BigQuery
| methodName | Description | Log type | Sample | Rule |
|---|---|---|---|---|
| any | Catch-all entry for bigquery.googleapis.com. Source-only rules that attribute to the service without a specific method attribute here. Not a distinct audit log operation. | activity | N | N |
| jobservice. | Retrieves the results of a query job. This method appears in BigQuery Data Access audit logs. | data_access | Y | Y |
| google. | Creates a new read session. A read session divides the contents of a BigQuery table into one or more streams, which can then be used to read data from the table. | data_access | N | N |
| datasetservice. | Create a BigQuery dataset (legacy DatasetService.insert log form). | activity | Y | N |
| google. | Create a BigQuery dataset. | activity | Y | N |
| google. | Submit a BigQuery job (query, load, extract, or copy). | data_access | Y | N |
| jobservice. | Submit a BigQuery job (legacy JobService.insert log form). | data_access | Y | N |
| jobservice. | BigQuery job completion event (legacy JobService.jobcompleted log form). | data_access | Y | N |
any: bigquery.googleapis.com (any method)
#Description
Catch-all entry for bigquery.googleapis.com. Source-only rules that attribute to the service without a specific method attribute here. Not a distinct audit log operation.
jobservice.getqueryresults: Get query results
#Description
Retrieves the results of a query job. This method appears in BigQuery Data Access audit logs.
Data Access audit logs are disabled by default. Full rule details for this event, including ATT&CK technique mappings and native queries →Example Audit Log Entry #
{
"insertId": "sljzioex5vkt",
"logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Fdata_access",
"protoPayload": {
"@type": "type.googleapis.com/google.cloud.audit.AuditLog",
"authenticationInfo": {
"oauthInfo": {
"oauthClientId": "32555940559.apps.googleusercontent.com"
},
"principalEmail": "user@example.com"
},
"authorizationInfo": [
{
"granted": true,
"permission": "bigquery.jobs.create",
"permissionType": "ADMIN_WRITE",
"resource": "projects/example-project-id",
"resourceAttributes": {}
},
{
"granted": true,
"permission": "bigquery.jobs.create",
"permissionType": "ADMIN_WRITE",
"resource": "projects/example-project-id",
"resourceAttributes": {}
}
],
"methodName": "jobservice.getqueryresults",
"requestMetadata": {
"callerIp": "203.0.113.10",
"callerSuppliedUserAgent": "google-cloud-sdk574.0.0 agent-name/claude_code google-api-python-client bq.query.jobs (gzip),gzip(gfe)",
"destinationAttributes": {},
"requestAttributes": {}
},
"resourceName": "projects/example-project-id/queries/bqjob_r234ea277378a8f90_0000019f138abbe2_1",
"serviceData": {
"@type": "type.googleapis.com/google.cloud.bigquery.logging.v1.AuditData",
"jobGetQueryResultsRequest": {
"maxResults": 100
},
"jobGetQueryResultsResponse": {
"job": {
"jobConfiguration": {
"query": {
"createDisposition": "CREATE_IF_NEEDED",
"defaultDataset": {},
"destinationTable": {
"datasetId": "_db976a08af735dea4debf05dedd688b2b7119cfd",
"projectId": "example-project-id",
"tableId": "anonff777d344a7af8ca8f87c2ac39603eb84746d2e263f0af1608cf3c73f1cdcc11"
},
"query": "SELECT 1 AS dw_audit_sample",
"queryPriority": "QUERY_INTERACTIVE",
"statementType": "SELECT",
"writeDisposition": "WRITE_TRUNCATE"
}
},
"jobName": {
"jobId": "bqjob_r234ea277378a8f90_0000019f138abbe2_1",
"location": "US",
"projectId": "example-project-id"
},
"jobStatistics": {
"createTime": "2026-06-29T13:21:27.411Z",
"endTime": "2026-06-29T13:21:27.920Z",
"queryOutputRowCount": "1",
"reservation": "unreserved",
"startTime": "2026-06-29T13:21:27.755Z",
"totalSlotMs": "7"
},
"jobStatus": {
"error": {},
"state": "DONE"
}
},
"totalResults": "1"
}
},
"serviceName": "bigquery.googleapis.com",
"status": {}
},
"receiveTimestamp": "2026-06-29T13:21:28.534165673Z",
"resource": {
"labels": {
"project_id": "example-project-id"
},
"type": "bigquery_resource"
},
"severity": "INFO",
"timestamp": "2026-06-29T13:21:28.307686Z"
}
Detection Rules #
YARA-L #
T1567
google.cloud.bigquery.BigQueryRead.CreateReadSession: Create read session
#Description
Creates a new read session. A read session divides the contents of a BigQuery table into one or more streams, which can then be used to read data from the table.
