cloudaudit.googleapis.com · vpc_flows

Was our Google Cloud project compromised?

Drop your Cloud Audit Logs and VPC Flow Logs, get a verdict, an incident timeline and a remediation checklist. Analyzed in your browser with WebAssembly — nothing is uploaded.

Drop your Google Cloud log export here

Cloud Audit Logs (Admin Activity, Data Access, System Event, Policy Denied) and VPC Flow Logs: Logs Explorer JSON downloads, log-sink files copied from Cloud Storage (whole folders or ZIP), gcloud logging read output, BigQuery JSON exports. .json, .jsonl and .gz files.

The sample is a fictional incident (invented company, people, keys and IP addresses): a leaked service-account key, roles/owner for a Gmail account, a startup-script backdoor, a bucket made public and a deleted log sink.

Analyzed in your browser with WebAssembly — nothing is uploaded.

How to get your logs

From nothing to a file dropped here in about two minutes. Start with the first tab; the others cover the console, existing sinks and where each log lives.

Collect the logs
Drop the file, folder or ZIP here
Analyzed in your browser — nothing is uploaded

Recommended

Needs: Logs Viewer role (roles/logging.viewer) on the project, plus Private Logs Viewer (roles/logging.privateLogViewer) to include Data Access logs. Nothing to install.

In the Google Cloud console, select the affected project and open Cloud Shell (the >_ button in the top bar).

Paste this to export the last 30 days of audit logs and VPC Flow Logs as one gzipped JSON file:

gcloud logging read 'logName:"cloudaudit.googleapis.com" OR logName:"vpc_flows"' --freshness=30d --format=json | gzip > gcp-logs.json.gz

3
Download it to your computer (or use ⋮ More → Download in Cloud Shell), then drop gcp-logs.json.gz here:
```
cloudshell download gcp-logs.json.gz
```
4
Optional: organization-level logs (IAM and organization-policy changes made on the organization itself) are stored separately. Replace ORG_ID (see gcloud organizations list), download that file too and drop both together:
```
gcloud logging read 'logName:"cloudaudit.googleapis.com" OR logName:"vpc_flows"' --organization=ORG_ID --freshness=30d --format=json | gzip > gcp-org-logs.json.gz
```

Gotchas

Export now: Data Access, Policy Denied and VPC Flow Logs are kept 30 days (Admin Activity 400), and an attacker with Owner rights can delete logs and sinks. Raise --freshness (up to 400d) to reach further back.
Data Access logs are off by default for most services, and exporting them needs the Private Logs Viewer role: without them, data reads are invisible.
Download JSON, never CSV (not read), and mind the console's 10,000-entry cap per download. All timestamps are UTC.

§ 01

What this tool does

GCP Forensics answers the first question of a cloud incident: was our Google Cloud project compromised, and how? It reads Cloud Audit Logs — the who-did-what-where record Google Cloud keeps for every API call — and VPC Flow Logs, then runs a set of detections written for the way real Google Cloud intrusions unfold.

You get a verdict (Clean, Suspicious or Compromised) with its reasons, the findings with their MITRE ATT&CK techniques and evidence entries, an incident timeline, a pivot on principals, service-account keys, IP addresses, projects and resources, and a prioritized remediation checklist.

Everything runs in your browser: a Rust parser compiled to WebAssembly streams the files in a Web Worker. Your logs, which contain e-mail addresses, IPs and resource names, never leave your machine.

§ 02

What it detects

Stolen credentials: service-account keys created or uploaded, keys used from Internet IPs and from new IPs, impersonation (actAs, Token Creator), bursts of permission-denied calls.
IAM takeover: Owner / Editor / IAM admin grants, personal gmail.com accounts and unknown domains added to IAM policies, organization-policy and custom-role changes.
Compute abuse: startup-script backdoors, SSH keys injected in metadata, OS Login disabled, GPU instances, bursts of VM creations, VMs in never-used regions, firewalls opened to 0.0.0.0/0.
Data theft: buckets and other resources made public (allUsers), bulk storage.objects.get, BigQuery copies to other projects, shared images and snapshots, large transfers to Internet IPs in VPC Flow Logs.
Anti-forensics: log sinks deleted or modified, exclusions, log buckets and logs deleted, Data Access logging disabled, Security Command Center notifications removed, KMS key versions destroyed.
Correlation: the same IP or principal moving from suspicious access to takeover actions is raised as a critical attack chain.

