Google Cloud Audit Logs
Google Cloud Audit Logs. Cloud Logging LogEntry carrying an AuditLog protoPayload.
Source and collection
Cloud Logging audit log streams and configured sinks.
Check Admin Activity, Data Access and applicable audit policy; verify sink exclusions.
Native example and provenance
upstream test fixture. Published example; no independent capture provenance claimed.
Original publisher / pinned upstream fixture — line 1
One complete record selected; values unchanged.
Pinned source commit: 9ae756f00f82786ac3496ce99c2dd288c5a5c031
Download the exact sample · Offline research kit
SHA-256: 2e20b3fa812efabb6a01ec525e42eb28d6bfd9d2edab6adae7aa680323dbcced
{"insertId":"-uihnmjctwo","logName":"projects/elastic-beats/logs/cloudaudit.googleapis.com%2Fdata_access","protoPayload":{"@type":"type.googleapis.com/google.cloud.audit.AuditLog","authenticationInfo":{"principalEmail":"xxx@xxx.xxx"},"authorizationInfo":[{"granted":true,"permission":"resourcemanager.projects.get","resource":"projects/elastic-beats","resourceAttributes":{}}],"methodName":"GetResourceBillingInfo","request":{"@type":"type.googleapis.com/google.internal.cloudbilling.billingaccount.v1.GetResourceBillingInfoRequest","resourceName":"projects/189716325846"},"requestMetadata":{"callerIp":"192.168.1.1","destinationAttributes":{},"requestAttributes":{}},"resourceName":"projects/elastic-beats","serviceName":"cloudbilling.googleapis.com","status":{}},"receiveTimestamp":"2019-12-19T00:49:36.313482371Z","resource":{"labels":{"project_id":"elastic-beats"},"type":"project"},"severity":"INFO","timestamp":"2019-12-19T00:49:36.086Z"}
Structure and field interpretation
| Field/path | Serialized type |
|---|---|
insertId | str |
logName | str |
protoPayload.@type | str |
protoPayload.authenticationInfo.principalEmail | str |
protoPayload.authorizationInfo | array |
protoPayload.authorizationInfo[0].granted | bool |
protoPayload.authorizationInfo[0].permission | str |
protoPayload.authorizationInfo[0].resource | str |
protoPayload.methodName | str |
protoPayload.request.@type | str |
protoPayload.request.resourceName | str |
protoPayload.requestMetadata.callerIp | str |
protoPayload.resourceName | str |
protoPayload.serviceName | str |
receiveTimestamp | str |
resource.labels.project_id | str |
resource.type | str |
severity | str |
timestamp | str |
- protoPayload
- Native field; inspect its exact type and nesting in the complete example below.
- resource
- Native field; inspect its exact type and nesting in the complete example below.
- logName
- Native field; inspect its exact type and nesting in the complete example below.
- timestamp
- Native field; inspect its exact type and nesting in the complete example below.
Investigation uses
- Review principal, method, service, resource and authorization information.
- Retain resource, account/project/subscription and region context for correlation.
Validation boundaries
Data Access availability depends on service and configuration; absent logs cannot establish absence of access.
This sample passed byte-integrity and JSON/XML parsing checks, including the catalogue’s specified event discriminators. This is not a complete vendor-schema validation or a tested detection.
For a simulation, first parse this fixture offline, then create a separately labelled synthetic variant and test it against the intended collector in an isolated lab. Never replay public example identities or destinations into production.
Related sources
Ecosystem connections
- Telemetry Library — ATT&CK data components
- Detection Rules — candidate detection content
- Threat hunting — from intelligence to validated defense
- Practical security learning paths
- AdversaryGraph — evidence-led investigation
References
Sample provenance is linked above. Field availability and product behavior must be checked against the deployed version.