Collect Google Cloud Run functions context logs

This document describes how fields of Google Cloud Run functions context logs map to Google Security Operations Unified Data Model (UDM) fields.

An ingestion label identifies the parser which normalizes raw log data to structured UDM format. The information in this document applies to the parser with the GCP_CLOUD_FUNCTIONS_CONTEXT ingestion label.

For information about other context parsers that Google SecOps supports, see Google SecOps context parsers .

Supported Google Cloud Run functions context logs log formats

The Google Cloud Run functions context logs parser supports logs in JSON format.

Supported Google Cloud Run functions context logs sample logs

• JSON:

   {
    "name": "//cloudfunctions.googleapis.com/projects/cspm-32817/locations/asia-south1/functions/GetNSPAAlertsFunction-asia-south1",
    "assetType": "cloudfunctions.googleapis.com/CloudFunction",
    "resource": {
      "version": "v1",
      "discoveryDocumentUri": "https://cloudfunctions.googleapis.com/$discovery/rest",
      "discoveryName": "CloudFunction",
      "parent": "//cloudresourcemanager.googleapis.com/projects/1063885730524",
      "data": {
        "availableMemoryMb": 256,
        "buildId": "843ffd9a-eab1-4022-8d0f-256e55d110d3",
        "buildName": "projects/1063885730524/locations/asia-south1/builds/843ffd9a-eab1-4022-8d0f-256e55d110d3",
        "dockerRegistry": "CONTAINER_REGISTRY",
        "entryPoint": "google_cloud_function_handler",
        "eventTrigger": {
          "eventType": "google.pubsub.topic.publish",
          "failurePolicy": {},
          "resource": "projects/cspm-32817/topics/GetNSPAAlerts-asia-south1",
          "service": "pubsub.googleapis.com"
        },
        "ingressSettings": "ALLOW_ALL",
        "labels": {
          "deployment-tool": "console-cloud"
        },
        "maxInstances": 3000,
        "name": "projects/cspm-32817/locations/asia-south1/functions/GetNSPAAlertsFunction-asia-south1",
        "runtime": "python37",
        "serviceAccountEmail": "dummy@user.com",
        "sourceArchiveUrl": "gs://cloudfunctionscrest/GetNetskopeSecurityPostureAssessmentFunction (2).zip",
        "status": "ACTIVE",
        "timeout": "300s",
        "updateTime": "2023-04-21T13:33:30.711Z",
        "versionId": "1"
      }
    },
    "ancestors": [
      "projects/1063885730524",
      "organizations/595779152576"
    ]
  } 
  

Field mapping reference

This section explains how the Google SecOps parser maps Google Cloud Run functions context logs fields to Google SecOps UDM fields.