Integrating with Firebase and Pangea's security services
Tags: firebase, security, tutorial, flutter
Published: 2023-02-14 17:35:40

**NOTE**: This article originally appeared on the [Pangea](https://pangea.cloud/).

Firebase, similar to the Pangea platform, helps you develop high-quality apps, grow your user base, and focus on providing your users with your unique value proposition. Each feature works independently, and they work even better together. If you are unfamiliar with Firebase and would like to learn more, visit the [Firebase](https://firebase.google.com/) site.

In this tutorial, learn how to install and utilize a combination of Pangea provided [Firebase Extensions](https://firebase.google.com/products/extensions). Firebase Extensions are an easy way to add Pangea services to your Firebase app without the need to write or debug code on your own. Extensions are pre-packaged solutions designed to save development time and quickly deploy Pangea functionality into your applications hosted on Firebase. You provide the configuration parameters, such as authentication tokens, for each extension at install time. All Pangea-provided extensions are open-sourced and built on Firebase and Google Cloud products you already know. Deployment and configuration of each extension are performed in the Firebase console or the Firebase CLI, and once deployed, they require no maintenance.

Each section of this tutorial will focus on a specific Pangea service and demonstrate how to install and utilize the associated Firebase Extension. After completing the first section, [Configure a Starter Project](https://pangea.cloud/docs/tutorials/firebase/configure), you can follow the tutorial sequentially to implement the complete use case or skip to each section relevant to you. As the Pangea platform's capabilities increase with the addition of new services, this tutorial will also evolve to highlight the new functionality. You can refer to this multi-part series at any time to learn about new Pangea services and how they may help secure an application hosted on Firebase.

## Configure a Starter Application

### Overview
In this section, you will familiarize yourself with Firebase and the services it offers, such as the NoSQL document database, [Cloud Firestore](https://firebase.google.com/products/firestore), that lets you easily store, sync, and query data. You will also configure [Cloud Storage](https://firebase.google.com/products/storage) which is designed to help you quickly and easily store and serve user-generated content, such as photos and videos. In the subsequent sections, you will utilize Pangea-provided [Firebase Extensions](https://firebase.google.com/products-build) to secure your app. For a complete list of the Firebase services available to app builders, visit the Firebase Products  page.

Firebase services are designed to reduce development time by streamlining commonly performed tasks when developing applications; similarly, Pangea can be thought of as a stack-agnostic security framework. Regardless of what technologies you use to build your apps, Pangea is designed to alleviate your team from the burden of compliance.

**Note**
_If you already have a Firebase project you'd like to secure with Pangea, you can skip this section and install the extensions covered in the subsequent sections to your existing project._

### Prerequisites

- A free [Firebase](https://firebase.google.com/) account
- [Node.js](https://nodejs.org/en/) (version 14.16.1 or higher) and [npm](https://www.npmjs.com/) installed on your machine.

### Create the sample project
**Step 1**: From the [Firebase Console](https://console.firebase.google.com/), select **Create a project**:

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/l1x1r0jafhjl30llpfa1.png)

**Step 2**: Select a project name and follow the setup wizard:

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/r7nj8opa6a673e4hh7pm.png)

Take a moment to explore the console and services available. It contains four service categories, **Build**, **Release & Monitor**, **Analytics**, and **Engage**.

### Configure a Firestore Database
Next, to create a Cloud Firestore database to store and sync data between your client-side and server-side apps, perform the following steps:

**Step 1**: From the **Project Overview** left-hand menu, expand the **Build** section, and select **Firestore Database**.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/vl4k1cil2yt07oogddd7.png)

**Step 2**: Click the **Create database** button.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/dsm9xqc4ex8lf27tsmg3.png)

Follow the configuration wizard to select an initial security mode and region to deploy the database.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/2nzp9fgxhl48sygjotht.png)

**Note**
_Pangea recommends selecting the Start in production mode, even for a test project._

**Step 3**: You should now have a fully configured database that you can add collections and documents to. You will learn how to install extensions to listen and react to document changes in later sections of this tutorial.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/xb1gf1j91uqzup82u3fd.png)

### Configure Cloud Storage
Next, to create a Cloud Storage container to store files such as images and videos, perform the following steps:

