App Engine Admin

methodName	Log type	Sample	Rule
google.appengine.Firewall.BatchUpdateIngressRules	activity	N	N
google.appengine.Firewall.CreateIngressRule	activity	Y	Y
google.appengine.Firewall.DeleteIngressRule	activity	Y	Y
google.appengine.Firewall.GetIngressRule	data_access	N	N
google.appengine.Firewall.ListIngressRules	data_access	N	N
google.appengine.Firewall.UpdateIngressRule	activity	Y	Y

google.appengine.Firewall.BatchUpdateIngressRules: BatchUpdateIngressRules

ServiceName: appengine.googleapis.com

google.appengine.Firewall.CreateIngressRule: CreateIngressRule

ServiceName: appengine.googleapis.com

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete schema for this catalog entry.

Name	Rules	Vendors
`event.action`	1 detection rule	Elastic
`protoPayload.methodName`	1 detection rule	Panther

Example Audit Log Entry #

{
  "insertId": "ci755sd1r90",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Factivity",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "appengine.applications.update",
        "permissionType": "ADMIN_WRITE",
        "resource": "projects/example-project-id/locations/us-central1/applications/example-project-id",
        "resourceAttributes": {}
      }
    ],
    "methodName": "google.appengine.v1.Firewall.CreateIngressRule",
    "request": {
      "@type": "type.googleapis.com/google.appengine.v1.CreateIngressRuleRequest",
      "parent": "projects/example-project-id/locations/us-central1/applications/example-project-id"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.app.firewall-rules.create invocation-id/74ebc2e45e2044819172915cef3daf9e environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/True python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T16:32:04.040672254Z"
      }
    },
    "resourceName": "apps/example-project-id/firewall/ingressRules/100",
    "response": {
      "@type": "type.googleapis.com/google.appengine.v1.FirewallRule"
    },
    "serviceName": "appengine.googleapis.com",
    "status": {}
  },
  "receiveTimestamp": "2026-06-29T16:32:04.563765089Z",
  "resource": {
    "labels": {
      "method": "google.appengine.v1.Firewall.CreateIngressRule",
      "project_id": "example-project-id",
      "service": "appengine.googleapis.com"
    },
    "type": "audited_resource"
  },
  "severity": "NOTICE",
  "timestamp": "2026-06-29T16:32:04.009596942Z"
}

Detection Rules #

Full rule details for this catalog entry, including ATT&CK technique mappings and native queries →

Elastic #

GCP Firewall Rule Creation source low: Identifies when a firewall rule is created in Google Cloud Platform (GCP) for Virtual Private Cloud (VPC) or App Engine. These firewall rules can be configured to allow or deny connections to or from virtual machine (VM) instances or specific applications. An adversary may create a new firewall rule in order to weaken their target's security controls and allow more permissive ingress or egress traffic flows for their benefit.T1562, T1562.007

Panther #

GCP Firewall Rule Created source low: This rule detects creations of GCP firewall rules.

google.appengine.Firewall.DeleteIngressRule: DeleteIngressRule

ServiceName: appengine.googleapis.com

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete schema for this catalog entry.

Name	Rules	Vendors
`event.action`	1 detection rule	Elastic
`protoPayload.methodName`	1 detection rule	Panther

Example Audit Log Entry #

{
  "insertId": "s1207od2bxz",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Factivity",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "appengine.applications.update",
        "permissionType": "ADMIN_WRITE",
        "resource": "projects/example-project-id/locations/us-central1/applications/example-project-id/firewall/ingressRules/100",
        "resourceAttributes": {}
      }
    ],
    "methodName": "google.appengine.v1.Firewall.DeleteIngressRule",
    "request": {
      "@type": "type.googleapis.com/google.appengine.v1.DeleteIngressRuleRequest",
      "name": "projects/example-project-id/locations/us-central1/applications/example-project-id/firewall/ingressRules/100"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.app.firewall-rules.delete invocation-id/8815bea0a98641589ec34a1972c880aa environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/True python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T16:32:06.389442398Z"
      }
    },
    "resourceName": "apps/example-project-id/firewall/ingressRules/100",
    "serviceName": "appengine.googleapis.com",
    "status": {}
  },
  "receiveTimestamp": "2026-06-29T16:32:07.502208517Z",
  "resource": {
    "labels": {
      "method": "google.appengine.v1.Firewall.DeleteIngressRule",
      "project_id": "example-project-id",
      "service": "appengine.googleapis.com"
    },
    "type": "audited_resource"
  },
  "severity": "NOTICE",
  "timestamp": "2026-06-29T16:32:06.320004454Z"
}

