GKEAudit

GKEAudit Schema #

Table description #

TableSection TableType TableSectionName Description
Usx Regular Microsoft Sentinel The Google Cloud Platform (GCP) Kubernetes Engine data connector allows you to monitor containerized applications, track performance metrics, and detect potential threats across your GKE environment.

Table retention #

HotDays ColdDays TotalInteractiveDays
14 16 30

Schema #

Name Description Type
_BilledSize Double
_IsBillable String
InsertId A unique identifier for the log entry, used to deduplicate log records. String
JsonPayload The JSON representation of the log entry payload, often containing key audit data when not using ProtoPayload. Object
Labels Custom key-value pairs that provide additional metadata for the log entry, such as environment or custom tags. Object
logName The full name of the log (e.g., projects/[PROJECT_ID]/logs/cloudaudit.googleapis.com%2Factivity), showing the type and location of the log data. String
LogType The category or type of log, such as GKEAudit, indicating the origin of the log data. String
Operation Contains information about an operation associated with the log, such as operation ID and producer. Object
ProtoPayload A structured representation of the audit log entry using the Protobuf format. Contains detailed audit event data such as method name, status, and authentication info. Object
ReceiveTimestamp The time when the log entry was received by the logging system. DateTime
Severity The severity level of the log entry (e.g., INFO, WARNING, ERROR). Indicates the importance or impact of the event. String
SourceSystem String
TenantId Unique identifier of the tenant into which the data connector ingests data. String
TimeGenerated The timestamp indicating when the log event was created or generated by the source system. DateTime
Type The name of the table String

Schema changes #

Date Action
2026-01-02 Table added to tracking