Serial Console SSH Gateway
| methodName | Description | Log type | Sample | Rule |
|---|---|---|---|---|
| google. | Records a connection attempt to a VM's serial console through the ssh-serialport.googleapis.com gateway; access is IAM-gated, not firewall-gated. In real records the serviceName is region-prefixed (for example us-central1-ssh-serialport.googleapis.com). | activity | N | Y |
| google. | Recorded at the end of a serial console session, symmetric with the connect entry. In real records the serviceName is region-prefixed (for example us-central1-ssh-serialport.googleapis.com). | activity | N | N |
google.ssh-serialport.connect: Connect
#Description
Records a connection attempt to a VM's serial console through the ssh-serialport.googleapis.com gateway; access is IAM-gated, not firewall-gated. In real records the serviceName is region-prefixed (for example us-central1-ssh-serialport.googleapis.com).
Detection Fields #
Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete schema for this catalog entry.
| Name | Rules | Vendors |
|---|---|---|
protoPayload.methodName | 1 detection rule | Panther |
protoPayload.serviceName | 1 detection rule | Panther |
protoPayload.status.message | 1 detection rule | Panther |
Detection Rules #
Full rule details for this catalog entry, including ATT&CK technique mappings and native queries →Panther #
google.ssh-serialport.disconnect: Disconnect
#Description
Recorded at the end of a serial console session, symmetric with the connect entry. In real records the serviceName is region-prefixed (for example us-central1-ssh-serialport.googleapis.com).
any: ssh-serialport.googleapis.com (any method)
#Scope grouping: This repository-authored catalog entry represents a broad attribution scope, not a distinct emitted event or operation. Any sample below is a representative record from that scope; attached rules, if any, are listed separately.
Description
Catch-all entry for ssh-serialport.googleapis.com. Source-only rules that attribute to the service without a specific method attribute here. Not a distinct audit log operation.