Data Access audit logs are disabled by default.
datasetservice.insert: DatasetService.insert (legacy)
#Description
Create a BigQuery dataset (legacy DatasetService.insert log form).
Example Audit Log Entry #
{
"insertId": "nm0dymd2m72",
"logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Factivity",
"protoPayload": {
"@type": "type.googleapis.com/google.cloud.audit.AuditLog",
"authenticationInfo": {
"oauthInfo": {
"oauthClientId": "32555940559.apps.googleusercontent.com"
},
"principalEmail": "user@example.com"
},
"authorizationInfo": [
{
"granted": true,
"permission": "bigquery.datasets.create",
"permissionType": "ADMIN_WRITE",
"resource": "projects/example-project-id",
"resourceAttributes": {}
}
],
"methodName": "datasetservice.insert",
"requestMetadata": {
"callerIp": "203.0.113.10",
"callerSuppliedUserAgent": "google-cloud-sdk574.0.0 agent-name/claude_code google-api-python-client bq.mk.datasets (gzip),gzip(gfe)",
"destinationAttributes": {},
"requestAttributes": {}
},
"resourceLocation": {
"currentLocations": [
"us-central1"
]
},
"resourceName": "projects/example-project-id/datasets",
"serviceData": {
"@type": "type.googleapis.com/google.cloud.bigquery.logging.v1.AuditData",
"datasetInsertRequest": {
"resource": {
"acl": {},
"datasetName": {
"datasetId": "dwgen_dw739065",
"projectId": "example-project-id"
},
"info": {}
}
},
"datasetInsertResponse": {
"resource": {
"acl": {
"entries": [
{
"role": "WRITER",
"specialGroup": "PROJECT_WRITERS",
"viewName": {}
},
{
"role": "OWNER",
"specialGroup": "PROJECT_OWNERS",
"viewName": {}
},
{
"role": "OWNER",
"specialGroup": "PROJECT_OWNERS",
"userEmail": "user@example.com",
"viewName": {}
},
{
"role": "READER",
"specialGroup": "PROJECT_READERS",
"viewName": {}
}
]
},
"createTime": "2026-06-29T13:21:25.033Z",
"datasetName": {
"datasetId": "dwgen_dw739065",
"projectId": "example-project-id"
},
"info": {},
"updateTime": "2026-06-29T13:21:25.033Z"
}
}
},
"serviceName": "bigquery.googleapis.com",
"status": {}
},
"receiveTimestamp": "2026-06-29T13:21:26.137823527Z",
"resource": {
"labels": {
"project_id": "example-project-id"
},
"type": "bigquery_resource"
},
"severity": "NOTICE",
"timestamp": "2026-06-29T13:21:25.148654Z"
}
google.cloud.bigquery.DatasetService.InsertDataset: InsertDataset
#Description
Create a BigQuery dataset.
Example Audit Log Entry #
{
"insertId": "nm0dymd2m74",
"logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Factivity",
"protoPayload": {
"@type": "type.googleapis.com/google.cloud.audit.AuditLog",
"authenticationInfo": {
"oauthInfo": {
"oauthClientId": "32555940559.apps.googleusercontent.com"
},
"principalEmail": "user@example.com"
},
"authorizationInfo": [
{
"granted": true,
"permission": "bigquery.datasets.create",
"permissionType": "ADMIN_WRITE",
"resource": "projects/example-project-id",
"resourceAttributes": {}
}
],
"metadata": {
"@type": "type.googleapis.com/google.cloud.audit.BigQueryAuditMetadata",
"datasetCreation": {
"dataset": {
"acl": {
"policy": {
"bindings": [
{
"members": [
"projectEditor:example-project-id"
],
"role": "roles/bigquery.dataEditor"
},
{
"members": [
"projectOwner:example-project-id",
"user:user@example.com"
],
"role": "roles/bigquery.dataOwner"
},
{
"members": [
"projectViewer:example-project-id"
],
"role": "roles/bigquery.dataViewer"
}
]
}
},
"createTime": "2026-06-29T13:21:25.033Z",
"datasetName": "projects/example-project-id/datasets/dwgen_dw739065",
"updateTime": "2026-06-29T13:21:25.033Z"
},
"reason": "CREATE"
}
},
"methodName": "google.cloud.bigquery.v2.DatasetService.InsertDataset",
"requestMetadata": {
"callerIp": "203.0.113.10",
"callerSuppliedUserAgent": "google-cloud-sdk574.0.0 agent-name/claude_code google-api-python-client bq.mk.datasets (gzip),gzip(gfe)",
"destinationAttributes": {},
"requestAttributes": {}
},
"resourceName": "projects/example-project-id/datasets/dwgen_dw739065",
"serviceName": "bigquery.googleapis.com",
"status": {}
},
"receiveTimestamp": "2026-06-29T13:21:26.137823527Z",
"resource": {
"labels": {
"dataset_id": "dwgen_dw739065",
"project_id": "example-project-id"
},
"type": "bigquery_dataset"
},
"severity": "NOTICE",
"timestamp": "2026-06-29T13:21:25.150242Z"
}
google.cloud.bigquery.JobService.InsertJob: InsertJob
#Description
Submit a BigQuery job (query, load, extract, or copy).
