gcp-audit-logs

Configure GCP Cloud Audit Logs and route them to BigQuery for analysis.

46|4|Updated Jan 27, 2026

Search Tags:#security #logging #gcp #compliance #bigquery #audit logs

Ready to run

npx skills add https://github.com/BagelHole/DevOps-Security-Agent-Skills --skill gcp-audit-logs

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: gcp-audit-logs
Source: https://github.com/BagelHole/DevOps-Security-Agent-Skills/tree/main/compliance/auditing/gcp-audit-logs
Command: npx skills add https://github.com/BagelHole/DevOps-Security-Agent-Skills --skill gcp-audit-logs

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

This Skill helps you configure and manage Google Cloud Platform (GCP) audit logs to meet compliance requirements, ensuring all critical activities are logged and auditable.

Core Features & Use Cases

Audit Log Configuration: Enables and configures different types of audit logs (Admin Activity, Data Access, System Event, Policy Denied).
Log Routing: Sets up sinks to route audit logs to a GCS bucket or BigQuery for long-term storage and analysis.
BigQuery Analysis: Provides SQL queries to analyze audit logs stored in BigQuery, enabling security and compliance investigations.
Use Case: Ensure your GCP environment adheres to SOC2 by enabling comprehensive audit logging and setting up BigQuery analysis for regular compliance checks.

Quick Start

Configure GCP audit logs to be sent to a BigQuery dataset named 'audit_logs_dataset' in project 'my-gcp-project'.

Frequently Asked Questions about gcp-audit-logs

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I configure GCP audit logs for SOC2 compliance?▼

You can configure GCP audit logs for compliance by enabling Admin Activity, Data Access, System Event, and Policy Denied logs, then setting up sinks to route them to BigQuery for analysis and long-term storage.

What types of GCP audit logs are needed for tracking administrative actions?▼

GCP audit logs needed for tracking administrative actions include Admin Activity logs, Data Access logs, System Event logs, and Policy Denied logs. Configuring these ensures auditable trails of administrative actions and system events.

Do I need gcloud CLI to set up GCP audit log routing to BigQuery?▼

Yes, you need gcloud CLI to set up GCP audit log routing. The configuration requires gcloud CLI for project setup and BigQuery for log storage and querying to successfully route and analyze your audit trails.

How do I analyze GCP audit logs stored in BigQuery for security investigations?▼

To analyze GCP audit logs stored in BigQuery, you run SQL queries against the routed log data. This enables security and compliance investigations by allowing you to query administrative actions, data access, and system events.

Can I route GCP audit logs to a Google Cloud Storage bucket instead of BigQuery?▼

Yes, you can route GCP audit logs to a Google Cloud Storage bucket. The log routing configuration supports setting up sinks to send audit logs to either a GCS bucket or BigQuery for long-term storage and analysis.