GKEApplication

GKEApplication Schema #

Table description #

TableSection TableType TableSectionName Description
Usx Regular Microsoft Sentinel The Google Cloud Platform (GCP) Kubernetes Engine data connector allows you to monitor containerized applications, track performance metrics, and detect potential threats across your GKE environment.

Table retention #

HotDays ColdDays TotalInteractiveDays
14 16 30

Schema #

Name Description Type
_BilledSize Double
_IsBillable String
ClusterName The name of the GKE cluster from which the log entry originated. String
ComputeResourceName The name of the underlying compute resource (such as the node or instance). String
ContainerName The name of the container inside the pod that generated the log. String
InsertId A unique identifier for the log entry, useful for deduplication. String
JsonPayload Structured JSON-formatted log content if available. Object
Labels Key-value pairs providing additional metadata about the log entry. Object
Location The GCP region or zone where the log entry was generated. String
LogName The full resource name of the log (e.g., ‘projects/[PROJECT_ID]/logs/[LOG_ID]’). String
NamespaceName The Kubernetes namespace associated with the log entry. String
PodName The name of the Kubernetes pod where the container is running. String
ProjectID The ID of the Google Cloud project where the log entry originated. String
ReceiveTimestamp The time the log entry was received by the logging system. DateTime
Severity The severity level of the log entry (e.g., DEBUG, INFO, WARNING, ERROR). String
SourceSystem String
TenantId Unique identifier of the tenant into which the data connector ingests data. String
TextPayload Unstructured text message associated with the log entry. String
TimeGenerated The timestamp indicating when the log event was created or generated by the source system. DateTime
Type The name of the table String

Schema changes #

Date Action
2026-01-02 Table added to tracking