Reference Library for GCP Audit Logs Falco Threat Detection Rules
Sysdig Secure enables you to create and customize Threat Detection Rules to secure your environment.
This topic provides all the fields and events that apply to Falco rules for GCP Audit Logs.
Fields
Field Class: JSON
| Name | Type | Description |
|---|
json.value | CHARBUF | Extracts a value from a JSON-encoded input. Syntax is json.value[], where is a json pointer (see https://datatracker.ietf.org/doc/html/rfc6901) |
json.obj | CHARBUF | The full json message as a text string. |
json.rawtime | CHARBUF | The time of the event, identical to evt.rawtime. |
jevt.value | CHARBUF | Alias for json.value, provided for backwards compatibility. |
jevt.obj | CHARBUF | Alias for json.obj, provided for backwards compatibility. |
jevt.rawtime | CHARBUF | Alias for json.rawtime, provided for backwards compatibility. |
Field Class: GCP Audit Logs
| Name | Type | Description |
|---|
gcp.user | CHARBUF | GCP principal, actor of the action |
gcp.callerIP | CHARBUF | Actor’s IP |
gcp.userAgent | CHARBUF | Actor’s User agent |
gcp.authorizationInfo | CHARBUF | GCP authorization (JSON) |
gcp.serviceName | CHARBUF | GCP API service name |
gcp.policyDelta | CHARBUF | GCP service resource access control policy delta |
gcp.request | CHARBUF | GCP API raw request (JSON) |
gcp.methodName | CHARBUF | GCP API service method executed |
gcp.cloudfunctions.function | CHARBUF | GCF name |
gcp.cloudsql.databaseId | CHARBUF | GCP SQL database ID |
gcp.compute.instanceId | CHARBUF | GCE instance ID |
gcp.compute.networkId | CHARBUF | GCP network ID |
gcp.compute.subnetwork | CHARBUF | GCP subnetwork name |
gcp.compute.subnetworkId | CHARBUF | GCP subnetwork ID |
gcp.dns.zone | CHARBUF | GCP DNS zone |
gcp.iam.serviceAccount | CHARBUF | GCP service account |
gcp.iam.serviceAccountId | CHARBUF | GCP IAM unique ID |
gcp.location | CHARBUF | GCP region |
gcp.logging.sink | CHARBUF | GCP logging sink |
gcp.projectId | CHARBUF | GCP project ID |
gcp.resourceName | CHARBUF | GCP resource name |
gcp.resourceType | CHARBUF | GCP resource type |
gcp.resourceLabels | CHARBUF | GCP resource labels (JSON) |
gcp.storage.bucket | CHARBUF | GCP bucket name |
gcp.time | CHARBUF | Timestamp of the event in RFC3339 format |
