BigQuery
| methodName | Description | Log type | Sample | Rule |
|---|---|---|---|---|
| jobservice. | Retrieves the results of a query job. This method appears in BigQuery Data Access audit logs. | data_access | Y | Y |
| google. | Creates a new read session. A read session divides the contents of a BigQuery table into one or more streams, which can then be used to read data from the table. | data_access | N | N |
| datasetservice. | Create a BigQuery dataset (legacy DatasetService.insert log form). | activity | Y | N |
| google. | Create a BigQuery dataset. | activity | Y | N |
| google. | Submit a BigQuery job (query, load, extract, or copy). | data_access | Y | N |
| jobservice. | Submit a BigQuery job (legacy JobService.insert log form). | data_access | Y | N |
| jobservice. | BigQuery job completion event (legacy JobService.jobcompleted log form). | data_access | Y | N |
jobservice.getqueryresults: Get query results
#Description
Retrieves the results of a query job. This method appears in BigQuery Data Access audit logs.
Data Access audit logs are disabled by default. Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete schema for this catalog entry. Full rule details for this catalog entry, including ATT&CK technique mappings and native queries →Detection Fields #
Name Rules Vendors metadata.log_type1 detection rule YARA-L security_result.action1 detection rule YARA-L Example Audit Log Entry #
{
"insertId": "sljzioex5vkt",
"logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Fdata_access",
"protoPayload": {
"@type": "type.googleapis.com/google.cloud.audit.AuditLog",
"authenticationInfo": {
"oauthInfo": {
"oauthClientId": "32555940559.apps.googleusercontent.com"
},
"principalEmail": "user@example.com"
},
"authorizationInfo": [
{
"granted": true,
"permission": "bigquery.jobs.create",
"permissionType": "ADMIN_WRITE",
"resource": "projects/example-project-id",
"resourceAttributes": {}
},
{
"granted": true,
"permission": "bigquery.jobs.create",
"permissionType": "ADMIN_WRITE",
"resource": "projects/example-project-id",
"resourceAttributes": {}
}
],
"methodName": "jobservice.getqueryresults",
"requestMetadata": {
"callerIp": "203.0.113.10",
"callerSuppliedUserAgent": "google-cloud-sdk574.0.0 agent-name/claude_code google-api-python-client bq.query.jobs (gzip),gzip(gfe)",
"destinationAttributes": {},
"requestAttributes": {}
},
"resourceName": "projects/example-project-id/queries/bqjob_r234ea277378a8f90_0000019f138abbe2_1",
"serviceData": {
"@type": "type.googleapis.com/google.cloud.bigquery.logging.v1.AuditData",
"jobGetQueryResultsRequest": {
"maxResults": 100
},
"jobGetQueryResultsResponse": {
"job": {
"jobConfiguration": {
"query": {
"createDisposition": "CREATE_IF_NEEDED",
"defaultDataset": {},
"destinationTable": {
"datasetId": "_db976a08af735dea4debf05dedd688b2b7119cfd",
"projectId": "example-project-id",
"tableId": "anonff777d344a7af8ca8f87c2ac39603eb84746d2e263f0af1608cf3c73f1cdcc11"
},
"query": "SELECT 1 AS dw_audit_sample",
"queryPriority": "QUERY_INTERACTIVE",
"statementType": "SELECT",
"writeDisposition": "WRITE_TRUNCATE"
}
},
"jobName": {
"jobId": "bqjob_r234ea277378a8f90_0000019f138abbe2_1",
"location": "US",
"projectId": "example-project-id"
},
"jobStatistics": {
"createTime": "2026-06-29T13:21:27.411Z",
"endTime": "2026-06-29T13:21:27.920Z",
"queryOutputRowCount": "1",
"reservation": "unreserved",
"startTime": "2026-06-29T13:21:27.755Z",
"totalSlotMs": "7"
},
"jobStatus": {
"error": {},
"state": "DONE"
}
},
"totalResults": "1"
}
},
"serviceName": "bigquery.googleapis.com",
"status": {}
},
"receiveTimestamp": "2026-06-29T13:21:28.534165673Z",
"resource": {
"labels": {
"project_id": "example-project-id"
},
"type": "bigquery_resource"
},
"severity": "INFO",
"timestamp": "2026-06-29T13:21:28.307686Z"
}
Detection Rules #
YARA-L #
T1567
google.cloud.bigquery.BigQueryRead.CreateReadSession: Create read session
#Description
Creates a new read session. A read session divides the contents of a BigQuery table into one or more streams, which can then be used to read data from the table.
Data Access audit logs are disabled by default.
datasetservice.insert: DatasetService.insert (legacy)
#Description
Create a BigQuery dataset (legacy DatasetService.insert log form).
