GCPIAM

GCPIAM Schema #

Table description #

TableSection TableType TableSectionName Description
Usx Regular Microsoft Sentinel The Google Cloud Platform IAM audit logs, ingested from Sentinel’s connector, eAudit logs relating to Identity and Access Management (IAM) activities within Google Cloud.

Table retention #

HotDays ColdDays TotalInteractiveDays
14 16 30

Schema #

Name Description Type
_BilledSize Double
_IsBillable String
AuthenticationInfoPrincipalSubject Subject associated with the authenticated principal in the request. String
AuthInfoPrincipalEmail The email address associated with the principal (e.g., user, service account) performing the action. String
AuthInfoPrincipalSubject The subject or identifier associated with the principal performing the action. String
AuthInfoServiceAccountDelegationInfo Delegation information for a service account. String
AuthorizationInfo Information related to the authorization of the request. String
GCPResourceName The name of the resource involved in the request or logged event. String
GCPResourceType The type of resource involved in the request. String
InsertId A unique identifier for the log entry, typically used for deduplication. String
LogName The name of the log in which the entry resides. String
MetadataIdentityDelegationChain A chain of delegated identities for the request. String
MetadataMappedPrincipal Mapped principal in the metadata. String
MetadataType The type of metadata being provided. String
MethodName The name of the method being invoked. String
NumResponseItems The number of items returned in the response. String
OperationFirst Boolean indicating whether this is the first operation in a sequence. Boolean
OperationId A unique identifier for the operation. String
OperationLast Boolean indicating whether this is the last operation in a sequence. Boolean
OperationProducer The producer (system or service) that initiated the operation. String
PayloadType The type of payload being processed or transmitted. String
ReceiveTimestamp Timestamp representing the time when the log entry was received by the system. DateTime
RequestAccountId Account ID associated with the request. String
RequestFullResourceName Full name of the resource requested. String
RequestGrantType The grant type associated with the request. String
RequestIncludeInactiveApiRoles Boolean indicating whether inactive API roles should be included in the request. Boolean
RequestKeyTypes Types of keys involved in the request. String
RequestMetadataCallerIp The IP address from which the request originated. String
RequestMetadataCallerSuppliedUserAgent The user-agent String provided by the caller during the request. String
RequestMetadataRequestAttributesTime Time-related attributes of the request metadata. String
RequestName The name of the request. String
RequestOptionsRequestedPolicyVersion The version of the policy requested. String
RequestPageSize The size of the page requested in a paginated request. String
RequestPageToken Token for pagination in the request. String
RequestParent The parent resource of the request. String
RequestPolicyAuditConfigs Configuration for auditing in the request policy. String
RequestPolicyBindings Binding configurations associated with the request policy. String
RequestPolicyEtag The ETag value for the request policy. String
RequestPrivateKeyType Type of private key being used in the request. String
RequestRemoveDeletedServiceAccounts Boolean indicating if deleted service accounts should be removed. Boolean
RequestRequestedTokenType The type of token requested. String
RequestResource The resource being requested. String
RequestRoleDescription Description of the role being requested. String
RequestRoleId The unique identifier for the role. String
RequestRoleIncludedPermissions Permissions included in the role in the request. String
RequestRoleTitle Title of the role being requested. String
RequestServiceAccountDescription Description of the service account being requested. String
RequestServiceAccountDisplayName Display name of the service account being requested. String
RequestShowDeleted Boolean indicating if deleted items should be included in the response. Boolean
RequestSkipVisibilityCheck Boolean indicating whether the visibility check for the request should be skipped. Boolean
RequestSubjectTokenType The type of subject token being used in the request. String
RequestType The type of request being made. String
RequestUpdateMaskPaths The paths to be updated in the request. String
RequestView The view or perspective for the request. String
ResourceLabelsEmailId Email identifier associated with the resource. String
ResourceLabelsLocation The geographical or logical location of the resource. String
ResourceLabelsMethod The method associated with the resource, often used for filtering or categorization. String
ResourceLabelsProjectId Project ID for the resource being accessed or logged. String
ResourceLabelsRoleName The name of the role associated with the resource. String
ResourceLabelsService The service to which the resource belongs. String
ResourceLabelsTopicId The topic ID associated with the resource. String
ResourceLabelsUniqueId A unique identifier for the resource. String
ResourceLabelsVersion The version of the resource being logged. String
ResponseAuditConfigs Audit configurations in the response. String
ResponseBindings The bindings used in the response. String
ResponseDescription Description of the response. String
ResponseDisplayName Display name associated with the response. String
ResponseEmail Email associated with the response. String
ResponseEtag The ETag value for the response. String
ResponseGroupName The group name for the response. String
ResponseGroupTitle The title of the group in the response. String
ResponseIncludedPermissions Permissions included in the response. String
ResponseKeyAlgorithm The key algorithm used in the response. String
ResponseKeyOrigin The origin of the key in the response. String
ResponseKeyType The type of key used in the response. String
ResponseName Name associated with the response. String
ResponseOauth2ClientId OAuth2 client ID associated with the response. String
ResponsePrivateKeyType The type of private key used in the response. String
ResponseProjectId Project ID associated with the response. String
ResponseTitle Title associated with the response. String
ResponseType The type of response being returned. String
ResponseUniqueId Unique identifier for the response. String
ResponseValidAfterTimeSeconds Time in seconds after which the response becomes valid. String
ResponseValidBeforeTimeSeconds Time in seconds before the response becomes valid. String
ServiceDataPermissionDeltaAddedPermissions Permissions that were added in the service data policy. String
ServiceDataPermissionDeltaRemovedPermissions Permissions that were removed in the service data policy. String
ServiceDataPolicyDeltaBindingDeltas Changes to policy bindings in the response. String
ServiceDataType The type of service data being logged. String
ServiceName The name of the service that generated the log entry. String
Severity The severity level of the log entry or request. String
SourceSystem String
StatusCode The HTTP or operation status code for the response. String
StatusMessage The message associated with the status code. String
TenantId Unique identifier of the tenant into which the data connector ingests data. String
TimeGenerated Timestamp representing the time at which the log entry was generated. DateTime
Timestamp The timestamp when the log entry or event occurred. DateTime
Type The name of the table String

Schema changes #

Date Action
2026-01-02 Table added to tracking