**Step 1**: From the **Project Overview** left-hand menu, expand the **Build** section, select **Storage**, and click the **Get started** button.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/82g16v8xvjgha4b7vhzr.png)

**Step 2**: Follow the configuration wizard to select an initial security mode and region to deploy the Storage service.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/iuwigidbhrygilq390sc.png)

**Note**
_Pangea recommends selecting the **Start in production mode**, even for a test project._

**Step 3**: You should now have a fully configured Storage container that you can upload files to. You will learn how to install extensions to listen and react to upload events in the next section of this tutorial.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/38lqnk6gtbrq9ge9nh8d.png)

### Configure Authentication
To enabled authentication and allow users to create accounts to access your application services, perform the following steps:

**Step 1**: From the **Project Overview** left-hand menu, expand the **Build** section, select **Authentication**, and click the **Get started** button.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/eoit5cajxj93lclfavay.png)

**Step 2**: From the **Sign-in providers** section, under the **Native providers** column, select **Email/Password**.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/tai9gbiiplt9pdh8f2dv.png)

**Step 3**: Enable the **Email/Password** provider and click **Save** button.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/rcw2mb1jaugvlcc8rnlb.png)

### Configure Cloud Functions, billing profile, and your local environment.

To enable [Cloud Functions](https://firebase.google.com/products/functions) to host and run serverless code, you'll need to upgrade your Firebase account to a **Blaze** tier **Pay as you go** plan. To do so, perform the following steps:

**Step 1**: From the **Project Overview** left-hand menu, expand the Build section, select **Functions**, and click the **Upgrade Project** button.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ym4ddv7sciqiqov8ebvr.png)

**Step 2**: To upgrade, click the **Continue** button and follow the instructions. You will be redirected to the **Set up your billing profile** section of Google Cloud Platform (GCP) and asked to complete a billing profile.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ln67bqhn8usg5tsrrwsi.png)

**Note**
_You will only be charged if to you exceed the usage allotted by the free tier. Visit the [Firebase Pricing page](https://firebase.google.com/pricing) for details._

**Step 3**: After setting up your GCP billing profile, you will be redirected back to the Firebase Console. From the left-hand menu, expand the **Build** section, select **Functions**, and click the **Get started** button.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/lj190ivxz2hx84ykg4zr.png)

**Step 4**: Follow the instructions in the **Set up Functions** wizard. First, to install the Firebase tools run the following command:

```
npm install -g firebase-tools
```

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/0ywrqbu4p7grsy2xphto.png)

To link your firebase account to the command-line tools installed, run:

```
firebase login
```

Follow the instructions presented by the login command, then when presented with the **Sign in** screen in a browser window, use your **Google Account** to log in and grant the **Firebase CLI** access to the permissions it needs.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/0xzxrfqur6jtcx2o0gqv.png)

**Note**
_If the browser window is not automatically presented, copy and paste the URL provided by the **firebase login** command into a new browser window or tab._

Then, to initialize your Firebase project for local development, create a folder for your project, set the current directory to the folder created, and run the following command:

```
firebase init
```

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/zj0mdq2kageysuyxsveu.png)

You will be guided through the configuration process with a series of questions.

**Note**
_You will be prompted to select which Firebase services you'd like to configure. These will vary depending on your desired use case but for the purpose of this tutorial, make sure to at least select **Firestore**, **Functions**, and **Storage**._