Example Audit Log Entry #
{
"insertId": "nm0dymd2m72",
"logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Factivity",
"protoPayload": {
"@type": "type.googleapis.com/google.cloud.audit.AuditLog",
"authenticationInfo": {
"oauthInfo": {
"oauthClientId": "32555940559.apps.googleusercontent.com"
},
"principalEmail": "user@example.com"
},
"authorizationInfo": [
{
"granted": true,
"permission": "bigquery.datasets.create",
"permissionType": "ADMIN_WRITE",
"resource": "projects/example-project-id",
"resourceAttributes": {}
}
],
"methodName": "datasetservice.insert",
"requestMetadata": {
"callerIp": "203.0.113.10",
"callerSuppliedUserAgent": "google-cloud-sdk574.0.0 agent-name/claude_code google-api-python-client bq.mk.datasets (gzip),gzip(gfe)",
"destinationAttributes": {},
"requestAttributes": {}
},
"resourceLocation": {
"currentLocations": [
"us-central1"
]
},
"resourceName": "projects/example-project-id/datasets",
"serviceData": {
"@type": "type.googleapis.com/google.cloud.bigquery.logging.v1.AuditData",
"datasetInsertRequest": {
"resource": {
"acl": {},
"datasetName": {
"datasetId": "dwgen_dw739065",
"projectId": "example-project-id"
},
"info": {}
}
},
"datasetInsertResponse": {
"resource": {
"acl": {
"entries": [
{
"role": "WRITER",
"specialGroup": "PROJECT_WRITERS",
"viewName": {}
},
{
"role": "OWNER",
"specialGroup": "PROJECT_OWNERS",
"viewName": {}
},
{
"role": "OWNER",
"specialGroup": "PROJECT_OWNERS",
"userEmail": "user@example.com",
"viewName": {}
},
{
"role": "READER",
"specialGroup": "PROJECT_READERS",
"viewName": {}
}
]
},
"createTime": "2026-06-29T13:21:25.033Z",
"datasetName": {
"datasetId": "dwgen_dw739065",
"projectId": "example-project-id"
},
"info": {},
"updateTime": "2026-06-29T13:21:25.033Z"
}
}
},
"serviceName": "bigquery.googleapis.com",
"status": {}
},
"receiveTimestamp": "2026-06-29T13:21:26.137823527Z",
"resource": {
"labels": {
"project_id": "example-project-id"
},
"type": "bigquery_resource"
},
"severity": "NOTICE",
"timestamp": "2026-06-29T13:21:25.148654Z"
}
google.cloud.bigquery.DatasetService.InsertDataset: InsertDataset
#Description
Create a BigQuery dataset.
Example Audit Log Entry #
{
"insertId": "nm0dymd2m74",
"logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Factivity",
"protoPayload": {
"@type": "type.googleapis.com/google.cloud.audit.AuditLog",
"authenticationInfo": {
"oauthInfo": {
"oauthClientId": "32555940559.apps.googleusercontent.com"
},
"principalEmail": "user@example.com"
},
"authorizationInfo": [
{
"granted": true,
"permission": "bigquery.datasets.create",
"permissionType": "ADMIN_WRITE",
"resource": "projects/example-project-id",
"resourceAttributes": {}
}
],
"metadata": {
"@type": "type.googleapis.com/google.cloud.audit.BigQueryAuditMetadata",
"datasetCreation": {
"dataset": {
"acl": {
"policy": {
"bindings": [
{
"members": [
"projectEditor:example-project-id"
],
"role": "roles/bigquery.dataEditor"
},
{
"members": [
"projectOwner:example-project-id",
"user:user@example.com"
],
"role": "roles/bigquery.dataOwner"
},
{
"members": [
"projectViewer:example-project-id"
],
"role": "roles/bigquery.dataViewer"
}
]
}
},
"createTime": "2026-06-29T13:21:25.033Z",
"datasetName": "projects/example-project-id/datasets/dwgen_dw739065",
"updateTime": "2026-06-29T13:21:25.033Z"
},
"reason": "CREATE"
}
},
"methodName": "google.cloud.bigquery.v2.DatasetService.InsertDataset",
"requestMetadata": {
"callerIp": "203.0.113.10",
"callerSuppliedUserAgent": "google-cloud-sdk574.0.0 agent-name/claude_code google-api-python-client bq.mk.datasets (gzip),gzip(gfe)",
"destinationAttributes": {},
"requestAttributes": {}
},
"resourceName": "projects/example-project-id/datasets/dwgen_dw739065",
"serviceName": "bigquery.googleapis.com",
"status": {}
},
"receiveTimestamp": "2026-06-29T13:21:26.137823527Z",
"resource": {
"labels": {
"dataset_id": "dwgen_dw739065",
"project_id": "example-project-id"
},
"type": "bigquery_dataset"
},
"severity": "NOTICE",
"timestamp": "2026-06-29T13:21:25.150242Z"
}
google.cloud.bigquery.JobService.InsertJob: InsertJob
#Description
Submit a BigQuery job (query, load, extract, or copy).
