{"insertId":"-uihnmjctwo","logName":"projects/elastic-beats/logs/cloudaudit.googleapis.com%2Fdata_access","protoPayload":{"@type":"type.googleapis.com/google.cloud.audit.AuditLog","authenticationInfo":{"principalEmail":"xxx@xxx.xxx"},"authorizationInfo":[{"granted":true,"permission":"resourcemanager.projects.get","resource":"projects/elastic-beats","resourceAttributes":{}}],"methodName":"GetResourceBillingInfo","request":{"@type":"type.googleapis.com/google.internal.cloudbilling.billingaccount.v1.GetResourceBillingInfoRequest","resourceName":"projects/189716325846"},"requestMetadata":{"callerIp":"192.168.1.1","destinationAttributes":{},"requestAttributes":{}},"resourceName":"projects/elastic-beats","serviceName":"cloudbilling.googleapis.com","status":{}},"receiveTimestamp":"2019-12-19T00:49:36.313482371Z","resource":{"labels":{"project_id":"elastic-beats"},"type":"project"},"severity":"INFO","timestamp":"2019-12-19T00:49:36.086Z"}
{"insertId":"-h6onuze1h7dg","logName":"projects/elastic-beats/logs/cloudaudit.googleapis.com%2Fdata_access","protoPayload":{"@type":"type.googleapis.com/google.cloud.audit.AuditLog","authenticationInfo":{"principalEmail":"xxx@xxx.xxx"},"authorizationInfo":[{"granted":false,"permission":"compute.machineTypes.list","resourceAttributes":{"name":"projects/elastic-beats","service":"resourcemanager","type":"resourcemanager.projects"}}],"methodName":"beta.compute.machineTypes.aggregatedList","numResponseItems":"71","request":{"@type":"type.googleapis.com/compute.machineTypes.aggregatedList"},"requestMetadata":{"callerIp":"192.168.1.1","callerSuppliedUserAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:71.0) Gecko/20100101 Firefox/71.0,gzip(gfe),gzip(gfe)","destinationAttributes":{},"requestAttributes":{"auth":{},"time":"2019-12-19T00:45:51.711Z"}},"resourceLocation":{"currentLocations":["global"]},"resourceName":"projects/elastic-beats/global/machineTypes","serviceName":"compute.googleapis.com"},"receiveTimestamp":"2019-12-19T00:45:52.367887078Z","resource":{"labels":{"location":"global","method":"compute.machineTypes.aggregatedList","project_id":"elastic-beats","service":"compute.googleapis.com","version":"beta"},"type":"api"},"severity":"INFO","timestamp":"2019-12-19T00:45:51.228Z"}
{"insertId":"yonau2dg2zi","logName":"projects/elastic-beats/logs/cloudaudit.googleapis.com%2Fdata_access","protoPayload":{"@type":"type.googleapis.com/google.cloud.audit.AuditLog","authenticationInfo":{"principalEmail":"xxx@xxx.xxx"},"authorizationInfo":[{"granted":true,"permission":"compute.instances.list","resourceAttributes":{"name":"projects/elastic-beats","service":"resourcemanager","type":"resourcemanager.projects"}}],"methodName":"beta.compute.instances.aggregatedList","numResponseItems":"61","request":{"@type":"type.googleapis.com/compute.instances.aggregatedList"},"requestMetadata":{"callerIp":"192.168.1.1","callerSuppliedUserAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:71.0) Gecko/20100101 Firefox/71.0,gzip(gfe),gzip(gfe)","destinationAttributes":{},"requestAttributes":{"auth":{},"time":"2019-12-19T00:44:25.198Z"}},"response":{"@type":"core.k8s.io/v1.Status","apiVersion":"v1","details":{"group":"batch","kind":"jobs","name":"gsuite-exporter-1589294700","uid":"2beff34a-945f-11ea-bacf-42010a80007f"},"kind":"Status","metadata":{},"status":"Success"},"resourceLocation":{"currentLocations":["global"]},"resourceName":"projects/elastic-beats/global/instances","serviceName":"compute.googleapis.com"},"receiveTimestamp":"2019-12-19T00:44:25.262379373Z","resource":{"labels":{"location":"global","method":"compute.instances.aggregatedList","project_id":"elastic-beats","service":"compute.googleapis.com","version":"beta"},"type":"api"},"severity":"INFO","timestamp":"2019-12-19T00:44:25.051Z"}
{"insertId":"yonau3dc2zi","logName":"projects/elastic-beats/logs/cloudaudit.googleapis.com%2Fdata_access","protoPayload":{"@type":"type.googleapis.com/google.cloud.audit.AuditLog","authenticationInfo":{"principalEmail":"xxx@xxx.xxx"},"authorizationInfo":[{"permission":"compute.instances.list","resourceAttributes":{"name":"projects/elastic-beats","service":"resourcemanager","type":"resourcemanager.projects"}}],"methodName":"beta.compute.instances.aggregatedList","numResponseItems":"61","request":{"@type":"type.googleapis.com/compute.instances.aggregatedList"},"requestMetadata":{"callerIp":"192.168.1.1","callerSuppliedUserAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:71.0) Gecko/20100101 Firefox/71.0,gzip(gfe),gzip(gfe)","destinationAttributes":{},"requestAttributes":{"auth":{},"time":"2019-12-19T00:44:25.198Z"}},"resourceLocation":{"currentLocations":["global"]},"resourceName":"projects/elastic-beats/global/instances","serviceName":"compute.googleapis.com","status":{"code":7,"message":"PERMISSION_DENIED"}},"receiveTimestamp":"2019-12-19T00:44:25.262379373Z","resource":{"labels":{"location":"global","method":"compute.instances.aggregatedList","project_id":"elastic-beats","service":"compute.googleapis.com","version":"beta"},"type":"api"},"severity":"INFO","timestamp":"2019-12-19T00:44:25.051Z"}
{"insertId":"87efd529-6349-45d2-b905-fc607e6c5d3b","labels":{"authorization.k8s.io/decision":"allow","authorization.k8s.io/reason":"RBAC: allowed by ClusterRoleBinding \"cert-manager-webhook:auth-delegator\" of ClusterRole \"system:auth-delegator\" to ServiceAccount \"cert-manager-webhook/cert-manager\""},"logName":"projects/foo/logs/cloudaudit.googleapis.com%2Fdata_access","operation":{"first":true,"id":"5555555-6349-45d2-b905-fc607e6c5d3b","last":true,"producer":"k8s.io"},"protoPayload":{"@type":"type.googleapis.com/google.cloud.audit.AuditLog","authenticationInfo":{"principalEmail":"system:serviceaccount:cert-manager:cert-manager-webhook"},"authorizationInfo":[{"granted":true,"permission":"io.k8s.authorization.v1beta1.subjectaccessreviews.create","resource":"authorization.k8s.io/v1beta1/subjectaccessreviews"}],"methodName":"io.k8s.authorization.v1beta1.subjectaccessreviews.create","request":{"@type":"authorization.k8s.io/v1beta1.SubjectAccessReview","apiVersion":"authorization.k8s.io/v1beta1","kind":"SubjectAccessReview","metadata":{"creationTimestamp":null},"spec":{"group":["system:serviceaccounts","system:serviceaccounts:kube-system","system:authenticated"],"nonResourceAttributes":{"path":"/apis/webhook.cert-manager.io/v1beta1","verb":"get"},"user":"system:serviceaccount:kube-system:resourcequota-controller"},"status":{"allowed":false}},"requestMetadata":{"callerIp":"10.11.12.13","callerSuppliedUserAgent":"webhook/v0.0.0 (linux/amd64) kubernetes/$Format"},"resourceName":"authorization.k8s.io/v1beta1/subjectaccessreviews","response":{"@type":"authorization.k8s.io/v1beta1.SubjectAccessReview","apiVersion":"authorization.k8s.io/v1beta1","kind":"SubjectAccessReview","metadata":{"creationTimestamp":null},"spec":{"group":["system:serviceaccounts","system:serviceaccounts:kube-system","system:authenticated"],"nonResourceAttributes":{"path":"/apis/webhook.cert-manager.io/v1beta1","verb":"get"},"user":"system:serviceaccount:kube-system:resourcequota-controller"},"status":{"allowed":true,"reason":"RBAC: allowed by ClusterRoleBinding \"system:discovery\" of ClusterRole \"system:discovery\" to Group \"system:authenticated\""}},"serviceName":"k8s.io","status":{"code":0}},"receiveTimestamp":"2020-08-05T21:07:32.157698684Z","resource":{"labels":{"cluster_name":"analysis-cluster","location":"us-central1-a","project_id":"elastic-siem"},"type":"k8s_cluster"},"timestamp":"2020-08-05T21:07:30.974750Z"}
{"insertId":"v2spcwdzmc2","logName":"projects/foo/logs/cloudaudit.googleapis.com%2Factivity","operation":{"first":true,"id":"operation-1596664766354-5ac287c395484-fa3923bd-543e018e","producer":"compute.googleapis.com"},"protoPayload":{"@type":"type.googleapis.com/google.cloud.audit.AuditLog","authenticationInfo":{"principalEmail":"user@mycompany.com"},"authorizationInfo":[{"granted":true,"permission":"compute.images.create","resourceAttributes":{"name":"projects/foo/global/images/windows-server-2016-v20200805","service":"compute","type":"compute.images"}}],"methodName":"v1.compute.images.insert","request":{"@type":"type.googleapis.com/compute.images.insert","family":"windows-server-2016","guestOsFeatures":[{"type":"VIRTIO_SCSI_MULTIQUEUE"},{"type":"WINDOWS"}],"name":"windows-server-2016-v20200805","rawDisk":{"source":"https://storage.googleapis.com/storage/v1/b/foo/o/windows-server-2016-v20200805.tar.gz"},"sourceType":"RAW"},"requestMetadata":{"callerIp":"67.43.156.13","callerSuppliedUserAgent":"google-cloud-sdk gcloud/290.0.1 command/gcloud.compute.images.create invocation-id/032752ad0fa44b4ea951951d2deef6a3 environment/None environment-version/None interactive/True from-script/False python/2.7.17 term/xterm-256color (Macintosh; Intel Mac OS X 19.6.0),gzip(gfe)","destinationAttributes":{},"requestAttributes":{"auth":{},"time":"2020-08-05T21:59:27.515Z"}},"resourceLocation":{"currentLocations":["eu"]},"resourceName":"projects/foo/global/images/windows-server-2016-v20200805","response":{"@type":"type.googleapis.com/operation","id":"44919313","insertTime":"2020-08-05T14:59:27.259-07:00","name":"operation-1596664766354-5ac287c395484-fa3923bd-543e018e","operationType":"insert","progress":"0","selfLink":"https://www.googleapis.com/compute/v1/projects/foo/global/operations/operation-1596664766354-5ac287c395484-fa3923bd-543e018e","selfLinkWithId":"https://www.googleapis.com/compute/v1/projects/foo/global/operations/4491931805423146320","startTime":"2020-08-05T14:59:27.274-07:00","status":"RUNNING","targetId":"12345","targetLink":"https://www.googleapis.com/compute/v1/projects/foo/global/images/windows-server-2016-v20200805","user":"user@mycompany.com"},"serviceName":"compute.googleapis.com"},"receiveTimestamp":"2020-08-05T21:59:27.822546978Z","resource":{"labels":{"image_id":"771879043","project_id":"foo"},"type":"gce_image"},"severity":"NOTICE","timestamp":"2020-08-05T21:59:26.456Z"}
{"insertId":"-c7ctxmd2zab","logName":"projects/foo/logs/cloudaudit.googleapis.com%2Factivity","operation":{"id":"operation-1596646123456-5ac2438b775f6-f8ca1382-e70b6831","last":true,"producer":"compute.googleapis.com"},"protoPayload":{"@type":"type.googleapis.com/google.cloud.audit.AuditLog","authenticationInfo":{"principalEmail":"user@mycompany.com"},"methodName":"beta.compute.instances.stop","request":{"@type":"type.googleapis.com/compute.instances.stop"},"requestMetadata":{"callerIp":"67.43.156.13","callerSuppliedUserAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:79.0) Gecko/20100101 Firefox/79.0,gzip(gfe),gzip(gfe)"},"resourceName":"projects/foo/zones/us-central1-a/instances/win10-test","serviceName":"compute.googleapis.com"},"receiveTimestamp":"2020-08-05T16:56:41.315135528Z","resource":{"labels":{"instance_id":"590261181","project_id":"foo","zone":"us-central1-a"},"type":"gce_instance"},"severity":"NOTICE","timestamp":"2020-08-05T16:56:40.428Z"}
{"insertId":"94170ac4-6e82-4345-98ad-3c780222d19d","labels":{"authorization.k8s.io/decision":"allow","authorization.k8s.io/reason":""},"logName":"projects/elastic-siem/logs/cloudaudit.googleapis.com%2Fdata_access","operation":{"first":true,"id":"94170ac4-6e82-4345-98ad-3c780222d19d","last":true,"producer":"k8s.io"},"protoPayload":{"@type":"type.googleapis.com/google.cloud.audit.AuditLog","authenticationInfo":{"principalEmail":"xxx@xxx.xxx"},"authorizationInfo":[{"granted":true,"permission":"io.k8s.core.v1.nodes.list","resource":"core/v1/nodes"}],"methodName":"io.k8s.core.v1.nodes.list","requestMetadata":{"callerIp":"192.168.1.1","callerSuppliedUserAgent":"GoogleCloudConsole"},"resourceName":"core/v1/nodes","serviceName":"k8s.io","status":{}},"receiveTimestamp":"2021-04-23T14:47:31.94822935Z","resource":{"labels":{"cluster_name":"analysis-cluster","location":"us-central1-a","project_id":"elastic-siem"},"type":"k8s_cluster"},"timestamp":"2021-04-23T14:47:07.535383Z"}
