GCPCDN

GCPCDN Schema #

Table description #

TableSection TableType TableSectionName Description
Usx Regular Microsoft Sentinel The Google Cloud Platform CDN data connector provides the capability to ingest Cloud CDN Audit logs and Cloud CDN Traffic logs into Microsoft Sentinel using the Compute Engine API.

Table retention #

HotDays ColdDays TotalInteractiveDays
14 16 30

Schema #

Name Description Type
_BilledSize Double
_IsBillable String
AuthenticationInfoPrincipalEmail The email of the authenticated identity making the request String
AuthorizationInfo Authorization details such as permission name, granted status, and resource type String
AuthzPolicyInfoPolicies The list of Authorization policies that match the request String
AuthzPolicyInfoResult Stores information about the Authorization Policy result String
BackendTargetProjectNumber Holds the project number where the backend target—backend service or backend bucket—has been created String
CacheDecision Indicates caching decisions taken String
CacheID Unique identifier for the cache entry associated with this response String
EnforcedEdgeSecurityPolicyConfiguredAction The configured action that was evaluated in the edge security policy String
EnforcedEdgeSecurityPolicyName The name of the edge security policy that was applied to the request String
EnforcedEdgeSecurityPolicyOutcome The outcome of applying the policy String
EnforcedEdgeSecurityPolicyPriority The priority value of the rule within the edge security policy that matched the request String
ErrorBackendStatusDetails Backend-specific error details when a request fails or is served with an error response String
ErrorService Holds the backend service that provided the custom error response String
HttpRequestCacheFillBytes Number of bytes written to the cache from this response String
HttpRequestCacheHit Boolean flag indicating whether the response was served from cache Boolean
HttpRequestCacheLookup Boolean flag indicating whether the request attempted a cache lookup before contacting the backend Boolean
HttpRequestLatency The latency or total time taken to process the request String
HttpRequestRemoteIP The IP address of the client that made the request String
HttpRequestRequestMethod HTTP method used for the request String
HttpRequestRequestSize Size of the incoming HTTP request in bytes String
HttpRequestRequestUrl Full URL that was requested String
HttpRequestResponseSize Size of the HTTP response payload sent to the client, in bytes String
HttpRequestServerIP IP address of the server (or Google Front End) that processed the request String
HttpRequestStatus HTTP status code returned by the server String
HttpRequestUserAgent User agent string from the HTTP request header String
InsertID A unique identifier for the log entry assigned by the logging system String
JsonPayloadType The protobuf type URL describing the type of jsonPayload content in the log String
LabelsAPIRootTriggerID The root trigger ID identifying the origin request that caused this log entry String
LoadBalancingScheme Holds a string that describes which load balancing scheme was used to route the request String
LogName The full resource name of the log to which this entry belongs String
MethodName The name of the API method invoked String
NumResponseItems The number of items returned in a list response String
OperationFirst Boolean flag indicating this log entry is the first record in a long-running operation Boolean
OperationID Unique identifier for the operation String
OperationLast Boolean flag indicating this log entry is the final record in a long-running operation Boolean
OperationProducer The service that initiated and owns the operation String
OverrideResponseCode Holds the override response code applied to the response sent to the client String
PayloadType Type URL of the request or response payload String
ReceiveTimestamp The time the log entry was received by the logging system DateTime
RemoteIP The IP address of the client as seen by the load balancer String
RequestBackends Configuration for backend groups String
RequestCDNPolicyCacheKeyPolicyIncludeHost Whether the host is included in the cache key Boolean
RequestCDNPolicyCacheKeyPolicyIncludeProtocol Whether protocol is included in the cache key Boolean
RequestCDNPolicyCacheKeyPolicyIncludeQueryString Whether the query string is included in the cache key Boolean
RequestCDNPolicyCacheMode Cache mode setting String
RequestCDNPolicyClientTtl Time-to-live set on responses for clients String
RequestCDNPolicyDefaultTtl Default TTL applied when no caching headers are set String
RequestCDNPolicyMaxTtl Maximum allowed TTL for cached responses String
