Service Usage

methodName	Description	Log type	Sample	Rule
any	Catch-all entry for serviceusage.googleapis.com. Source-only rules that attribute to the service without a specific method attribute here. Not a distinct audit log operation.	activity	N	N
google.api.serviceusage.ServiceUsage.BatchEnableServices	Enables multiple services on a project. The operation is atomic; if enabling any service fails, then the entire batch fails, and no state changes occur. To enable a single service, use the EnableService method instead.	activity	Y	N
google.api.serviceusage.ServiceUsage.DisableService	Disables a service so that it can no longer be used with a project. It is not valid to call the disable method on a service that is not currently enabled.	activity	Y	Y
google.api.serviceusage.ServiceUsage.EnableService	Enables a service so that it can be used with a project.	activity	Y	N

any: serviceusage.googleapis.com (any method)

ServiceName: serviceusage.googleapis.com

Description

Catch-all entry for serviceusage.googleapis.com. Source-only rules that attribute to the service without a specific method attribute here. Not a distinct audit log operation.

google.api.serviceusage.ServiceUsage.BatchEnableServices: Batch enable services

ServiceName: serviceusage.googleapis.com

Description

Enables multiple services on a project. The operation is atomic; if enabling any service fails, then the entire batch fails, and no state changes occur. To enable a single service, use the EnableService method instead.