{"insertId":"b10a904a-faa4-4e0d-9ec3-7bc6a180196a","labels":{"authorization.k8s.io/decision":"allow","authorization.k8s.io/reason":"","k8s.io/deprecated":"true","k8s.io/removed-release":"1.22"},"logName":"projects/elastic-siem/logs/cloudaudit.googleapis.com%2Fdata_access","operation":{"first":true,"id":"b10a904a-faa4-4e0d-9ec3-7bc6a180196a","last":true,"producer":"k8s.io"},"protoPayload":{"@type":"type.googleapis.com/google.cloud.audit.AuditLog","authenticationInfo":{"principalEmail":"xxx@xxx.xxx"},"authorizationInfo":[{"granted":true,"permission":"io.k8s.extensions.v1beta1.ingresses.list","resource":"extensions/v1beta1/namespaces/cos-auditd/ingresses"}],"methodName":"io.k8s.extensions.v1beta1.ingresses.list","requestMetadata":{"callerIp":"192.168.1.1","callerSuppliedUserAgent":"GoogleCloudConsole"},"resourceName":"extensions/v1beta1/namespaces/cos-auditd/ingresses","serviceName":"k8s.io","status":{}},"receiveTimestamp":"2021-04-23T14:16:36.37362467Z","resource":{"labels":{"cluster_name":"analysis-cluster","location":"us-central1-a","project_id":"elastic-siem"},"type":"k8s_cluster"},"timestamp":"2021-04-23T14:16:07.574776Z"}
{"insertId":"e973134d-b4d5-4e2f-92b8-82bba13fdb92","labels":{"authorization.k8s.io/decision":"allow","authorization.k8s.io/reason":"RBAC: allowed by ClusterRoleBinding \"system:public-info-viewer\" of ClusterRole \"system:public-info-viewer\" to Group \"system:unauthenticated\""},"logName":"projects/elastic-siem/logs/cloudaudit.googleapis.com%2Fdata_access","operation":{"first":true,"id":"e973134d-b4d5-4e2f-92b8-82bba13fdb92","last":true,"producer":"k8s.io"},"protoPayload":{"@type":"type.googleapis.com/google.cloud.audit.AuditLog","authenticationInfo":{"principalEmail":"system:anonymous"},"authorizationInfo":[{"granted":true,"permission":"io.k8s.get","resource":"readyz"}],"methodName":"io.k8s.get","requestMetadata":{"callerIp":"127.0.0.1","callerSuppliedUserAgent":"kube-probe/1.19+"},"resourceName":"readyz","serviceName":"k8s.io","status":{}},"receiveTimestamp":"2021-04-29T08:19:21.606980385Z","resource":{"labels":{"cluster_name":"analysis-cluster","location":"us-central1-a","project_id":"elastic-siem"},"type":"k8s_cluster"},"timestamp":"2021-04-29T08:19:20.80581Z"}
{"insertId":"03adfb9f-71a3-4f41-9701-29b5542f4d22","labels":{"authorization.k8s.io/decision":"allow","authorization.k8s.io/reason":"RBAC: allowed by ClusterRoleBinding \"system:discovery\" of ClusterRole \"system:discovery\" to Group \"system:authenticated\""},"logName":"projects/elastic-siem/logs/cloudaudit.googleapis.com%2Fdata_access","operation":{"first":true,"id":"03adfb9f-71a3-4f41-9701-29b5542f4d22","last":true,"producer":"k8s.io"},"protoPayload":{"@type":"type.googleapis.com/google.cloud.audit.AuditLog","authenticationInfo":{"principalEmail":"system:serviceaccount:kube-system:generic-garbage-collector"},"authorizationInfo":[{"granted":true,"permission":"io.k8s.get","resource":"api/v1"}],"methodName":"io.k8s.get","requestMetadata":{"callerIp":"::1","callerSuppliedUserAgent":"kube-controller-manager/v1.19.8 (linux/amd64) kubernetes/4f6f69f/system:serviceaccount:kube-system:generic-garbage-collector"},"resourceName":"api/v1","serviceName":"k8s.io","status":{}},"receiveTimestamp":"2021-04-29T08:23:19.71757101Z","resource":{"labels":{"cluster_name":"analysis-cluster","location":"us-central1-a","project_id":"elastic-siem"},"type":"k8s_cluster"},"timestamp":"2021-04-29T08:23:18.899153Z"}
{"insertId":"03adfb9f-71a3-4f41-9701-29b5542f4d23","logName":"projects/elastic-beats/logs/cloudaudit.googleapis.com%2Fdata_access","protoPayload":{"@type":"type.googleapis.com/google.cloud.audit.AuditLog","authenticationInfo":{"principalEmail":"xxx@xxx.xxx","principalSubject":"sub","serviceAccountKeyName":"//xxx@xxx"},"authorizationInfo":[{"granted":true,"permission":"iam.serviceAccounts.list","resource":"projects/project","resourceAttributes":{}}],"methodName":"google.iam.admin.v1.ListServiceAccounts","request":{"@type":"type.googleapis.com/google.iam.admin.v1.ListServiceAccountsRequest","name":"projects/project","page_token":"cg:FFFFFF"},"requestMetadata":{"callerIp":"gce-internal-ip","callerSuppliedUserAgent":"google-api-go-client/0.5,gzip(gfe)","destinationAttributes":{},"requestAttributes":{"auth":{},"time":"2022-02-21T13:57:39.178418578Z"}},"resourceName":"projects/project","serviceName":"iam.googleapis.com","status":{}},"receiveTimestamp":"2022-02-21T13:57:39.341344991Z","resource":{"labels":{"location":"global","method":"google.iam.admin.v1.ListServiceAccounts","project_id":"project","service":"iam.googleapis.com","version":"v1"},"type":"api"},"severity":"INFO","timestamp":"2022-02-21T13:57:39.174555198Z"}
{"insertId":"03adfb9f-71a3-4f41-9701-29b5542f4d24","labels":{"authentication.k8s.io/legacy-token":"system:serviceaccount:kube-system:metrics-server","authorization.k8s.io/decision":"allow","authorization.k8s.io/reason":"RBAC: allowed by ClusterRoleBinding \"metrics-server:system:auth-delegator\" of ClusterRole \"system:auth-delegator\" to ServiceAccount \"metrics-server/kube-system\"","k8s.io/deprecated":"true","k8s.io/removed-release":"1.22"},"logName":"projects/project","operation":{"first":true,"id":"924fbbf6-1982-4173-9355-3fca0ab7b0ee","last":true,"producer":"k8s.io"},"protoPayload":{"@type":"type.googleapis.com/google.cloud.audit.AuditLog","authenticationInfo":{"principalEmail":"xxx@xxx.xxx"},"authorizationInfo":[{"granted":true,"permission":"io.k8s.authorization.v1beta1.subjectaccessreviews.create","resource":"authorization.k8s.io/v1beta1/subjectaccessreviews"}],"methodName":"io.k8s.authorization.v1beta1.subjectaccessreviews.create","request":{"@type":"authorization.k8s.io/v1beta1.SubjectAccessReview","apiVersion":"authorization.k8s.io/v1beta1","kind":"SubjectAccessReview","metadata":{"creationTimestamp":null},"spec":{"group":["system:serviceaccounts","system:serviceaccounts:kube-system","system:authenticated"],"nonResourceAttributes":{"path":"/apis/metrics.k8s.io/v1beta1","verb":"get"},"user":"system:serviceaccount:kube-system:resourcequota-controller"},"status":{"allowed":false}},"requestMetadata":{"callerIp":"67.43.156.13","callerSuppliedUserAgent":"metrics-server/v0.0.0 (linux/amd64) kubernetes/$Format"},"resourceName":"authorization.k8s.io/v1beta1/subjectaccessreviews","response":{"@type":"authorization.k8s.io/v1beta1.SubjectAccessReview","apiVersion":"authorization.k8s.io/v1beta1","kind":"SubjectAccessReview","metadata":{"creationTimestamp":null,"managedFields":[{"apiVersion":"authorization.k8s.io/v1beta1","fieldsType":"FieldsV1","fieldsV1":{"f:spec":{"f:group":{},"f:nonResourceAttributes":{".":{},"f:path":{},"f:verb":{}},"f:user":{}}},"manager":"metrics-server","operation":"Update","time":"2022-02-21T14:00:40Z"}]},"spec":{"group":["system:serviceaccounts","system:serviceaccounts:kube-system","system:authenticated"],"nonResourceAttributes":{"path":"/apis/metrics.k8s.io/v1beta1","verb":"get"},"user":"system:serviceaccount:kube-system:resourcequota-controller"},"status":{"allowed":true,"reason":"RBAC: allowed by ClusterRoleBinding \"system:discovery\" of ClusterRole \"system:discovery\" to Group \"system:authenticated\""}},"serviceName":"k8s.io","status":{}},"receiveTimestamp":"2022-02-21T14:00:42.030209174Z","resource":{"labels":{"cluster_name":"elastic","location":"europe-west1","project_id":"project"},"type":"k8s_cluster"},"timestamp":"2022-02-21T14:00:40.802327Z"}
{"insertId":"e5132c86-462b-41b3-9b6a-47966addbb0b","labels":{"authorization.k8s.io/decision":"allow","authorization.k8s.io/reason":""},"logName":"projects/iammai-340819/logs/cloudaudit.googleapis.com%2Factivity","operation":{"first": true,"id":"e5132c86-462b-41b3-9b6a-47966addbb0b","last": true,"producer":"k8s.io"},"protoPayload":{"@type":"type.googleapis.com/google.cloud.audit.AuditLog","authenticationInfo":{"principalEmail":"system:addon-manager"},"authorizationInfo":[{"granted": true,"permission":"io.k8s.apps.v1.deployments.patch","resource":"apps/v1/namespaces/kube-system/deployments/konnectivity-agent"}],"methodName":"io.k8s.apps.v1.deployments.patch","request":{"@type":"k8s.io/Patch","spec":{"strategy":{"$retainKeys":["type"]},"template":{"spec":{"$setElementOrder/volumes":[{"name":"konnectivity-agent-token"}],"volumes":[{"$retainKeys":["name","projected"],"name":"konnectivity-agent-token","projected":{"sources":[{"serviceAccountToken":{"audience":"system:konnectivity-server","path":"konnectivity-agent-token"}}]}}]}}}},"requestMetadata":{"callerIp":"10.142.0.152","callerSuppliedUserAgent":"kubectl/v1.20.2 (linux/amd64) kubernetes/faecb19"},"resourceName":"apps/v1/namespaces/kube-system/deployments/konnectivity-agent","response":{"@type":"apps.k8s.io/v1.Deployment","apiVersion":"apps/v1","kind":"Deployment","metadata":{"annotations":{"components.gke.io/layer":"addon","deployment.kubernetes.io/revision":"1","kubectl.kubernetes.io/last-applied-configuration":"{\"apiVersion\":\"apps/v1\",\"kind\":\"Deployment\",\"metadata\":{\"annotations\":{\"components.gke.io/layer\":\"addon\"},\"labels\":{\"addonmanager.kubernetes.io/mode\":\"Reconcile\",\"k8s-app\":\"konnectivity-agent\"},\"name\":\"konnectivity-agent\",\"namespace\":\"kube-system\"},\"spec\":{\"selector\":{\"matchLabels\":{\"k8s-app\":\"konnectivity-agent\"}},\"strategy\":{\"type\":\"RollingUpdate\"},\"template\":{\"metadata\":{\"annotations\":{\"cluster-autoscaler.kubernetes.io/safe-to-evict\":\"true\",\"components.gke.io/component-name\":\"konnectivitynetworkproxy-combined\",\"components.gke.io/component-version\":\"1.3.3\"},\"labels\":{\"k8s-app\":\"konnectivity-agent\"}},\"spec\":{\"containers\":[{\"args\":[\"--logtostderr=true\",\"--ca-cert=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt\",\"--proxy-server-host=34.75.195.103\",\"--proxy-server-port=8132\",\"--health-server-port=8093\",\"--admin-server-port=8094\",\"--sync-interval=5s\",\"--probe-interval=5s\",\"--service-account-token-path=/var/run/secrets/tokens/konnectivity-agent-token\",\"--v=3\"],\"command\":[\"/proxy-agent\"],\"env\":[{\"name\":\"POD_NAME\",\"valueFrom\":{\"fieldRef\":{\"fieldPath\":\"metadata.name\"}}},{\"name\":\"POD_NAMESPACE\",\"valueFrom\":{\"fieldRef\":{\"fieldPath\":\"metadata.namespace\"}}}],\"image\":\"gke.gcr.io/proxy-agent:v0.0.24-gke.0\",\"livenessProbe\":{\"httpGet\":{\"path\":\"/healthz\",\"port\":8093},\"initialDelaySeconds\":15,\"timeoutSeconds\":15},\"name\":\"konnectivity-agent\",\"ports\":[{\"containerPort\":8093,\"name\":\"metrics\",\"protocol\":\"TCP\"}],\"resources\":{\"limits\":{\"memory\":\"125Mi\"},\"requests\":{\"cpu\":\"10m\",\"memory\":\"30Mi\"}},\"securityContext\":{\"allowPrivilegeEscalation\":false,\"capabilities\":{\"drop\":[\"all\"]}},\"volumeMounts\":[{\"mountPath\":\"/var/run/secrets/tokens\",\"name\":\"konnectivity-agent-token\"}]}],\"nodeSelector\":{\"beta.kubernetes.io/os\":\"linux\"},\"priorityClassName\":\"system-cluster-critical\",\"securityContext\":{\"fsGroup\":1000,\"runAsGroup\":1000,\"runAsUser\":1000},\"serviceAccountName\":\"konnectivity-agent\",\"tolerations\":[{\"key\":\"CriticalAddonsOnly\",\"operator\":\"Exists\"},{\"effect\":\"NoSchedule\",\"key\":\"sandbox.gke.io/runtime\",\"operator\":\"Equal\",\"value\":\"gvisor\"},{\"key\":\"components.gke.io/gke-managed-components\",\"operator\":\"Exists\"}],\"topologySpreadConstraints\":[{\"labelSelector\":{\"matchLabels\":{\"k8s-app\":\"konnectivity-agent\"}},\"maxSkew\":1,\"topologyKey\":\"topology.kubernetes.io/zone\",\"whenUnsatisfiable\":\"ScheduleAnyway\"},{\"labelSelector\":{\"matchLabels\":{\"k8s-app\":\"konnectivity-agent\"}},\"maxSkew\":1,\"topologyKey\":\"kubernetes.io/hostname\",\"whenUnsatisfiable\":\"ScheduleAnyway\"}],\"volumes\":[{\"name\":\"konnectivity-agent-token\",\"projected\":{\"sources\":[{\"serviceAccountToken\":{\"audience\":\"system:konnectivity-server\",\"path\":\"konnectivity-agent-token\"}}]}}]}}}}"},"creationTimestamp":"2022-03-16T21:29:13Z","generation": 