Issue

When configuring a Google Cloud Platform (GCP) log source in Panther, logs are not appearing in the platform and there are no error messages in the Health tab.

Resolution

To ensure GCP logs are properly flowing into Panther:

1. If you selected Pub/Sub as the Data Transport method, and chose to create the infrastructure components manually rather than using a Terraform template, please ensure that you have followed the Panther's Pub/Sub setup guide.

2. Ensure that the appropriate schemas for your log types (GCP.AuditLog and GCP.HTTPLoadBalancer) are present in the Schemas tab of your log source.

3. Most importantly, make sure that you have created a logging sink in GCP that points to the Pub/Sub topic created during the setup outlined in Step 1. Without this sink configuration, log entries will not be routed to Panther.

   1. The same applies if you have used Google Cloud Storage as your Data Transport.

Cause

Logs fail to appear in Panther typically due to one of these reasons:

• Missing or incorrectly configured logging sink in GCP to route logs to the Pub/Sub topic. Without a sink, Panther will not receive any data to ingest, resulting in the value of the field "Last data received" showing "Waiting for data" in the Overview tab of the log source.

• Incomplete configuration steps while setting up the GCP log source and the corresponding data transport method.