Skip to content
Sign In
Telemetry

gcp:audit

Google Cloud Audit Logs

Admin Activity, Data Access, System Event, Policy Denied

Host type
Google Cloud (and Google Workspace)
Tier, as a whole
Minimum
Cost class
Included
Techniques
11
Rules listed
88
Events
87

Why this tier

CISA/ASD priority source; OMB M-26-14 A1 (Identity used; our analysis); OMB M-26-14 A3 (Object and data events; our analysis); OMB M-26-14 A4 (Privilege changes; our analysis); OMB M-26-14 A5 (Infrastructure changes; our analysis); OMB M-26-14 A9 (Data affected; our analysis)

Licensing

License or service
Cloud Audit Logs
What is free
Admin Activity always on
What costs
Data Access off by default; Logging charges if enabled
Vendor page
https://docs.cloud.google.com/kubernetes-engine/docs/how-to/audit-logging?hl=en
As read on
2026-11-01

A vendor statement as read on the date shown; the cost class is the durable part.

Standards and guidance naming this source

RequirementRelationBasis
OMB M-26-14: Identity usedSupports an activityour analysis: authenticationInfo.principalEmail
OMB M-26-14: Object and data eventsSupports an activityour analysis: Data Access audit logs
OMB M-26-14: Privilege changesSupports an activityour analysis: SetIamPolicy
OMB M-26-14: Infrastructure changesSupports an activityour analysis: Admin Activity
OMB M-26-14: Data affectedSupports an activityour analysis: Data Access audit logs
ASD ACSC / CISA et al.: Priority enterprise log sourcespriority_sourcequoted (cloud): administrative configuration changes; security principals; cloud APIs

Techniques

Rules

Sigma 16
Elastic 52
Microsoft Sentinel 20

Events

Listed (66)

Dataset version 0.5.3, built 2026-11-08, from public sources only. Vendor rule names, requirement text and ATT&CK content are reproduced as published; the links between them are the authors' analysis. See the references for each source, its version and its license.