professional-services/examples/audit-log-examples/cloud-identity/identity-user-login.log at main · atognolag/professional-services · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
Query: protoPayload.methodName:"google.login.LoginService.loginSuccess"
Workspace Login:
{
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "principalEmail": "admin@gsecurity.net"
    },
    "requestMetadata": {
      "callerIp": "2600::111",
      "requestAttributes": {},
      "destinationAttributes": {}
    },
    "serviceName": "login.googleapis.com",
    "methodName": "google.login.LoginService.loginSuccess",
    "resourceName": "organizations/614830067722",
    "metadata": {
      "activityId": {
        "timeUsec": "1628808070524169",
        "uniqQualifier": "556196293031"
      },
      "@type": "type.googleapis.com/ccc_hosted_reporting.ActivityProto",
      "event": [
        {
          "parameter": [
            {
              "type": "TYPE_STRING",
              "label": "LABEL_OPTIONAL",
              "name": "login_type",
              "value": "google_password"
            },
            {
              "multiStrValue": [
                "password"
              ],
              "label": "LABEL_REPEATED",
              "name": "login_challenge_method",
              "type": "TYPE_STRING"
            },
            {
              "name": "is_suspicious",
              "type": "TYPE_BOOL",
              "boolValue": false,
              "label": "LABEL_OPTIONAL"
            },
            {
              "type": "TYPE_STRING",
              "value": "IIPB-JS7s6ibgwE",
              "label": "LABEL_OPTIONAL",
              "name": "dusi"
            }
          ],
          "eventName": "login_success",
          "eventType": "login"
        }
      ]
    }
  },
  "insertId": "ezipchda58s",
  "resource": {
    "type": "audited_resource",
    "labels": {
      "service": "login.googleapis.com",
      "method": "google.login.LoginService.loginSuccess"
    }
  },
  "timestamp": "2021-08-12T22:41:10.524169Z",
  "severity": "NOTICE",
  "logName": "organizations/614830067722/logs/cloudaudit.googleapis.com%2Fdata_access",
  "receiveTimestamp": "2021-08-13T00:07:51.992089275Z"
}