Example Audit Log Entry #

{
  "insertId": "pau9t9dc54a",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Factivity",
  "operation": {
    "id": "operations/acf.p2-000000000000-ce3fc45a-e836-4ceb-b15d-ac4c5f3dba57",
    "last": true,
    "producer": "serviceusage.googleapis.com"
  },
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "serviceusage.services.enable",
        "permissionType": "ADMIN_WRITE",
        "resource": "projectnumbers/000000000000/services/apikeys.googleapis.com",
        "resourceAttributes": {}
      },
      {
        "granted": true,
        "permission": "serviceusage.services.enable",
        "permissionType": "ADMIN_WRITE",
        "resource": "projectnumbers/000000000000/services/cloudbuild.googleapis.com",
        "resourceAttributes": {}
      },
      {
        "granted": true,
        "permission": "serviceusage.services.enable",
        "permissionType": "ADMIN_WRITE",
        "resource": "projectnumbers/000000000000/services/cloudkms.googleapis.com",
        "resourceAttributes": {}
      },
      {
        "granted": true,
        "permission": "serviceusage.services.enable",
        "permissionType": "ADMIN_WRITE",
        "resource": "projectnumbers/000000000000/services/cloudresourcemanager.googleapis.com",
        "resourceAttributes": {}
      },
      {
        "granted": true,
        "permission": "serviceusage.services.enable",
        "permissionType": "ADMIN_WRITE",
        "resource": "projectnumbers/000000000000/services/compute.googleapis.com",
        "resourceAttributes": {}
      },
      {
        "granted": true,
        "permission": "serviceusage.services.enable",
        "permissionType": "ADMIN_WRITE",
        "resource": "projectnumbers/000000000000/services/container.googleapis.com",
        "resourceAttributes": {}
      },
      {
        "granted": true,
        "permission": "serviceusage.services.enable",
        "permissionType": "ADMIN_WRITE",
        "resource": "projectnumbers/000000000000/services/dlp.googleapis.com",
        "resourceAttributes": {}
      },
      {
        "granted": true,
        "permission": "serviceusage.services.enable",
        "permissionType": "ADMIN_WRITE",
        "resource": "projectnumbers/000000000000/services/dns.googleapis.com",
        "resourceAttributes": {}
      },
      {
        "granted": true,
        "permission": "serviceusage.services.enable",
        "permissionType": "ADMIN_WRITE",
        "resource": "projectnumbers/000000000000/services/iam.googleapis.com",
        "resourceAttributes": {}
      },
      {
        "granted": true,
        "permission": "serviceusage.services.enable",
        "permissionType": "ADMIN_WRITE",
        "resource": "projectnumbers/000000000000/services/iamcredentials.googleapis.com",
        "resourceAttributes": {}
      },
      {
        "granted": true,
        "permission": "serviceusage.services.enable",
        "permissionType": "ADMIN_WRITE",
        "resource": "projectnumbers/000000000000/services/networkmanagement.googleapis.com",
        "resourceAttributes": {}
      },
      {
        "granted": true,
        "permission": "serviceusage.services.enable",
        "permissionType": "ADMIN_WRITE",
        "resource": "projectnumbers/000000000000/services/orgpolicy.googleapis.com",
        "resourceAttributes": {}
      },
      {
        "granted": true,
        "permission": "serviceusage.services.enable",
        "permissionType": "ADMIN_WRITE",
        "resource": "projectnumbers/000000000000/services/pubsub.googleapis.com",
        "resourceAttributes": {}
      },
      {
        "granted": true,
        "permission": "serviceusage.services.enable",
        "permissionType": "ADMIN_WRITE",
        "resource": "projectnumbers/000000000000/services/run.googleapis.com",
        "resourceAttributes": {}
      },
      {
        "granted": true,
        "permission": "serviceusage.services.enable",
        "permissionType": "ADMIN_WRITE",
        "resource": "projectnumbers/000000000000/services/secretmanager.googleapis.com",
        "resourceAttributes": {}
      },
      {
        "granted": true,
        "permission": "serviceusage.services.enable",
        "permissionType": "ADMIN_WRITE",
        "resource": "projectnumbers/000000000000/services/sqladmin.googleapis.com",
        "resourceAttributes": {}
      }
    ],
    "methodName": "google.api.serviceusage.v1.ServiceUsage.BatchEnableServices",
    "request": {
      "@type": "type.googleapis.com/google.api.serviceusage.v1.BatchEnableServicesRequest",
      "parent": "projects/example-project-id",
      "serviceIds": [
        "compute.googleapis.com",
        "dns.googleapis.com",
        "iam.googleapis.com",
        "iamcredentials.googleapis.com",
        "cloudkms.googleapis.com",
        "pubsub.googleapis.com",
        "secretmanager.googleapis.com",
        "run.googleapis.com",
        "cloudbuild.googleapis.com",
        "container.googleapis.com",
        "sqladmin.googleapis.com",
        "cloudresourcemanager.googleapis.com",
        "apikeys.googleapis.com",
        "dlp.googleapis.com",
        "networkmanagement.googleapis.com",
        "orgpolicy.googleapis.com"
      ]
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.services.enable invocation-id/bcbe949760e84e85a3071f5b07b251d0 environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/False python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {}
    },
