detection.wiki

Cloud Logging

methodNameDescriptionLog typeSampleRule
anyCatch-all entry for logging.googleapis.com. Source-only rules that attribute to the service without a specific method attribute here. Not a distinct audit log operation.activityNY
google.logging.ConfigServiceV2.CreateSinkCreates a sink that exports specified log entries to a destination.activityYN
google.logging.ConfigServiceV2.DeleteSinkDeletes a sink.activityYY
google.logging.ConfigServiceV2.DeleteBucketDeletes a log bucket.activityYY
google.logging.ConfigServiceV2.CreateExclusionCreates a new exclusion in a specified parent resource.activityNN
google.logging.ConfigServiceV2.UpdateExclusionChanges one or more properties of an existing exclusion in the _Default sink.activityNN
google.logging.ConfigServiceV2.DeleteExclusionDeletes an exclusion in the _Default sink.activityNN
google.logging.ConfigServiceV2.UpdateBucketUpdates a log bucket.activityYN
google.logging.ConfigServiceV2.UpdateSinkUpdates a sink.activityYY
google.logging.ConfigServiceV2.UpdateSettingsUpdates the settings for the given resource.activityNN
google.logging.ConfigServiceV2.CreateBucketCreate a Cloud Logging log bucket.activityYN
google.logging.ConfigServiceV2.CreateViewCreate a Cloud Logging log view.activityYN
google.logging.ConfigServiceV2.ListBucketsList Cloud Logging log buckets.data_accessYN
google.logging.ConfigServiceV2.ListSinksList Cloud Logging sinks.data_accessYN
google.logging.LoggingServiceV2.ListLogEntriesRead log entries via the Cloud Logging API.data_accessYN
google.logging.MetricsServiceV2.CreateLogMetricCreate a logs-based metric.activityYN
google.logging.MetricsServiceV2.DeleteLogMetricDelete a logs-based metric.activityYN
google.logging.MetricsServiceV2.ListLogMetricsList logs-based metrics.data_accessYN

any: logging.googleapis.com (any method)

#
ServiceName
logging.googleapis.com

Description

Catch-all entry for logging.googleapis.com. Source-only rules that attribute to the service without a specific method attribute here. Not a distinct audit log operation.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Panther #

google.logging.ConfigServiceV2.CreateSink: Create log sink

#
ServiceName
logging.googleapis.com

Description

Creates a sink that exports specified log entries to a destination.

Example Audit Log Entry #

{
  "insertId": "1i50ppncltt",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Factivity",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "logging.sinks.create",
        "permissionType": "ADMIN_WRITE",
        "resource": "projects/example-project-id/sinks/dwgen-dw739065",
        "resourceAttributes": {
          "name": "projects/example-project-id/sinks/dwgen-dw739065",
          "service": "logging.googleapis.com",
          "type": "logging.googleapis.com/LogSink"
        }
      }
    ],
    "methodName": "google.logging.v2.ConfigServiceV2.CreateSink",
    "request": {
      "@type": "type.googleapis.com/google.logging.v2.CreateSinkRequest",
      "parent": "projects/example-project-id",
      "sink": {
        "destination": "storage.googleapis.com/dwgen-dw739065",
        "filter": "severity>=ERROR",
        "name": "dwgen-dw739065"
      },
      "uniqueWriterIdentity": true
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.logging.sinks.create invocation-id/27e74ead4e7f400e9f17ef0327f51a0c environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/True python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T13:20:07.836815549Z"
      }
    },
    "resourceName": "projects/example-project-id/sinks/dwgen-dw739065",
    "serviceName": "logging.googleapis.com",
    "status": {}
  },
  "receiveTimestamp": "2026-06-29T13:20:12.299817244Z",
  "resource": {
    "labels": {
      "destination": "",
      "name": "dwgen-dw739065",
      "project_id": "example-project-id"
    },
    "type": "logging_sink"
  },
  "severity": "NOTICE",
  "timestamp": "2026-06-29T13:20:07.826651798Z"
}

google.logging.ConfigServiceV2.DeleteSink: Delete log sink

#
ServiceName
logging.googleapis.com

Description

Deletes a sink.

