Cloud Functions (Cloud Run functions)
| methodName | Description | Log type | Sample | Rule |
|---|---|---|---|---|
| any | Catch-all entry for cloudfunctions.googleapis.com. Source-only rules that attribute to the service without a specific method attribute here. Not a distinct audit log operation. | activity | N | Y |
| google. | Creates a Cloud Functions 1st gen function from source; gated by cloudfunctions.functions.create, a documented privilege-escalation path. | activity | N | N |
| google. | Updates a 1st gen function's code or configuration; gated by cloudfunctions.functions.update. | activity | N | N |
| google. | Deletes a 1st gen function. | activity | N | N |
| google. | Generates a signed URL to which function source code is uploaded before create or update. | activity | N | N |
| SetIamPolicy | Sets the IAM policy on a function; Google documents the bare method name as covering all API versions. | activity | N | N |
| google. | Reads a single 1st gen function's configuration. | data_access | N | N |
| google. | Lists 1st gen functions in a region and project. | data_access | N | N |
| GetIamPolicy | Reads the IAM policy on a function; Google documents the bare method name as covering all API versions. | data_access | N | N |
| google. | Generates a signed URL for downloading a function's deployed source archive. | data_access | N | N |
| google. | Synchronously invokes a function directly through the Cloud Functions admin API (DATA_READ); distinct from the function's own HTTP or event trigger, which Cloud Audit Logs do not cover. | data_access | N | N |
| google. | Creates a Cloud Functions 2nd gen (Cloud Run functions) function, provisioning an underlying Cloud Run service; gated by the same cloudfunctions.functions.create permission as 1st gen. | activity | N | N |
| google. | Updates a 2nd gen function's code, trigger, or configuration. | activity | N | N |
| google. | Deletes a 2nd gen function and its underlying Cloud Run service. | activity | N | N |
| google. | Reads a single 2nd gen function's configuration. | data_access | N | N |
| google. | Lists 2nd gen functions in a region and project. | data_access | N | N |
any: cloudfunctions.googleapis.com (any method)
#Description
Catch-all entry for cloudfunctions.googleapis.com. Source-only rules that attribute to the service without a specific method attribute here. Not a distinct audit log operation.
Common Indicators #
Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.
| Field | Kind | Value | Rules | Vendors |
|---|---|---|---|---|
protoPayload.authorizationInfo (panther rule field) | is_not_null | | 2 rules | panther |
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Panther #
T1548T1548
google.cloud.functions.CloudFunctionsService.CreateFunction: Create function (1st gen)
#Description
Creates a Cloud Functions 1st gen function from source; gated by cloudfunctions.functions.create, a documented privilege-escalation path.
google.cloud.functions.CloudFunctionsService.UpdateFunction: Update function (1st gen)
#Description
Updates a 1st gen function's code or configuration; gated by cloudfunctions.functions.update.
google.cloud.functions.CloudFunctionsService.DeleteFunction: Delete function (1st gen)
#Description
Deletes a 1st gen function.
google.cloud.functions.CloudFunctionsService.GenerateUploadUrl: Generate upload URL
#Description
Generates a signed URL to which function source code is uploaded before create or update.
SetIamPolicy: Set function IAM policy
#Description
Sets the IAM policy on a function; Google documents the bare method name as covering all API versions.
google.cloud.functions.CloudFunctionsService.GetFunction: Get function (1st gen)
#Description
Reads a single 1st gen function's configuration.
Data Access audit logs are disabled by default.
google.cloud.functions.CloudFunctionsService.ListFunctions: List functions (1st gen)
#Description
Lists 1st gen functions in a region and project.
Data Access audit logs are disabled by default.
GetIamPolicy: Get function IAM policy
#Description
Reads the IAM policy on a function; Google documents the bare method name as covering all API versions.
Data Access audit logs are disabled by default.
google.cloud.functions.CloudFunctionsService.GenerateDownloadUrl: Generate download URL
#Description
Generates a signed URL for downloading a function's deployed source archive.
Data Access audit logs are disabled by default.
google.cloud.functions.CloudFunctionsService.CallFunction: Call function
#Description
Synchronously invokes a function directly through the Cloud Functions admin API (DATA_READ); distinct from the function's own HTTP or event trigger, which Cloud Audit Logs do not cover.
Data Access audit logs are disabled by default.
google.cloud.functions.FunctionService.CreateFunction: Create function (2nd gen)
#Description
Creates a Cloud Functions 2nd gen (Cloud Run functions) function, provisioning an underlying Cloud Run service; gated by the same cloudfunctions.functions.create permission as 1st gen.
google.cloud.functions.FunctionService.UpdateFunction: Update function (2nd gen)
#Description
Updates a 2nd gen function's code, trigger, or configuration.
google.cloud.functions.FunctionService.DeleteFunction: Delete function (2nd gen)
#Description
Deletes a 2nd gen function and its underlying Cloud Run service.
google.cloud.functions.FunctionService.GetFunction: Get function (2nd gen)
#Description
Reads a single 2nd gen function's configuration.
Data Access audit logs are disabled by default.
google.cloud.functions.FunctionService.ListFunctions: List functions (2nd gen)
#Description
Lists 2nd gen functions in a region and project.
Data Access audit logs are disabled by default.