Cloud Ngfw Threat Log Correlation Cloud Logging

What Cloud NGFW Threat Logging and Firewall Rule Logging Is

Cloud Next Generation Firewall (Cloud NGFW) Enterprise provides advanced Layer 7 inspection powered by intrusion detection and prevention technologies. When traffic matches a firewall policy rule configured with the apply_security_profile_group action, Cloud NGFW evaluates the packet against defined threat prevention security profiles. Cloud NGFW generates distinct log streams in Cloud Logging: one for the initial firewall policy rule match and another for the deep packet Layer 7 inspection performed by the firewall endpoint.

How It Meets the Investigation Requirements

• Threat Log Identification: When a malicious pattern or signature (such as a command-and-control connection) is identified, the firewall endpoint emits a log record under the resource type networksecurity.googleapis.com/FirewallEndpoint and log name networksecurity.googleapis.com/firewall_threat. This record contains the threatDetails payload with critical telemetry including threat ID, severity, CVE references, and the applied action.
• Firewall Rule Correlation: When logging is enabled on the firewall policy rule, Cloud NGFW logs an initial Firewall Rules Logging entry where jsonPayload.rule_details.action is logged as APPLY_SECURITY_PROFILE_GROUP. The engineer can cross-reference the connection 5-tuple (source IP, source port, destination IP, destination port, and protocol) between the firewall rule log and the threat log to pinpoint the exact connection and policy rule.

Key Advantages and Capabilities

• Granular Threat Telemetry: Threat logs include specific fields such as category, threat_id, alert_severity, and direction (CLIENT_TO_SERVER or SERVER_TO_CLIENT).
• Stateful Connection Tracking: Correlates L3/L4 connection 5-tuples with L7 deep inspection findings.
• Centralized Log Analytics: Enables security analysts to run SQL queries in Log Analytics or set up real-time alerting on high-severity network intrusions.
• Action Visibility: Reports whether the firewall endpoint took the default action, dropped packets (DROP), or generated alerts (ALERT).

Why This Is Optimal

Querying the dedicated networksecurity.googleapis.com/firewall_threat log name combined with the APPLY_SECURITY_PROFILE_GROUP rule disposition is the only native mechanism in Google Cloud to perform end-to-end correlation between network firewall enforcement and Layer 7 intrusion signatures.