Example Audit Log Entry #

{
  "insertId": "1rjzzkfd4sdn",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Factivity",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "logging.sinks.delete",
        "permissionType": "ADMIN_WRITE",
        "resource": "projects/example-project-id/sinks/dwsink7201353",
        "resourceAttributes": {
          "name": "projects/example-project-id/sinks/dwsink7201353",
          "service": "logging.googleapis.com",
          "type": "logging.googleapis.com/LogSink"
        }
      }
    ],
    "methodName": "google.logging.v2.ConfigServiceV2.DeleteSink",
    "request": {
      "@type": "type.googleapis.com/google.logging.v2.DeleteSinkRequest",
      "sinkName": "projects/example-project-id/sinks/dwsink7201353"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.logging.sinks.delete invocation-id/034ed480292e403c8528736e23c6f543 environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/True python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T16:25:31.933379185Z"
      }
    },
    "resourceName": "projects/example-project-id/sinks/dwsink7201353",
    "serviceName": "logging.googleapis.com",
    "status": {}
  },
  "receiveTimestamp": "2026-06-29T16:25:33.518552052Z",
  "resource": {
    "labels": {
      "destination": "",
      "name": "dwsink7201353",
      "project_id": "example-project-id"
    },
    "type": "logging_sink"
  },
  "severity": "NOTICE",
  "timestamp": "2026-06-29T16:25:31.922737118Z"
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

  • GCP Logging Sink Deletion source medium: Identifies a Logging sink deletion in Google Cloud Platform (GCP). Every time a log entry arrives, Logging compares the log entry to the sinks in that resource. Each sink whose filter matches the log entry writes a copy of the log entry to the sink's export destination. An adversary may delete a Logging sink to evade detection.T1562, T1562.008

google.logging.ConfigServiceV2.DeleteBucket: Delete log bucket

#
ServiceName
logging.googleapis.com

Description

Deletes a log bucket.

Example Audit Log Entry #

{
  "insertId": "fjyhzfd62yj",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Factivity",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "logging.buckets.delete",
        "permissionType": "ADMIN_WRITE",
        "resource": "projects/example-project-id/locations/global/buckets/dwb-dw746783",
        "resourceAttributes": {
          "name": "projects/example-project-id/locations/global/buckets/dwb-dw746783",
          "service": "logging.googleapis.com",
          "type": "logging.googleapis.com/LogBucket"
        }
      }
    ],
    "methodName": "google.logging.v2.ConfigServiceV2.DeleteBucket",
    "request": {
      "@type": "type.googleapis.com/google.logging.v2.DeleteBucketRequest",
      "name": "projects/example-project-id/locations/global/buckets/dwb-dw746783"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.logging.buckets.delete invocation-id/30d3dc897a5540e7959949945c69972f environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/False python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T15:32:07.843155601Z"
      }
    },
    "resourceName": "projects/example-project-id/locations/global/buckets/dwb-dw746783",
    "serviceName": "logging.googleapis.com",
    "status": {}
  },
  "receiveTimestamp": "2026-06-29T15:32:09.410652037Z",
  "resource": {
    "labels": {
      "method": "google.logging.v2.ConfigServiceV2.DeleteBucket",
      "project_id": "example-project-id",
      "service": "logging.googleapis.com"
    },
    "type": "audited_resource"
  },
  "severity": "NOTICE",
  "timestamp": "2026-06-29T15:32:07.833747571Z"
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

  • GCP Logging Bucket Deletion source medium: Identifies a Logging bucket deletion in Google Cloud Platform (GCP). Log buckets are containers that store and organize log data. A deleted bucket stays in a pending state for 7 days, and Logging continues to route logs to the bucket during that time. To stop routing logs to a deleted bucket, you can delete the log sinks that have the bucket as their destination, or modify the filter for the sinks to stop it from routing logs to the deleted bucket. An adversary may delete a log bucket to evade detection.T1562, T1562.008

google.logging.ConfigServiceV2.CreateExclusion: Create log exclusion

#
ServiceName
logging.googleapis.com

Description

Creates a new exclusion in a specified parent resource.

google.logging.ConfigServiceV2.UpdateExclusion: Update log exclusion

#
ServiceName
logging.googleapis.com

Description

Changes one or more properties of an existing exclusion in the _Default sink.

google.logging.ConfigServiceV2.DeleteExclusion: Delete log exclusion

#
ServiceName
logging.googleapis.com

Description

Deletes an exclusion in the _Default sink.

google.logging.ConfigServiceV2.UpdateBucket: Update log bucket

#
ServiceName
logging.googleapis.com

Description

Updates a log bucket.