    "resourceName": "projects/example-project-id/services",
    "response": {
      "@type": "type.googleapis.com/google.api.serviceusage.v1.BatchEnableServicesResponse",
      "services": [
        {
          "config": {
            "name": "compute.googleapis.com",
            "title": "Compute Engine API"
          },
          "name": "projects/000000000000/services/compute.googleapis.com",
          "parent": "projects/000000000000",
          "state": "ENABLED"
        },
        {
          "config": {
            "name": "dns.googleapis.com",
            "title": "Cloud DNS API"
          },
          "name": "projects/000000000000/services/dns.googleapis.com",
          "parent": "projects/000000000000",
          "state": "ENABLED"
        },
        {
          "config": {
            "name": "iam.googleapis.com",
            "title": "Identity and Access Management (IAM) API"
          },
          "name": "projects/000000000000/services/iam.googleapis.com",
          "parent": "projects/000000000000",
          "state": "ENABLED"
        },
        {
          "config": {
            "name": "iamcredentials.googleapis.com",
            "title": "IAM Service Account Credentials API"
          },
          "name": "projects/000000000000/services/iamcredentials.googleapis.com",
          "parent": "projects/000000000000",
          "state": "ENABLED"
        },
        {
          "config": {
            "name": "cloudkms.googleapis.com",
            "title": "Cloud Key Management Service (KMS) API"
          },
          "name": "projects/000000000000/services/cloudkms.googleapis.com",
          "parent": "projects/000000000000",
          "state": "ENABLED"
        },
        {
          "config": {
            "name": "pubsub.googleapis.com",
            "title": "Cloud Pub/Sub API"
          },
          "name": "projects/000000000000/services/pubsub.googleapis.com",
          "parent": "projects/000000000000",
          "state": "ENABLED"
        },
        {
          "config": {
            "name": "secretmanager.googleapis.com",
            "title": "Secret Manager API"
          },
          "name": "projects/000000000000/services/secretmanager.googleapis.com",
          "parent": "projects/000000000000",
          "state": "ENABLED"
        },
        {
          "config": {
            "name": "run.googleapis.com",
            "title": "Cloud Run Admin API"
          },
          "name": "projects/000000000000/services/run.googleapis.com",
          "parent": "projects/000000000000",
          "state": "ENABLED"
        },
        {
          "config": {
            "name": "cloudbuild.googleapis.com",
            "title": "Cloud Build API"
          },
          "name": "projects/000000000000/services/cloudbuild.googleapis.com",
          "parent": "projects/000000000000",
          "state": "ENABLED"
        },
        {
          "config": {
            "name": "container.googleapis.com",
            "title": "Kubernetes Engine API"
          },
          "name": "projects/000000000000/services/container.googleapis.com",
          "parent": "projects/000000000000",
          "state": "ENABLED"
        },
        {
          "config": {
            "name": "sqladmin.googleapis.com",
            "title": "Cloud SQL Admin API"
          },
          "name": "projects/000000000000/services/sqladmin.googleapis.com",
          "parent": "projects/000000000000",
          "state": "ENABLED"
        },
        {
          "config": {
            "name": "cloudresourcemanager.googleapis.com",
            "title": "Cloud Resource Manager API"
          },
          "name": "projects/000000000000/services/cloudresourcemanager.googleapis.com",
          "parent": "projects/000000000000",
          "state": "ENABLED"
        },
        {
          "config": {
            "name": "apikeys.googleapis.com",
            "title": "API Keys API"
          },
          "name": "projects/000000000000/services/apikeys.googleapis.com",
          "parent": "projects/000000000000",
          "state": "ENABLED"
        },
        {
          "config": {
            "name": "dlp.googleapis.com",
            "title": "Sensitive Data Protection (DLP)"
          },
          "name": "projects/000000000000/services/dlp.googleapis.com",
          "parent": "projects/000000000000",
          "state": "ENABLED"
        },
        {
          "config": {
            "name": "networkmanagement.googleapis.com",
            "title": "Network Management API"
          },
          "name": "projects/000000000000/services/networkmanagement.googleapis.com",
          "parent": "projects/000000000000",
          "state": "ENABLED"
        },
        {
          "config": {
            "name": "orgpolicy.googleapis.com",
            "title": "Organization Policy API"
          },
          "name": "projects/000000000000/services/orgpolicy.googleapis.com",
          "parent": "projects/000000000000",
          "state": "ENABLED"
        }
      ]
    },
    "serviceName": "serviceusage.googleapis.com",
    "status": {}
  },
  "receiveTimestamp": "2026-06-29T13:14:52.151772927Z",
  "resource": {
    "labels": {
      "method": "google.api.serviceusage.v1.ServiceUsage.BatchEnableServices",
      "project_id": "example-project-id",
      "service": "serviceusage.googleapis.com"
    },
    "type": "audited_resource"
  },
  "severity": "NOTICE",
  "timestamp": "2026-06-29T13:14:52.151772927Z"
}

