detection.wiki

Cloud Pub/Sub

methodNameDescriptionLog typeSampleRule
anyCatch-all entry for pubsub.googleapis.com. Source-only rules that attribute to the service without a specific method attribute here. Not a distinct audit log operation.activityNN
google.pubsub.Publisher.CreateTopicCreates the given topic with the given name.activityYY
google.pubsub.Publisher.DeleteTopicDeletes the topic with the given name.activityYY
google.pubsub.Publisher.DetachSubscriptionactivityNN
google.pubsub.Publisher.GetTopicdata_accessNN
google.pubsub.Publisher.ListTopicSnapshotsdata_accessNN
google.pubsub.Publisher.ListTopicSubscriptionsdata_accessNN
google.pubsub.Publisher.ListTopicsdata_accessYN
google.pubsub.Publisher.PublishNot audit-logged: Google excludes this method from Cloud Audit Logs as a high-volume data-plane operation, so no audit log entry ever records it. Detections cannot source this operation from Cloud Audit Logs.not_auditedNN
google.pubsub.Publisher.UpdateTopicUpdates an existing topic by updating the fields specified in the update mask.activityNN
google.pubsub.Subscriber.AcknowledgeNot audit-logged: Google excludes this method from Cloud Audit Logs as a high-volume data-plane operation, so no audit log entry ever records it. Detections cannot source this operation from Cloud Audit Logs.not_auditedNN
google.pubsub.Subscriber.CreateSnapshotactivityYN
google.pubsub.Subscriber.CreateSubscriptionCreates a subscription to a given topic.activityYY
google.pubsub.Subscriber.DeleteSnapshotactivityNN
google.pubsub.Subscriber.DeleteSubscriptionDeletes an existing subscription.activityYY
google.pubsub.Subscriber.GetSnapshotdata_accessNN
google.pubsub.Subscriber.GetSubscriptiondata_accessNN
google.pubsub.Subscriber.ListSnapshotsdata_accessYN
google.pubsub.Subscriber.ListSubscriptionsdata_accessYN
google.pubsub.Subscriber.ModifyAckDeadlineNot audit-logged: Google excludes this method from Cloud Audit Logs as a high-volume data-plane operation, so no audit log entry ever records it. Detections cannot source this operation from Cloud Audit Logs.not_auditedNN
google.pubsub.Subscriber.ModifyPushConfigModifies the PushConfig for a specified subscription.activityNN
google.pubsub.Subscriber.PullNot audit-logged: Google excludes this method from Cloud Audit Logs as a high-volume data-plane operation, so no audit log entry ever records it. Detections cannot source this operation from Cloud Audit Logs.not_auditedNN
google.pubsub.Subscriber.SeekactivityNN
google.pubsub.Subscriber.StreamingPullNot audit-logged: Google excludes this method from Cloud Audit Logs as a high-volume data-plane operation, so no audit log entry ever records it. Detections cannot source this operation from Cloud Audit Logs.not_auditedNN
google.pubsub.Subscriber.UpdateSnapshotactivityNN
google.pubsub.Subscriber.UpdateSubscriptionUpdates an existing subscription by updating the fields specified in the update mask.activityYN
google.pubsub.SchemaService.CreateSchemaCreate a Pub/Sub schema.activityYN
google.pubsub.SchemaService.DeleteSchemaDelete a Pub/Sub schema.activityYN
google.pubsub.SchemaService.ListSchemasList Pub/Sub schemas.data_accessYN

any: pubsub.googleapis.com (any method)

#
ServiceName
pubsub.googleapis.com

Description

Catch-all entry for pubsub.googleapis.com. Source-only rules that attribute to the service without a specific method attribute here. Not a distinct audit log operation.

google.pubsub.Publisher.CreateTopic: Create topic

#
ServiceName
pubsub.googleapis.com

Description

Creates the given topic with the given name.