Data Access audit logs are disabled by default.Example Audit Log Entry #
{
"insertId": "n1f23het6yk2",
"logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Fdata_access",
"operation": {
"id": "1782739287411-example-project-id:bqjob_r234ea277378a8f90_0000019f138abbe2_1",
"last": true,
"producer": "bigquery.googleapis.com"
},
"protoPayload": {
"@type": "type.googleapis.com/google.cloud.audit.AuditLog",
"authenticationInfo": {
"oauthInfo": {
"oauthClientId": "32555940559.apps.googleusercontent.com"
},
"principalEmail": "user@example.com"
},
"authorizationInfo": [
{
"granted": true,
"permission": "bigquery.jobs.create",
"permissionType": "ADMIN_WRITE",
"resource": "projects/example-project-id",
"resourceAttributes": {}
}
],
"metadata": {
"@type": "type.googleapis.com/google.cloud.audit.BigQueryAuditMetadata",
"jobChange": {
"after": "DONE",
"job": {
"jobConfig": {
"queryConfig": {
"createDisposition": "CREATE_IF_NEEDED",
"destinationTable": "projects/example-project-id/datasets/_db976a08af735dea4debf05dedd688b2b7119cfd/tables/anonff777d344a7af8ca8f87c2ac39603eb84746d2e263f0af1608cf3c73f1cdcc11",
"priority": "QUERY_INTERACTIVE",
"query": "SELECT 1 AS dw_audit_sample",
"statementType": "SELECT",
"writeDisposition": "WRITE_TRUNCATE"
},
"type": "QUERY"
},
"jobName": "projects/example-project-id/jobs/bqjob_r234ea277378a8f90_0000019f138abbe2_1",
"jobStats": {
"createTime": "2026-06-29T13:21:27.411Z",
"endTime": "2026-06-29T13:21:27.920Z",
"queryStats": {
"outputRowCount": "1"
},
"reservation": "unreserved",
"startTime": "2026-06-29T13:21:27.755Z",
"totalSlotMs": "7"
},
"jobStatus": {
"jobState": "DONE"
}
}
}
},
"methodName": "google.cloud.bigquery.v2.JobService.InsertJob",
"requestMetadata": {
"callerIp": "203.0.113.10",
"callerSuppliedUserAgent": "google-cloud-sdk574.0.0 agent-name/claude_code google-api-python-client bq.query.jobs (gzip),gzip(gfe)",
"destinationAttributes": {},
"requestAttributes": {}
},
"resourceName": "projects/example-project-id/jobs/bqjob_r234ea277378a8f90_0000019f138abbe2_1",
"serviceName": "bigquery.googleapis.com",
"status": {}
},
"receiveTimestamp": "2026-06-29T13:21:28.847396827Z",
"resource": {
"labels": {
"location": "US",
"project_id": "example-project-id"
},
"type": "bigquery_project"
},
"severity": "INFO",
"timestamp": "2026-06-29T13:21:27.974022Z"
}
jobservice.insert: JobService.insert (legacy)
#Description
Submit a BigQuery job (legacy JobService.insert log form).
