Collect Google Cloud SQL logs

This document describes how you can export Cloud SQL logs by enabling Google Cloud telemetry ingestion to Google Security Operations and how Cloud SQL logs fields map to Google Security Operations Unified Data Model (UDM) fields.

For more information, see Data ingestion to Google Security Operations overview .

A typical deployment consists of Cloud SQL logs enabled for ingestion to Google Security Operations. Each customer deployment might differ from this representation and might be more complex.

The deployment contains the following components:

• Google Cloud: The Google Cloud services and products from which you collect logs

• Cloud SQL logs: The Cloud SQL logs that are enabled for ingestion to Google Security Operations

• Google Security Operations: Retains and analyzes Cloud SQL logs and Google Workspace audit logs

An ingestion label identifies the parser which normalizes raw log data to structured UDM format. The information in this document applies to the parser with GCP_CLOUDSQL ingestion label.

Before you begin

• Ensure that you have set up access control for your organization and resources using Identity and Access Management (IAM). For more information about access control, see Access control for organizations with IAM .

• Ensure that all systems in the deployment architecture are configured in the UTC time zone.

• Verify the methods that the Cloud SQL parser supports. The following table lists the resources and methods supported by the Cloud SQL parser:

  flags	list

Configure ingestion of Cloud SQL logs

To ingest Cloud SQL logs to Google Security Operations, follow the steps on the Ingest Google Cloud logs to Google Security Operations page.

If you encounter issues when you ingest Cloud SQL logs, contact Google Security Operations support .

Supported Cloud SQL log formats

The Cloud SQL parser supports logs in JSON format.

Supported Cloud SQL sample logs

• JSON

   {
    "protoPayload": {
      "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
      "status": {},
      "authenticationInfo": {
        "principalEmail": "test.user@example.com"
      },
      "requestMetadata": {
        "callerIp": "198.51.100.0",
        "requestAttributes": {
          "time": "2023-05-18T06:16:08.481272Z",
          "auth": {}
        },
        "destinationAttributes": {}
      },
      "serviceName": "cloudsql.googleapis.com",
      "methodName": "cloudsql.backupRuns.list",
      "authorizationInfo": [
        {
          "resource": "projects/test-project/instances/test-instance",
          "permission": "cloudsql.backupRuns.list",
          "granted": true,
          "resourceAttributes": {
            "service": "sqladmin.googleapis.com",
            "name": "projects/test-project/instances/test-instance",
            "type": "sqladmin.googleapis.com/Instance"
          }
        }
      ],
      "resourceName": "projects/test-project/instances/test-instance",
      "request": {
        "instance": "test-instance",
        "maxResults": 1000,
        "project": "dummy-project",
        "@type": "type.googleapis.com/google.cloud.sql.v1beta4.SqlBackupRunsListRequest"
      }
    },
    "insertId": "9fsk13e6h22g",
    "resource": {
      "type": "cloudsql_database",
      "labels": {
        "database_id": "test-project:test-instance",
        "region": "us-central1",
        "project_id": "dummy-project"
      }
    },
    "timestamp": "2023-05-18T06:16:08.383405Z",
    "severity": "INFO",
    "logName": "projects/test-project/logs/cloudaudit.googleapis.com%2Fdata_access",
    "receiveTimestamp": "2023-05-18T06:16:08.563749821Z"
  } 
  

Field mapping reference

This section explains how the Google Security Operations parser maps Cloud SQL logs fields to Google Security Operations Unified Data Model (UDM) fields.

The following labels fields for UDM nouns are deprecated: about.labels , intermediary.labels , observer.labels , principal.labels , src.labels , security_result.about.labels , and target.labels . For existing parsers, in addition to these UDM fields, the logs fields are also mapped to key/value additional.fields UDM fields. For new parsers, the key/value settings in additional.fields UDM fields are used instead of the deprecated labels UDM fields. We recommend that you update the existing rules to use the key/value settings in the additional.fields UDM fields instead of the deprecated labels UDM fields.

What's next

• Data ingestion to Google Security Operations