Example Audit Log Entry #

{
  "insertId": "1f20f50ccbh",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Factivity",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "pubsub.topics.create",
        "permissionType": "ADMIN_WRITE",
        "resource": "projects/example-project-id",
        "resourceAttributes": {}
      },
      {
        "granted": true,
        "permission": "pubsub.topics.create",
        "permissionType": "ADMIN_WRITE",
        "resource": "projects/example-project-id/topics/dwgen-dw739065",
        "resourceAttributes": {
          "name": "projects/example-project-id/topics/dwgen-dw739065",
          "service": "pubsub.googleapis.com",
          "type": "pubsub.googleapis.com/Topic"
        }
      }
    ],
    "methodName": "google.pubsub.v1.Publisher.CreateTopic",
    "request": {
      "@type": "type.googleapis.com/google.pubsub.v1.Topic",
      "name": "projects/example-project-id/topics/dwgen-dw739065"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.pubsub.topics.create invocation-id/8d77991bb7e64b33b57bf822dcc1c7f4 environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/True python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T13:19:55.843392234Z"
      }
    },
    "resourceName": "projects/example-project-id/topics/dwgen-dw739065",
    "response": {
      "@type": "type.googleapis.com/google.pubsub.v1.Topic",
      "name": "projects/example-project-id/topics/dwgen-dw739065"
    },
    "serviceName": "pubsub.googleapis.com",
    "status": {}
  },
  "receiveTimestamp": "2026-06-29T13:19:57.959687220Z",
  "resource": {
    "labels": {
      "project_id": "example-project-id",
      "topic_id": "projects/example-project-id/topics/dwgen-dw739065"
    },
    "type": "pubsub_topic"
  },
  "severity": "NOTICE",
  "timestamp": "2026-06-29T13:19:55.835710472Z"
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

  • GCP Pub/Sub Topic Creation source low: Identifies the creation of a topic in Google Cloud Platform (GCP). In GCP, the publisher-subscriber relationship (Pub/Sub) is an asynchronous messaging service that decouples event-producing and event-processing services. A topic is used to forward messages from publishers to subscribers.T1530, T1651

google.pubsub.Publisher.DeleteTopic: Delete topic

#
ServiceName
pubsub.googleapis.com

Description

Deletes the topic with the given name.

Example Audit Log Entry #

{
  "insertId": "ogmn8id3cv6",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Factivity",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "pubsub.topics.delete",
        "permissionType": "ADMIN_WRITE",
        "resource": "projects/example-project-id/topics/dwtop7201353",
        "resourceAttributes": {}
      }
    ],
    "methodName": "google.pubsub.v1.Publisher.DeleteTopic",
    "request": {
      "@type": "type.googleapis.com/google.pubsub.v1.DeleteTopicRequest",
      "topic": "projects/example-project-id/topics/dwtop7201353"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.pubsub.topics.delete invocation-id/b072c4c7533b43819ea992431e45b561 environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/True python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T16:25:40.659782389Z"
      }
    },
    "resourceName": "projects/example-project-id/topics/dwtop7201353",
    "serviceName": "pubsub.googleapis.com",
    "status": {}
  },
  "receiveTimestamp": "2026-06-29T16:25:41.800532861Z",
  "resource": {
    "labels": {
      "project_id": "example-project-id",
      "topic_id": "projects/example-project-id/topics/dwtop7201353"
    },
    "type": "pubsub_topic"
  },
  "severity": "NOTICE",
  "timestamp": "2026-06-29T16:25:40.653018530Z"
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

  • GCP Pub/Sub Topic Deletion source low: Identifies the deletion of a topic in Google Cloud Platform (GCP). In GCP, the publisher-subscriber relationship (Pub/Sub) is an asynchronous messaging service that decouples event-producing and event-processing services. A publisher application creates and sends messages to a topic. Deleting a topic can interrupt message flow in the Pub/Sub pipeline.T1489, T1562

google.pubsub.Publisher.DetachSubscription: DetachSubscription

#
ServiceName
pubsub.googleapis.com

google.pubsub.Publisher.GetTopic: GetTopic

#
ServiceName
pubsub.googleapis.com

Data Access audit logs are disabled by default.

google.pubsub.Publisher.ListTopicSnapshots: ListTopicSnapshots

#
ServiceName
pubsub.googleapis.com

Data Access audit logs are disabled by default.

google.pubsub.Publisher.ListTopicSubscriptions: ListTopicSubscriptions

#
ServiceName
pubsub.googleapis.com

Data Access audit logs are disabled by default.

google.pubsub.Publisher.ListTopics: ListTopics

#
ServiceName
pubsub.googleapis.com

Data Access audit logs are disabled by default.

