Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
The Google Cloud Platform Compute Engine data connector provides the capability to ingest Compute Engine Audit logs into Microsoft Sentinel using the Google Cloud Compute Engine API. Refer to Cloud Compute Engine API documentation for more information.
Table attributes
| Attribute | Value |
|---|---|
| Resource types | - |
| Categories | Security |
| Solutions | SecurityInsights |
| Basic log | Yes |
| Ingestion-time transformation | No |
| Sample Queries | - |
Columns
| Column | Type | Description |
|---|---|---|
| _BilledSize | real | The record size in bytes |
| GCPResource | dynamic | Information about the monitored resource associated with the log entry, such as VM instance, database, etc. |
| InsertId | string | A unique identifier for the log entry used to prevent duplication. |
| _IsBillable | string | Specifies whether ingesting the data is billable. When _IsBillable is false ingestion isn't billed to your Azure account |
| Labels | dynamic | A set of key-value pairs that provide additional metadata about the log entry. |
| LogName | string | The full resource name of the log to which this log entry belongs. |
| Operation | dynamic | Information about an operation associated with the log entry, such as an audit trail or trace context. |
| ProtoPayload | dynamic | The structured payload of the log entry, typically in protocol buffer format; contains detailed event data. |
| ReceiveTimestamp | datetime | The time the log entry was received by the logging system. |
| Severity | string | The severity level of the log entry (e.g., DEBUG, INFO, WARNING, ERROR, CRITICAL). |
| SourceSystem | string | The type of agent the event was collected by. For example, OpsManager for Windows agent, either direct connect or Operations Manager, Linux for all Linux agents, or Azure for Azure Diagnostics |
| TenantId | string | The Log Analytics workspace ID |
| TimeGenerated | datetime | The actual time the event described by the log entry occurred. |
| Type | string | The name of the table |