Organization Policy
| methodName | Description | Log type | Sample | Rule |
|---|---|---|---|---|
| google. | Creates a Policy. | activity | Y | N |
| google. | Deletes a Policy. | activity | Y | Y |
| google. | Updates a Policy. | activity | N | Y |
google.cloud.orgpolicy.OrgPolicy.CreatePolicy: Create org policy
#Description
Creates a Policy.
Example Audit Log Entry #
{
"insertId": "19acbsfe4j04q",
"logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Factivity",
"protoPayload": {
"@type": "type.googleapis.com/google.cloud.audit.AuditLog",
"authenticationInfo": {
"oauthInfo": {
"oauthClientId": "32555940559.apps.googleusercontent.com"
},
"principalEmail": "user@example.com",
"principalSubject": "user:user@example.com"
},
"authorizationInfo": [
{
"granted": false,
"permission": "orgpolicy.policies.create",
"permissionType": "ADMIN_WRITE",
"resource": "projects/example-project-id",
"resourceAttributes": {}
}
],
"methodName": "google.cloud.orgpolicy.v2.OrgPolicy.CreatePolicy",
"request": {
"@type": "type.googleapis.com/google.cloud.orgpolicy.v2.CreatePolicyRequest",
"parent": "projects/example-project-id",
"policy": {
"name": "projects/example-project-id/policies/compute.disableSerialPortAccess",
"spec": {
"rules": [
{
"enforce": true
}
]
}
}
},
"requestMetadata": {
"callerIp": "203.0.113.10",
"callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.org-policies.set-policy invocation-id/14dd94dae2a546bfb0063fd9bc51b13c environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/False python/3.14.5 term/tmux-256color (Linux 6.1.0-41-amd64),gzip(gfe)",
"destinationAttributes": {},
"requestAttributes": {
"auth": {},
"time": "2026-06-29T16:25:51.815850142Z"
}
},
"resourceName": "projects/example-project-id",
"serviceName": "orgpolicy.googleapis.com",
"status": {
"code": 7,
"details": [
{
"@type": "type.googleapis.com/google.rpc.ErrorInfo",
"domain": "cloudresourcemanager.googleapis.com",
"reason": "IAM_PERMISSION_DENIED"
}
],
"message": "Permission 'orgpolicy.policies.create' denied on resource '//cloudresourcemanager.googleapis.com/projects/example-project-id' (or it may not exist)."
}
},
"receiveTimestamp": "2026-06-29T16:25:52.338198265Z",
"resource": {
"labels": {
"method": "google.cloud.orgpolicy.v2.OrgPolicy.CreatePolicy",
"project_id": "example-project-id",
"service": "orgpolicy.googleapis.com"
},
"type": "audited_resource"
},
"severity": "ERROR",
"timestamp": "2026-06-29T16:25:51.736936043Z"
}
google.cloud.orgpolicy.OrgPolicy.DeletePolicy: Delete org policy
#Description
Deletes a Policy.
Detection Fields #
Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete schema for this catalog entry.
| Name | Rules | Vendors |
|---|---|---|
metadata.log_type | 1 detection rule | YARA-L |
security_result.action | 1 detection rule | YARA-L |
target.application | 1 detection rule | YARA-L |
Example Audit Log Entry #
{
"insertId": "18eq8cpe252z2",
"logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Factivity",
"protoPayload": {
"@type": "type.googleapis.com/google.cloud.audit.AuditLog",
"authenticationInfo": {
"oauthInfo": {
"oauthClientId": "32555940559.apps.googleusercontent.com"
},
"principalEmail": "user@example.com",
"principalSubject": "user:user@example.com"
},
"authorizationInfo": [
{
"granted": false,
"permission": "orgpolicy.policies.delete",
"permissionType": "ADMIN_WRITE",
"resource": "projects/example-project-id/policies/compute.disableSerialPortAccess",
"resourceAttributes": {}
}
],
"methodName": "google.cloud.orgpolicy.v2.OrgPolicy.DeletePolicy",
"request": {
"@type": "type.googleapis.com/google.cloud.orgpolicy.v2.DeletePolicyRequest",
"name": "projects/example-project-id/policies/compute.disableSerialPortAccess"
},
"requestMetadata": {
"callerIp": "203.0.113.10",
"callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.org-policies.delete invocation-id/4a71d9a23a334d0e96baac922ebf5b5d environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/True python/3.14.5 term/tmux-256color (Linux 6.1.0-41-amd64),gzip(gfe)",
"destinationAttributes": {},
"requestAttributes": {
"auth": {},
"time": "2026-06-29T16:25:52.913186268Z"
}
},
"resourceName": "projects/example-project-id/policies/compute.disableSerialPortAccess",
"serviceName": "orgpolicy.googleapis.com",
"status": {
"code": 7,
"details": [
{
"@type": "type.googleapis.com/google.rpc.ErrorInfo",
"domain": "orgpolicy.googleapis.com",
"reason": "IAM_PERMISSION_DENIED"
}
],
"message": "Permission 'orgpolicy.policies.delete' denied on resource '//orgpolicy.googleapis.com/projects/example-project-id/policies/compute.disableSerialPortAccess' (or it may not exist)."
}
},
"receiveTimestamp": "2026-06-29T16:25:53.377191657Z",
"resource": {
"labels": {
"method": "google.cloud.orgpolicy.v2.OrgPolicy.DeletePolicy",
"project_id": "example-project-id",
"service": "orgpolicy.googleapis.com"
},
"type": "audited_resource"
},
"severity": "ERROR",
"timestamp": "2026-06-29T16:25:52.846813844Z"
}
Detection Rules #
Full rule details for this catalog entry, including ATT&CK technique mappings and native queries →YARA-L #
T1098↳ also matches google.cloud.orgpolicy.OrgPolicy.UpdatePolicy: Update org policy
google.cloud.orgpolicy.OrgPolicy.UpdatePolicy: Update org policy
#Description
Updates a Policy.
Detection Fields #
Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete schema for this catalog entry.
| Name | Rules | Vendors |
|---|---|---|
metadata.log_type | 1 detection rule | YARA-L |
security_result.action | 1 detection rule | YARA-L |
target.application | 1 detection rule | YARA-L |
Detection Rules #
Full rule details for this catalog entry, including ATT&CK technique mappings and native queries →YARA-L #
T1098↳ also matches google.cloud.orgpolicy.OrgPolicy.DeletePolicy: Delete org policy
any: orgpolicy.googleapis.com (any method)
#Scope grouping: This repository-authored catalog entry represents a broad attribution scope, not a distinct emitted event or operation. Any sample below is a representative record from that scope; attached rules, if any, are listed separately.
Description
Catch-all entry for orgpolicy.googleapis.com. Source-only rules that attribute to the service without a specific method attribute here. Not a distinct audit log operation.
Detection Fields #
Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete schema for this catalog entry.
| Name | Rules | Vendors |
|---|---|---|
method_name | 1 detection rule | Kusto |
ServiceName | 1 detection rule | Kusto |
Detection Rules #
Full rule details for this catalog entry, including ATT&CK technique mappings and native queries →Kusto #
T1562, T1562.001