Google Cloud Network Logs

Vendor key: gcp_network. In Arthur this source appears as GCP Network Logs. For how source fields and scan configs fit together, see Agent Discovery Integrations.

Reads one GCP project's Cloud DNS query logs and VPC flow logs from Cloud Logging and reports each workload seen calling a host that serves model inference, from Arthur's built-in list of model providers or your own hosts and ranges. Under Shared VPC, both logs are written to the host project, so that's the project a source names. To cover more projects, add one source for each.

A Compute Engine VM is named from its own DNS lookups, by its zone.
A Cloud Run service or job is named from the flow logs of the traffic it sends through your VPC network, by its region. A job execution is folded into its job.
A GKE pod can't be named, because its lookups are made by the node and its traffic leaves with the node's address. Its node appears as the VM it is.

A flow log names only an address, so Arthur labels it with the DNS answers in the same window. If the address also answered for a host that isn't an inference host, as Google's shared front ends do, the flow can't say which host was called, so Arthur doesn't report it. The scan log counts these flows.

Before you start

Neither log is on by default.

Turn on Cloud DNS logging for each VPC network with a DNS server policy.
Turn on VPC flow logs for each subnet whose traffic you want read.

For step-by-step instructions, see Cloud DNS logging and Use VPC Flow Logs in the Google Cloud documentation.

Source fields

Field	Required	Sensitive	Default	Description
`project_id`	Yes	No		The GCP project ID whose Cloud DNS query logs and VPC flow logs are read, for example `my-project-123456`. Under Shared VPC, this is the host project.
`service_account_key`	Yes*	Yes		The full JSON key of a GCP service account.
`extra_inference_hosts`	No	No	None	Comma-separated destinations to treat as inference endpoints in addition to the built-in list, up to 100, for example `llm-gateway.example.com, 10.50.0.0/16`. A host also matches its subdomains, and `*` stands for part of one label. IP addresses and CIDR ranges also work.

* Required unless your Arthur engine runs on GCP and has been configured to use its own Application Default Credentials (ARTHUR_ENGINE_GCP_NETWORK_ALLOW_ADC=true).

Scan config

Setting	Value
`query`	`""`
`query_language`	`none`
`lookback_window_seconds`	The time range of log entries read. `0` reads the last 24 hours.

A scan reads at most 200,000 entries from each log and logs a warning when it stops there. Shorten the lookback to read the rest. If a scan finds no DNS lookups in the window, it logs a warning that Cloud DNS logging may be off.

Required permissions

roles/logging.viewer on the project.
roles/run.viewer on the project. Optional: it lets Arthur fold a Cloud Run job execution into its job. Without it, the job is reported by its execution name and the scan logs a warning.

If Cloud Logging refuses a read, the scan fails with Google's status.