Cloud Build
any: cloudbuild.googleapis.com (any method)
#Description
Catch-all entry for cloudbuild.googleapis.com. Source-only rules that attribute to the service without a specific method attribute here. Not a distinct audit log operation.
google.devtools.cloudbuild.CloudBuild.ApproveBuild: ApproveBuild
#google.devtools.cloudbuild.CloudBuild.CancelBuild: CancelBuild
#google.devtools.cloudbuild.CloudBuild.CreateBuild: CreateBuild
#Example Audit Log Entry #
{
"insertId": "tywk1qdck1x",
"logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Factivity",
"operation": {
"first": true,
"id": "operations/build/example-project-id/ZDMwMTg4MDctOGMxYy00N2Y3LTgyNWMtYTVmY2M5NjM3ODBm",
"producer": "cloudbuild.googleapis.com"
},
"protoPayload": {
"@type": "type.googleapis.com/google.cloud.audit.AuditLog",
"authenticationInfo": {
"oauthInfo": {
"oauthClientId": "32555940559.apps.googleusercontent.com"
},
"principalEmail": "user@example.com",
"principalSubject": "user:user@example.com"
},
"authorizationInfo": [
{
"granted": true,
"permission": "cloudbuild.builds.create",
"permissionType": "ADMIN_WRITE",
"resource": "projects/example-project-id",
"resourceAttributes": {
"name": "projects//locations/global/builds",
"service": "cloudbuild.googleapis.com",
"type": "cloudbuild.googleapis.com/Build"
}
}
],
"methodName": "google.devtools.cloudbuild.v1.CloudBuild.CreateBuild",
"request": {
"@type": "type.googleapis.com/google.devtools.cloudbuild.v1.CreateBuildRequest",
"build": {},
"parent": "projects/example-project-id/locations/global"
},
"requestMetadata": {
"callerIp": "203.0.113.10",
"callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.builds.submit invocation-id/1fec36ef8af0493f94d1926f9be985a8 environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/True python/3.14.5 term/tmux-256color (Linux 6.1.0-41-amd64),gzip(gfe),gzip(gfe)",
"destinationAttributes": {},
"requestAttributes": {
"auth": {},
"time": "2026-06-29T16:29:53.696583Z"
}
},
"resourceLocation": {
"currentLocations": [
"global"
]
},
"resourceName": "projects/example-project-id/builds",
"serviceName": "cloudbuild.googleapis.com",
"status": {}
},
"receiveTimestamp": "2026-06-29T16:29:53.768565347Z",
"resource": {
"labels": {
"build_id": "d3018807-8c1c-47f7-825c-a5fcc963780f",
"build_trigger_id": "",
"project_id": "example-project-id"
},
"type": "build"
},
"severity": "NOTICE",
"timestamp": "2026-06-29T16:29:48.557352Z"
}
Common Indicators #
Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.
| Field | Kind | Value | Rules | Vendors |
|---|---|---|---|---|
protoPayload.authorizationInfo (panther rule field) | is_not_null | | 1 rule | panther |
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Panther #
T1548
google.devtools.cloudbuild.CloudBuild.CreateBuildTrigger: CreateBuildTrigger
#google.devtools.cloudbuild.CloudBuild.CreateWorkerPool: CreateWorkerPool
#google.devtools.cloudbuild.CloudBuild.DeleteBuildTrigger: DeleteBuildTrigger
#google.devtools.cloudbuild.CloudBuild.DeleteWorkerPool: DeleteWorkerPool
#google.devtools.cloudbuild.CloudBuild.GetBuild: GetBuild
#Data Access audit logs are disabled by default.
google.devtools.cloudbuild.CloudBuild.GetBuildTrigger: GetBuildTrigger
#Data Access audit logs are disabled by default.
google.devtools.cloudbuild.CloudBuild.GetDefaultServiceAccount: GetDefaultServiceAccount
#Data Access audit logs are disabled by default.
google.devtools.cloudbuild.CloudBuild.GetWorkerPool: GetWorkerPool
#Data Access audit logs are disabled by default.
google.devtools.cloudbuild.CloudBuild.ListBuildTriggers: ListBuildTriggers
#Data Access audit logs are disabled by default.
google.devtools.cloudbuild.CloudBuild.ListBuilds: ListBuilds
#Data Access audit logs are disabled by default.Example Audit Log Entry #
{
"insertId": "b527drdogi4",
"logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Fdata_access",
"protoPayload": {
"@type": "type.googleapis.com/google.cloud.audit.AuditLog",
"authenticationInfo": {
"oauthInfo": {
"oauthClientId": "32555940559.apps.googleusercontent.com"
},
"principalEmail": "user@example.com",
"principalSubject": "user:user@example.com"
},
"authorizationInfo": [
{
"granted": true,
"permission": "cloudbuild.builds.list",
"permissionType": "ADMIN_READ",
"resource": "projects/example-project-id",
"resourceAttributes": {}
}
],
"methodName": "google.devtools.cloudbuild.v1.CloudBuild.ListBuilds",
"request": {
"@type": "type.googleapis.com/google.devtools.cloudbuild.v1.ListBuildsRequest",
"parent": "projects/example-project-id/locations/global"
},
"requestMetadata": {
"callerIp": "203.0.113.10",
"callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.builds.list invocation-id/a04c798afc944ad698470171b30bbcef environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/True python/3.14.5 term/tmux-256color (Linux 6.1.0-41-amd64),gzip(gfe),gzip(gfe)",
"destinationAttributes": {},
"requestAttributes": {
"auth": {},
"time": "2026-06-29T13:18:07.600870Z"
}
},
"resourceLocation": {
"currentLocations": [
"global"
]
},
"resourceName": "projects/example-project-id/builds",
"serviceName": "cloudbuild.googleapis.com",
"status": {}
},
"receiveTimestamp": "2026-06-29T13:18:08.576503263Z",
"resource": {
"labels": {
"build_id": "",
"build_trigger_id": "",
"project_id": "example-project-id"
},
"type": "build"
},
"severity": "INFO",
"timestamp": "2026-06-29T13:18:07.435153Z"
}
google.devtools.cloudbuild.CloudBuild.ListWorkerPools: ListWorkerPools
#Data Access audit logs are disabled by default.