Example Audit Log Entry #

{
  "insertId": "1xxv3wmd2lv6",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Factivity",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "logging.buckets.update",
        "permissionType": "ADMIN_WRITE",
        "resource": "projects/example-project-id/locations/global/buckets/dwb-dw746783",
        "resourceAttributes": {
          "name": "projects/example-project-id/locations/global/buckets/dwb-dw746783",
          "service": "logging.googleapis.com",
          "type": "logging.googleapis.com/LogBucket"
        }
      },
      {
        "granted": true,
        "permission": "logging.buckets.update",
        "permissionType": "ADMIN_WRITE",
        "resource": "projects/example-project-id/locations/global/buckets/dwb-dw746783",
        "resourceAttributes": {
          "name": "projects/example-project-id/locations/global/buckets/dwb-dw746783",
          "service": "logging.googleapis.com",
          "type": "logging.googleapis.com/LogBucket"
        }
      }
    ],
    "methodName": "google.logging.v2.ConfigServiceV2.UpdateBucket",
    "request": {
      "@type": "type.googleapis.com/google.logging.v2.UpdateBucketRequest",
      "bucket": {
        "description": "dw upd"
      },
      "name": "projects/example-project-id/locations/global/buckets/dwb-dw746783",
      "updateMask": "description"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.logging.buckets.update invocation-id/96c274108b08449db47d748c54100a0a environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/True python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T15:26:48.408139724Z"
      }
    },
    "resourceName": "projects/example-project-id/locations/global/buckets/dwb-dw746783",
    "serviceName": "logging.googleapis.com",
    "status": {}
  },
  "receiveTimestamp": "2026-06-29T15:26:49.198817906Z",
  "resource": {
    "labels": {
      "method": "google.logging.v2.ConfigServiceV2.UpdateBucket",
      "project_id": "example-project-id",
      "service": "logging.googleapis.com"
    },
    "type": "audited_resource"
  },
  "severity": "NOTICE",
  "timestamp": "2026-06-29T15:26:48.396582046Z"
}

google.logging.ConfigServiceV2.UpdateSink: Update log sink

#
ServiceName
logging.googleapis.com

Description

Updates a sink.

Example Audit Log Entry #

{
  "insertId": "1rjzzkfd4lan",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Factivity",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "logging.sinks.update",
        "permissionType": "ADMIN_WRITE",
        "resource": "projects/example-project-id/sinks/dwsink-dw743447",
        "resourceAttributes": {
          "name": "projects/example-project-id/sinks/dwsink-dw743447",
          "service": "logging.googleapis.com",
          "type": "logging.googleapis.com/LogSink"
        }
      }
    ],
    "methodName": "google.logging.v2.ConfigServiceV2.UpdateSink",
    "request": {
      "@type": "type.googleapis.com/google.logging.v2.UpdateSinkRequest",
      "sink": {
        "filter": "severity>=WARNING",
        "name": "dwsink-dw743447"
      },
      "sinkName": "projects/example-project-id/sinks/dwsink-dw743447",
      "uniqueWriterIdentity": true,
      "updateMask": "filter"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.logging.sinks.update invocation-id/a2ff5f7fff404c338161bc93f852427c environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/True python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T14:34:12.971113033Z"
      }
    },
    "resourceName": "projects/example-project-id/sinks/dwsink-dw743447",
    "serviceName": "logging.googleapis.com",
    "status": {}
  },
  "receiveTimestamp": "2026-06-29T14:34:13.984353809Z",
  "resource": {
    "labels": {
      "destination": "",
      "name": "dwsink-dw743447",
      "project_id": "example-project-id"
    },
    "type": "logging_sink"
  },
  "severity": "NOTICE",
  "timestamp": "2026-06-29T14:34:12.960251286Z"
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

  • GCP Logging Sink Modification source low: Identifies a modification to a Logging sink in Google Cloud Platform (GCP). Logging compares the log entry to the sinks in that resource. Each sink whose filter matches the log entry writes a copy of the log entry to the sink's export destination. An adversary may update a Logging sink to exfiltrate logs to a different export destination.T1537, T1562, T1562.008

google.logging.ConfigServiceV2.UpdateSettings: Update logging settings

#
ServiceName
logging.googleapis.com

Description

Updates the settings for the given resource.

google.logging.ConfigServiceV2.CreateBucket: CreateBucket

#
ServiceName
logging.googleapis.com

Description

Create a Cloud Logging log bucket.