2,"labels":{"addonmanager.kubernetes.io/mode":"Reconcile","k8s-app":"konnectivity-agent"},"managedFields":[{"apiVersion":"apps/v1","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:components.gke.io/layer":{},"f:kubectl.kubernetes.io/last-applied-configuration":{}},"f:labels":{".":{},"f:addonmanager.kubernetes.io/mode":{},"f:k8s-app":{}}},"f:spec":{"f:progressDeadlineSeconds":{},"f:replicas":{},"f:revisionHistoryLimit":{},"f:selector":{},"f:strategy":{"f:rollingUpdate":{".":{},"f:maxSurge":{},"f:maxUnavailable":{}},"f:type":{}},"f:template":{"f:metadata":{"f:annotations":{".":{},"f:cluster-autoscaler.kubernetes.io/safe-to-evict":{},"f:components.gke.io/component-name":{},"f:components.gke.io/component-version":{}},"f:labels":{".":{},"f:k8s-app":{}}},"f:spec":{"f:containers":{"k:{\"name\":\"konnectivity-agent\"}":{".":{},"f:args":{},"f:command":{},"f:env":{".":{},"k:{\"name\":\"POD_NAME\"}":{".":{},"f:name":{},"f:valueFrom":{".":{},"f:fieldRef":{".":{},"f:apiVersion":{},"f:fieldPath":{}}}},"k:{\"name\":\"POD_NAMESPACE\"}":{".":{},"f:name":{},"f:valueFrom":{".":{},"f:fieldRef":{".":{},"f:apiVersion":{},"f:fieldPath":{}}}}},"f:image":{},"f:imagePullPolicy":{},"f:livenessProbe":{".":{},"f:failureThreshold":{},"f:httpGet":{".":{},"f:path":{},"f:port":{},"f:scheme":{}},"f:initialDelaySeconds":{},"f:periodSeconds":{},"f:successThreshold":{},"f:timeoutSeconds":{}},"f:name":{},"f:ports":{".":{},"k:{\"containerPort\":8093,\"protocol\":\"TCP\"}":{".":{},"f:containerPort":{},"f:name":{},"f:protocol":{}}},"f:resources":{".":{},"f:limits":{".":{},"f:memory":{}},"f:requests":{".":{},"f:cpu":{},"f:memory":{}}},"f:securityContext":{".":{},"f:allowPrivilegeEscalation":{},"f:capabilities":{".":{},"f:drop":{}}},"f:terminationMessagePath":{},"f:terminationMessagePolicy":{},"f:volumeMounts":{".":{},"k:{\"mountPath\":\"/var/run/secrets/tokens\"}":{".":{},"f:mountPath":{},"f:name":{}}}}},"f:dnsPolicy":{},"f:nodeSelector":{".":{},"f:beta.kubernetes.io/os":{}},"f:priorityClassName":{},"f:restartPolicy":{},"f:schedulerName":{},"f:securityContext":{".":{},"f:fsGroup":{},"f:runAsGroup":{},"f:runAsUser":{}},"f:serviceAccount":{},"f:serviceAccountName":{},"f:terminationGracePeriodSeconds":{},"f:tolerations":{},"f:topologySpreadConstraints":{".":{},"k:{\"topologyKey\":\"kubernetes.io/hostname\",\"whenUnsatisfiable\":\"ScheduleAnyway\"}":{".":{},"f:labelSelector":{},"f:maxSkew":{},"f:topologyKey":{},"f:whenUnsatisfiable":{}},"k:{\"topologyKey\":\"topology.kubernetes.io/zone\",\"whenUnsatisfiable\":\"ScheduleAnyway\"}":{".":{},"f:labelSelector":{},"f:maxSkew":{},"f:topologyKey":{},"f:whenUnsatisfiable":{}}},"f:volumes":{".":{},"k:{\"name\":\"konnectivity-agent-token\"}":{".":{},"f:name":{},"f:projected":{".":{},"f:defaultMode":{},"f:sources":{}}}}}}}},"manager":"kubectl-client-side-apply","operation":"Update","time":"2022-03-16T21:29:13Z"},{"apiVersion":"apps/v1","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{"f:deployment.kubernetes.io/revision":{}}},"f:status":{"f:availableReplicas":{},"f:conditions":{".":{},"k:{\"type\":\"Available\"}":{".":{},"f:lastTransitionTime":{},"f:lastUpdateTime":{},"f:message":{},"f:reason":{},"f:status":{},"f:type":{}},"k:{\"type\":\"Progressing\"}":{".":{},"f:lastTransitionTime":{},"f:lastUpdateTime":{},"f:message":{},"f:reason":{},"f:status":{},"f:type":{}}},"f:observedGeneration":{},"f:readyReplicas":{},"f:replicas":{},"f:updatedReplicas":{}}},"manager":"kube-controller-manager","operation":"Update","time":"2022-03-17T08:55:52Z"}],"name":"konnectivity-agent","namespace":"kube-system","resourceVersion":"280105","uid":"d3b49e97-7bac-435e-bfc6-19a25fe494fe"},"spec":{"progressDeadlineSeconds": 600,"replicas": 6,"revisionHistoryLimit": 10,"selector":{"matchLabels":{"k8s-app":"konnectivity-agent"}},"strategy":{"rollingUpdate":{"maxSurge":"25%","maxUnavailable":"25%"},"type":"RollingUpdate"},"template":{"metadata":{"annotations":{"cluster-autoscaler.kubernetes.io/safe-to-evict":"true","components.gke.io/component-name":"konnectivitynetworkproxy-combined","components.gke.io/component-version":"1.3.3"},"creationTimestamp": null,"labels":{"k8s-app":"konnectivity-agent"}},"spec":{"containers":[{"args":["--logtostderr=true","--ca-cert=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt","--proxy-server-host=34.75.195.103","--proxy-server-port=8132","--health-server-port=8093","--admin-server-port=8094","--sync-interval=5s","--probe-interval=5s","--service-account-token-path=/var/run/secrets/tokens/konnectivity-agent-token","--v=3"],"command":["/proxy-agent"],"env":[{"name":"POD_NAME","valueFrom":{"fieldRef":{"apiVersion":"v1","fieldPath":"metadata.name"}}},{"name":"POD_NAMESPACE","valueFrom":{"fieldRef":{"apiVersion":"v1","fieldPath":"metadata.namespace"}}}],"image":"gke.gcr.io/proxy-agent:v0.0.24-gke.0","imagePullPolicy":"IfNotPresent","livenessProbe":{"failureThreshold": 3,"httpGet":{"path":"/healthz","port": 8093,"scheme":"HTTP"},"initialDelaySeconds": 15,"periodSeconds": 10,"successThreshold": 1,"timeoutSeconds": 15},"name":"konnectivity-agent","ports":[{"containerPort": 8093,"name":"metrics","protocol":"TCP"}],"resources":{"limits":{"memory":"125Mi"},"requests":{"cpu":"10m","memory":"30Mi"}},"securityContext":{"allowPrivilegeEscalation": false,"capabilities":{"drop":["all"]}},"terminationMessagePath":"/dev/termination-log","terminationMessagePolicy":"File","volumeMounts":[{"mountPath":"/var/run/secrets/tokens","name":"konnectivity-agent-token"}]}],"dnsPolicy":"ClusterFirst","nodeSelector":{"beta.kubernetes.io/os":"linux"},"priorityClassName":"system-cluster-critical","restartPolicy":"Always","schedulerName":"default-scheduler","securityContext":{"fsGroup": 1000,"runAsGroup": 1000,"runAsUser": 1000},"serviceAccount":"konnectivity-agent","serviceAccountName":"konnectivity-agent","terminationGracePeriodSeconds": 30,"tolerations":[{"key":"CriticalAddonsOnly","operator":"Exists"},{"effect":"NoSchedule","key":"sandbox.gke.io/runtime","operator":"Equal","value":"gvisor"},{"key":"components.gke.io/gke-managed-components","operator":"Exists"}],"topologySpreadConstraints":[{"labelSelector":{"matchLabels":{"k8s-app":"konnectivity-agent"}},"maxSkew": 1,"topologyKey":"topology.kubernetes.io/zone","whenUnsatisfiable":"ScheduleAnyway"},{"labelSelector":{"matchLabels":{"k8s-app":"konnectivity-agent"}},"maxSkew": 1,"topologyKey":"kubernetes.io/hostname","whenUnsatisfiable":"ScheduleAnyway"}],"volumes":[{"name":"konnectivity-agent-token","projected":{"defaultMode": 420,"sources":[{"serviceAccountToken":{"audience":"system:konnectivity-server","expirationSeconds": 3600,"path":"konnectivity-agent-token"}}]}}]}}},"status":{"availableReplicas": 6,"conditions":[{"lastTransitionTime":"2022-03-17T08:55:41Z","lastUpdateTime":"2022-03-17T08:55:41Z","message":"ReplicaSet \"konnectivity-agent-56c9b8cf8\" has successfully progressed.","reason":"NewReplicaSetAvailable","status":"True","type":"Progressing"},{"lastTransitionTime":"2022-03-17T08:55:52Z","lastUpdateTime":"2022-03-17T08:55:52Z","message":"Deployment has minimum availability.","reason":"MinimumReplicasAvailable","status":"True","type":"Available"}],"observedGeneration": 2,"readyReplicas": 6,"replicas": 6,"updatedReplicas": 6}},"serviceName":"k8s.io","status":{}},"receiveTimestamp":"2022-03-21T19:46:38.090036928Z","resource":{"labels":{"cluster_name":"iammai-340819-gke-cluster","location":"us-east1","project_id":"iammai-340819"},"type":"k8s_cluster"},"timestamp":"2022-03-21T19:46:36.090498Z"}