Here is an example output:

```
local-machine:~/Development/YourFirstFirebaseProject Firebase init

     ######## #### ########  ######## ########     ###     ######  ########
     ##        ##  ##     ## ##       ##     ##  ##   ##  ##       ##
     ######    ##  ########  ######   ########  #########  ######  ######
     ##        ##  ##    ##  ##       ##     ## ##     ##       ## ##
     ##       #### ##     ## ######## ########  ##     ##  ######  ########

You're about to initialize a Firebase project in this directory:

  /Users/Development/YourFirstFirebaseProject

? Which Firebase features do you want to set up for this directory? Press Space to select features, then Enter to c
onfirm your choices. Firestore: Configure security rules and indexes files for Firestore, Functions: Configure a Cl
oud Functions directory and its files, Storage: Configure a security rules file for Cloud Storage, Emulators: Set u
p local emulators for Firebase products

=== Project Setup

First, let's associate this project directory with a Firebase project.
You can create multiple project aliases by running firebase use --add,
but for now we'll just set up a default project.

? Please select an option: Use an existing project
? Select a default Firebase project for this directory: yourfirstfirebaseproject (YourFirstFirebaseProject)
i  Using project yourfirstfirebaseproject (YourFirstFirebaseProject)

=== Firestore Setup

Firestore Security Rules allow you to define how and when to allow
requests. You can keep these rules in your project directory
and publish them with firebase deploy.

? What file should be used for Firestore Rules? firestore.rules

Firestore indexes allow you to perform complex queries while
maintaining performance that scales with the size of the result
set. You can keep index definitions in your project directory
and publish them with firebase deploy.

? What file should be used for Firestore indexes? firestore.indexes.json

=== Functions Setup
Let's create a new codebase for your functions.
A directory corresponding to the codebase will be created in your project
with sample code pre-configured.

See https://firebase.google.com/docs/functions/organize-functions for
more information on organizing your functions using codebases.

Functions can be deployed with firebase deploy.

? What language would you like to use to write Cloud Functions? TypeScript
? Do you want to use ESLint to catch probable bugs and enforce style? Yes
✔  Wrote functions/package.json
✔  Wrote functions/.eslintrc.js
✔  Wrote functions/tsconfig.json
✔  Wrote functions/tsconfig.dev.json
✔  Wrote functions/src/index.ts
✔  Wrote functions/.gitignore
? Do you want to install dependencies with npm now? Yes
npm WARN EBADENGINE Unsupported engine {
npm WARN EBADENGINE   package: undefined,
npm WARN EBADENGINE   required: { node: '16' },
npm WARN EBADENGINE   current: { node: 'v19.2.0', npm: '8.19.3' }
npm WARN EBADENGINE }

added 410 packages, and audited 411 packages in 52s

89 packages are looking for funding
  run `npm fund` for details

2 vulnerabilities (1 moderate, 1 high)

To address all issues (including breaking changes), run:
  npm audit fix --force

Run `npm audit` for details.

=== Storage Setup

Firebase Storage Security Rules allow you to define how and when to allow
uploads and downloads. You can keep these rules in your project directory
and publish them with firebase deploy.

? What file should be used for Storage Rules? storage.rules
✔  Wrote storage.rules

=== Emulators Setup
? Which Firebase emulators do you want to set up? Press Space to select emulators, then Enter to confirm your choic
es. Authentication Emulator, Functions Emulator, Firestore Emulator, Storage Emulator, Eventarc Emulator
? Which port do you want to use for the auth emulator? 9099
? Which port do you want to use for the functions emulator? 5001
? Which port do you want to use for the firestore emulator? 8080
? Which port do you want to use for the storage emulator? 9199
? Which port do you want to use for the eventarc emulator? 9299
? Would you like to enable the Emulator UI? Yes
? Which port do you want to use for the Emulator UI (leave empty to use any available port)?
? Would you like to download the emulators now? Yes
i  ui: downloading ui-v1.11.2.zip...

i  Writing configuration info to firebase.json...
i  Writing project information to .firebaserc...
i  Writing gitignore file to .gitignore...

✔  Firebase initialization complete!
```

Navigate back to the browser with the Firebase console and click the **Finish** button of the **Set up Functions** dialog. The second command, `firebase deploy` shown in that dialog, is not required since you do not yet have functions to deploy. However, you now have the Cloud Functions service configured and the **Waiting for your first deploy** message displayed, as shown below.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/snxruiw4c4tcy6xwmsbw.png)

The Pangea Extensions you will install in the following few sections of this tutorial are actually pre-packaged Cloud Functions provided by Pangea that you can deploy and authorize to run in your Firebase environment. All the Pangea Extensions are open source and available for you to reference, modify, and improve. You can visit our [Github Repository](https://github.com/pangeacyber/pangea-extensions-firebase) to view or download the code. To learn how to quickly leverage the power of Pangea's security services without needing to write or debug code proceed to the next section.

