App Engine Admin

methodName	Description	Log type	Sample	Rule
any	Catch-all entry for appengine.googleapis.com. Source-only rules that attribute to the service without a specific method attribute here. Not a distinct audit log operation.	activity	N	N
google.appengine.Firewall.BatchUpdateIngressRules		activity	N	N
google.appengine.Firewall.CreateIngressRule		activity	Y	Y
google.appengine.Firewall.DeleteIngressRule		activity	Y	Y
google.appengine.Firewall.GetIngressRule		data_access	N	N
google.appengine.Firewall.ListIngressRules		data_access	N	N
google.appengine.Firewall.UpdateIngressRule		activity	Y	Y

any: appengine.googleapis.com (any method)

ServiceName: appengine.googleapis.com

Description

Catch-all entry for appengine.googleapis.com. Source-only rules that attribute to the service without a specific method attribute here. Not a distinct audit log operation.

google.appengine.Firewall.BatchUpdateIngressRules: BatchUpdateIngressRules

ServiceName: appengine.googleapis.com

google.appengine.Firewall.CreateIngressRule: CreateIngressRule

ServiceName: appengine.googleapis.com

Example Audit Log Entry #

{
  "insertId": "ci755sd1r90",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Factivity",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "appengine.applications.update",
        "permissionType": "ADMIN_WRITE",
        "resource": "projects/example-project-id/locations/us-central1/applications/example-project-id",
        "resourceAttributes": {}
      }
    ],
    "methodName": "google.appengine.v1.Firewall.CreateIngressRule",
    "request": {
      "@type": "type.googleapis.com/google.appengine.v1.CreateIngressRuleRequest",
      "parent": "projects/example-project-id/locations/us-central1/applications/example-project-id"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.app.firewall-rules.create invocation-id/74ebc2e45e2044819172915cef3daf9e environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/True python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T16:32:04.040672254Z"
      }
    },
    "resourceName": "apps/example-project-id/firewall/ingressRules/100",
    "response": {
      "@type": "type.googleapis.com/google.appengine.v1.FirewallRule"
    },
    "serviceName": "appengine.googleapis.com",
    "status": {}
  },
  "receiveTimestamp": "2026-06-29T16:32:04.563765089Z",
  "resource": {
    "labels": {
      "method": "google.appengine.v1.Firewall.CreateIngressRule",
      "project_id": "example-project-id",
      "service": "appengine.googleapis.com"
    },
    "type": "audited_resource"
  },
  "severity": "NOTICE",
  "timestamp": "2026-06-29T16:32:04.009596942Z"
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

GCP Firewall Rule Creation source low: Identifies when a firewall rule is created in Google Cloud Platform (GCP) for Virtual Private Cloud (VPC) or App Engine. These firewall rules can be configured to allow or deny connections to or from virtual machine (VM) instances or specific applications. An adversary may create a new firewall rule in order to weaken their target's security controls and allow more permissive ingress or egress traffic flows for their benefit.T1562, T1562.007

Panther #

GCP Firewall Rule Created source low: This rule detects creations of GCP firewall rules.

google.appengine.Firewall.DeleteIngressRule: DeleteIngressRule

ServiceName: appengine.googleapis.com

Example Audit Log Entry #

{
  "insertId": "s1207od2bxz",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Factivity",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "appengine.applications.update",
        "permissionType": "ADMIN_WRITE",
        "resource": "projects/example-project-id/locations/us-central1/applications/example-project-id/firewall/ingressRules/100",
        "resourceAttributes": {}
      }
    ],
    "methodName": "google.appengine.v1.Firewall.DeleteIngressRule",
    "request": {
      "@type": "type.googleapis.com/google.appengine.v1.DeleteIngressRuleRequest",
      "name": "projects/example-project-id/locations/us-central1/applications/example-project-id/firewall/ingressRules/100"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.app.firewall-rules.delete invocation-id/8815bea0a98641589ec34a1972c880aa environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/True python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T16:32:06.389442398Z"
      }
    },
    "resourceName": "apps/example-project-id/firewall/ingressRules/100",
    "serviceName": "appengine.googleapis.com",
    "status": {}
  },
  "receiveTimestamp": "2026-06-29T16:32:07.502208517Z",
  "resource": {
    "labels": {
      "method": "google.appengine.v1.Firewall.DeleteIngressRule",
      "project_id": "example-project-id",
      "service": "appengine.googleapis.com"
    },
    "type": "audited_resource"
  },
  "severity": "NOTICE",
  "timestamp": "2026-06-29T16:32:06.320004454Z"
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

GCP Firewall Rule Deletion source medium: Identifies when a firewall rule is deleted in Google Cloud Platform (GCP) for Virtual Private Cloud (VPC) or App Engine. These firewall rules can be configured to allow or deny connections to or from virtual machine (VM) instances or specific applications. An adversary may delete a firewall rule in order to weaken their target's security controls.T1562, T1562.007

Panther #

GCP Firewall Rule Deleted source low: This rule detects deletions of GCP firewall rules.

google.appengine.Firewall.GetIngressRule: GetIngressRule

ServiceName: appengine.googleapis.com

Data Access audit logs are disabled by default.

google.appengine.Firewall.ListIngressRules: ListIngressRules

ServiceName: appengine.googleapis.com

Data Access audit logs are disabled by default.

google.appengine.Firewall.UpdateIngressRule: UpdateIngressRule

ServiceName: appengine.googleapis.com

Example Audit Log Entry #

{
  "insertId": "6dv7hbd1poe",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Factivity",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "appengine.applications.update",
        "permissionType": "ADMIN_WRITE",
        "resource": "projects/example-project-id/locations/us-central1/applications/example-project-id/firewall/ingressRules/100",
        "resourceAttributes": {}
      }
    ],
    "methodName": "google.appengine.v1.Firewall.UpdateIngressRule",
    "request": {
      "@type": "type.googleapis.com/google.appengine.v1.UpdateIngressRuleRequest",
      "name": "projects/example-project-id/locations/us-central1/applications/example-project-id/firewall/ingressRules/100"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.app.firewall-rules.update invocation-id/49868961cdb243a8843c1821e344df44 environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/True python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T16:32:05.261088362Z"
      }
    },
    "resourceName": "apps/example-project-id/firewall/ingressRules/100",
    "response": {
      "@type": "type.googleapis.com/google.appengine.v1.FirewallRule"
    },
    "serviceName": "appengine.googleapis.com",
    "status": {}
  },
  "receiveTimestamp": "2026-06-29T16:32:05.560124825Z",
  "resource": {
    "labels": {
      "method": "google.appengine.v1.Firewall.UpdateIngressRule",
      "project_id": "example-project-id",
      "service": "appengine.googleapis.com"
    },
    "type": "audited_resource"
  },
  "severity": "NOTICE",
  "timestamp": "2026-06-29T16:32:05.195645926Z"
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

GCP Firewall Rule Modification source medium: Identifies when a firewall rule is modified in Google Cloud Platform (GCP) for Virtual Private Cloud (VPC) or App Engine. These firewall rules can be modified to allow or deny connections to or from virtual machine (VM) instances or specific applications. An adversary may modify an existing firewall rule in order to weaken their target's security controls and allow more permissive ingress or egress traffic flows for their benefit.T1562, T1562.007

Panther #

GCP Firewall Rule Modified source low: This rule detects modifications to GCP firewall rules.