GCPAuditLogs

GCPAuditLogs Schema #

Table description #

TableSection TableType TableSectionName Description
Usx Regular Microsoft Sentinel The Google Cloud Platform (GCP) audit logs, ingested from Sentinel’s connector, enable you to capture three types of audit logs: admin activity logs, data access logs, and access transparency logs. Google cloud audit Logs record a trail that practitioners can use to monitor access and detect potential threats across Google Cloud Platform (GCP) resources.

Table retention #

HotDays ColdDays TotalInteractiveDays
14 76 90

Schema #

Name Description Type
_BilledSize Double
_IsBillable String
AuthenticationInfo Authentication information. Object
AuthorizationInfo Authorization information. If there are multiple resources or permissions involved, then there is one AuthorizationInfo element for each {resource, permission} tuple. Object
GCPResourceName The resource or collection that is the target of the operation. The name is a scheme-less URI, not including the API service name. String
GCPResourceType The identifier of the type associated with this resource, such as ‘pubsub_subscription’. String
InsertId Optional. Providing a unique identifier for the log entry allows Logging to remove duplicate entries with the same timestamp and insertId in a single query result. String
LogName Information including a suffix identifying the log sub-type (e.g., admin activity, system access, data access) and where in the hierarchy the request was made. String
Metadata Other service-specific data about the request, response, and other information associated with the current audited event. Object
MethodName The name of the service method or operation. For API calls, this should be the name of the API method. String
NumResponseItems The number of items returned from a list or query API method, if applicable. String
PrincipalEmail The email address of the authenticated user (or service account on behalf of third party principal) making the request. For third party identity callers, the principalSubject field is populated instead of this field. For privacy reasons, the principal email address is sometimes redacted. String
ProjectId The identifier of the Google Cloud Platform (GCP) project associated with this resource, such as “my-project”. String
Request The operation request. This may not include all request parameters, such as those that are too large, privacy-sensitive, or duplicated elsewhere in the log record. It should never include user-generated data, such as file contents. When the JSON object represented here has a proto equivalent, the proto name will be indicated in the @type property. Object
RequestMetadata Metadata about the operation. Object
ResourceLocation The resource location information. Object
ResourceOriginalState The resource original state before mutation. Present only for operations which have successfully modified the targeted resource(s). In general, this field should contain all changed fields, except those that are already been included in request, response, metadata or serviceData fields. When the JSON object represented here has a proto equivalent, the proto name will be indicated in the @type property. Object
Response The operation response. This may not include all response elements, such as those that are too large, privacy-sensitive, or duplicated elsewhere in the log record. It should never include user-generated data, such as file contents. When the JSON object represented here has a proto equivalent, the proto name will be indicated in the @type property. Object
ServiceData An object containing fields of an arbitrary type. An additional field “@type” contains a URI identifying the type. Example: { “id”: 1234, “@type”: “types.example.com/standard/id” }. Object
ServiceName The name of the API service performing the operation. For example, ‘compute.googleapis.com’. String
Severity Optional. The severity of the log entry. For example, the following filter expression will match log entries with severities INFO, NOTICE, and WARNING. String
SourceSystem String
Status The status of the overall operation. Object
StatusMessage The message status of the overall operation. String
Subscription A named resource representing the stream of messages from a single, specific topic, to be delivered to the subscribing application. String
TenantId String
TimeGenerated The time the log entry was received by logging. DateTime
Timestamp The time the event described by the log entry occurred. DateTime
Type The name of the table String

Schema changes #

Date Action
2024-10-18 Table added to tracking