The Google Cloud Platform Compute Engine data connector provides the capability to ingest Compute Engine Audit logs into Microsoft Sentinel using the Google Cloud Compute Engine API. Refer to Cloud Compute Engine API documentation for more information.
Schema
Name
Description
Type
_BilledSize
Double
_IsBillable
String
GCPResource
Information about the monitored resource associated with the log entry, such as VM instance, database, etc.
Object
InsertId
A unique identifier for the log entry used to prevent duplication.
String
Labels
A set of key-value pairs that provide additional metadata about the log entry.
Object
LogName
The full resource name of the log to which this log entry belongs.
String
Operation
Information about an operation associated with the log entry, such as an audit trail or trace context.
Object
ProtoPayload
The structured payload of the log entry, typically in protocol buffer format; contains detailed event data.
Object
ReceiveTimestamp
The time the log entry was received by the logging system.
DateTime
Severity
The severity level of the log entry (e.g., DEBUG, INFO, WARNING, ERROR, CRITICAL).
String
SourceSystem
String
TenantId
Unique identifier of the tenant into which the data connector ingests data.
String
TimeGenerated
The actual time the event described by the log entry occurred.