gcp:project
Google Cloud project and Workspace
Audit, network and Workspace logs.
- Host type
- Google Cloud (and Google Workspace)
- Standards scope
- cloud
- Minimum events
- 0
- Recommended events
- 28
- Log sources
- 4
Logs, as a whole
For this role the log is the unit an organization turns on, so each log is tiered as a whole, beside the per-event rows.
| Log | Tier | Techniques | Rules |
|---|---|---|---|
| Google Cloud Audit Logs | Minimum | 11 | 88 |
| GCP VPC Flow Logs | Minimum | 1 | 0 |
| Google Workspace audit logs | Minimum | 12 | 60 |
Minimum
No event reaches the minimum bar for this role at the event level. The logs tiered as a whole, above, are the unit to read.
Recommended
28 more events meet one of the three criteria. Each source opens on its own.
Google Cloud Audit Logs21 events · Included
| Event | How to enable | Techniques | Rules | Standards |
|---|---|---|---|---|
| admin.googleapis.com | 1 | none | ||
| compute.instances.setMetadata | 1 | none | ||
| drive.activity | 1 | none | ||
| iam.serviceAccounts.keys.create | 1 | none | ||
| io.k8s.authorization.rbac.v1.clusterrolebindings.create | 0 | Elastic 3 | ||
| io.k8s.authorization.rbac.v1.clusterroles.create | 0 | Elastic 3 | ||
| io.k8s.authorization.rbac.v1.clusterroles.patch | 0 | Elastic 4 | ||
| io.k8s.authorization.rbac.v1.clusterroles.update | 0 | Elastic 4 | ||
| io.k8s.authorization.rbac.v1.roles.create | 0 | Elastic 3 | ||
| io.k8s.authorization.rbac.v1.roles.patch | 0 | Elastic 4 | ||
| io.k8s.authorization.rbac.v1.roles.update | 0 | Elastic 4 | ||
| io.k8s.certificates.v1.certificatesigningrequests.create | 0 | Elastic 4 | ||
| io.k8s.core.v1.pods.create | 0 | Elastic 8 | ||
| io.k8s.core.v1.pods.exec.create | 0 | Elastic 5 | ||
| io.k8s.core.v1.pods.exec.get | 0 | Elastic 5 | ||
| io.k8s.core.v1.pods.patch | 0 | Elastic 5 | ||
| io.k8s.core.v1.pods.update | 0 | Elastic 5 | ||
| io.k8s.core.v1.secrets.get | 0 | Elastic 4 | ||
| io.k8s.core.v1.secrets.list | 0 | Elastic 3 | ||
| login.event | 1 | none | ||
| os-login.sshPublicKeys.add | 1 | none |
Google Workspace audit logs7 events · Included
| Event | How to enable | Techniques | Rules | Standards |
|---|---|---|---|---|
| APIRequest | 1 | none | ||
| authorize | 0 | Elastic 4 | ||
| CHANGE_APPLICATION_SETTING | 0 | Elastic 5 | ||
| drive.permission.add | 1 | none | ||
| groups.list | 1 | none | ||
| OAuthTokenGranted | 1 | none | ||
| users.list | 1 | none |