Data Access audit logs are disabled by default.Example Audit Log Entry #
{
"insertId": "n1f23het6yk4",
"logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Fdata_access",
"protoPayload": {
"@type": "type.googleapis.com/google.cloud.audit.AuditLog",
"authenticationInfo": {
"oauthInfo": {
"oauthClientId": "32555940559.apps.googleusercontent.com"
},
"principalEmail": "user@example.com"
},
"authorizationInfo": [
{
"granted": true,
"permission": "bigquery.jobs.create",
"permissionType": "ADMIN_WRITE",
"resource": "projects/example-project-id",
"resourceAttributes": {}
}
],
"methodName": "jobservice.insert",
"requestMetadata": {
"callerIp": "203.0.113.10",
"callerSuppliedUserAgent": "google-cloud-sdk574.0.0 agent-name/claude_code google-api-python-client bq.query.jobs (gzip),gzip(gfe)",
"destinationAttributes": {},
"requestAttributes": {}
},
"resourceName": "projects/example-project-id/jobs",
"serviceData": {
"@type": "type.googleapis.com/google.cloud.bigquery.logging.v1.AuditData",
"jobInsertRequest": {
"resource": {
"jobConfiguration": {
"query": {
"createDisposition": "CREATE_IF_NEEDED",
"defaultDataset": {},
"destinationTable": {},
"query": "SELECT 1 AS dw_audit_sample",
"queryPriority": "QUERY_INTERACTIVE",
"writeDisposition": "WRITE_EMPTY"
}
},
"jobName": {
"jobId": "bqjob_r234ea277378a8f90_0000019f138abbe2_1",
"projectId": "example-project-id"
}
}
},
"jobInsertResponse": {
"resource": {
"jobConfiguration": {
"query": {
"createDisposition": "CREATE_IF_NEEDED",
"defaultDataset": {},
"destinationTable": {
"datasetId": "_db976a08af735dea4debf05dedd688b2b7119cfd",
"projectId": "example-project-id",
"tableId": "anonff777d344a7af8ca8f87c2ac39603eb84746d2e263f0af1608cf3c73f1cdcc11"
},
"query": "SELECT 1 AS dw_audit_sample",
"queryPriority": "QUERY_INTERACTIVE",
"statementType": "SELECT",
"writeDisposition": "WRITE_TRUNCATE"
}
},
"jobName": {
"jobId": "bqjob_r234ea277378a8f90_0000019f138abbe2_1",
"location": "US",
"projectId": "example-project-id"
},
"jobStatistics": {
"createTime": "2026-06-29T13:21:27.411Z",
"endTime": "2026-06-29T13:21:27.920Z",
"queryOutputRowCount": "1",
"reservation": "unreserved",
"startTime": "2026-06-29T13:21:27.755Z",
"totalSlotMs": "7"
},
"jobStatus": {
"error": {},
"state": "DONE"
}
}
}
},
"serviceName": "bigquery.googleapis.com",
"status": {}
},
"receiveTimestamp": "2026-06-29T13:21:28.847396827Z",
"resource": {
"labels": {
"project_id": "example-project-id"
},
"type": "bigquery_resource"
},
"severity": "INFO",
"timestamp": "2026-06-29T13:21:27.977231Z"
}
jobservice.jobcompleted: JobService.jobcompleted (legacy)
#Description
BigQuery job completion event (legacy JobService.jobcompleted log form).
Data Access audit logs are disabled by default.Example Audit Log Entry #
{
"insertId": "n1f23het6yk0",
"logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Fdata_access",
"protoPayload": {
"@type": "type.googleapis.com/google.cloud.audit.AuditLog",
"authenticationInfo": {
"oauthInfo": {
"oauthClientId": "32555940559.apps.googleusercontent.com"
},
"principalEmail": "user@example.com"
},
"methodName": "jobservice.jobcompleted",
"requestMetadata": {
"callerIp": "203.0.113.10",
"callerSuppliedUserAgent": "google-cloud-sdk574.0.0 agent-name/claude_code google-api-python-client bq.query.jobs (gzip),gzip(gfe)",
"destinationAttributes": {},
"requestAttributes": {}
},
"resourceName": "projects/example-project-id/jobs/bqjob_r234ea277378a8f90_0000019f138abbe2_1",
"serviceData": {
"@type": "type.googleapis.com/google.cloud.bigquery.logging.v1.AuditData",
"jobCompletedEvent": {
"eventName": "query_job_completed",
"job": {
"jobConfiguration": {
"query": {
"createDisposition": "CREATE_IF_NEEDED",
"defaultDataset": {},
"destinationTable": {
"datasetId": "_db976a08af735dea4debf05dedd688b2b7119cfd",
"projectId": "example-project-id",
"tableId": "anonff777d344a7af8ca8f87c2ac39603eb84746d2e263f0af1608cf3c73f1cdcc11"
},
"query": "SELECT 1 AS dw_audit_sample",
"queryPriority": "QUERY_INTERACTIVE",
"statementType": "SELECT",
"writeDisposition": "WRITE_TRUNCATE"
}
},
"jobName": {
"jobId": "bqjob_r234ea277378a8f90_0000019f138abbe2_1",
"location": "US",
"projectId": "example-project-id"
},
"jobStatistics": {
"createTime": "2026-06-29T13:21:27.411Z",
"endTime": "2026-06-29T13:21:27.920Z",
"queryOutputRowCount": "1",
"reservation": "unreserved",
"startTime": "2026-06-29T13:21:27.755Z",
"totalSlotMs": "7"
},
"jobStatus": {
"error": {},
"state": "DONE"
}
}
}
},
"serviceName": "bigquery.googleapis.com",
"status": {}
},
"receiveTimestamp": "2026-06-29T13:21:28.847396827Z",
"resource": {
"labels": {
"project_id": "example-project-id"
},
"type": "bigquery_resource"
},
"severity": "INFO",
"timestamp": "2026-06-29T13:21:27.973468Z"
}