gcp cloud audit

Expression

product = "gcp cloud audit"

Fields

Field	Core	Detection	Informational
service_name		✓
resource_dir			✓
resource_type			✓
fallback_user_name
domain_user_name
event_category			✓
operation_first			✓
src_ip		✓
project_id			✓
zone			✓
domain			✓
resource_path		✓
result_code			✓
resource_name			✓
region		✓
operation_last			✓
user		✓
operation		✓
user_agent		✓

Activity Types

Activity Type	Field	Status	Core	Detection	Informational
bucket-create
bucket-list
disk-attach	device_name	Default			✓
	disk_mode	Default			✓
	src_resource	Default			✓
disk-create	src_resource	Default			✓
disk-list
endpoint-create	machine_type	Default			✓
	src_resource	Default			✓
	subnetwork	Default			✓
	linked_service_account	Default			✓
endpoint-list
endpoint-modify	machine_type				✓
	modified_keys			✓
	added_keys			✓
endpoint-screenshot
file-list
file-permission-modify	acl_content			✓
	added_role_name				✓
	added_member				✓
	bucket_name			✓
	added_member_type				✓
	policy_bindings			✓
	policy_delta			✓
	removed_role				✓
	added_role				✓
	removed_role_name				✓
	removed_member				✓
	removed_member_type				✓
file-read
file-write
function-create
image-create	src_resource	Default			✓
	image_publisher			✓
policy-modify	added_role_name	Default			✓
	added_member	Default			✓
	added_member_type	Default			✓
	policy_bindings	Default			✓
	policy_delta	Default			✓
	removed_role	Default			✓
	added_role	Default			✓
	removed_role_name	Default			✓
	removed_member	Default			✓
	removed_member_type	Default			✓
	policy				✓
role-create	role_permissions	Default			✓
	removed_permissions	Default			✓
	added_permissions	Default			✓
role-list
role-modify	role_permissions	Default			✓
	removed_permissions	Default			✓
	added_permissions	Default			✓
snapshot-create	src_resource	Default			✓
snapshot-list
user-create
user-key-create