Example Audit Log Entry #

{
  "insertId": "18ycyvsd17z3",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Fdata_access",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "pubsub.topics.list",
        "permissionType": "DATA_READ",
        "resource": "projects/example-project-id",
        "resourceAttributes": {}
      }
    ],
    "methodName": "google.pubsub.v1.Publisher.ListTopics",
    "request": {
      "@type": "type.googleapis.com/google.pubsub.v1.ListTopicsRequest",
      "project": "projects/example-project-id"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.pubsub.topics.list invocation-id/65a452e434c1441082d8af584fc86009 environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/True python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T13:17:56.572471014Z"
      }
    },
    "resourceName": "projects/example-project-id",
    "serviceName": "pubsub.googleapis.com",
    "status": {}
  },
  "receiveTimestamp": "2026-06-29T13:17:57.229816297Z",
  "resource": {
    "labels": {
      "project_id": "projects/example-project-id"
    },
    "type": "project"
  },
  "severity": "INFO",
  "timestamp": "2026-06-29T13:17:56.565212078Z"
}

google.pubsub.Publisher.Publish: Publish

#
ServiceName
pubsub.googleapis.com

Description

Not audit-logged: Google excludes this method from Cloud Audit Logs as a high-volume data-plane operation, so no audit log entry ever records it. Detections cannot source this operation from Cloud Audit Logs.

google.pubsub.Publisher.UpdateTopic: Update topic

#
ServiceName
pubsub.googleapis.com

Description

Updates an existing topic by updating the fields specified in the update mask.

google.pubsub.Subscriber.Acknowledge: Acknowledge

#
ServiceName
pubsub.googleapis.com

Description

Not audit-logged: Google excludes this method from Cloud Audit Logs as a high-volume data-plane operation, so no audit log entry ever records it. Detections cannot source this operation from Cloud Audit Logs.

google.pubsub.Subscriber.CreateSnapshot: CreateSnapshot

#
ServiceName
pubsub.googleapis.com

Example Audit Log Entry #

{
  "insertId": "tfejctd25z0",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Factivity",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "pubsub.snapshots.create",
        "permissionType": "ADMIN_WRITE",
        "resource": "projects/example-project-id",
        "resourceAttributes": {}
      },
      {
        "granted": true,
        "permission": "pubsub.snapshots.create",
        "permissionType": "ADMIN_WRITE",
        "resource": "projects/example-project-id/snapshots/dwsnap-dw743447",
        "resourceAttributes": {
          "name": "projects/example-project-id/snapshots/dwsnap-dw743447",
          "service": "pubsub.googleapis.com",
          "type": "pubsub.googleapis.com/Snapshot"
        }
      }
    ],
    "methodName": "google.pubsub.v1.Subscriber.CreateSnapshot",
    "request": {
      "@type": "type.googleapis.com/google.pubsub.v1.CreateSnapshotRequest",
      "name": "projects/example-project-id/snapshots/dwsnap-dw743447",
      "subscription": "projects/example-project-id/subscriptions/dwsub-dw743447"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.pubsub.snapshots.create invocation-id/61fef1541c75409ea4886f9de49414ed environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/True python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T14:33:49.713638511Z"
      }
    },
    "resourceName": "projects/example-project-id/snapshots/dwsnap-dw743447",
    "response": {
      "@type": "type.googleapis.com/google.pubsub.v1.Snapshot",
      "expireTime": "2026-07-06T14:33:50.295Z",
      "name": "projects/example-project-id/snapshots/dwsnap-dw743447",
      "topic": "projects/example-project-id/topics/dwtop-dw743447"
    },
    "serviceName": "pubsub.googleapis.com",
    "status": {}
  },
  "receiveTimestamp": "2026-06-29T14:33:52.334209088Z",
  "resource": {
    "labels": {
      "project_id": "example-project-id",
      "snapshot_id": "projects/example-project-id/snapshots/dwsnap-dw743447"
    },
    "type": "pubsub_snapshot"
  },
  "severity": "NOTICE",
  "timestamp": "2026-06-29T14:33:49.705930030Z"
}

google.pubsub.Subscriber.CreateSubscription: Create subscription

#
ServiceName
pubsub.googleapis.com

Description

Creates a subscription to a given topic.

