GCP Audit Logs - List GCP Organization Policy Modifications by Principal

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Content Index

---

Lists all Google Cloud Platform organization policy deletion and update operations performed by principals (users and service accounts).

Attribute	Value
Type	Hunting Query
Solution	Google Cloud Platform Audit Logs
ID	7a3e8c5f-4b9d-4e6a-8c7b-5f2a9d6e8b3c
Tactics	DefenseEvasion
Techniques	T1562.001
Required Connectors	GCPAuditLogsDefinition
Source	View on GitHub

Tables Used

This content item queries data from the following tables:

Table	Transformations	Ingestion API	Lake-Only
GCPAuditLogs	✓	✓	?

---

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Hunting Queries · Back to Google Cloud Platform Audit Logs