Cloud

GCP Cloud Audit Logs

GCP Cloud Audit Logs — API calls across Compute Engine, IAM, Cloud Storage, GKE, BigQuery, and VPC networking from a multi-project organization. Includes console logins, service account operations, error injection, and 3 caller identity types.

View on GitHub

Quick Start

uv tool install eventum-generator
git clone https://github.com/eventum-generator/content-packs.git
cd content-packs
eventum generate \
  --path generators/cloud-gcp-audit/generator.yml \
  --id gcp-audit \
  --live-mode true

Event Types

Event ID	Description	Frequency	Category
v1.compute.instances.list	List Compute Engine instances	~12%	host
GetIamPolicy	Get project IAM policy	~10%	iam
storage.objects.get	Get a Cloud Storage object	~9%	file
v1.compute.instances.get	Get instance details	~8%	host
google.login.LoginService.loginSuccess	Console login	~8%	authentication
google.container.v1.ClusterManager.GetCluster	Get GKE cluster details	~8%	configuration
v1.compute.instances.insert	Create a new VM instance	~5%	host
google.cloud.bigquery.v2.JobService.InsertJob	Run BigQuery query/load job	~6%	database

Realism Features

Jinja2 macros eliminate boilerplate across 22 templates
3 caller identity types — Service Account (55%), User (40%), GCP Service (5%)
Error injection (~4%) — 20 realistic error scenarios mapped to specific API methods
Console login flow with ~5% failure rate
Multi-project environment — 3 GCP projects (production, staging, development)
10 IAM users across 7 departments, 10 service accounts
6 GCP services — Compute, IAM, Storage, GKE, BigQuery, Networking

Sample Output

{
    "@timestamp": "2026-03-04T14:22:31+00:00",
    "cloud": {
        "availability_zone": "us-central1-a",
        "project": { "id": "acme-prod-001", "name": "Acme Production" },
        "provider": "gcp",
        "region": "us-central1"
    },
    "event": {
        "action": "v1.compute.instances.insert",
        "category": ["host", "configuration"],
        "dataset": "gcp.audit",
        "kind": "event",
        "module": "gcp",
        "outcome": "success",
        "provider": "activity",
        "type": ["creation", "allowed"]
    },
    "gcp": {
        "audit": {
            "authentication_info": {
                "principal_email": "michael.chen@acme.io"
            },
            "authorization_info": [{
                "granted": true,
                "permission": "compute.instances.create",
                "resource_attributes": {
                    "name": "projects/acme-prod-001/zones/us-central1-a/instances/web-server-a1b2",
                    "service": "compute",
                    "type": "compute.instances"
                }
            }],
            "method_name": "v1.compute.instances.insert",
            "request_metadata": {
                "caller_ip": "198.51.100.25",
                "caller_supplied_user_agent": "google-cloud-sdk gcloud/462.0.1"
            },
            "resource": {
                "labels": {
                    "instance_id": "1234567890123456789",
                    "project_id": "acme-prod-001",
                    "zone": "us-central1-a"
                },
                "type": "gce_instance"
            },
            "resource_name": "projects/acme-prod-001/zones/us-central1-a/instances/web-server-a1b2",
            "service_name": "compute.googleapis.com",
            "type": "type.googleapis.com/google.cloud.audit.AuditLog"
        }
    },
    "service": { "name": "compute.googleapis.com" },
    "source": { "ip": "198.51.100.25" }
}

Parameters

Parameter	Default	Description
agent_id	b2c3d4e5-...	Filebeat agent UUID
agent_version	8.17.0	Elastic Agent version
error_rate	4	Error injection rate (percentage, 0-100)

Related Generators

Cloud

AWS CloudTrail Management Events

AWS CloudTrail audit trail — API calls across EC2, IAM, STS, and S3 from a multi-account organization. Includes console logins, role assumptions, error injection, and 4 identity types.

Cloud

AWS GuardDuty Findings

AWS GuardDuty threat detection findings across EC2, IAM, and S3 resources. Covers 8 categories — Recon, UnauthorizedAccess, Policy, Trojan, Impact, CryptoCurrency, Stealth, and Backdoor — with 27 finding types, 10 threat actor IPs, and geo/ASN enrichment.

Cloud

AWS VPC Flow Logs

AWS VPC Flow Logs (v5) — network traffic records across multiple accounts, VPCs, and subnets. TCP/UDP/ICMP flows with ACCEPT/REJECT actions, NAT gateway traffic, and realistic byte/packet distributions.