gcp-cloud-logging

Search GCP audit logs to trace administrative actions and identify the user who deleted a VM. This skill queries project-scoped cloud audit logs to retrieve administrative event records, filtering by resource type and operation type to pinpoint the deletion.

Analyzing VPC flow logs for denied connections requires filtering project logs by the denied action. This skill queries VPC flow logs across projects to surface denied entries within a given time frame and summarizes the findings for network troubleshooting.

You can investigate triggered firewall rules by querying Google Cloud firewall logs. This skill retrieves firewall log entries to identify which specific rule was applied to a denied connection, aiding security investigations and network diagnostics.

Yes, querying Cloud Logging across multiple projects requires OAuth 2.0 authentication. This skill satisfies OAuth 2.0 requirements to enable project-scoped log access, utilizing MCP-based log queries for secure discovery and retrieval.

Compile security investigation findings into an incident report by retrieving and analyzing relevant VPC flow, firewall, and audit logs. This skill provides guided workflows to structure concrete steps, patterns, and findings for compliance reviews.