Example Audit Log Entry #

{
  "insertId": "fttlczd3fuo",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Factivity",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "pubsub.subscriptions.create",
        "permissionType": "ADMIN_WRITE",
        "resource": "projects/example-project-id",
        "resourceAttributes": {}
      },
      {
        "granted": true,
        "permission": "pubsub.subscriptions.create",
        "permissionType": "ADMIN_WRITE",
        "resource": "projects/example-project-id/subscriptions/dwgen-dw739065-sub",
        "resourceAttributes": {
          "name": "projects/example-project-id/subscriptions/dwgen-dw739065-sub",
          "service": "pubsub.googleapis.com",
          "type": "pubsub.googleapis.com/Subscription"
        }
      }
    ],
    "methodName": "google.pubsub.v1.Subscriber.CreateSubscription",
    "request": {
      "@type": "type.googleapis.com/google.pubsub.v1.Subscription",
      "name": "projects/example-project-id/subscriptions/dwgen-dw739065-sub",
      "topic": "projects/example-project-id/topics/dwgen-dw739065"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.pubsub.subscriptions.create invocation-id/9e551797bb9541c19178f11ba33d16f9 environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/True python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T13:19:58.761905019Z"
      }
    },
    "resourceName": "projects/example-project-id/subscriptions/dwgen-dw739065-sub",
    "response": {
      "@type": "type.googleapis.com/google.pubsub.v1.Subscription",
      "ackDeadlineSeconds": 10,
      "expirationPolicy": {
        "ttl": "2678400s"
      },
      "messageRetentionDuration": "604800s",
      "name": "projects/example-project-id/subscriptions/dwgen-dw739065-sub",
      "pushConfig": {},
      "topic": "projects/example-project-id/topics/dwgen-dw739065"
    },
    "serviceName": "pubsub.googleapis.com",
    "status": {}
  },
  "receiveTimestamp": "2026-06-29T13:20:00.926122345Z",
  "resource": {
    "labels": {
      "project_id": "example-project-id",
      "subscription_id": "projects/example-project-id/subscriptions/dwgen-dw739065-sub"
    },
    "type": "pubsub_subscription"
  },
  "severity": "NOTICE",
  "timestamp": "2026-06-29T13:19:58.753582967Z"
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

  • GCP Pub/Sub Subscription Creation source low: Identifies the creation of a subscription in Google Cloud Platform (GCP). In GCP, the publisher-subscriber relationship (Pub/Sub) is an asynchronous messaging service that decouples event-producing and event-processing services. A subscription is a named resource representing the stream of messages to be delivered to the subscribing application.T1119, T1530

google.pubsub.Subscriber.DeleteSnapshot: DeleteSnapshot

#
ServiceName
pubsub.googleapis.com

google.pubsub.Subscriber.DeleteSubscription: Delete subscription

#
ServiceName
pubsub.googleapis.com

Description

Deletes an existing subscription.

Example Audit Log Entry #

{
  "insertId": "a2gw4b6j",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Factivity",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "resourceAttributes": {}
      }
    ],
    "methodName": "google.pubsub.v1.Subscriber.DeleteSubscription",
    "request": {
      "@type": "type.googleapis.com/google.pubsub.v1.DeleteSubscriptionRequest",
      "subscription": "projects/example-project-id/subscriptions/dwsub7201353"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.pubsub.subscriptions.delete invocation-id/6c0edf4b33a04c2b9eb8ed216321dee8 environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/True python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {}
    },
    "resourceName": "projects/example-project-id/topics/dwtop7201353",
    "response": {
      "@type": "type.googleapis.com/google.protobuf.Empty"
    },
    "serviceName": "pubsub.googleapis.com",
    "status": {}
  },
  "receiveTimestamp": "2026-06-29T16:25:40.150611844Z",
  "resource": {
    "labels": {
      "project_id": "example-project-id",
      "topic_id": "projects/example-project-id/topics/dwtop7201353"
    },
    "type": "pubsub_topic"
  },
  "severity": "NOTICE",
  "timestamp": "2026-06-29T16:25:39.102117131Z"
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

