Resource Manager context logs

This document describes how fields of Resource Manager context logs map to Google Security Operations Unified Data Model (UDM) fields.

An ingestion label identifies the parser which normalizes raw log data to structured UDM format. The information in this document applies to the parser with the GCP_RESOURCE_MANAGER_CONTEXT ingestion label.

For information about other context parsers that Google Security Operations supports, see Google Security Operations context parsers .

Supported Resource Manager context logs log formats

The Resource Manager context logs parser supports logs in JSON format.

Supported Resource Manager context logs sample logs

• JSON:

   {
    "name": "//cloudresourcemanager.googleapis.com/folders/722926615140",
    "assetType": "cloudresourcemanager.googleapis.com/Folder",
    "resource": {
      "version": "v2",
      "discoveryDocumentUri": "https://cloudresourcemanager.googleapis.com/$discovery/rest?version=v2",
      "discoveryName": "Folder",
      "parent": "//cloudresourcemanager.googleapis.com/organizations/299419016487",
      "data": {
        "createTime": "2022-06-08T22:40:08.491Z",
        "displayName": "OrgChangeSourceFolder",
        "lifecycleState": "ACTIVE",
        "name": "folders/dummy",
        "parent": "organizations/dummy"
      }
    },
    "ancestors": [
      "folders/722926615140",
      "organizations/299419016487"
    ]
  } 
  

Field mapping reference

The following table explains how the Google Security Operations parser maps Resource Manager context logs fields to Google Security Operations Unified Data Model (UDM) fields.

Need more help? Get answers from Community members and Google SecOps professionals.