RequestCDNPolicyNegativeCaching Boolean indicating if negative caching is enabled Boolean
RequestCDNPolicyServeWhileStale Duration responses are served while stale String
RequestCDNPolicySignedUrlCacheMaxAgeSec Cache TTL for signed URLs in seconds String
RequestCompressionMode Specifies whether and how compression is applied String
RequestConnectionDrainingTimeoutSec Time in seconds for draining connections during backend removal String
RequestDescription A custom description associated with the backend service configuration String
RequestEnableCDN Boolean indicating if Cloud CDN is enabled for the backend service Boolean
RequestFingerprint Fingerprint of the request configuration, used for optimistic locking String
RequestGroup The reference to instance group used by the backend service String
RequestHealthChecks List of health check resources attached to the backend service String
RequestIPAddressSelectionPolicy Specifies IP address family for the backend String
RequestKeyName The name of the key used in the request String
RequestLoadBalancingScheme Load balancing scheme used String
RequestLocalityLbPolicy Locality-based load balancing strategy String
RequestLogConfigEnable Boolean to enable request logging Boolean
RequestLogConfigSampleRate Sampling rate for log entries when logging is enabled String
RequestMetadataCallerIP IP address of the request initiator String
RequestMetadataCallerSuppliedUserAgent User agent string of the request initiator String
RequestMetadataDestinationAttributes Attributes of the destination, often empty in public APIs String
RequestMetadataRequestAttributesAuth Authentication metadata for the request String
RequestMetadataRequestAttributesReason Encoded reason for the request String
RequestMetadataRequestAttributesTime Time when the request was initiated DateTime
RequestName The name assigned to the resource in the request String
RequestPortName The named port of the backend service String
RequestProtocol The protocol used String
RequestSecurityPolicy The name or full path of the security policy attached to the backend service String
RequestSessionAffinity Affinity setting used to keep sessions on the same backend String
RequestTimeoutSec Timeout value (in seconds) for the backend service String
RequestType Type of the request payload object String
ResourceLabelsBackendBucketID Holds the ResourceLabelsBackendBucketID value recorded in the CDN or load balancer log String
ResourceLabelsBackendServiceID The unique identifier for the GCE backend service String
ResourceLabelsBackendServiceName The name of the backend service String
ResourceLabelsForwardingRuleName The name of the forwarding rule object String
ResourceLabelsLocation The geographical or regional location of the resource String
ResourceLabelsProjectID The identifier of the Google Cloud project associated with this resource String
ResourceLabelsTargetProxyName The name of the target proxy object referenced by the forwarding rule String
ResourceLabelsUrlMapName The name of the URL map object configured to select a backend service String
ResourceLabelsZone The zone in which the load balancer is running String
ResourceLocationCurrentLocations Region or location associated with the resource String
ResponseID Unique identifier for the response or operation String
ResponseInsertTime Time when the response operation was created DateTime
ResponseName Name assigned to the long-running operation String
ResponseOperationType Type of the operation performed String
ResponseProgress Progress of the operation in percentage String
ResponseSelfLink URI of the operation String
ResponseSelfLinkWithID URI of the operation with ID appended String
ResponseStartTime Time when the operation started DateTime
ResponseStatus Status of the operation String
ResponseTargetID ID of the target resource affected by the operation String
ResponseTargetLink URI of the affected resource String
ResponseType Type of the response object returned String
ResponseUser User who initiated the operation. String
ServiceName The Google service processing the request String
Severity Indicates the importance or severity level of the log entry String
SourceSystem String
SpanID Identifier of the span within a trace String
StatusDetails Holds a string that explains why the load balancer returned the HTTP status that it did String
TenantId Unique identifier of the tenant into which the data connector ingests data. String
TimeGenerated The timestamp when the log entry was fetched into Microsoft Sentinel DateTime
Timestamp The time when the first layer GFE receives the request DateTime
Trace Identifier of the trace String
Type The name of the table String

Schema changes #

Date Action
2026-01-02 Table added to tracking