4.31 - Usage of LLM models over time
April 24, 2024 ยท View on GitHub
Analyze LLM model usage over time, grouping by specific LLM model. Use this to detect any usage spikes or anomalies.
Category: Data Usage
Use Cases: Audit, Detect
Data Sources: Audit Logs - Data Access
Queries or Rules
| BigQuery | Log Analytics | Google SecOps |
|---|---|---|
| SQL | SQL | Contribute rule |
Event Generation
No event generation steps provided. Contribute emulation test to this use case.
Sample Event
google.cloud.aiplatform.v1.PredictionService.Predict
{
"protoPayload": {
"@type": "type.googleapis.com/google.cloud.audit.AuditLog",
"authenticationInfo": {
"principalEmail": "test-user@example.com",
"principalSubject": "user:test-user@example.com"
},
"requestMetadata": {
"callerIp": "203.0.113.255",
"callerSuppliedUserAgent": "<redacted>",
"requestAttributes": {
"time": "2024-02-22T14:33:29.284843427Z",
"auth": {
}
},
"destinationAttributes": {
}
},
"serviceName": "aiplatform.googleapis.com",
"methodName": "google.cloud.aiplatform.v1.PredictionService.Predict",
"authorizationInfo": [
{
"resource": "projects/my-project/locations/us-central1/publishers/google/models/code-bison@002",
"permission": "aiplatform.endpoints.predict",
"granted": true,
"resourceAttributes": {
}
}
],
"resourceName": "projects/my-project/locations/us-central1/publishers/google/models/code-bison@002",
"request": {
"endpoint": "projects/my-project/locations/us-central1/publishers/google/models/code-bison@002",
"@type": "type.googleapis.com/google.cloud.aiplatform.v1.PredictRequest"
},
"response": {
"@type": "type.googleapis.com/google.cloud.aiplatform.v1.PredictResponse"
}
},
"insertId": "1pbm5dbe1oqug",
"resource": {
"type": "audited_resource",
"labels": {
"service": "aiplatform.googleapis.com",
"project_id": "my-project",
"method": "google.cloud.aiplatform.v1.PredictionService.Predict"
}
},
"timestamp": "2024-02-22T14:33:29.284416639Z",
"severity": "INFO",
"logName": "projects/my-project/logs/cloudaudit.googleapis.com%2Fdata_access",
"receiveTimestamp": "2024-02-22T14:33:31.245712026Z"
}
google.cloud.aiplatform.v1beta1.PredictionService.GenerateContent
{
"protoPayload": {
"@type": "type.googleapis.com/google.cloud.audit.AuditLog",
"authenticationInfo": {
"principalEmail": "test-user@example.com",
"principalSubject": "user:test-user@example.com"
},
"requestMetadata": {
"callerIp": "203.0.113.255",
"callerSuppliedUserAgent": "<redacted>",
"requestAttributes": {
"time": "2024-02-22T04:55:11.117617705Z",
"auth": {
}
},
"destinationAttributes": {
}
},
"serviceName": "aiplatform.googleapis.com",
"methodName": "google.cloud.aiplatform.v1beta1.PredictionService.GenerateContent",
"authorizationInfo": [
{
"resource": "projects/my-project/locations/us-central1/publishers/google/models/gemini-1.0-pro-001",
"permission": "aiplatform.endpoints.predict",
"granted": true,
"resourceAttributes": {
}
}
],
"resourceName": "projects/my-project/locations/us-central1/publishers/google/models/gemini-1.0-pro-001",
"request": {
"@type": "type.googleapis.com/google.cloud.aiplatform.v1beta1.GenerateContentRequest",
"model": "projects/my-project/locations/us-central1/publishers/google/models/gemini-1.0-pro-001"
},
"response": {
"@type": "type.googleapis.com/google.cloud.aiplatform.v1beta1.GenerateContentResponse"
}
},
"insertId": "a9mqkae614f2",
"resource": {
"type": "audited_resource",
"labels": {
"service": "aiplatform.googleapis.com",
"method": "google.cloud.aiplatform.v1beta1.PredictionService.GenerateContent",
"project_id": "my-project"
}
},
"timestamp": "2024-02-22T04:55:11.116811865Z",
"severity": "INFO",
"logName": "projects/my-project/logs/cloudaudit.googleapis.com%2Fdata_access",
"receiveTimestamp": "2024-02-22T04:55:14.371010794Z"
}