Detection Rules #

Full rule details for this catalog entry, including ATT&CK technique mappings and native queries →

Elastic #

GCP Firewall Rule Deletion source medium: Identifies when a firewall rule is deleted in Google Cloud Platform (GCP) for Virtual Private Cloud (VPC) or App Engine. These firewall rules can be configured to allow or deny connections to or from virtual machine (VM) instances or specific applications. An adversary may delete a firewall rule in order to weaken their target's security controls.T1562, T1562.007

Panther #

GCP Firewall Rule Deleted source low: This rule detects deletions of GCP firewall rules.

google.appengine.Firewall.GetIngressRule: GetIngressRule

ServiceName: appengine.googleapis.com

Data Access audit logs are disabled by default.

google.appengine.Firewall.ListIngressRules: ListIngressRules

ServiceName: appengine.googleapis.com

Data Access audit logs are disabled by default.

google.appengine.Firewall.UpdateIngressRule: UpdateIngressRule

ServiceName: appengine.googleapis.com

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete schema for this catalog entry.

Name	Rules	Vendors
`event.action`	1 detection rule	Elastic
`protoPayload.methodName`	1 detection rule	Panther

Example Audit Log Entry #

{
  "insertId": "6dv7hbd1poe",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Factivity",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "appengine.applications.update",
        "permissionType": "ADMIN_WRITE",
        "resource": "projects/example-project-id/locations/us-central1/applications/example-project-id/firewall/ingressRules/100",
        "resourceAttributes": {}
      }
    ],
    "methodName": "google.appengine.v1.Firewall.UpdateIngressRule",
    "request": {
      "@type": "type.googleapis.com/google.appengine.v1.UpdateIngressRuleRequest",
      "name": "projects/example-project-id/locations/us-central1/applications/example-project-id/firewall/ingressRules/100"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.app.firewall-rules.update invocation-id/49868961cdb243a8843c1821e344df44 environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/True python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T16:32:05.261088362Z"
      }
    },
    "resourceName": "apps/example-project-id/firewall/ingressRules/100",
    "response": {
      "@type": "type.googleapis.com/google.appengine.v1.FirewallRule"
    },
    "serviceName": "appengine.googleapis.com",
    "status": {}
  },
  "receiveTimestamp": "2026-06-29T16:32:05.560124825Z",
  "resource": {
    "labels": {
      "method": "google.appengine.v1.Firewall.UpdateIngressRule",
      "project_id": "example-project-id",
      "service": "appengine.googleapis.com"
    },
    "type": "audited_resource"
  },
  "severity": "NOTICE",
  "timestamp": "2026-06-29T16:32:05.195645926Z"
}

Detection Rules #

Full rule details for this catalog entry, including ATT&CK technique mappings and native queries →

Elastic #

GCP Firewall Rule Modification source medium: Identifies when a firewall rule is modified in Google Cloud Platform (GCP) for Virtual Private Cloud (VPC) or App Engine. These firewall rules can be modified to allow or deny connections to or from virtual machine (VM) instances or specific applications. An adversary may modify an existing firewall rule in order to weaken their target's security controls and allow more permissive ingress or egress traffic flows for their benefit.T1562, T1562.007

Panther #

GCP Firewall Rule Modified source low: This rule detects modifications to GCP firewall rules.

any: appengine.googleapis.com (any method)

Scope grouping: This repository-authored catalog entry represents a broad attribution scope, not a distinct emitted event or operation. Any sample below is a representative record from that scope; attached rules, if any, are listed separately.

ServiceName: appengine.googleapis.com

Description

Catch-all entry for appengine.googleapis.com. Source-only rules that attribute to the service without a specific method attribute here. Not a distinct audit log operation.