Cisco
Login
Search
Software Multicloud Defense
Activity Onboard

Traffic Discovery and Visiblilty Types of Traffic Enable DNS Logs GCP: Enable DNS Logs

Last updated: Jul 03, 2025

GCP: Enable DNS Logs

To enable GCP DNS query logs, follow the steps below.

Procedure

1

In the Security Cloud Control platform menu, choose Products > Multicloud Defense .
2

Navigate to VPC network in GCP console.
3

Open Google cloud shell and execute this command:

gcloud dns policies create POLICY_NAME --networks=NETWORK --enable-logging
4

Navigate to Cloud Storage section and create a storage bucket. You can leave everything as default when creating storage bucket.


 

Both DNS and VPC logs can share the same cloud storage bucket.

5

Navigate to Logs Route section.
6

Click on Create Sink.
7

Provide a sink name.
8

Select "Cloud Storage bucket" for sink service.
9

Select the cloud storage bucket that was created above.
10

In "Choose logs to include in sink" section, put in this string: resource.type="dns_query".

The following steps are the same as mentioned in the VPC flow log for GCP. If you are sharing cloud storage bucket, you only need to perform below steps once.
11

Click Create Sink.
12

Navigate to IAM > Roles.
13

Create a custom role with this permission: storage.buckets.list.
14

Create another custom role with following permission:

storage.buckets.get storage.objects.get storage.objects.list.
15

Add both custom role to the service account created for Multicloud Defense Controller. When adding the second custom role, put this condition:


(resource.type == "storage.googleapis.com/Bucket" || resource.type ==
 "storage.googleapis.com/Object") && 
resource.name.startsWith('projects/_/buckets/<cloud storage name>')
16

Navigate to Pub/Subs.
17

Click on Create Topic.
18

Provide a Topic name and click create.
19

Click on Subscriptions. You will find that there is a subscription created for the topic that was just created.
20

Edit the subscription.
21

Change Delivery type as Push.
22

Once Push is selected, enter in the endpoint URL: https://prod1- webhook.vtxsecurityservices.com:8093/webhook/<tenant name>/gcp/cloudstorage. Tenant name is assigned by Multicloud Defense. To view tenant name, navigate to Multicloud Defense Controller and click on your username.
23

Click Update.
24

Create a cloud storage notification by opening a Google cloud shell and execute this command: gsutil notification create -t <TOPIC_NAME\> -f json gs://<BUCKET_NAME>.
Previous topic AWS: Enable DNS Logs Next topic Azure: DNS Logs