{"insertId":"15ciwwfd47gm","logName":"projects/elastic/logs/cloudaudit.googleapis.com%2Fdata_access","protoPayload":{"@type":"type.googleapis.com/google.cloud.audit.AuditLog","authenticationInfo":{"principalEmail":"service-xxxx@developer.gserviceaccount.com","principalSubject":"serviceAccount:service-xxxx@developer.gserviceaccount.com"},"authorizationInfo":[{"granted":true,"permission":"container.clusters.get","resourceAttributes":{}}],"methodName":"google.container.v1.ClusterManager.GetCluster","policyViolationInfo":{"orgPolicyViolationInfo":{}},"request":{"@type":"type.googleapis.com/google.container.v1alpha1.GetClusterRequest","name":"projects/elastic-product/locations/us-central1-a/clusters/demo-elastic-co"},"requestMetadata":{"callerIp":"192.168.1.1","callerSuppliedUserAgent":"google-api-go-client/0.5 cluster-autoscaler,gzip(gfe)","destinationAttributes":{},"requestAttributes":{"auth":{},"time":"2022-06-01T11:15:10.836131149Z"}},"resourceLocation":{"currentLocations":["us-central1-a"]},"resourceName":"projects/elastic-product/zones/us-central1-a/clusters/demo-elastic-co","serviceName":"container.googleapis.com"},"receiveTimestamp":"2022-06-01T11:15:11.07151757Z","resource":{"labels":{"cluster_name":"demo-elastic-co","location":"us-central1-a","project_id":"elastic-product"},"type":"gke_cluster"},"severity":"INFO","timestamp":"2022-06-01T11:15:10.842495409Z","logging.googleapis.com/timestamp":"2022-06-01T11:15:10.842495409Z"}
{"insertId":"4pyr6eegiuw1","logName":"projects/elastic/logs/cloudaudit.googleapis.com%2Fdata_access","protoPayload":{"@type":"type.googleapis.com/google.cloud.audit.AuditLog","authenticationInfo":{"principalEmail":"xxx-compute@developer.gserviceaccount.com","serviceAccountDelegationInfo":[{}]},"authorizationInfo":[{"granted":true,"permission":"storage.objects.get","resource":"projects/_/buckets/dataflow-staging-us-central1-xxx/objects/staging/xxx.jar","resourceAttributes":{}}],"methodName":"storage.objects.get","requestMetadata":{"callerSuppliedUserAgent":"BigstoreFile BigstoreIO (cr/xxx)","destinationAttributes":{},"requestAttributes":{"auth":{},"time":"2022-06-01T11:19:08.205760711Z"}},"resourceLocation":{"currentLocations":["us-central1"]},"resourceName":"projects/_/buckets/dataflow-staging-us-central1-xxx/objects/staging/jfxrt-xxx.jar","serviceName":"storage.googleapis.com","status":{}},"receiveTimestamp":"2022-06-01T11:19:08.699785539Z","resource":{"labels":{"bucket_name":"dataflow-staging-us-central1-150691754250","location":"us-central1","project_id":"elastic-product"},"type":"gcs_bucket"},"severity":"INFO","timestamp":"2022-06-01T11:19:08.199407722Z","logging.googleapis.com/timestamp":"2022-06-01T11:19:08.199407722Z"}
{"insertId":"15ciwwfd47gf","logName":"projects/elastic/logs/cloudaudit.googleapis.com%2Fdata_access","protoPayload":{"@type":"type.googleapis.com/google.cloud.audit.AuditLog","authenticationInfo":{"principalEmail":"servoce-xxxx@developer.gserviceaccount.com","principalSubject":"serviceAccount:servoce-xxxx@developer.gserviceaccount.com"},"authorizationInfo":[{"granted":true,"permission":"container.clusters.get","resourceAttributes":{}}],"methodName":"google.container.v1.ClusterManager.GetCluster","policyViolationInfo":{"orgPolicyViolationInfo":{}},"request":{"@type":"type.googleapis.com/google.container.v1alpha1.GetClusterRequest","name":"projects/elastic-product/locations/us-central1-a/clusters/demo-elastic-co","policy":"scalar-policy"},"requestMetadata":{"callerIp":"192.168.1.1","callerSuppliedUserAgent":"google-api-go-client/0.5 cluster-autoscaler,gzip(gfe)","destinationAttributes":{},"requestAttributes":{"auth":{},"time":"2022-06-01T11:15:10.836131149Z"}},"resourceLocation":{"currentLocations":["us-central1-a"]},"resourceName":"projects/elastic-product/zones/us-central1-a/clusters/demo-elastic-co","serviceName":"container.googleapis.com"},"receiveTimestamp":"2022-06-01T11:15:11.07151757Z","resource":{"labels":{"cluster_name":"demo-elastic-co","location":"us-central1-a","project_id":"elastic-product"},"type":"gke_cluster"},"severity":"INFO","timestamp":"2022-06-01T11:15:10.842495409Z","logging.googleapis.com/timestamp":"2022-06-01T11:15:10.842495409Z"}
{"insertId":"03adfb9f-71a3-4f41-9701-29b5542f4d23","logName":"projects/elastic-beats/logs/cloudaudit.googleapis.com%2Fdata_access","protoPayload":{"@type":"type.googleapis.com/google.cloud.audit.AuditLog","authenticationInfo":{"principalEmail":"xxx@xxx.xxx","principalSubject":"sub","serviceAccountKeyName":"//xxx@xxx"},"authorizationInfo":[{"granted":true,"permission":"iam.serviceAccounts.list","resource":"projects/project","resourceAttributes":{}}],"methodName":"google.iam.admin.v1.ListServiceAccounts","request":{"@type":"type.googleapis.com/google.iam.admin.v1.ListServiceAccountsRequest","name":"projects/project","page_token":"cg:FFFFFF"},"requestMetadata":{"callerIp":"private","callerSuppliedUserAgent":"google-api-go-client/0.5,gzip(gfe)","destinationAttributes":{},"requestAttributes":{"auth":{},"time":"2022-02-21T13:57:39.178418578Z"}},"resourceName":"projects/project","serviceName":"iam.googleapis.com","status":{}},"receiveTimestamp":"2022-02-21T13:57:39.341344991Z","resource":{"labels":{"location":"global","method":"google.iam.admin.v1.ListServiceAccounts","project_id":"project","service":"iam.googleapis.com","version":"v1"},"type":"api"},"severity":"INFO","timestamp":"2022-02-21T13:57:39.174555198Z"}
