Activeboard: GCP Cloud Audit

[ 1 Purpose ] [ 2 Prerequisites ] [ 3 Open Activeboard ] [ 4 Use Activeboard ]

Purpose

This Activeboard summarizes information about the most relevant fields contained in GPC Cloud Audit log entries related to GCP Services audited API calls for a selected period of time. It allows you to filter by main log entry fields (Resource Type, Project ID, Service Name, Principal - entity issuing API calls - and Caller IP). The Activeboard is divided into four sections:

Overview
Errors
Data by Main Categories
Data Table

Filters
Resource Type: Select input	Service: Text box input	Caller IP: Text box input
Project ID: Text box input	Principal: Text box input	Line Graphs Grouping Period: Select input
Overview
Total Number of Log Entries: Simple value widget	Log Entries by Type: Pie chart widget	Top 5 Most Active System Processes: Table widget
Log Entries by Top 3 Resources Locations: Column chart widget	Top 5 Log Entries by Severity: Pie chart widget	Top 5 Most Active Public IPv4’s: Table widget
Log Entries by Caller IP Location: Markers map widget	Top 7 Log Entries by Type & Severity Over Time: Line chart widget	Top 5 Most Active Users: Table widget
Top 5 Most Active Public IPv4’s: Table widget	Top 7 Most Active Service Accounts: Table widget
Errors
Top 5 Users with Error in Logged Actions: Table widget	Ok vs Error Log Entries: Pie chart widget	Top 5 SP’s with Error in Logged Actions: Table widget
Top 5 Public IPv4’s with Error in LA’s: Table widget	Top 5 Log Entries by Error Over Time: Line chart widget	Top 5 Log Entries by Error: Pie chart widget
Log Entries with Error: Simple value widget	Top 5 Public IPv4’s with Error in Logged Actions: Table widget	Top 5 Log Entries by Error Over Time: Line chart widget
Data by Main Categories
Top 5 Log Entries by Resource Types: Column chart widget	Top 5 Log Entries by Project ID Over Time: Area chart widget	Top 5 Log Entries by Method: Column chart widget
Top 5 Log Entries by Resource Type Over Time: Area chart widget	Top 5 Log Entries by Service: Column chart widget	Top 5 Log Entries by Method Over Time: Area chart widget
Top 5 Log Entries by Progect ID: Column chart widget	Top 5 Log Entries by Service Over Time: Area chart widget
Data table
Data Groupes by Main Categories: Table widget

Prerequisites

To use this Activeboard, you must have the following data sources available on your domain:

cloud.gcp.cloudaudit ^{learn more}

Open Activeboard

Once you have installed the Activeboard, you can use the Open button at the top right of the card in Exchange to access it and see the different widgets populated with the relevant data. You can also access the Activeboard area via the Navigation pane.

Data loading takes too long?

Sometimes some widgets take time to upload the data, it is possible to speed up the process by creating aggregation tasks. Refer to the Aggregation tasks article to learn how to do it.

Use Activeboard

After installing and opening the Activeboard, you can use its widgets to visualize and monitor data. To do this, each widget offers a variety of customization and visualization options. Refer to Using widgets and Using inputs to know them all.