Example Audit Log Entry #

{
  "insertId": "1i50ppnd126p",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Factivity",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "logging.buckets.create",
        "permissionType": "ADMIN_WRITE",
        "resource": "projects/example-project-id/locations/global/buckets/dwb-dw746783",
        "resourceAttributes": {
          "name": "projects/example-project-id/locations/global/buckets/dwb-dw746783",
          "service": "logging.googleapis.com",
          "type": "logging.googleapis.com/LogBucket"
        }
      }
    ],
    "methodName": "google.logging.v2.ConfigServiceV2.CreateBucket",
    "request": {
      "@type": "type.googleapis.com/google.logging.v2.CreateBucketRequest",
      "bucket": {
        "description": "dw"
      },
      "bucketId": "dwb-dw746783",
      "parent": "projects/example-project-id/locations/global"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.logging.buckets.create invocation-id/3f423a07a15f42b6afce1bf78e5362e2 environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/True python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T15:26:46.960207235Z"
      }
    },
    "resourceName": "projects/example-project-id/locations/global/buckets/dwb-dw746783",
    "serviceName": "logging.googleapis.com",
    "status": {}
  },
  "receiveTimestamp": "2026-06-29T15:26:47.795359547Z",
  "resource": {
    "labels": {
      "method": "google.logging.v2.ConfigServiceV2.CreateBucket",
      "project_id": "example-project-id",
      "service": "logging.googleapis.com"
    },
    "type": "audited_resource"
  },
  "severity": "NOTICE",
  "timestamp": "2026-06-29T15:26:46.951192951Z"
}

google.logging.ConfigServiceV2.CreateView: CreateView

#
ServiceName
logging.googleapis.com

Description

Create a Cloud Logging log view.

Example Audit Log Entry #

{
  "insertId": "29qv21cvw0",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Factivity",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "logging.views.create",
        "permissionType": "ADMIN_WRITE",
        "resource": "projects/example-project-id/locations/global/buckets/dwb-dw746783/views/dwv-dw746783",
        "resourceAttributes": {
          "name": "projects/example-project-id/locations/global/buckets/dwb-dw746783/views/dwv-dw746783",
          "service": "logging.googleapis.com",
          "type": "logging.googleapis.com/LogView"
        }
      }
    ],
    "methodName": "google.logging.v2.ConfigServiceV2.CreateView",
    "request": {
      "@type": "type.googleapis.com/google.logging.v2.CreateViewRequest",
      "parent": "projects/example-project-id/locations/global/buckets/dwb-dw746783",
      "view": {
        "filter": "severity>=WARNING"
      },
      "viewId": "dwv-dw746783"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.logging.views.create invocation-id/bca8c950a3f5466dbd3f62afe1cf65fa environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/True python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T15:26:49.756774332Z"
      }
    },
    "resourceName": "projects/example-project-id/locations/global/buckets/dwb-dw746783/views/dwv-dw746783",
    "serviceName": "logging.googleapis.com",
    "status": {
      "code": 3,
      "message": "Invalid view filter. View filters may only contain restrictions on log source, valid resource types, apphub fields, user-defined labels, or log ID"
    }
  },
  "receiveTimestamp": "2026-06-29T15:26:50.781341377Z",
  "resource": {
    "labels": {
      "method": "google.logging.v2.ConfigServiceV2.CreateView",
      "project_id": "example-project-id",
      "service": "logging.googleapis.com"
    },
    "type": "audited_resource"
  },
  "severity": "ERROR",
  "timestamp": "2026-06-29T15:26:49.744943473Z"
}

google.logging.ConfigServiceV2.ListBuckets: ListBuckets

#
ServiceName
logging.googleapis.com

Description

List Cloud Logging log buckets.

Data Access audit logs are disabled by default.

Example Audit Log Entry #

{
  "insertId": "1i50ppnclmf",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Fdata_access",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "logging.buckets.list",
        "permissionType": "ADMIN_READ",
        "resource": "projects/example-project-id/locations/global",
        "resourceAttributes": {
          "name": "projects/example-project-id/locations/global",
          "service": "logging.googleapis.com",
          "type": "logging.googleapis.com/Location"
        }
      }
    ],
    "methodName": "google.logging.v2.ConfigServiceV2.ListBuckets",
    "request": {
      "@type": "type.googleapis.com/google.logging.v2.ListBucketsRequest",
      "parent": "projects/example-project-id/locations/global"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.logging.buckets.list invocation-id/cffc405ec1ff4c648bcdda84d51fc32e environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/True python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T13:18:00.958763393Z"
      }
    },
    "resourceName": "projects/example-project-id/locations/global",
    "serviceName": "logging.googleapis.com",
    "status": {}
  },
  "receiveTimestamp": "2026-06-29T13:18:02.170924671Z",
  "resource": {
    "labels": {
      "method": "google.logging.v2.ConfigServiceV2.ListBuckets",
      "project_id": "example-project-id",
      "service": "logging.googleapis.com"
    },
    "type": "audited_resource"
  },
  "severity": "INFO",
  "timestamp": "2026-06-29T13:18:00.946362736Z"
}

google.logging.ConfigServiceV2.ListSinks: ListSinks

#
ServiceName
logging.googleapis.com

Description

List Cloud Logging sinks.

Data Access audit logs are disabled by default.

Example Audit Log Entry #

{
  "insertId": "1i50ppnclmc",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Fdata_access",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "logging.sinks.list",
        "permissionType": "ADMIN_READ",
        "resource": "projects/example-project-id",
        "resourceAttributes": {
          "name": "projects/example-project-id",
          "service": "logging.googleapis.com",
          "type": "cloudresourcemanager.googleapis.com/Project"
        }
      }
    ],
    "methodName": "google.logging.v2.ConfigServiceV2.ListSinks",
    "request": {
      "@type": "type.googleapis.com/google.logging.v2.ListSinksRequest",
      "parent": "projects/example-project-id"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.logging.sinks.list invocation-id/2b2a9c2b33ef49b8b213b8579dc76f1c environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/True python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T13:18:00.003957037Z"
      }
    },
    "resourceName": "projects/example-project-id",
    "serviceName": "logging.googleapis.com",
    "status": {}
  },
  "receiveTimestamp": "2026-06-29T13:18:01.177266277Z",
  "resource": {
    "labels": {
      "destination": "",
      "name": "",
      "project_id": "example-project-id"
    },
    "type": "logging_sink"
  },
  "severity": "INFO",
  "timestamp": "2026-06-29T13:17:59.993082329Z"
}

google.logging.LoggingServiceV2.ListLogEntries: ListLogEntries

#
ServiceName
logging.googleapis.com

Description

Read log entries via the Cloud Logging API.

Data Access audit logs are disabled by default.