## Install the Known Malware Detection Extension

### Overview
Firebase [Cloud Storage](https://firebase.google.com/products/storage) is designed to store and serve user-generated content with ease as you prototype and scale your application. But what happens when a user uploads a malicious file? The Pangea Known Malware Detection Extension can be configured to automatically check files uploaded by users against a database of 25 million known malicious files, and if deemed dangerous, it can be naturalized by packaging it into a password protected gzip container.

In this section, you will learn how to install, configure, and test the Extension and leverage the Pangea [File Intel Service](https://pangea.cloud/docs/file-intel) without writing a single line of code.

### Prerequisites

- A free [Firebase](https://firebase.google.com/) account with the [Pay as you go (https://firebase.google.com/pricing) billing plan enabled.
- A free [Pangea](https://pangea.cloud/signup) account.
- Completed part 1. [Configure a Starter Application](https://pangea.cloud/docs/tutorials/firebase/configure) of this multi-part tutorial OR a Firebase project with the [Cloud Functions](https://firebase.google.com/products/functions) and [Cloud Storage](https://firebase.google.com/products/storage) services enabled.
- A Pangea **Domain** and **Access Token** with access rights to the File Intel service. To learn how to create an account and configure each service, visit the [Getting Started](https://firebase.google.com/products/storage) guide.

### Install and configure the Extension
**Step 1**: Click the [Known Malware Detection](https://console.firebase.google.com/project/_/extensions/install?ref=pangea/storage-file-intel@0.1.39) install link, and select the Firebase project you'd like to deploy the Extension to:

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/f9110padbt2czamedk6k.png)

**Step 2**: Accept the **Early Access** acknowledgement by clicking the **Next** button:

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ypj2p1d7167qkcc3ldod.png)

**Step 3**: Review the billing and usage details, and tap the **Next** button. If you have not done so already, you'll be presented with the option to upgrade your Firebase account to a pay-as-you-go plan, you can do so by clicking the **Upgrade project to continue** button and following the instructions:

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/uk5ud1goq7lgimle3bwc.png)

**Note**
_If you upgrade your billing plan, you will be redirected to the **Set up your billing profile** section of Google Cloud Platform (GCP). After setting up your billing profile, you may need to restart the Extension install by clicking the [install](https://console.firebase.google.com/project/_/extensions/install?ref=pangea/storage-file-intel@0.1.31) and repeating **Step 1** and **Step 2**._

**Step 4**: Review the APIs and the resources that will be created by this Extension. If any required Firebase services are not yet enabled, tap the **Enable** button next to each required service and then click the **Next** button.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/449mit1zmot5fnhy5d4f.png)

**Step 5**: In the **Review access granted to this extension** section, grant the extension permission to **Storage** and **Secrets Manager** by clicking the **Next** button.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/rd3dkyff3za5uma40f20.png)

**Note**
_The **Storage Admin** permission will be used to store gzip formatted files that contain and neutralize malicious files uploaded to your bucket, and the **Secret Manager Secret Accessor** permission is required to store your Pangea Auth Token, and optional password for any gzip files created._

**Step 5**: In the final step, **Configure extension**, of the install process, you'll be asked to provide a few parameters, some of which are optional. The first two are what region you want to deploy the Extension and where your Pangea services are deployed, respectively. The Extension should be deployed as close to your Firebase Cloud Storage, so ideally, the same region you used when you configured it. The Pangea service base **Domain** and Auth **Token** can be copied from the [Pangea Console](https://console.aws.us.pangea.cloud/) > File Intel Overview page. The Pangea Auth Token and optional password to protect the gzip container should be stored in **Google Secret Manager**. To do so, just click the **Create secret** button next to each input field after entering their respective value.

The rest of the parameters are either optional or have default values to dictate which buckets you want to monitor, which paths to include or ignore, and whether to delete or keep a malicious file when it is detected.

**Note**
_You can use the default values for now and reconfigure your Extension later._

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/adei7lstsrv13vljch0j.png)

You can also configure how much memory to allocate to your function; neutralizing large files may require more memory.

Check the **Enable events** box and select the **completed** event. This will allow your Firebase application to listen to and react when malicious files are uploaded.