Data Access audit logs are disabled by default.Example Audit Log Entry #
{
"insertId": "n1f23het6yk2",
"logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Fdata_access",
"operation": {
"id": "1782739287411-example-project-id:bqjob_r234ea277378a8f90_0000019f138abbe2_1",
"last": true,
"producer": "bigquery.googleapis.com"
},
"protoPayload": {
"@type": "type.googleapis.com/google.cloud.audit.AuditLog",
"authenticationInfo": {
"oauthInfo": {
"oauthClientId": "32555940559.apps.googleusercontent.com"
},
"principalEmail": "user@example.com"
},
"authorizationInfo": [
{
"granted": true,
"permission": "bigquery.jobs.create",
"permissionType": "ADMIN_WRITE",
"resource": "projects/example-project-id",
"resourceAttributes": {}
}
],
"metadata": {
"@type": "type.googleapis.com/google.cloud.audit.BigQueryAuditMetadata",
"jobChange": {
"after": "DONE",
"job": {
"jobConfig": {
"queryConfig": {
"createDisposition": "CREATE_IF_NEEDED",
"destinationTable": "projects/example-project-id/datasets/_db976a08af735dea4debf05dedd688b2b7119cfd/tables/anonff777d344a7af8ca8f87c2ac39603eb84746d2e263f0af1608cf3c73f1cdcc11",
"priority": "QUERY_INTERACTIVE",
"query": "SELECT 1 AS dw_audit_sample",
"statementType": "SELECT",
"writeDisposition": "WRITE_TRUNCATE"
},
"type": "QUERY"
},
"jobName": "projects/example-project-id/jobs/bqjob_r234ea277378a8f90_0000019f138abbe2_1",
"jobStats": {
"createTime": "2026-06-29T13:21:27.411Z",
"endTime": "2026-06-29T13:21:27.920Z",
"queryStats": {
"outputRowCount": "1"
},
"reservation": "unreserved",
"startTime": "2026-06-29T13:21:27.755Z",
"totalSlotMs": "7"
},
"jobStatus": {
"jobState": "DONE"
}
}
}
},
"methodName": "google.cloud.bigquery.v2.JobService.InsertJob",
"requestMetadata": {
"callerIp": "203.0.113.10",
"callerSuppliedUserAgent": "google-cloud-sdk574.0.0 agent-name/claude_code google-api-python-client bq.query.jobs (gzip),gzip(gfe)",
"destinationAttributes": {},
"requestAttributes": {}
},
"resourceName": "projects/example-project-id/jobs/bqjob_r234ea277378a8f90_0000019f138abbe2_1",
"serviceName": "bigquery.googleapis.com",
"status": {}
},
"receiveTimestamp": "2026-06-29T13:21:28.847396827Z",
"resource": {
"labels": {
"location": "US",
"project_id": "example-project-id"
},
"type": "bigquery_project"
},
"severity": "INFO",
"timestamp": "2026-06-29T13:21:27.974022Z"
}
jobservice.insert: JobService.insert (legacy)
#Description
Submit a BigQuery job (legacy JobService.insert log form).
Data Access audit logs are disabled by default.Example Audit Log Entry #
{
"insertId": "n1f23het6yk4",
"logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Fdata_access",
"protoPayload": {
"@type": "type.googleapis.com/google.cloud.audit.AuditLog",
"authenticationInfo": {
"oauthInfo": {
"oauthClientId": "32555940559.apps.googleusercontent.com"
},
"principalEmail": "user@example.com"
},
"authorizationInfo": [
{
"granted": true,
"permission": "bigquery.jobs.create",
"permissionType": "ADMIN_WRITE",
"resource": "projects/example-project-id",
"resourceAttributes": {}
}
],
"methodName": "jobservice.insert",
"requestMetadata": {
"callerIp": "203.0.113.10",
"callerSuppliedUserAgent": "google-cloud-sdk574.0.0 agent-name/claude_code google-api-python-client bq.query.jobs (gzip),gzip(gfe)",
"destinationAttributes": {},
"requestAttributes": {}
},
"resourceName": "projects/example-project-id/jobs",
"serviceData": {
"@type": "type.googleapis.com/google.cloud.bigquery.logging.v1.AuditData",
"jobInsertRequest": {
"resource": {
"jobConfiguration": {
"query": {
"createDisposition": "CREATE_IF_NEEDED",
"defaultDataset": {},
"destinationTable": {},
"query": "SELECT 1 AS dw_audit_sample",
"queryPriority": "QUERY_INTERACTIVE",
"writeDisposition": "WRITE_EMPTY"
}
},
"jobName": {
"jobId": "bqjob_r234ea277378a8f90_0000019f138abbe2_1",
"projectId": "example-project-id"