{"protoPayload":{"@type":"type.googleapis.com/google.cloud.audit.AuditLog","status":{"message":"InstancemigratedduringComputeEnginemaintenance."},"authenticationInfo":{"principalEmail":"system@google.com"},"serviceName":"compute.googleapis.com","methodName":"compute.instances.migrateOnHostMaintenance","resourceName":"projects/elastic-siem/zones/us-central1-c/instances/sep-perf-debian-11-155","request":{"@type":"type.googleapis.com/compute.instances.migrateOnHostMaintenance"}},"insertId":"-g2g374e10tyi","resource":{"type":"gce_instance","labels":{"instance_id":"5630355820693738547","zone":"us-central1-c","project_id":"elastic-siem"}},"timestamp":"2024-08-20T23:40:30.997109Z","severity":"INFO","labels":{"compute.googleapis.com/root_trigger_id":"b11f3ce7-7400-4ba4-9cee-eee4c65e38b4"},"logName":"projects/elastic-siem/logs/cloudaudit.googleapis.com%2Fsystem_event","operation":{"id":"systemevent-1724197136000-62025edd06400-961ecb86-ebb8062e","producer":"compute.instances.migrateOnHostMaintenance","first":true,"last":true},"receiveTimestamp":"2024-08-20T23:40:31.703530860Z"}
{"protoPayload":{"@type":"type.googleapis.com/google.cloud.audit.AuditLog","status":{"code": 7,"message":"PERMISSION_DENIED","details":[{"@type":"type.googleapis.com/google.rpc.PreconditionFailure","violations":[{"type":"VPC_SERVICE_CONTROLS","description":"ljv4RZNmza4g69MMoOXBtRrlNKRYTjjhgkadQiqlfhmDZhClaMVgjoWA"}]}]},"authenticationInfo":{},"requestMetadata":{"callerIp":"192.168.1.1","requestAttributes":{},"destinationAttributes":{}},"serviceName":"storage.googleapis.com","methodName":"google.storage.buckets.get","resourceName":"projects/elastic-siem","metadata":{"securityPolicyInfo":{"servicePerimeterName":"accessPolicies/30507210272/servicePerimeters/some_service","organizationId":"614830067722"},"vpcServiceControlsUniqueId":"ljv4RZNmza4g69MMoOXBtRrlNKRYTjjhgkadQiqlfhmDZhClaMVgjoWA","accessLevels":["accessPolicies/30507210272/accessLevels/thingy","accessPolicies/30507210272/accessLevels/test_us"],"@type":"type.googleapis.com/google.cloud.audit.VpcServiceControlAuditMetadata","ingressViolations":[{"servicePerimeter":"accessPolicies/30507210272/servicePerimeters/some_service","targetResource":"projects/elastic-siem/locations/us-central1"}],"violationReason":"NO_MATCHING_ACCESS_LEVEL","resourceNames":["projects/elastic-siem/locations/us-central1"]}},"insertId":"d21cmyd7av9","resource":{"type":"audited_resource","labels":{"project_id":"elastic-siem","method":"google.storage.buckets.get","service":"storage.googleapis.com"}},"timestamp":"2021-09-13T03:10:14.801613786Z","severity":"ERROR","logName":"projects/elastic-siem/logs/cloudaudit.googleapis.com%2Fpolicy","receiveTimestamp":"2021-09-13T03:10:15.410616031Z"}
{"insertId":"15ciwwfd47gf","logName":"projects/elastic/logs/cloudaudit.googleapis.com%2Fdata_access","protoPayload":{"@type":"type.googleapis.com/google.cloud.audit.AuditLog","authenticationInfo":{"principalEmail":"servoce-xxxx@developer.gserviceaccount.com","principalSubject":"serviceAccount:servoce-xxxx@developer.gserviceaccount.com"},"authorizationInfo":[{"granted": true,"permission":"container.clusters.get","resourceAttributes":{}}],"methodName":"google.container.v1.ClusterManager.GetCluster","policyViolationInfo":{"orgPolicyViolationInfo":{"payload":{"key1":"value1","key2":"value2"},"resourceType":"compute.googleapis.com/Instance","resourceTags":{"instance_id":"INSTANCE_ID","zone":"us-central1-a"},"violationInfo":[{"constraint":"compute.vmExternalIpAccess","errorMessage":"This policy disallows the use of external IP addresses for VM instances.","checkedValue":"Value","policyType":"CUSTOM_CONSTRAINT"}]}},"request":{"@type":"type.googleapis.com/google.container.v1alpha1.GetClusterRequest","name":"projects/elastic-product/locations/us-central1-a/clusters/demo-elastic-co","policy":"scalar-policy"},"requestMetadata":{"callerIp":"192.168.1.1","callerSuppliedUserAgent":"google-api-go-client/0.5 cluster-autoscaler,gzip(gfe)","destinationAttributes":{},"requestAttributes":{"auth":{},"time":"2022-06-01T11:15:10.836131149Z"}},"resourceLocation":{"currentLocations":["us-central1-a"]},"resourceName":"projects/elastic-product/zones/us-central1-a/clusters/demo-elastic-co","serviceName":"container.googleapis.com"},"receiveTimestamp":"2022-06-01T11:15:11.07151757Z","resource":{"labels":{"cluster_name":"demo-elastic-co","location":"us-central1-a","project_id":"elastic-product"},"type":"gke_cluster"},"severity":"INFO","timestamp":"2022-06-01T11:15:10.842495409Z","logging.googleapis.com/timestamp":"2022-06-01T11:15:10.842495409Z"}
{"protoPayload":{"@type":"type.googleapis.com/google.cloud.audit.AuditLog","status":{},"serviceName":"container.googleapis.com","methodName":"google.container.v1.ClusterManager.SetLabels","resourceName":"projects/elastic-siem/zones/us-central1-c/clusters/endpoint-gke-cluster","metadata":{"operationType":"UPDATE_CLUSTER"},"resourceLocation":{"currentLocations":["us-central1-c"]},"policyViolationInfo":{"orgPolicyViolationInfo":{}}},"insertId":"17ah0cpe10gvp","resource":{"type":"gke_cluster","labels":{"location":"us-central1-c","cluster_name":"endpoint-gke-cluster","project_id":"elastic-siem"}},"timestamp":"2024-08-23T02:12:01.626546355Z","severity":"NOTICE","logName":"projects/elastic-siem/logs/cloudaudit.googleapis.com%2Factivity","operation":{"id":"operation-1724379121483-d43ef943-bcf8-46e9-9ff2-ba71cfbc26b2","producer":"container.googleapis.com","last": true},"receiveTimestamp":"2024-08-23T02:12:02.419428097Z"}