**Note**
_In this tutorial's next section, **Add Secure Audit Logging**, you will configure the Pangea **Secure Audit Log Extension** to log events emitted from this **Known Malware Detection Extension**._

To complete the installation, click the **Install extension** button.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/gt02sr3qv055536c1dag.png)

It may take Firebase 3-5 minutes to deploy your Extension. When it completes, you should see it listed under the **Extensions** section of your [Firebase Console](https://console.firebase.google.com/).

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/4al8g9jh6p8dqi36i4qs.png)

### Test the Extension
Instead of testing the Known Malware Detection Extensions with a real malicious file or virus, you can use a file developed by the [European Institute for Computer Antivirus Research (EICAR](https://https//en.wikipedia.org/wiki/European_Institute_for_Computer_Antivirus_Research)) known as the [EICAR Anti-Virus test file](https://en.wikipedia.org/wiki/EICAR_test_file). It was developed to test the response of computer anti-virus (AV) programs. Instead of using real malware, which could cause real damage, this test file allows you to test anti-virus software without having to use a real computer virus. To do so, do the following:

**Step 1**: To create the EICAR antivirus test file, create a file with this string:

`5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*`

**Note**
_You can also download the test file directly from: [eicar.com](https://secure.eicar.org/eicar.com)_

**Step 2**: Using the Firebase **Project Overview** left-hand menu, expand the Build section, and select **Storage**.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/0sap75os10fqdf1o9kp7.png)

**Step 3**: Click the **Upload file** button, and select the _eicar-test-file.com_ file you downloaded in the previous step. After a few seconds, you will notice that the file was moved into a .zip file under the path you configured; we used _/malicious_ as the default. If you also chose the default extension configuration, the complete path will be _/malicious/eicar-test-file_com.zip_. You can download this file, inspect its contents, or send it to an incident response team for analysis.

**Note**
_You may need to refresh the browser to load the updated paths._

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/nrc1nxyz47a450hte6t9.png)

**Note**
_You can also try to upload a non-malicious file and note that the Extension does not process it._

## Add Secure Audit Log to security-critical app events

###Overview
In this section, learn how to install, configure and invoke the Pangea [Secure Audit Log](https://pangea.cloud/docs/audit/) Extension to leverage the Secure Audit Log . Once installed, the Extension will automatically log security-critical events emitted by Firebase and other Pangea Extensions. You will also learn how to log your custom app events by recording them in a [Firebase Firestore](https://firebase.google.com/products/firestore) Document. Using the [Pangea Console Log Viewer](https://console.aws.us.pangea.cloud/service/audit/logs) you can cryptographically verify that records have not been modified, inserted, or deleted.

When your application utilizes Pangea's tamperproof logging service, log hashes are automatically published to an immutable public ledger or blockchain. Doing so provides irrefutable evidence of what events occurred in an application without exposing the logs' contents publicly. With the Secure Audit Log Extension, you can deliver the power of the blockchain to your users without writing a single line of code.

### Prerequisites

- A free [Firebase](https://firebase.google.com/) account with the [Pay as you go](https://firebase.google.com/pricing) billing plan enabled.
- A free [Pangea](https://pangea.cloud/signup) account.
- Completed part [1. Configure a Starter Applicatio](https://pangea.cloud/docs/tutorials/firebase/configure)n of this multi-part tutorial **OR** a Firebase project with the [Cloud Functions](https://firebase.google.com/products/functions) and [Cloud Firestore](https://firebase.google.com/products/firesore) services enabled.
- A Pangea **Domain** and **Access Token** with access rights to the File Intel service. To learn how to create an account and configure each service, visit the [Getting Started](https://pangea.cloud/docs/getting-started/) guide.

### Install and configure the Extension
**Step 1**: Click the [Secure Audit Logging Extension](https://console.firebase.google.com/project/_/extensions/install?ref=pangea/firestore-audit-log@0.0.15) install link, and select the Firebase project you'd like to deploy the Extension to:

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/8q4xo8qmld6e6kut5834.png)

**Step 2**: Accept the **Early Access** acknowledgement by clicking the **Next** button:

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/83bn4q31llcayr4ryqz3.png)

**Step 3**: Review the billing and usage details, and tap the **Next** button. If you have not done so already, you'll be presented with the option to upgrade your Firebase account to a pay-as-you-go plan, and you can do so by clicking the **Upgrade project to continue** button and following the instructions:

