You need to investigate who modified the firewall rules in your VPC network yesterday. You want to view the logs that record administrative actions and configuration changes.

Which type of Cloud Audit Log should you review?

Cloud Audit Logs are divided into several types. Admin Activity logs contain log entries for API calls or administrative actions that modify the configuration or metadata of resources (e.g., creating a VM, modifying a firewall rule). These are enabled by default and cannot be disabled.