GCPComputeEngine

GCPComputeEngine Schema #

Table description #

TableSection TableType TableSectionName Description
Usx Regular Microsoft Sentinel The Google Cloud Platform Compute Engine data connector provides the capability to ingest Compute Engine Audit logs into Microsoft Sentinel using the Google Cloud Compute Engine API. Refer to Cloud Compute Engine API documentation for more information.

Table retention #

HotDays ColdDays TotalInteractiveDays
14 16 30

Schema #

Name Description Type
_BilledSize Double
_IsBillable String
GCPResource Information about the monitored resource associated with the log entry, such as VM instance, database, etc. Object
InsertId A unique identifier for the log entry used to prevent duplication. String
Labels A set of key-value pairs that provide additional metadata about the log entry. Object
LogName The full resource name of the log to which this log entry belongs. String
Operation Information about an operation associated with the log entry, such as an audit trail or trace context. Object
ProtoPayload The structured payload of the log entry, typically in protocol buffer format; contains detailed event data. Object
ReceiveTimestamp The time the log entry was received by the logging system. DateTime
Severity The severity level of the log entry (e.g., DEBUG, INFO, WARNING, ERROR, CRITICAL). String
SourceSystem String
TenantId Unique identifier of the tenant into which the data connector ingests data. String
TimeGenerated The actual time the event described by the log entry occurred. DateTime
Type The name of the table String

Schema changes #

Date Action
2026-01-02 Table added to tracking