Example Audit Log Entry #

{
  "insertId": "11gkrxte1wvo8",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Fdata_access",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "logging.privateLogEntries.list",
        "permissionType": "DATA_READ",
        "resource": "projects/example-project-id",
        "resourceAttributes": {
          "name": "projects/example-project-id",
          "service": "logging.googleapis.com",
          "type": "cloudresourcemanager.googleapis.com/Project"
        }
      },
      {
        "granted": true,
        "permission": "logging.logEntries.list",
        "permissionType": "DATA_READ",
        "resource": "projects/example-project-id",
        "resourceAttributes": {
          "name": "projects/example-project-id",
          "service": "logging.googleapis.com",
          "type": "cloudresourcemanager.googleapis.com/Project"
        }
      }
    ],
    "methodName": "google.logging.v2.LoggingServiceV2.ListLogEntries",
    "request": {
      "@type": "type.googleapis.com/google.logging.v2.ListLogEntriesRequest",
      "filter": "timestamp>=\"2026-06-29T14:30:07Z\" AND log_id(\"cloudaudit.googleapis.com/activity\")",
      "orderBy": "timestamp desc",
      "pageSize": 1000,
      "pageToken": "eq0HCqgHAZdMAV73DFNmGQXljmq_FkJwgHiNJmYhrWrv_ZlQ7ad7IfPQ7LzIefAPMRkCf6TxvbV0Y6s9U2FdS7roB7PUuqcIkHip2kW9ysAU3Gk8Vgv13fvB6leoOWM-EXR7Hm9imT6cdvAy7N5nrsnYobf6tZ0vnavfGrcoQBX_WBC0ERR8lDXVj9wVbTGFNlHiQ1yVPCrRE4khQWs6b1UQzOL2khwqQ1sTjJYHhsuC48zhMMBSjrgFhfM0xAhZpTQ-y-BkhLU_S_N13EvTzjlA9FQt4itoAcm88JCYWinWUsx3En3qgRC4Qgylg3uRaOkWGOlXSZWUrShX05xh-2YY_isfpcs--PP9G81poXud_vp6HX5Ki3q4czYWtWRTuBHuXJvcha2aGtK9DSQQwoVUhFOQ8iL5HlnfFM71qjCTHbiQKshEtaCz_E_iYg84zmwL72vRtdBi6oS7suQejcxmHdhwCQz3NQX7aRgm_Eile1m2oQDAU1ckKVYxYh05KLZkEjYMfPpy6EBLy7mPgm9JxmsdcCq6bdDA7lszqZ6WTEMye52Ghv80o98cFJ5ZvFnyGNtPnu7JQlWZ-zGdwtx9EztCQ2kjRBPJt34l6ACr-NAhaN0fRVRppOlAn6P8nb6BrdUrwywCy9EAXHhidph55qHhoxmYf-AIQIqYqdJcHoq41fIH-rD2dh0uZK_8DyFr5Js1--_vthgq6NVzuI1oM0k8COn6ZpaSqUvMLze3MhtkM1YQTTgYIwKxIyQkQJgdeYLxjkovNgVuqgbd6PB27vf9tTlUqu6mItPNpRvM-e34KzKhLXQylL4r-6VqD1tfFCF4dlNwr8AjDDMSBcPiDVTKKubMsyruuYrYVlnnA_GBdYsASDR_2CByxZGrDeiIrl0zjv69MO1tdeaFwvd8dFLwc8H6TIk2pmfiAV15T0T64ZSlYyNCWz3XqvWkF9zgLbV1IB5Fo463jzDW5S00wlkPXJffdXD8UxwE3aZr14XMsssnRycMjD7ZvXa7N9lup6I7TwL0mWJda_VtfHCdFAZ7vwzMqiVQN2-SqTHIE7YUPjJjIEqlzkHB7q0QdQMKl7oTsMs6N-jgeK-kxovW9m3_TTzEZRaq2ocoQ9w9mQuW-NgdPw53WLcqvcqBzAdgU-nL_DDokhcQHIfUCMbCZa1eb2-ovzmc9_kDMf5neMwk6WDjJHaBFHUOU_MkVASpTl2Xlc2q9D4aZ9zhXbKcJeCkXJCZOj9PKtqPEAE",
      "resourceNames": [
        "projects/example-project-id"
      ]
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.logging.read invocation-id/7568be0876cc48c0839c853eae7960f3 environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/False python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T14:53:54.760462068Z"
      }
    },
    "resourceName": "projects/example-project-id",
    "serviceName": "logging.googleapis.com",
    "status": {}
  },
  "receiveTimestamp": "2026-06-29T14:53:56.514796095Z",
  "resource": {
    "labels": {
      "name": "",
      "project_id": "example-project-id"
    },
    "type": "logging_log"
  },
  "severity": "INFO",
  "timestamp": "2026-06-29T14:53:54.754634121Z"
}

google.logging.MetricsServiceV2.CreateLogMetric: CreateLogMetric

#
ServiceName
logging.googleapis.com

Description

Create a logs-based metric.

