GCPAuditLogs

The Google Cloud Platform (GCP) audit logs, ingested from Sentinel's connector, enable you to capture three types of audit logs: admin activity logs, data access logs, and access transparency logs. Google cloud audit Logs record a trail that practitioners can use to monitor access and detect potential threats across Google Cloud Platform (GCP) resources.

Table attributes

Attribute	Value
Resource types	-
Categories	Security
Solutions	SecurityInsights
Basic log	No
Ingestion-time transformation	Yes
Sample Queries	Yes

Columns

Column	Type	Description
AuthenticationInfo	dynamic	Authentication information.
AuthorizationInfo	dynamic	Authorization information. If there are multiple resources or permissions involved, then there is one AuthorizationInfo element for each {resource, permission} tuple.
_BilledSize	real	The record size in bytes
GCPResourceName	string	The resource or collection that is the target of the operation. The name is a scheme-less URI, not including the API service name.
GCPResourceType	string	The identifier of the type associated with this resource, such as 'pubsub_subscription'.
InsertId	string	Optional. Providing a unique identifier for the log entry allows Logging to remove duplicate entries with the same timestamp and insertId in a single query result.
_IsBillable	string	Specifies whether ingesting the data is billable. When _IsBillable is false ingestion isn't billed to your Azure account
LogName	string	Information including a suffix identifying the log sub-type (e.g., admin activity, system access, data access) and where in the hierarchy the request was made.
Metadata	dynamic	Other service-specific data about the request, response, and other information associated with the current audited event.
MethodName	string	The name of the service method or operation. For API calls, this should be the name of the API method.
NumResponseItems	string	The number of items returned from a list or query API method, if applicable.
PrincipalEmail	string	The email address of the authenticated user (or service account on behalf of third party principal) making the request. For third party identity callers, the principalSubject field is populated instead of this field. For privacy reasons, the principal email address is sometimes redacted.
ProjectId	string	The identifier of the Google Cloud Platform (GCP) project associated with this resource, such as "my-project".
Request	dynamic	The operation request. This may not include all request parameters, such as those that are too large, privacy-sensitive, or duplicated elsewhere in the log record. It should never include user-generated data, such as file contents. When the JSON object represented here has a proto equivalent, the proto name will be indicated in the @type property.
RequestMetadata	dynamic	Metadata about the operation.
ResourceLocation	dynamic	The resource location information.
ResourceOriginalState	dynamic	The resource original state before mutation. Present only for operations which have successfully modified the targeted resource(s). In general, this field should contain all changed fields, except those that are already been included in request, response, metadata or serviceData fields. When the JSON object represented here has a proto equivalent, the proto name will be indicated in the @type property.
Response	dynamic	The operation response. This may not include all response elements, such as those that are too large, privacy-sensitive, or duplicated elsewhere in the log record. It should never include user-generated data, such as file contents. When the JSON object represented here has a proto equivalent, the proto name will be indicated in the @type property.
ServiceData	dynamic	An object containing fields of an arbitrary type. An additional field "@type" contains a URI identifying the type. Example: { "id": 1234, "@type": "types.example.com/standard/id" }.
ServiceName	string	The name of the API service performing the operation. For example, 'compute.googleapis.com'.
Severity	string	Optional. The severity of the log entry. For example, the following filter expression will match log entries with severities INFO, NOTICE, and WARNING.
SourceSystem	string	The type of agent the event was collected by. For example, OpsManager for Windows agent, either direct connect or Operations Manager, Linux for all Linux agents, or Azure for Azure Diagnostics
Status	dynamic	The status of the overall operation.
StatusMessage	string	The message status of the overall operation.
Subscription	string	A named resource representing the stream of messages from a single, specific topic, to be delivered to the subscribing application.
TenantId	string	The Log Analytics workspace ID
TimeGenerated	datetime	The time the log entry was received by logging.
Timestamp	datetime	The time the event described by the log entry occurred.
Type	string	The name of the table