{"protoPayload":{"@type":"type.googleapis.com/google.cloud.audit.AuditLog","authenticationInfo":{"principalEmail":"user@mycompany.com"},"authorizationInfo":[{"granted":true,"permission":"io.k8s.core.v1.pods.delete","resource":"core/v1/namespaces/default/pods/debug4"}],"methodName":"io.k8s.core.v1.pods.delete","request":{"@type":"meta.k8s.io/__internal.DeleteOptions","apiVersion":"meta.k8s.io/__internal","kind":"DeleteOptions","propagationPolicy":"Background"},"requestMetadata":{"callerIp":"67.43.156.0","callerSuppliedUserAgent":"kubectl/v1.26.3 (linux/amd64) kubernetes/9e64410"},"resourceName":"core/v1/namespaces/default/pods/debug4","response":{"@type":"core.k8s.io/v1.Pod","apiVersion":"v1","kind":"Pod","metadata":{"creationTimestamp":"2023-04-27T11:50:35Z","deletionGracePeriodSeconds":30,"deletionTimestamp":"2023-04-27T20:59:07Z","labels":{"run":"debug4"},"managedFields":[{"apiVersion":"v1","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:labels":{".":{},"f:run":{}}},"f:spec":{"f:containers":{"k:{\"name\":\"debug4\"}":{".":{},"f:image":{},"f:imagePullPolicy":{},"f:name":{},"f:resources":{},"f:stdin":{},"f:stdinOnce":{},"f:terminationMessagePath":{},"f:terminationMessagePolicy":{},"f:tty":{}}},"f:dnsPolicy":{},"f:enableServiceLinks":{},"f:hostNetwork":{},"f:restartPolicy":{},"f:schedulerName":{},"f:securityContext":{},"f:terminationGracePeriodSeconds":{}}},"manager":"kubectl-run","operation":"Update","time":"2023-04-27T11:50:35Z"},{"apiVersion":"v1","fieldsType":"FieldsV1","fieldsV1":{"f:status":{"f:conditions":{"k:{\"type\":\"ContainersReady\"}":{".":{},"f:lastProbeTime":{},"f:lastTransitionTime":{},"f:status":{},"f:type":{}},"k:{\"type\":\"Initialized\"}":{".":{},"f:lastProbeTime":{},"f:lastTransitionTime":{},"f:status":{},"f:type":{}},"k:{\"type\":\"Ready\"}":{".":{},"f:lastProbeTime":{},"f:lastTransitionTime":{},"f:status":{},"f:type":{}}},"f:containerStatuses":{},"f:hostIP":{},"f:phase":{},"f:podIP":{},"f:podIPs":{".":{},"k:{\"ip\":\"216.160.83.56\"}":{".":{},"f:ip":{}}},"f:startTime":{}}},"manager":"kubelet","operation":"Update","subresource":"status","time":"2023-04-27T11:50:36Z"}],"name":"debug4","namespace":"default","resourceVersion":"76620168","uid":"6661e893-99d5-4a9d-ac16-254a177e9516"},"spec":{"containers":[{"image":"ubuntu","imagePullPolicy":"Always","name":"debug4","resources":{},"stdin":true,"stdinOnce":true,"terminationMessagePath":"/dev/termination-log","terminationMessagePolicy":"File","tty":true,"volumeMounts":[{"mountPath":"/var/run/secrets/kubernetes.io/serviceaccount","name":"kube-api-access-pls9v","readOnly":true}]}],"dnsPolicy":"ClusterFirst","enableServiceLinks":true,"hostNetwork":true,"nodeName":"gke-sa-da-gke-lls-default-pool-1e5fc85d-9rug","preemptionPolicy":"PreemptLowerPriority","priority":0,"restartPolicy":"Never","schedulerName":"default-scheduler","securityContext":{},"serviceAccount":"default","serviceAccountName":"default","terminationGracePeriodSeconds":30,"tolerations":[{"effect":"NoExecute","key":"node.kubernetes.io/not-ready","operator":"Exists","tolerationSeconds":300},{"effect":"NoExecute","key":"node.kubernetes.io/unreachable","operator":"Exists","tolerationSeconds":300}],"volumes":[{"name":"kube-api-access-pls9v","projected":{"defaultMode":420,"sources":[{"serviceAccountToken":{"expirationSeconds":3607,"path":"token"}},{"configMap":{"items":[{"key":"ca.crt","path":"ca.crt"}],"name":"kube-root-ca.crt"}},{"downwardAPI":{"items":[{"fieldRef":{"apiVersion":"v1","fieldPath":"metadata.namespace"},"path":"namespace"}]}}]}}]},"status":{"conditions":[{"lastProbeTime":null,"lastTransitionTime":"2023-04-27T11:50:35Z","status":"True","type":"Initialized"},{"lastProbeTime":null,"lastTransitionTime":"2023-04-27T11:50:36Z","status":"True","type":"Ready"},{"lastProbeTime":null,"lastTransitionTime":"2023-04-27T11:50:36Z","status":"True","type":"ContainersReady"},{"lastProbeTime":null,"lastTransitionTime":"2023-04-27T11:50:35Z","status":"True","type":"PodScheduled"}],"containerStatuses":[{"containerID":"containerd://415af393459f3a8bccabb0ddd595e3276d2b5206bc3d1f34866c5fc6e14cd35f","image":"docker.io/library/ubuntu:latest","imageID":"docker.io/library/ubuntu@sha256:67211c14fa74f070d27cc59d69a7fa9aeff8e28ea118ef3babc295a0428a6d21","lastState":{},"name":"debug4","ready":true,"restartCount":0,"started":true,"state":{"running":{"startedAt":"2023-04-27T11:50:36Z"}}}],"hostIP":"216.160.83.56","phase":"Running","podIP":"216.160.83.56","podIPs":[{"ip":"216.160.83.56"}],"qosClass":"BestEffort","startTime":"2023-04-27T11:50:35Z"}},"serviceName":"k8s.io","status":{"code":0}},"insertId":"c9f95099-6738-4781-8993-58d5fbb5c2c0","resource":{"type":"k8s_cluster","labels":{"location":"europe-west1","cluster_name":"sa-da-gke-lls","project_id":"elastic-sa"}},"timestamp":"2023-04-27T20:58:37.419997Z","labels":{"authorization.k8s.io/reason":"access granted by IAM permissions.","authorization.k8s.io/decision":"allow"},"logName":"projects/elastic-sa/logs/cloudaudit.googleapis.com%2Factivity","operation":{"id":"c9f95099-6738-4781-8993-58d5fbb5c2c0","producer":"k8s.io","first":true,"last":true},"receiveTimestamp":"2023-04-27T20:59:08.485927903Z"}
{"insertId":"veqbqlc5a2","jsonPayload":{"access":{"callerIp":"89.160.20.156","callerIpGeo":{"regionCode":"DE"},"methodName":"v1.compute.projects.setCommonInstanceMetadata","principalEmail":"example.user@example.com","principalSubject":"user:example.user@example.com","serviceName":"compute.googleapis.com","userAgent":"google-cloud-sdk gcloud/525.0.0 command/gcloud.compute.ssh invocation-id/881a0585a52e4ff68bbaf3efb4f2da2c environment/None environment-version/None client-os/MACOSX client-os-ver/24.5.0 client-pltf-arch/arm interactive/True from-script/False python/3.13.4 term/xterm-256color (Macintosh; Intel Mac OS X 24.5.0),gzip(gfe)"},"actionTime":"2025-06-13T13:42:47.922290Z","actionType":"add_ssh_key","affectedResources":["//compute.googleapis.com/projects/10594"],"learnMoreUri":"https://cloud.google.com/security-command-center/docs/concepts-sensitive-actions-overview","sourceLogIds":[{"insertId":"3czf3od3","logTime":"2025-06-13T13:42:46.293601Z","queryUri":"https://console.cloud.google.com/logs/query;query=timestamp%3D%222025-06-13T13:42:46.293601Z%22%0AinsertId%3D%223czf3od3k16%22?project=elastic-sa","resourceContainer":"projects/elastic-sa"}]},"logName":"projects/elastic-sa/logs/sensitiveaction.googleapis.com%2Faction","receiveTimestamp":"2025-06-13T13:42:49.295214268Z","resource":{"labels":{"location":"global","resource_container":"//compute.googleapis.com/projects/10594"},"type":"sensitiveaction.googleapis.com/Location"},"severity":"NOTICE","timestamp":"2025-06-13T13:42:47.92229Z"}