§ 03

Before the next incident

Collecting logs for the current incident? Use the collection guide under the drop zone.

To make sure the next investigation has the evidence it needs:

No sink yet? Create one now (Logging → Log Router → Create sink → Cloud Storage) so the next events are preserved even if logs are deleted.
Enable Data Access audit logs (IAM & Admin → Audit Logs) at least for Cloud Storage, IAM and Secret Manager: without them, data theft is invisible.
Route audit logs of the whole organization to a locked bucket in a separate project that project owners cannot modify.
Enable VPC Flow Logs on sensitive subnets.

§ 04

Limits

No detection is not proof of absence: the verdict only covers the logs you dropped, and Data Access logs are off by default for most services.
Heuristics point, they do not prove: a key used from a CI provider's IP or an owner granted to a consultant can be legitimate. Confirm each finding with its owner.
GKE / Kubernetes API audit entries are handed to Kubernetes Forensics, and Google Workspace audit entries to Google Workspace Forensics.
Up to 100,000 routine events are listed in the table (flagged ones are always kept); detections and entities cover every entry. Very large exports are limited by the browser's memory for the result, not for the input, which is streamed.
BigQuery Avro / Parquet exports and Logs Explorer CSV downloads are not read: export as JSON.

§ 05

What to do next

If the verdict is Suspicious or Compromised, contain first, then investigate: work through the tool's remediation checklist (most severe items first), preserve the logs, and follow Google's own guidance below.

The checklist is generated from your findings in the Checklist tab of the results.

§ 06

Detection rules

Detections are data, not code: every rule lives in rules/gcp.rules.json (Sigma-style conditions on LogEntry fields) so it can be reviewed, tuned and reused. Stateful analytics and the attack-chain correlation keep their thresholds in the same file.

Rule	Severity	Tactic	MITRE ATT&CK
Service account key created `sa_key_created`	Medium	Persistence	T1098.001
Public key uploaded to a service account `sa_key_uploaded`	High	Persistence	T1098.001
Service account key used from a public IP `sa_key_used_external`	Medium	Initial access	T1078.004
Service account created `sa_created`	Low	Persistence	T1136.003
Service account impersonation `sa_impersonation`	Medium	Privilege escalation	T1550.001
Impersonation role granted `token_creator_granted`	High	Privilege escalation	T1098.003
Owner, Editor or IAM admin role granted `owner_editor_granted`	High	Privilege escalation	T1098.003
Personal Gmail account granted access `consumer_account_granted`	High	Persistence	T1098.003
Owner granted to a personal Gmail account `owner_to_consumer`	Critical	Privilege escalation	T1098.003
Resource made public (allUsers) `public_access_granted`	Critical	Exfiltration	T1530 T1537
Organization policy changed `org_policy_changed`	Medium	Defense evasion	T1484
Custom role created or changed `custom_role_changed`	Low	Privilege escalation	T1098.003
Cloud Storage HMAC key created `hmac_key_created`	Medium	Persistence	T1098.001
Startup script added or changed `startup_script_changed`	High	Persistence	T1037 T1651
SSH key added to metadata `ssh_key_added`	Medium	Persistence	T1098.004
OS Login disabled or SSH-key blocking changed `oslogin_changed`	High	Defense evasion	T1098.004 T1556
GPU instance created `gpu_instance_created`	Medium	Impact	T1496
Burst of VM creations `instance_burst`	High	Impact	T1496
Firewall opened to the Internet `firewall_opened`	Medium	Defense evasion	T1562.007
Bulk Cloud Storage downloads `bulk_object_reads`	High	Exfiltration	T1530
BigQuery data copied to another project `bq_foreign_export`	High	Exfiltration	T1537
Image, snapshot or disk shared `image_shared`	Medium	Exfiltration	T1537
Log sink deleted `sink_deleted`	High	Defense evasion	T1562.008
Log sink modified `sink_modified`	Medium	Defense evasion	T1562.008
Log exclusion created or changed `log_exclusion_created`	Medium	Defense evasion	T1562.008
Log bucket deleted or changed `log_bucket_changed`	Medium	Defense evasion	T1562.008
Logs deleted `log_deleted`	High	Defense evasion	T1070
Data Access audit logging disabled `audit_logging_disabled`	High	Defense evasion	T1562.008
Security Command Center alerting removed `scc_notification_removed`	High	Defense evasion	T1562
KMS key version destroyed `kms_key_destroyed`	High	Impact	T1485 T1486
Project deleted `project_deleted`	High	Impact	T1485
Burst of permission-denied calls `permission_denied_burst`	Medium	Discovery	T1580 T1526
Service account key used from a new IP `sa_key_new_ip`	High	Initial access	T1078.004
Access granted to an unknown domain `new_external_domain`	Medium	Persistence	T1098.003
VM created in a never-used region `new_zone_instance`	Medium	Defense evasion	T1535
Large transfer to an Internet IP `flow_large_egress`	Medium	Exfiltration	T1048
Suspicious IP also talking to your VMs `flow_ioc_match`	High	Command and control	T1071
Attack chain: stolen access, then takeover `attack_chain`	Critical	Impact