}
}
},
"jobInsertResponse": {
"resource": {
"jobConfiguration": {
"query": {
"createDisposition": "CREATE_IF_NEEDED",
"defaultDataset": {},
"destinationTable": {
"datasetId": "_db976a08af735dea4debf05dedd688b2b7119cfd",
"projectId": "example-project-id",
"tableId": "anonff777d344a7af8ca8f87c2ac39603eb84746d2e263f0af1608cf3c73f1cdcc11"
},
"query": "SELECT 1 AS dw_audit_sample",
"queryPriority": "QUERY_INTERACTIVE",
"statementType": "SELECT",
"writeDisposition": "WRITE_TRUNCATE"
}
},
"jobName": {
"jobId": "bqjob_r234ea277378a8f90_0000019f138abbe2_1",
"location": "US",
"projectId": "example-project-id"
},
"jobStatistics": {
"createTime": "2026-06-29T13:21:27.411Z",
"endTime": "2026-06-29T13:21:27.920Z",
"queryOutputRowCount": "1",
"reservation": "unreserved",
"startTime": "2026-06-29T13:21:27.755Z",
"totalSlotMs": "7"
},
"jobStatus": {
"error": {},
"state": "DONE"
}
}
}
},
"serviceName": "bigquery.googleapis.com",
"status": {}
},
"receiveTimestamp": "2026-06-29T13:21:28.847396827Z",
"resource": {
"labels": {
"project_id": "example-project-id"
},
"type": "bigquery_resource"
},
"severity": "INFO",
"timestamp": "2026-06-29T13:21:27.977231Z"
}
jobservice.jobcompleted: JobService.jobcompleted (legacy)
#Description
BigQuery job completion event (legacy JobService.jobcompleted log form).
Data Access audit logs are disabled by default.Example Audit Log Entry #
{
"insertId": "n1f23het6yk0",
"logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Fdata_access",
"protoPayload": {
"@type": "type.googleapis.com/google.cloud.audit.AuditLog",
"authenticationInfo": {
"oauthInfo": {
"oauthClientId": "32555940559.apps.googleusercontent.com"
},
"principalEmail": "user@example.com"
},
"methodName": "jobservice.jobcompleted",
"requestMetadata": {
"callerIp": "203.0.113.10",
"callerSuppliedUserAgent": "google-cloud-sdk574.0.0 agent-name/claude_code google-api-python-client bq.query.jobs (gzip),gzip(gfe)",
"destinationAttributes": {},
"requestAttributes": {}
},
"resourceName": "projects/example-project-id/jobs/bqjob_r234ea277378a8f90_0000019f138abbe2_1",
"serviceData": {
"@type": "type.googleapis.com/google.cloud.bigquery.logging.v1.AuditData",
"jobCompletedEvent": {
"eventName": "query_job_completed",
"job": {
"jobConfiguration": {
"query": {
"createDisposition": "CREATE_IF_NEEDED",
"defaultDataset": {},
"destinationTable": {
"datasetId": "_db976a08af735dea4debf05dedd688b2b7119cfd",
"projectId": "example-project-id",
"tableId": "anonff777d344a7af8ca8f87c2ac39603eb84746d2e263f0af1608cf3c73f1cdcc11"
},
"query": "SELECT 1 AS dw_audit_sample",
"queryPriority": "QUERY_INTERACTIVE",
"statementType": "SELECT",
"writeDisposition": "WRITE_TRUNCATE"
}
},
"jobName": {
"jobId": "bqjob_r234ea277378a8f90_0000019f138abbe2_1",
"location": "US",
"projectId": "example-project-id"
},
"jobStatistics": {
"createTime": "2026-06-29T13:21:27.411Z",
"endTime": "2026-06-29T13:21:27.920Z",
"queryOutputRowCount": "1",
"reservation": "unreserved",
"startTime": "2026-06-29T13:21:27.755Z",
"totalSlotMs": "7"
},
"jobStatus": {
"error": {},
"state": "DONE"
}
}
}
},
"serviceName": "bigquery.googleapis.com",
"status": {}
},
"receiveTimestamp": "2026-06-29T13:21:28.847396827Z",
"resource": {
"labels": {
"project_id": "example-project-id"
},
"type": "bigquery_resource"
},
"severity": "INFO",
"timestamp": "2026-06-29T13:21:27.973468Z"
}
any: bigquery.googleapis.com (any method)
#Scope grouping: This repository-authored catalog entry represents a broad attribution scope, not a distinct emitted event or operation. Any sample below is a representative record from that scope; attached rules, if any, are listed separately.
Description
Catch-all entry for bigquery.googleapis.com. Source-only rules that attribute to the service without a specific method attribute here. Not a distinct audit log operation.