How to Export and Review Google Cloud Audit Logs

Summary

A practical guide to exporting Google Cloud audit logs with Logs Explorer or gcloud, covering log types, retention, permissions, useful filters, suspicious activity to review, and common troubleshooting steps.

Key points

Export logs as JSON through Logs Explorer or with gcloud logging read; include a timestamp filter because the default freshness window is one day.
Admin Activity and System Event logs are always on and retained for 400 days; Data Access logs are generally off by default and retained for 30 days once enabled.
Data Access logs require the Private Logs Viewer role; Logs Viewer covers Admin Activity, System Event, and Policy Denied logs.
For larger exports, raise the result limit or split the time window; JSON output can be converted to newline-delimited JSON with jq.
Review service-account key creation, IAM policy changes, altered or deleted log sinks, unusual compute regions, and bursts of permission-denied events.
Organization- and folder-level activity must be queried at those scopes; routed sink copies may provide older history than the standard log retention.

Article Details

Defense Focus: Export and review Google Cloud audit logs to investigate identity and configuration changes, detect suspicious activity, and identify attempts to alter or suppress logging.
Detection Methods: Filter Cloud Audit Logs for service-account key creation using protoPayload.methodName="google.iam.admin.v1.CreateServiceAccountKey".
Review SetIamPolicy events for grants such as roles/owner, roles/editor, or allUsers.
Look for UpdateSink, DeleteSink, and new log exclusions that may redirect or suppress logs.
Investigate v1.compute.instances.insert events in unusual regions.
Review bursts of status.code: 7 (PERMISSION_DENIED) for possible credential probing.
Filter by principalEmail to examine activity associated with one identity.
Data Sources: Google Cloud Admin Activity audit logs
Google Cloud System Event audit logs
Google Cloud Data Access audit logs
Google Cloud Policy Denied audit logs
GKE Kubernetes audit logs recorded in Cloud Audit Logs
Audit-log copies routed through sinks to Cloud Storage or BigQuery
Rule Types: Google Cloud audit-log detection rules
Cloud Logging filter queries
Platforms: Google Cloud
Cloud Logging
Logs Explorer
LogTotal
Prime Core
Defensive Actions: Enable Data Access logging where needed; it is off by default except for BigQuery, and logs are retained for 30 days once enabled.
Use the appropriate Logs Viewer or Private Logs Viewer permissions to access the relevant audit logs.
Include an explicit timestamp range in gcloud logging read filters; raise the result limit or split the time window when needed.
Query organization- or folder-level logs at the corresponding scope rather than relying only on project-level logs.
Export larger or older log histories from sinks routed to Cloud Storage or BigQuery.
Review and sanitize exported data before uploading it to LogTotal.