§ 07

FAQ

Are my logs uploaded anywhere?

No. The files are read by your browser and analyzed by a WebAssembly module in a Web Worker. There is no server-side processing: you can disconnect from the network after the page has loaded.

How do I know if a service account key leaked?

Look for the key being used from IP addresses outside Google Cloud, especially addresses it had never used before, followed by IAM changes or enumeration (bursts of permission-denied calls). The tool flags all three and links them into an attack chain. Disable the key first, then investigate.

Which Google Cloud logs do I need?

Admin Activity audit logs are always on and free; they show IAM, compute, logging and configuration changes. Data Access audit logs show data reads (buckets, secrets) but must be enabled. VPC Flow Logs show network traffic of the VMs. Export all three for the suspected period.

Can it read a whole log-sink bucket?

Yes. Copy the bucket with gsutil or gcloud storage and drop the folder (or a ZIP of it). Files are streamed and gzip is decompressed in the browser, so multi-gigabyte exports are fine.

What about GKE and Google Workspace logs?

Kubernetes API audit entries (serviceName k8s.io) are counted and handed to Kubernetes Forensics; Google Workspace audit entries to Google Workspace Forensics. Both are sister tools built the same way.

Is this an official Google tool?

No. GCP Forensics is an independent tool, not affiliated with, endorsed or sponsored by Google. Google Cloud is a trademark of Google LLC.

Blog

Read the blog

Sep 27, 2026

GCP Data Access logs: off by default, and other blind spots

Why GCP Data Access audit logs are the usual dead end: off by default, 30-day retention, what goes unseen without them, and what to enable before an incident.

#google-cloud #cloud-audit-logs #incident-response

Sep 24, 2026

A GCP compromise walkthrough (fictional case study)

A fictional Google Cloud incident investigated end to end: leaked CI key, Owner for a Gmail account, startup-script backdoor, public bucket, deleted log sink.

#google-cloud #incident-response #cloud-audit-logs

Sep 22, 2026

VPC Flow Logs analysis in GCP: spotting exfiltration

Use Google Cloud VPC Flow Logs in an investigation: record fields, sampling caveats, egress per external IP, and matching audit-log attacker IPs to VM traffic.

#google-cloud #vpc-flow-logs #exfiltration