How to Identify and Debug Missing GCP Assets in Cortex Cloud Due to Disabled Service-Specific GCP APIs

• When onboarding GCP projects or organizations, ensure that service-specific administrative APIs corresponding to all deployed workload types are enabled across target projects in addition to standard onboarding prerequisites. 
• Baseline GCP cloud onboarding requires the primary Cloud Asset API (cloudasset.googleapis.com). However, individual resource types rely on their respective GCP service administration APIs (e.g., sqladmin.googleapis.com for Cloud SQL, container.googleapis.com for GKE) to extract metadata.
• If a service-specific API is disabled in either the target GCP project hosting the asset or the project hosting the Cortex Service Account, background discovery queries fail and record error messages in the backend auditing dataset.

• Cortex Cloud

• Step 1: Query the Health Auditing Dataset
  • Log into the Cortex tenant.
  • Navigate to XQL Search.
  • Run the following query to expose silent discovery failures and identify missing API dependencies:
    

    dataset = cloud_health_auditing
    | filter capability = "discovery"
    | filter classification != "Success"
    | filter connector = "<GCP_CONNECTOR_ID>" // Optional: Filter by specific GCP Connector ID

• Step 2: Identify the Disabled API
  • Examine the log results for explicit API error messages (they will be logged as informational).
  • Example Audit log output:
    • Cloud SQL Admin API is disabled. Enable it in order to collect data. (API: sqladmin)
• Step 3: Enable the target API in GCP
  • Open the Google Cloud Console.
  • Navigate to APIs & Services > Library.
  • Ensure you select the appropriate GCP project:
    • The target GCP project where the resources reside.
    • The host project containing the Cortex Cloud Service Account (if onboarded at the organization level).
  • Search for the API identified in Step 2 and click Enable.

• Palo Alto Networks Documentation: Prerequisites for Onboarding GCP