  • GCP Pub/Sub Subscription Deletion source low: Identifies the deletion of a subscription in Google Cloud Platform (GCP). In GCP, the publisher-subscriber relationship (Pub/Sub) is an asynchronous messaging service that decouples event-producing and event-processing services. A subscription is a named resource representing the stream of messages to be delivered to the subscribing application.T1489, T1562

google.pubsub.Subscriber.GetSnapshot: GetSnapshot

#
ServiceName
pubsub.googleapis.com

Data Access audit logs are disabled by default.

google.pubsub.Subscriber.GetSubscription: GetSubscription

#
ServiceName
pubsub.googleapis.com

Data Access audit logs are disabled by default.

google.pubsub.Subscriber.ListSnapshots: ListSnapshots

#
ServiceName
pubsub.googleapis.com

Data Access audit logs are disabled by default.

Example Audit Log Entry #

{
  "insertId": "1uva72rd2aa2",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Fdata_access",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "pubsub.snapshots.list",
        "permissionType": "ADMIN_READ",
        "resource": "projects/example-project-id",
        "resourceAttributes": {}
      }
    ],
    "methodName": "google.pubsub.v1.Subscriber.ListSnapshots",
    "request": {
      "@type": "type.googleapis.com/google.pubsub.v1.ListSnapshotsRequest",
      "project": "projects/example-project-id"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.pubsub.snapshots.list invocation-id/daaf3ab4fd9b4228a0f38e8e3f084fb0 environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/True python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T15:38:31.009390389Z"
      }
    },
    "resourceName": "projects/example-project-id",
    "serviceName": "pubsub.googleapis.com",
    "status": {}
  },
  "receiveTimestamp": "2026-06-29T15:38:31.748233705Z",
  "resource": {
    "labels": {
      "project_id": "projects/example-project-id"
    },
    "type": "project"
  },
  "severity": "INFO",
  "timestamp": "2026-06-29T15:38:31.001858242Z"
}

google.pubsub.Subscriber.ListSubscriptions: ListSubscriptions

#
ServiceName
pubsub.googleapis.com

Data Access audit logs are disabled by default.

Example Audit Log Entry #

{
  "insertId": "9pphu8d2u0y",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Fdata_access",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "pubsub.subscriptions.list",
        "permissionType": "DATA_READ",
        "resource": "projects/example-project-id",
        "resourceAttributes": {}
      }
    ],
    "methodName": "google.pubsub.v1.Subscriber.ListSubscriptions",
    "request": {
      "@type": "type.googleapis.com/google.pubsub.v1.ListSubscriptionsRequest",
      "project": "projects/example-project-id"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.pubsub.subscriptions.list invocation-id/b83ab1050de449f4ad858ec4597ff462 environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/True python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T13:17:57.493840642Z"
      }
    },
    "resourceName": "projects/example-project-id",
    "serviceName": "pubsub.googleapis.com",
    "status": {}
  },
  "receiveTimestamp": "2026-06-29T13:17:57.606909951Z",
  "resource": {
    "labels": {
      "project_id": "projects/example-project-id"
    },
    "type": "project"
  },
  "severity": "INFO",
  "timestamp": "2026-06-29T13:17:57.485862592Z"
}

google.pubsub.Subscriber.ModifyAckDeadline: ModifyAckDeadline

#
ServiceName
pubsub.googleapis.com

Description

Not audit-logged: Google excludes this method from Cloud Audit Logs as a high-volume data-plane operation, so no audit log entry ever records it. Detections cannot source this operation from Cloud Audit Logs.

