GCPResourceManager

GCPResourceManager Schema #

Table description #

TableSection TableType TableSectionName Description
Usx Regular Microsoft Sentinel The Google Cloud Platform Resource Manager data connector provides the capability to ingest Resource Manager Admin Activity and Data Access Audit logs into Microsoft Sentinel using the Cloud Resource Manager API. Refer the Product overview document for more details.

Table retention #

HotDays ColdDays TotalInteractiveDays
14 16 30

Schema #

Name Description Type
_BilledSize Double
_IsBillable String
AuthenticationInfoPrincipalEmail The email address of the authenticated principal making the request. String
AuthenticationInfoPrincipalSubject The unique subject identifier for the principal (useful for federated identities). String
AuthenticationInfoServiceAccountKeyName The resource name of the service account key used to authenticate the request. String
AuthorizationInfo Details on the authorization checks performed, including the permissions evaluated. String
GCPResourceName The name of the resource that the operation is acting on. String
GCPResourceType The type of resource involved in the operation (e.g., project, folder, organization). String
InsertID A unique ID for the log entry used for deduplication. String
LogName The full resource name of the log (e.g., projects/[PROJECT_ID]/logs/[LOG_ID]). String
MetadataParentDeltaDestinationParentId The destination parent ID when a resource moves between parents (e.g., folder or org). String
MetadataParentDeltaDestinationParentType The type of destination parent (e.g., folder, organization). String
MetadataParentDeltaSourceParentId The original parent ID of the resource before the move. String
MetadataParentDeltaSourceParentType The type of source parent (e.g., folder, organization). String
MetadataType The type of metadata associated with the log entry. String
MethodName The API method that was called (e.g., google.cloud.resourcemanager.v3.Projects.CreateProject). String
NumResponseItems The number of items returned in the response, if applicable. String
OperationFirst Indicates whether this is the first log entry for a long-running operation. Boolean
OperationID An identifier for a long-running operation shared across related log entries. String
OperationLast Indicates whether this is the last log entry for a long-running operation. Boolean
OperationProducer The name of the producer of the operation (e.g., the GCP service executing the operation). String
PayloadType The type of the log payload (e.g., protoPayload, textPayload). String
ReceiveTimestamp The time the log entry was received by Cloud Logging. DateTime
RequestConstraint The Org Policy constraint specified in the request. String
RequestCreateTime The timestamp when the resource was created as specified in the request. DateTime
RequestCustomConstraint Custom constraint configuration specified in the request. String
RequestDestinationParent The resource name of the destination parent, used in resource moves. String
RequestFolderDisplayName The display name of the folder provided in the request. String
RequestFolderParent The parent resource of the folder specified in the request. String
RequestLifecycleState The lifecycle state of the resource in the request (e.g., ACTIVE, DELETE_REQUESTED). String
RequestListValue A list of values specified in the request (e.g., tags, constraints). String
RequestMetadataCallerIP The IP address of the caller who made the request. String
RequestMetadataCallerSuppliedUserAgent The user agent String provided by the caller’s client application. String
RequestMetadataDestinationAttributes Metadata about the request destination, such as port or protocol. String
RequestMetadataRequestAttributesAuth Authentication attributes related to the request, such as authority selector or principal email. String
RequestMetadataRequestAttributesReason The reason or justification for making the request (if provided). String
RequestMetadataRequestAttributesTime The timestamp when the request was made. DateTime
RequestName The name or ID of the resource targeted by the request. String
RequestOptionsRequestedPolicyVersion The version of the IAM policy format requested. String
RequestPageSize The number of results to return per page in a list request. String
RequestParent The parent resource (e.g., folder or org) under which the request is being made. String
RequestPolicyAuditConfigs The audit configuration settings defined in the policy request. String
RequestPolicyBindings A list of role bindings defined in the IAM policy request. String
RequestPolicyEtag The ETag used for concurrency control in the policy request. String
RequestPolicyName The resource name of the policy being modified in the request. String
RequestPolicySpec Detailed specification of the Org Policy being applied. String
RequestProjectCreateTime The time the project was created as per the request. DateTime
RequestProjectId The project ID associated with the request. String
RequestProjectLabels Key-value labels assigned to the project in the request. String
RequestProjectLifecycleState The lifecycle state of the project (e.g., ACTIVE, DELETE_REQUESTED). String
RequestProjectName The display name of the project specified in the request. String
RequestProjectParent The parent resource (folder or organization) under which the project is created. String
RequestProjectProjectId The unique project ID provided in the request. String
RequestProjectProjectNumber The numerical project identifier. String
RequestQuery A query String used for filtering results (e.g., in search or list operations). String
RequestResource The full representation of the resource included in the request. String
RequestTagBindingParent The full name of the resource to which the tag is being bound. String
RequestTagBindingTagValue The tag value being bound to a resource in the request. String
RequestTagKeyName The full resource name of the tag key referenced in the request. String
RequestTagValueName The full resource name of the tag value in the request. String
RequestType The type of request being made (e.g., Create, Update, Delete). String
RequestUpdateMask A comma-separated list specifying the fields to be updated in a partial update request. String
ResourceLabelsFolderId The folder ID associated with the resource. String
ResourceLabelsMethod The method name label used for filtering in logs. String
ResourceLabelsOrganizationId The organization ID associated with the resource. String
ResourceLabelsProjectId The project ID associated with the resource. String
ResourceLabelsService The service name label used for filtering in logs. String
ResponseAuditConfigs The audit configurations returned in the response. String
ResponseBindings The IAM role bindings included in the response. String
ResponseCreateTime The timestamp when the resource was created, as returned in the response. DateTime
ResponseDescription A description of the resource or result returned in the response. String
ResponseDisplayName The display name of the resource returned in the response. String
ResponseEtag The ETag used for concurrency control in the response. String
ResponseLabels The key-value labels attached to the resource in the response. String
ResponseLifecycleState The lifecycle state of the resource in the response (e.g., ACTIVE, DELETE_REQUESTED). String
ResponseName The full resource name returned in the response. String
ResponseNamespacedName A namespaced identifier for the resource (used in tagging). String
ResponseParent The parent resource name associated with the response. String
ResponsePolicySpec The policy specification returned in the response (Org Policy or IAM policy). String
ResponseProjectId The project ID returned in the response. String
ResponseProjectNumber The project ID returned in the response. String
ResponseShortName The short, user-defined name of the resource returned in the response. String
ResponseState The current state of the resource (e.g., ACTIVE, DELETED). String
ResponseTagKey The tag key associated with the resource returned in the response. String
ResponseTagValue The tag value associated with the resource in the response. String
ResponseTagValueNamespacedName A fully qualified name (including tag key) for the tag value. String
ResponseType The type of the response payload. String
ResponseUpdateTime The time when the resource was last updated, as per the response. DateTime
ServiceDataPolicyDeltaBindingDeltas Changes (additions or removals) to IAM bindings as part of the policy delta. String
ServiceDataType The type of service-specific data returned in the response. String
ServiceName The name of the GCP service handling the request (e.g., cloudresourcemanager.googleapis.com). String
Severity Log level indicating the severity of the event (e.g., INFO, ERROR). String
SourceSystem String
Status The status of the request, including error codes and messages if the operation failed. String
TenantId Unique identifier of the tenant into which the data connector ingests data. String
TimeGenerated The time the log entry was received by logging. DateTime
Timestamp The time the event described by the log entry occurred. DateTime
Type The name of the table String

Schema changes #

Date Action
2026-01-02 Table added to tracking