Example Audit Log Entry #

{
  "insertId": "hrhlo9d6b4w",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Factivity",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "logging.logMetrics.create",
        "permissionType": "ADMIN_WRITE",
        "resource": "projects/example-project-id/metrics/dwm-dw746783",
        "resourceAttributes": {
          "name": "projects/example-project-id/metrics/dwm-dw746783",
          "service": "logging.googleapis.com",
          "type": "logging.googleapis.com/LogMetric"
        }
      }
    ],
    "methodName": "google.logging.v2.MetricsServiceV2.CreateLogMetric",
    "request": {
      "@type": "type.googleapis.com/google.logging.v2.CreateLogMetricRequest",
      "metric": {
        "description": "dw",
        "filter": "severity>=ERROR",
        "name": "dwm-dw746783"
      },
      "parent": "projects/example-project-id"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.logging.metrics.create invocation-id/8d56b3c335a140b687b9835383b1aeb4 environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/True python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T15:26:45.398466768Z"
      }
    },
    "resourceName": "projects/example-project-id/metrics/dwm-dw746783",
    "serviceName": "logging.googleapis.com",
    "status": {}
  },
  "receiveTimestamp": "2026-06-29T15:26:46.394410827Z",
  "resource": {
    "labels": {
      "name": "logging.googleapis.com/user/dwm-dw746783",
      "project_id": "example-project-id"
    },
    "type": "metric"
  },
  "severity": "NOTICE",
  "timestamp": "2026-06-29T15:26:45.385321034Z"
}

google.logging.MetricsServiceV2.DeleteLogMetric: DeleteLogMetric

#
ServiceName
logging.googleapis.com

Description

Delete a logs-based metric.

Example Audit Log Entry #

{
  "insertId": "1i50ppnd12rt",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Factivity",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "logging.logMetrics.delete",
        "permissionType": "ADMIN_WRITE",
        "resource": "projects/example-project-id/metrics/dwm-dw746783",
        "resourceAttributes": {
          "name": "projects/example-project-id/metrics/dwm-dw746783",
          "service": "logging.googleapis.com",
          "type": "logging.googleapis.com/LogMetric"
        }
      }
    ],
    "methodName": "google.logging.v2.MetricsServiceV2.DeleteLogMetric",
    "request": {
      "@type": "type.googleapis.com/google.logging.v2.DeleteLogMetricRequest",
      "metricName": "projects/example-project-id/metrics/dwm-dw746783"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.logging.metrics.delete invocation-id/49f56d84306942558e4bb16651d6c348 environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/False python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T15:32:09.250971846Z"
      }
    },
    "resourceName": "projects/example-project-id/metrics/dwm-dw746783",
    "serviceName": "logging.googleapis.com",
    "status": {}
  },
  "receiveTimestamp": "2026-06-29T15:32:11.114849173Z",
  "resource": {
    "labels": {
      "name": "logging.googleapis.com/user/dwm-dw746783",
      "project_id": "example-project-id"
    },
    "type": "metric"
  },
  "severity": "NOTICE",
  "timestamp": "2026-06-29T15:32:09.240881800Z"
}

google.logging.MetricsServiceV2.ListLogMetrics: ListLogMetrics

#
ServiceName
logging.googleapis.com

Description

List logs-based metrics.

Data Access audit logs are disabled by default.

Example Audit Log Entry #

{
  "insertId": "1xxv3wmd2mes",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Fdata_access",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "logging.logMetrics.list",
        "permissionType": "ADMIN_READ",
        "resource": "projects/example-project-id",
        "resourceAttributes": {
          "name": "projects/example-project-id",
          "service": "logging.googleapis.com",
          "type": "cloudresourcemanager.googleapis.com/Project"
        }
      }
    ],
    "methodName": "google.logging.v2.MetricsServiceV2.ListLogMetrics",
    "request": {
      "@type": "type.googleapis.com/google.logging.v2.ListLogMetricsRequest",
      "parent": "projects/example-project-id"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.logging.metrics.list invocation-id/bd02107703af4fd383df93efa704255c environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/True python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T15:38:34.890423682Z"
      }
    },
    "resourceName": "projects/example-project-id",
    "serviceName": "logging.googleapis.com",
    "status": {}
  },
  "receiveTimestamp": "2026-06-29T15:38:35.280351579Z",
  "resource": {
    "labels": {
      "name": "",
      "project_id": "example-project-id"
    },
    "type": "metric"
  },
  "severity": "INFO",
  "timestamp": "2026-06-29T15:38:34.879081210Z"
}