GCP (Cloud Identity)
| eventName | Description | Sample | Rule |
|---|---|---|---|
| IMPORT_ | An SSH public key was imported for a GCP/Cloud Identity managed user. | N | N |
| DELETE_ | A POSIX account entry was deleted for a managed user. | N | N |
| DELETE_ | An SSH public key was deleted for a managed user. | N | N |
| UPDATE_ | An SSH public key was updated for a managed user. | N | N |
| GET_ | A login profile was retrieved for a managed user. | N | N |
| GET_ | An SSH public key was retrieved for a managed user. | N | N |
IMPORT_SSH_PUBLIC_KEY: Import SSH Public Key
#Description
An SSH public key was imported for a GCP/Cloud Identity managed user.
References #
DELETE_POSIX_ACCOUNT: Delete POSIX Account
#Description
A POSIX account entry was deleted for a managed user.
References #
DELETE_SSH_PUBLIC_KEY: Delete SSH Public Key
#Description
An SSH public key was deleted for a managed user.
References #
UPDATE_SSH_PUBLIC_KEY: Update SSH Public Key
#Description
An SSH public key was updated for a managed user.
References #
GET_LOGIN_PROFILE: Get Login Profile
#Description
A login profile was retrieved for a managed user.
References #
GET_SSH_PUBLIC_KEY: Get SSH Public Key
#Description
An SSH public key was retrieved for a managed user.
References #
any: GCP (Cloud Identity) (any event)
#Scope grouping: This repository-authored catalog entry represents a broad attribution scope, not a distinct emitted event or operation. Any sample below is a representative record from that scope; attached rules, if any, are listed separately.
Description
Source-only rules that filter on applicationName 'gcp' without specifying an eventName attribute here.