Organization Policy

methodName	Description	Log type	Sample	Rule
any	Catch-all entry for orgpolicy.googleapis.com. Source-only rules that attribute to the service without a specific method attribute here. Not a distinct audit log operation.	activity	N	Y
google.cloud.orgpolicy.OrgPolicy.CreatePolicy	Creates a Policy.	activity	Y	N
google.cloud.orgpolicy.OrgPolicy.DeletePolicy	Deletes a Policy.	activity	Y	Y
google.cloud.orgpolicy.OrgPolicy.UpdatePolicy	Updates a Policy.	activity	N	Y

any: orgpolicy.googleapis.com (any method)

ServiceName: orgpolicy.googleapis.com

Description

Catch-all entry for orgpolicy.googleapis.com. Source-only rules that attribute to the service without a specific method attribute here. Not a distinct audit log operation.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Kusto #

GCP Audit Logs - Detect Organization Policy Deletion or Updation source high: Detects when a Google Cloud Platform organization policy is deleted or updated. Organization policies provide centralized control over your organization's cloud resources and help ensure security and compliance. Deletion or modification of org policies may indicate an attempt to bypass security controls or weaken the security posture of GCP projects. Adversaries may delete or update organization policies to disable security constraints before performing malicious activities.T1562, T1562.001

google.cloud.orgpolicy.OrgPolicy.CreatePolicy: Create org policy

ServiceName: orgpolicy.googleapis.com

Description

Creates a Policy.

Example Audit Log Entry #

{
  "insertId": "19acbsfe4j04q",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Factivity",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": false,
        "permission": "orgpolicy.policies.create",
        "permissionType": "ADMIN_WRITE",
        "resource": "projects/example-project-id",
        "resourceAttributes": {}
      }
    ],
    "methodName": "google.cloud.orgpolicy.v2.OrgPolicy.CreatePolicy",
    "request": {
      "@type": "type.googleapis.com/google.cloud.orgpolicy.v2.CreatePolicyRequest",
      "parent": "projects/example-project-id",
      "policy": {
        "name": "projects/example-project-id/policies/compute.disableSerialPortAccess",
        "spec": {
          "rules": [
            {
              "enforce": true
            }
          ]
        }
      }
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.org-policies.set-policy invocation-id/14dd94dae2a546bfb0063fd9bc51b13c environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/False python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T16:25:51.815850142Z"
      }
    },
    "resourceName": "projects/example-project-id",
    "serviceName": "orgpolicy.googleapis.com",
    "status": {
      "code": 7,
      "details": [
        {
          "@type": "type.googleapis.com/google.rpc.ErrorInfo",
          "domain": "cloudresourcemanager.googleapis.com",
          "reason": "IAM_PERMISSION_DENIED"
        }
      ],
      "message": "Permission 'orgpolicy.policies.create' denied on resource '//cloudresourcemanager.googleapis.com/projects/example-project-id' (or it may not exist)."
    }
  },
  "receiveTimestamp": "2026-06-29T16:25:52.338198265Z",
  "resource": {
    "labels": {
      "method": "google.cloud.orgpolicy.v2.OrgPolicy.CreatePolicy",
      "project_id": "example-project-id",
      "service": "orgpolicy.googleapis.com"
    },
    "type": "audited_resource"
  },
  "severity": "ERROR",
  "timestamp": "2026-06-29T16:25:51.736936043Z"
}

google.cloud.orgpolicy.OrgPolicy.DeletePolicy: Delete org policy

ServiceName: orgpolicy.googleapis.com

Description

Deletes a Policy.

Example Audit Log Entry #

{
  "insertId": "18eq8cpe252z2",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Factivity",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": false,
        "permission": "orgpolicy.policies.delete",
        "permissionType": "ADMIN_WRITE",
        "resource": "projects/example-project-id/policies/compute.disableSerialPortAccess",
        "resourceAttributes": {}
      }
    ],
    "methodName": "google.cloud.orgpolicy.v2.OrgPolicy.DeletePolicy",
    "request": {
      "@type": "type.googleapis.com/google.cloud.orgpolicy.v2.DeletePolicyRequest",
      "name": "projects/example-project-id/policies/compute.disableSerialPortAccess"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.org-policies.delete invocation-id/4a71d9a23a334d0e96baac922ebf5b5d environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/True python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T16:25:52.913186268Z"
      }
    },
    "resourceName": "projects/example-project-id/policies/compute.disableSerialPortAccess",
    "serviceName": "orgpolicy.googleapis.com",
    "status": {
      "code": 7,
      "details": [
        {
          "@type": "type.googleapis.com/google.rpc.ErrorInfo",
          "domain": "orgpolicy.googleapis.com",
          "reason": "IAM_PERMISSION_DENIED"
        }
      ],
      "message": "Permission 'orgpolicy.policies.delete' denied on resource '//orgpolicy.googleapis.com/projects/example-project-id/policies/compute.disableSerialPortAccess' (or it may not exist)."
    }
  },
  "receiveTimestamp": "2026-06-29T16:25:53.377191657Z",
  "resource": {
    "labels": {
      "method": "google.cloud.orgpolicy.v2.OrgPolicy.DeletePolicy",
      "project_id": "example-project-id",
      "service": "orgpolicy.googleapis.com"
    },
    "type": "audited_resource"
  },
  "severity": "ERROR",
  "timestamp": "2026-06-29T16:25:52.846813844Z"
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

YARA-L #

GCP IAM Organization Policy Updated Or Deleted source high: Detect when GCP IAM Organization Policy is updated or deleted.T1098↳ also matches google.cloud.orgpolicy.OrgPolicy.UpdatePolicy: Update org policy

google.cloud.orgpolicy.OrgPolicy.UpdatePolicy: Update org policy

ServiceName: orgpolicy.googleapis.com

Description

Updates a Policy.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

YARA-L #

GCP IAM Organization Policy Updated Or Deleted source high: Detect when GCP IAM Organization Policy is updated or deleted.T1098↳ also matches google.cloud.orgpolicy.OrgPolicy.DeletePolicy: Delete org policy