cloud.gcp

[ 1 Introduction ] [ 2 Valid tags and data tables ] [ 3 Table structure ]

Introduction

The tags beginning with cloud.gcp identify events generated by Google Cloud Platform.

Valid tags and data tables

The full tag must have four levels. The first two are fixed as cloud.gcp and represent technology and brand. The third level corresponds to the service while the fourth identifies the type of events sent.

These are the valid tags and corresponding data tables that will receive the parsers' data:

Product / Service	Tags	Data tables

Product / Service	Tags	Data tables
Google Cloud Platform	`cloud.gcp`	`cloud.gcp`
Google Cloud BigQuery	`cloud.gcp.bigquery.gmail`	`cloud.gcp.bigquery.gmail`
Google Cloud Armor	`cloud.gcp.cloud_armor.adaptive_protection` `cloud.gcp.cloud_armor.events`	`cloud.gcp.cloud_armor.adaptive_protection` `cloud.gcp.cloud_armor.events`
Google Cloud Audit	`cloud.gcp.cloudaudit` `cloud.gcp.cloudaudit.activity` `cloud.gcp.cloudaudit.bigquery` `cloud.gcp.cloudaudit.data_access` `cloud.gcp.cloudaudit.k8s` `cloud.gcp.cloudaudit.login` `cloud.gcp.cloudaudit.policy` `cloud.gcp.cloudaudit.project` `cloud.gcp.cloudaudit.system_event` `cloud.gcp.scc.event_threat`	`cloud.gcp.cloudaudit` `cloud.gcp.cloudaudit.activity` `cloud.gcp.cloudaudit.bigquery` `cloud.gcp.cloudaudit.data_access` `cloud.gcp.cloudaudit.k8s` `cloud.gcp.cloudaudit.login` `cloud.gcp.cloudaudit.policy` `cloud.gcp.cloudaudit.project` `cloud.gcp.cloudaudit.system_event` `cloud.gcp.scc.event_threat`
Google Compute Engine	`cloud.gcp.compute.firewall` `cloud.gcp.compute.shielded_vm_integrity`	`cloud.gcp.compute.firewall` `cloud.gcp.compute.shielded_vm_integrity`
Google Cloud DNS	`cloud.gcp.dns.dns_queries`	`cloud.gcp.dns.dns_queries`
Google Cloud GCEGuestAgent	`cloud.gcp.gceguestagent.none`	`cloud.gcp.gceguestagent.none`
Google Cloud IDS	`cloud.gcp.ids.threat`	`cloud.gcp.ids.threat`
Google Cloud OS Config agent	`cloud.gcp.osconfigagent.none`	`cloud.gcp.osconfigagent.none`
Google Cloud Platform requests	`cloud.gcp.requests`	`cloud.gcp.requests`
GCP Security Command Center	`cloud.gcp.scc.event_threat` `cloud.gcp.scc.findings`	`cloud.gcp.scc.event_threat` `cloud.gcp.scc.findings`
Google Cloud’s operations suite (formerly Stackdriver)	`cloud.gcp.stackdriver.log`	`cloud.gcp.stackdriver.log`
GCP Standard Error Messages	`cloud.gcp.stderr`	`cloud.gcp.stderr`
GCP Standard Output	`cloud.gcp.stdout`	`cloud.gcp.stdout`
GCP Syslog	`cloud.gcp.syslog.none`	`cloud.gcp.syslog.none`
GCP Threat Detection	`cloud.gcp.threatdetection.detection`	`cloud.gcp.threatdetection.detection`
-	`cloud.gcp.unknown.none`	`cloud.gcp.unknown.none`

For more information, read more About Devo tags.

Table structure

These are the fields displayed in these tables: