GCP Audit Log

gcloud logging read "logName:audit_log"

Query GCP Audit Logs with gcloud, reviewing administrative and access activity of project resources.

Run it when you need GCP activity: gcloud logging read queries Cloud Logging — the logName:audit_log filter returns audit events: administrative operations (create/delete resources, IAM changes), data access (reading a bucket), and system events. It is the source of project activity: the resource created by the attacker, the permission change, the access to sensitive data. In GCP IR, Audit Logs are the equivalent of CloudTrail: the attacker's chain of operations is reconstructed with gcloud logging read queries.

Do not use it as a complete source: Audit Logs cover the three types (Admin, Data Access, System Event) — Data Access logs (data accesses) require explicit enabling and generate volume/cost; without them, access to a bucket is not recorded. Default Cloud Logging retention is limited: long history requires sinks to BigQuery or a bucket. And watch out for filtering: logging filter syntax (logName, protoPayload.methodName, resource.type) is specific — a poorly written filter returns empty or everything. The event shows the operation (who, what, when); correlation with the rest (Security Command Center, 164) completes the analysis.