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/bxqjtv5fw7j8ldl4tehw.png)

**Note**
_If upgrading your billing plan, you will be redirected to the **Set up your billing profile** section of Google Cloud Platform (GCP). After setting up your billing profile, you may need to restart the Extension install by clicking the [install](https://console.firebase.google.com/project/_/extensions/install?ref=pangea/firestore-audit-log@0.0.5) and repeating **Step 1** and **Step 2**._

**Step 4**: Review the APIs and the resources that this Extension will create. If any required Firebase services are not yet enabled, tap the **Enable** button next to each required service and then click the **Next** button.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/zv60owp270ltd4xpwn04.png)

**Note**
_The Extension declares several functions to create Secure Audit Log entries:

**fslog** - listens for changes made to a Firestore collection. You can invoke this Extension to log custom events by writing to a document in a specified collection.

**onmaliciousfiledetected** - will be automatically invoked by the **Known Malware Detection** Extension installed in the previous section of this tutorial if you enabled the **completed** event.

**onusercreated** - will be automatically invoked when a user is created.

**onuserdeleted** - will be automatically invoked when a user is created._

_**onlogevent** - listens for custom log events you can emit from your application code.
_

**Step 5**: In the **Review access granted to this extensio**n section, grant the extension permission to **Firestore** and **Secrets Manager** by clicking the **Next** button.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/3q5t8j68nbk3oz8ikjf2.png)

**Note**
_The **Cloud datastore User** permission will be used to read and write the responses of the Pangea Secure Audit Log service to a Firestore document. The **Secret Manager Secret Accessor** permission is required to store your Pangea Auth Token._

Step 6: In the final step, **Configure extension**, of the install process, you'll be asked to provide a few parameters, some of which are optional. The first two and what region you want to deploy the Extension and where your Pangea services are deployed, respectively. The Extension should be deployed as close to your Firebase Cloud Firestore, so ideally, the same region you used when you configured it. The Pangea service base **Domain** and Auth **Token** can be copied from [Secure Audit Log Overview](https://console.pangea.cloud/service/audit) page of the Pangea Console. The Pangea Auth Token should be stored in **Google Secret Manager**. To do so, click the **Create secret** button next to its input field after entering the token value.

The **Collection path** and **Input field name** are the Firestore paths you want to write custom events to, and the **Response output field name** is the path to which the response of each request will be written to by the Extension.

**Note**
_You can use the default values for now and reconfigure your Extension later._

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/qxhermk5sm2cho3mpe2g.png)

To complete the installation, click the **Install extension** button.

It may take Firebase 3-5 minutes to deploy your Extension. When it completes, you should see it listed under the **Extensions** section of your [Firebase Console](https://console.firebase.google.com/).

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/8t45enz06k5pg4bz6mn3.png)

That's it! You now have Secure Audit Logging enabled in your Firebase app. Events emitted from other Pangea Extensions will automatically be recorded.

### Test automatic logging of events from other Pangea Extensions

To test events automatically logged by the **Known Malware Detection Extension**, upload another malicious file to Cloud Storage. To do so, refer to the **Test the Extension** portion of the [previous section](https://pangea.cloud/docs/tutorials/firebase/file-intel#test-the-extension), **2. Detect malicious Files uploaded to Cloud Storage** of this tutorial and perform **Step 1**, **Step 2**, and **Step 3**.

**Note**
_If you have not done so already, make sure to delete the test file from your previous test._

Then, to view the event, navigate to the [Pangea Console Log Viewer](https://console.aws.us.pangea.cloud/service/audit/logs) of the Pangea Console. You should see the event similar to:

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/i6er883lb3u4mx8n1h4n.png)

### Test automatic logging of Firebase Authentication events

This _Secure Audit Logging_ Extension listens for and automatically logs when a new Firebase user is created or deleted. To test and view these events, perform the following steps:

**Step 1**: From [Firebase Console](https://console.firebase.google.com/), expand the **Build** category, select **Authentication** from the left-hand menu, and click the **Add user** button.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/fkrbiurn6e124bkjzfa1.png)

**Step 2**: Enter a **Email** and **Password** for your test user and click the Add user button in the **Add an Email/Password user** dialog box.

