pub/Sub topic for real-time streaming—and a filter that selects which logs are sent there. When configuring a sink, you write a filter expression that uses logic to include only the logs you need, such as firewall logs, while excluding high-volume, low-value operational logs. This selective filtering helps control costs by reducing the amount of data transferred and stored, while still capturing the logs required for compliance audits.
Once firewall logs are routed to a SIEM like Google Security Operations (Google SecOps), they are parsed and normalized into a standard format called the Unified Data Model (UDM). The parser extracts the connection details, rule information, and any threat data from the raw logs. This transformation allows the SIEM to correlate firewall events with other security data, like host logs or user identity information.
Inside the SIEM, the normalized firewall events can trigger automated threat detection rules. Security teams can create simple rules to flag a single suspicious event, like a denied connection attempt to a sensitive server. They can also create more complex rules that correlate multiple firewall events over time to detect sophisticated, multi-step attacks that would be missed by looking at individual logs alone.
Firewall Rules Logging is a feature in Google Cloud that records information about network traffic evaluated by your firewall rules. It helps you monitor traffic patterns, audit your security policies, and investigate security incidents. Logging works for both standard VPC firewall rules and Cloud NGFW rules. To use it, you must first enable the Firewall Rules Logging feature for your entire Google Cloud project. After it's enabled, you can then turn logging on or off for each individual firewall rule you create or edit.
Enabling logging is a two-step process. First, you enable the feature at the project level. Second, you configure logging on each specific firewall rule by selecting a logging option (like "Log all matches" or "Log denied connections") when you create or edit the rule. You can enable logging for both inbound (ingress) and outbound (egress) rules. It's important to note that services like Firewall Insights, which analyzes your rules for security gaps, only work for rules that have logging enabled. Therefore, configuring logging is essential for continuous security monitoring and optimization.
Firewall logs contain several categories of metadata that are useful for analysis. Connection details include the source and destination IPs, ports, and protocol. Rule details include the name, priority, and action of the rule that matched the traffic, as well as which resources (like VMs or subnets) the rule applies to. For Cloud NGFW, logs also include threat information, such as which security profile detected a threat. Network information fields identify the specific VPC network, subnetwork, and project where the traffic was observed, which is crucial for tracing events in complex environments.
Logging all firewall activity can generate a large volume of data, which increases costs. To manage this, you should strategically enable logging on the rules that provide the most security value. For example, you might log all "deny" rules to monitor blocked attack attempts, but only log critical "allow" rules that protect sensitive data. The system also provides options like log sampling (recording only a percentage of events) and controlling which metadata is included to help reduce volume while maintaining necessary visibility for troubleshooting and forensics.
Analyzing firewall log telemetry means examining the detailed records of network traffic captured by your firewalls to solve network problems, investigate security breaches, and check if your security policies are working correctly. This analysis uses logs from both standard VPC Firewall rules and the more advanced Cloud Next Generation Firewall (NGFW), all collected in Cloud Logging. By querying these logs, you can determine exactly what happened to specific traffic and which rule was responsible.
There are two main sources of firewall logs. VPC Firewall logs come from traditional firewall rules and record basic connection attempts, showing whether traffic was allowed or denied based on IP addresses and ports. Cloud NGFW logs are generated when traffic is inspected by next-generation firewall policies that include features like URL filtering or intrusion prevention; these logs contain much richer details, including application-layer information and specific threat data. Both types of logs are sent to Cloud Logging, where they can be searched, analyzed, and exported to SIEM systems for long-term storage and deeper forensic investigation.
To understand what happened to network traffic, you need to look at specific fields in the firewall logs. The disposition field (in VPC logs) or the action field (in NGFW logs) tells you the final outcome, such as ALLOWED, DENIED, or INTERCEPTED. When a rule matches the traffic, the log includes a rule_details section that lists the rule's priority, name, and the specific source and destination criteria. For example, if a connection fails, a log entry with disposition: "DENIED" and the associated rule_details will show you exactly which firewall rule blocked it, which is the first clue in troubleshooting the issue.
You perform analysis by building targeted queries in the Logs Explorer. A query filters the massive stream of logs to find events related to a specific problem. For instance, to diagnose a failed connection, you would create a query that filters on the source and destination IP addresses and ports involved. The resulting logs will show you the disposition and which rule was matched. For forensic investigations with Cloud NGFW, you can create more advanced queries, such as searching for all logs where the action was DENY due to a URL filtering policy, which would include the blocked web address. Correlating logs from multiple firewalls over time helps you reconstruct complex attack sequences.
Firewall logs are not just for looking back at incidents; they can also be used proactively to improve your security setup. The Firewall Insights service analyzes your logged firewall activity to generate recommendations. It can identify rules that are never used ("unused allow rules"), rules that are too permissive but have only been used for a narrow range of IPs, and rules that are hidden or "shadowed" by higher-priority rules. By acting on these insights, you can safely remove unused rules, tighten over-permissive rules to follow the principle of least privilege, and delete redundant rules. This cycle of optimization, driven by actual log data, strengthens your security and simplifies your firewall configuration.
StudyCerts
StudyCertsdisposition or action field in a firewall log entry indicates the final fate of the traffic (e.g., ALLOWED, DENIED), while rule_details identifies the specific rule that made the decision.VPC Firewall logs record basic connection attempts and rule matches based on IP addresses, ports, and protocols (Layer 3/4). Cloud NGFW logs include all that plus detailed application-layer information (Layer 7), such as URLs accessed and specific threat detections from features like intrusion prevention or URL filtering.
You should enable logging on firewall rules that are critical for security monitoring and troubleshooting. This typically includes all "deny" rules to audit blocked traffic, and key "allow" rules that protect sensitive resources. Avoid logging every rule to manage costs and log volume effectively.
Log filtering allows you to export only the specific firewall logs you need for audit compliance (like all denied connections) to your SIEM or storage, while excluding high-volume, low-value operational logs. This reduces the amount of data transferred and stored, lowering costs while ensuring you retain the necessary records.
Firewall Insights analyzes your firewall log data to identify unused rules that can be safely deleted, overly permissive rules that should be narrowed, and rules that are shadowed (made irrelevant) by higher-priority rules. This helps you optimize your security posture and simplify your firewall configuration.
Prepare and test your skills
Prepare and test your skills