Cyyder Google Cloud SOC Sandbox v1.0

org 882134 · 4 projects · 5 ingestion nodes · telemetry live

Multi-Project Google Cloud Environment

org 882134 · cyyder.io

prod-organization-core

Critical

Org root, IAM, Secret Manager, KMS

412 assets monitored

gke-cluster-prod

High

Workloads, GKE, Cloud Run

268 assets monitored

data-warehouse-bq

Critical

BigQuery, Dataflow, PII datasets

154 assets monitored

ci-cd-pipeline-project

High

Cloud Build, Artifact Registry, Terraform

96 assets monitored

audit pipeline

GCP ProjectsCloud Logging RouterLog Sinks (Pub/Sub)Google SecOps (UDM)SCC + SOC Console

Telemetry Ingestion Nodes

5 / 5 healthy

  • Google Cloud Audit Logs

    Admin Activity · Data Access · System Event

    12.4k EPS

  • VPC Flow Logs

    5s aggregation · 100% sampling on prod

    48.9k EPS

  • Kubernetes Audit Logs

    GKE control plane, RequestResponse level

    6.1k EPS

  • Google SecOps

    UDM normalisation · YARA-L rule engine

    67k EPS in

  • Security Command Center

    ETD · SHA · Posture findings

    310 findings/d

Live Telemetry Stream — protoPayload

cloudaudit.googleapis.com
live audit ingest · 12 events buffered
{"timestamp":"2026-08-04T02:47:33.436Z","protoPayload.methodName":"jobservice.insert","protoPayload.serviceName":"bigquery.googleapis.com","resource.labels.project_id":"data-warehouse-bq","authenticationInfo.principalEmail":"terraform-admin@prod-organization-core.iam.gserviceaccount.com","requestMetadata.callerIp":"34.89.12.7","severity":"INFO"}
{"timestamp":"2026-08-04T02:47:33.436Z","protoPayload.methodName":"google.cloud.run.v1.Services.SetIamPolicy","protoPayload.serviceName":"run.googleapis.com","resource.labels.project_id":"gke-cluster-prod","authenticationInfo.principalEmail":"a.petrov@cyyder.io","requestMetadata.callerIp":"35.204.11.9","severity":"INFO"}
{"timestamp":"2026-08-04T02:47:33.436Z","protoPayload.methodName":"storage.objects.get","protoPayload.serviceName":"storage.googleapis.com","resource.labels.project_id":"data-warehouse-bq","authenticationInfo.principalEmail":"d.ionescu@cyyder.io","requestMetadata.callerIp":"89.147.22.10","severity":"INFO"}
{"timestamp":"2026-08-04T02:47:33.436Z","protoPayload.methodName":"AccessSecretVersion","protoPayload.serviceName":"secretmanager.googleapis.com","resource.labels.project_id":"prod-organization-core","authenticationInfo.principalEmail":"terraform-admin@prod-organization-core.iam.gserviceaccount.com","requestMetadata.callerIp":"34.89.12.7","severity":"INFO"}
{"timestamp":"2026-08-04T02:47:33.436Z","protoPayload.methodName":"SetIamPolicy","protoPayload.serviceName":"cloudresourcemanager.googleapis.com","resource.labels.project_id":"prod-organization-core","authenticationInfo.principalEmail":"bq-export-runner@data-warehouse-bq.iam.gserviceaccount.com","requestMetadata.callerIp":"185.220.101.44","severity":"INFO"}
{"timestamp":"2026-08-04T02:47:33.436Z","protoPayload.methodName":"google.logging.v2.ConfigServiceV2.DeleteSink","protoPayload.serviceName":"logging.googleapis.com","resource.labels.project_id":"prod-organization-core","authenticationInfo.principalEmail":"m.varga@cyyder.io","requestMetadata.callerIp":"89.147.22.10","severity":"INFO"}
{"timestamp":"2026-08-04T02:47:33.436Z","protoPayload.methodName":"google.devtools.cloudbuild.v1.UpdateBuildTrigger","protoPayload.serviceName":"cloudbuild.googleapis.com","resource.labels.project_id":"ci-cd-pipeline-project","authenticationInfo.principalEmail":"cloudbuild@ci-cd-pipeline-project.iam.gserviceaccount.com","requestMetadata.callerIp":"185.220.101.44","severity":"INFO"}
{"timestamp":"2026-08-04T02:47:33.436Z","protoPayload.methodName":"Decrypt","protoPayload.serviceName":"cloudkms.googleapis.com","resource.labels.project_id":"prod-organization-core","authenticationInfo.principalEmail":"a.petrov@cyyder.io","requestMetadata.callerIp":"35.204.11.9","severity":"INFO"}
{"timestamp":"2026-08-04T02:47:33.436Z","protoPayload.methodName":"google.devtools.cloudbuild.v1.UpdateBuildTrigger","protoPayload.serviceName":"cloudbuild.googleapis.com","resource.labels.project_id":"ci-cd-pipeline-project","authenticationInfo.principalEmail":"terraform-admin@prod-organization-core.iam.gserviceaccount.com","requestMetadata.callerIp":"203.0.113.44","severity":"INFO"}
{"timestamp":"2026-08-04T02:47:33.436Z","protoPayload.methodName":"io.k8s.core.v1.pods.create","protoPayload.serviceName":"container.googleapis.com","resource.labels.project_id":"gke-cluster-prod","authenticationInfo.principalEmail":"m.varga@cyyder.io","requestMetadata.callerIp":"185.220.101.44","severity":"INFO"}
{"timestamp":"2026-08-04T02:47:33.436Z","protoPayload.methodName":"google.cloud.run.v1.Services.SetIamPolicy","protoPayload.serviceName":"run.googleapis.com","resource.labels.project_id":"gke-cluster-prod","authenticationInfo.principalEmail":"a.petrov@cyyder.io","requestMetadata.callerIp":"185.220.101.44","severity":"INFO"}
{"timestamp":"2026-08-04T02:47:33.436Z","protoPayload.methodName":"storage.objects.get","protoPayload.serviceName":"storage.googleapis.com","resource.labels.project_id":"data-warehouse-bq","authenticationInfo.principalEmail":"d.ionescu@cyyder.io","requestMetadata.callerIp":"203.0.113.44","severity":"INFO"}