GCP Data Access logs: off by default, and other blind spots
Why GCP Data Access audit logs are the usual dead end: off by default, 30-day retention, what goes unseen without them, and what to enable before an incident.
Posts tagged: #exfiltration
VPC Flow Logs analysis in GCP: spotting exfiltration
Use Google Cloud VPC Flow Logs in an investigation: record fields, sampling caveats, egress per external IP, and matching audit-log attacker IPs to VM traffic.
GCS and BigQuery exfiltration: evidence in audit logs
Prove or rule out data theft from Cloud Storage and BigQuery: bulk storage.objects.get, public buckets, HMAC keys, cross-project copies, shared disk images.