**Note**
_You do not need to use a valid email address. You will delete this user account in the next step._

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/jph4bcgc4nnsls5iutmb.png)

**Step 3**: Expand the user options using the three-dot options menu button on the right-hand side of the user row you created in the previous step. Click the **Delete account** option, and when the **Delete account** dialog box is presented, confirm the delete by clicking the **Delete** button.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/vo4mzmnxsfskk04th04n.png)

**Step 4**: Then, to view the User created and User deleted events, navigate back to the [Pangea Console Log Viewer](https://console.aws.us.pangea.cloud/service/audit/logs) of the Pangea Console. You should see the event similar to:

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/2klb89m7zfzoc39tzej2.png)

### Test logging custom events by writing to Firestore
When you installed the _Secure Audit_ Logging Extension, you configured it to listen to changes to a specific Document in your application's Firestore database. To record your custom application events, such as user login attempts, registrations, or object access attempts, you can invoke the Pangea Secure Audit Log service by simply writing to the Document. In this section, you will test this functionality using the [Firebase Console](https://console.firebase.google.com/) user interface. To do so, perform the following steps:

**Step 1**: From [Firebase Console](https://console.firebase.google.com/), expand the **Build** category and select **Firestore Database** from the left-hand menu.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/64dhw4qulzdg5a4f1m1o.png)

**Step 2**: Select the **Start collection** option from the **Panel View**, and because you used the default collection name when installing the _Secure Audit Logging Extension_, enter '**audit**' as the **Collection ID** and click the **Next** button.

**Note**
_The collection names are case-sensitive. Use all lowercase letters in the **Collection ID** field._

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/xpdfntyrptijh4ic3of9.png)

**Step 3**: To add the **Document** to the **Collection**, click the **Auto-ID** button to generate an ID for the Document; then again, because you used the default configuration parameters when you installed the Extension, enter '**log**' as the **Field** value and set the **Type** to **map**.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/76qk7ngpzhnbub2l5yf2.png)

A document with an auto-generated **Document ID** and single **Field** of type map should look similar to this:

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/1b2nzkuavswaxfo4i8i4.png)

**Step 4**: You can now map each of the Pangea [Secure Audit Log API](https://pangea.cloud/docs/api/audit#log-an-entry) parameters to a **Field** of the '**log**' map. Add the following **Field** : **Value** pairs, each of **Type string**:

```
message : Hello, World!
action  : test
status  : complete
source  : firestore
target  : audit-log-ext
actor   : firebase-console
```

Then, to create the **Document** and trigger Secure Audit Log Service, click the **Save** button.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/fghc8vqw2gglf0sm0ltg.png)

In a few moments, you should see a **response** field containing the Pangea service response added to the Document as a pier to the **log** field you created.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/3jdjosv92n60bis1gofn.png)

Then, to view the event, navigate back to the [Pangea Console Log Viewer](https://console.aws.us.pangea.cloud/service/audit/logs) of the Pangea Console. You can expand the log entry by clicking on it to reveal the custom metadata fields. You should see an entry similar to the one below:

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/45v4rtvypfg2w0ftep2w.png)

The _Secure Audit Logging_ Extension will be invoked by any write operation to the Document it is configured to observe. The Cloud Firestore **Panel view** is a great way to test the Extension by quickly creating and editing Firestore documents, but you may want to record auditable events from your application code. With the _Secure Audit Logging_ Extension installed, you can do so from anywhere in your application that can write to Firestore.

Here is a quick example of how to create the same Document programmatically:

```
import {getFirestore} from "firebase-admin/firestore";

getFirestore().collection("audit").add({
  log: {
    message: "Hello, World!",
    action: "test",
    status: "complete",
    source: "firestore",
    target: "audit-log-ext",
    actor: "firebase-console",
  },
});
```

You can also send custom events to the extension using EventArc. Here is an example:

```
import {getEventarc} from "firebase-admin/eventarc";

getEventarc().channel().publish({
  type: "firebase.extensions.pangea-audit-log.v1.log",
  data: {
    message: "Hello, World!",
    action: "test",
    status: "complete",
    source: "target",
    target: "audit-log-ext",
    actor: "firebase-console",
  },
});
```