google.pubsub.Subscriber.ModifyPushConfig: Modify push config

#
ServiceName
pubsub.googleapis.com

Description

Modifies the PushConfig for a specified subscription.

google.pubsub.Subscriber.Pull: Pull

#
ServiceName
pubsub.googleapis.com

Description

Not audit-logged: Google excludes this method from Cloud Audit Logs as a high-volume data-plane operation, so no audit log entry ever records it. Detections cannot source this operation from Cloud Audit Logs.

google.pubsub.Subscriber.Seek: Seek

#
ServiceName
pubsub.googleapis.com

google.pubsub.Subscriber.StreamingPull: StreamingPull

#
ServiceName
pubsub.googleapis.com

Description

Not audit-logged: Google excludes this method from Cloud Audit Logs as a high-volume data-plane operation, so no audit log entry ever records it. Detections cannot source this operation from Cloud Audit Logs.

google.pubsub.Subscriber.UpdateSnapshot: UpdateSnapshot

#
ServiceName
pubsub.googleapis.com

google.pubsub.Subscriber.UpdateSubscription: Update subscription

#
ServiceName
pubsub.googleapis.com

Description

Updates an existing subscription by updating the fields specified in the update mask.

Example Audit Log Entry #

{
  "insertId": "i1mr8ncfv4",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Factivity",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "pubsub.subscriptions.update",
        "permissionType": "ADMIN_WRITE",
        "resource": "projects/example-project-id/subscriptions/dwsub-dw743447",
        "resourceAttributes": {}
      },
      {
        "granted": true,
        "permission": "pubsub.subscriptions.update",
        "permissionType": "ADMIN_WRITE",
        "resource": "projects/example-project-id/subscriptions/dwsub-dw743447",
        "resourceAttributes": {
          "name": "projects/example-project-id/subscriptions/dwsub-dw743447",
          "service": "pubsub.googleapis.com",
          "type": "pubsub.googleapis.com/Subscription"
        }
      }
    ],
    "methodName": "google.pubsub.v1.Subscriber.UpdateSubscription",
    "request": {
      "@type": "type.googleapis.com/google.pubsub.v1.UpdateSubscriptionRequest",
      "subscription": {
        "ackDeadlineSeconds": 30,
        "name": "projects/example-project-id/subscriptions/dwsub-dw743447"
      },
      "updateMask": "ackDeadlineSeconds"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.pubsub.subscriptions.update invocation-id/d167a0028b224538ac637b8816db2806 environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/True python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T14:33:47.935472151Z"
      }
    },
    "resourceName": "projects/example-project-id/subscriptions/dwsub-dw743447",
    "response": {
      "@type": "type.googleapis.com/google.pubsub.v1.Subscription",
      "ackDeadlineSeconds": 30,
      "expirationPolicy": {
        "ttl": "2678400s"
      },
      "messageRetentionDuration": "604800s",
      "name": "projects/example-project-id/subscriptions/dwsub-dw743447",
      "pushConfig": {
        "attributes": {
          "x-goog-version": "v1"
        }
      },
      "topic": "projects/example-project-id/topics/dwtop-dw743447"
    },
    "serviceName": "pubsub.googleapis.com",
    "status": {}
  },
  "receiveTimestamp": "2026-06-29T14:33:49.235332739Z",
  "resource": {
    "labels": {
      "project_id": "example-project-id",
      "subscription_id": "projects/example-project-id/subscriptions/dwsub-dw743447"
    },
    "type": "pubsub_subscription"
  },
  "severity": "NOTICE",
  "timestamp": "2026-06-29T14:33:47.926536593Z"
}

google.pubsub.SchemaService.CreateSchema: CreateSchema

#
ServiceName
pubsub.googleapis.com

Description

Create a Pub/Sub schema.