google.api.serviceusage.ServiceUsage.DisableService: Disable service

ServiceName: serviceusage.googleapis.com

Description

Disables a service so that it can no longer be used with a project. It is not valid to call the disable method on a service that is not currently enabled.

Example Audit Log Entry #

{
  "insertId": "1yx7tke11kmw",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Factivity",
  "operation": {
    "id": "operations/acat.p17-000000000000-5caf4e25-7ea1-4dd6-9cb0-5f4c3d7a4a40",
    "last": true,
    "producer": "serviceusage.googleapis.com"
  },
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "serviceusage.services.disable",
        "permissionType": "ADMIN_WRITE",
        "resource": "projectnumbers/000000000000/services/dlp.googleapis.com",
        "resourceAttributes": {}
      }
    ],
    "methodName": "google.api.serviceusage.v1.ServiceUsage.DisableService",
    "request": {
      "@type": "type.googleapis.com/google.api.serviceusage.v1.DisableServiceRequest",
      "name": "projects/example-project-id/services/dlp.googleapis.com"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.services.disable invocation-id/b628bdd6556d414fa13ed818933c6bdc environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/True python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {}
    },
    "resourceName": "projects/example-project-id/services/dlp.googleapis.com",
    "response": {
      "@type": "type.googleapis.com/google.api.serviceusage.v1.DisableServiceResponse",
      "service": {
        "config": {
          "name": "dlp.googleapis.com",
          "title": "Sensitive Data Protection (DLP)"
        },
        "name": "projects/000000000000/services/dlp.googleapis.com",
        "parent": "projects/000000000000",
        "state": "DISABLED"
      }
    },
    "serviceName": "serviceusage.googleapis.com",
    "status": {}
  },
  "receiveTimestamp": "2026-06-29T15:05:38.132330040Z",
  "resource": {
    "labels": {
      "method": "google.api.serviceusage.v1.ServiceUsage.DisableService",
      "project_id": "example-project-id",
      "service": "serviceusage.googleapis.com"
    },
    "type": "audited_resource"
  },
  "severity": "NOTICE",
  "timestamp": "2026-06-29T15:05:38.132330040Z"
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

YARA-L #

GCP Multiple Service APIs Disabled source high: Detect when multiple GCP Service APIs are disabled in a short period of time.T1489

google.api.serviceusage.ServiceUsage.EnableService: Enable service

ServiceName: serviceusage.googleapis.com

Description

Enables a service so that it can be used with a project.

Example Audit Log Entry #

{
  "insertId": "-sk25w9di2xa",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Factivity",
  "operation": {
    "id": "operations/acat.p2-000000000000-ae582130-d843-442f-b2c8-1de593ff910c",
    "last": true,
    "producer": "serviceusage.googleapis.com"
  },
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "serviceusage.services.enable",
        "permissionType": "ADMIN_WRITE",
        "resource": "projectnumbers/000000000000/services/accesscontextmanager.googleapis.com",
        "resourceAttributes": {}
      }
    ],
    "methodName": "google.api.serviceusage.v1.ServiceUsage.EnableService",
    "request": {
      "@type": "type.googleapis.com/google.api.serviceusage.v1.EnableServiceRequest",
      "name": "projects/example-project-id/services/accesscontextmanager.googleapis.com"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.services.enable invocation-id/ecab03743bdc4aa3b3e6e951416ee6dd environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/False python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {}
    },
    "resourceName": "projects/example-project-id/services/accesscontextmanager.googleapis.com",
    "response": {
      "@type": "type.googleapis.com/google.api.serviceusage.v1.EnableServiceResponse",
      "service": {
        "config": {
          "name": "accesscontextmanager.googleapis.com",
          "title": "Access Context Manager API"
        },
        "name": "projects/000000000000/services/accesscontextmanager.googleapis.com",
        "parent": "projects/000000000000",
        "state": "ENABLED"
      }
    },
    "serviceName": "serviceusage.googleapis.com",
    "status": {}
  },
  "receiveTimestamp": "2026-06-29T13:15:03.243515165Z",
  "resource": {
    "labels": {
      "method": "google.api.serviceusage.v1.ServiceUsage.EnableService",
      "project_id": "example-project-id",
      "service": "serviceusage.googleapis.com"
    },
    "type": "audited_resource"
  },
  "severity": "NOTICE",
  "timestamp": "2026-06-29T13:15:03.243515165Z"
}