Example Audit Log Entry #

{
  "insertId": "10cxgmrd2nj0",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Factivity",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "pubsub.schemas.create",
        "permissionType": "ADMIN_WRITE",
        "resource": "projects/000000000000",
        "resourceAttributes": {}
      },
      {
        "granted": true,
        "permission": "pubsub.schemas.create",
        "permissionType": "ADMIN_WRITE",
        "resource": "projects/000000000000",
        "resourceAttributes": {
          "name": "projects/000000000000/schemas/dwschema-dw746783",
          "service": "pubsub.googleapis.com",
          "type": "pubsub.googleapis.com/Schema"
        }
      }
    ],
    "methodName": "google.pubsub.v1.SchemaService.CreateSchema",
    "request": {
      "@type": "type.googleapis.com/google.pubsub.v1.CreateSchemaRequest",
      "parent": "projects/example-project-id",
      "schema": {}
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.pubsub.schemas.create invocation-id/4833cb9f753543b9849339e641581b36 environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/True python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T15:26:51.184726979Z"
      }
    },
    "resourceName": "projects/example-project-id/schemas/dwschema-dw746783",
    "response": {
      "@type": "type.googleapis.com/google.pubsub.v1.Schema",
      "name": "projects/example-project-id/schemas/dwschema-dw746783"
    },
    "serviceName": "pubsub.googleapis.com",
    "status": {}
  },
  "receiveTimestamp": "2026-06-29T15:26:52.633967135Z",
  "resource": {
    "labels": {
      "project_id": "projects/example-project-id/schemas/dwschema-dw746783"
    },
    "type": "project"
  },
  "severity": "NOTICE",
  "timestamp": "2026-06-29T15:26:51.177595932Z"
}

google.pubsub.SchemaService.DeleteSchema: DeleteSchema

#
ServiceName
pubsub.googleapis.com

Description

Delete a Pub/Sub schema.

Example Audit Log Entry #

{
  "insertId": "17at11zd1a2r",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Factivity",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "pubsub.schemas.delete",
        "permissionType": "ADMIN_WRITE",
        "resource": "projects/000000000000/schemas/dwschema-dw746783",
        "resourceAttributes": {}
      }
    ],
    "methodName": "google.pubsub.v1.SchemaService.DeleteSchema",
    "request": {
      "@type": "type.googleapis.com/google.pubsub.v1.DeleteSchemaRequest",
      "name": "projects/example-project-id/schemas/dwschema-dw746783"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.pubsub.schemas.delete invocation-id/c6735d983986458c8605a82785c7c1e9 environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/False python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T15:32:06.757273126Z"
      }
    },
    "resourceName": "projects/000000000000/schemas/dwschema-dw746783",
    "serviceName": "pubsub.googleapis.com",
    "status": {}
  },
  "receiveTimestamp": "2026-06-29T15:32:07.781230761Z",
  "resource": {
    "labels": {
      "method": "",
      "project_id": "example-project-id",
      "service": ""
    },
    "type": "audited_resource"
  },
  "severity": "NOTICE",
  "timestamp": "2026-06-29T15:32:06.750489764Z"
}

google.pubsub.SchemaService.ListSchemas: ListSchemas

#
ServiceName
pubsub.googleapis.com

Description

List Pub/Sub schemas.

Data Access audit logs are disabled by default.

Example Audit Log Entry #

{
  "insertId": "1n4rxm5d3hkw",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Fdata_access",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "pubsub.schemas.list",
        "permissionType": "ADMIN_READ",
        "resource": "projects/000000000000",
        "resourceAttributes": {}
      }
    ],
    "methodName": "google.pubsub.v1.SchemaService.ListSchemas",
    "request": {
      "@type": "type.googleapis.com/google.pubsub.v1.ListSchemasRequest",
      "parent": "projects/example-project-id",
      "view": "BASIC"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.pubsub.schemas.list invocation-id/8bdc81b896bc4156b9a3a2d34c62e250 environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/True python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T15:38:30.097262871Z"
      }
    },
    "resourceName": "projects/000000000000",
    "serviceName": "pubsub.googleapis.com",
    "status": {}
  },
  "receiveTimestamp": "2026-06-29T15:38:30.491632992Z",
  "resource": {
    "labels": {
      "project_id": "projects/000000000000"
    },
    "type": "project"
  },
  "severity": "INFO",
  "timestamp": "2026-06-29T15:38:30.088338007Z"
}