BigQuery
| methodName | Description | Log type | Sample | Rule |
|---|---|---|---|---|
| any | Catch-all entry for bigquery.googleapis.com. Source-only rules that attribute to the service without a specific method attribute here. Not a distinct audit log operation. | activity | N | N |
| jobservice. | Retrieves the results of a query job. This method appears in BigQuery Data Access audit logs. | data_access | Y | Y |
| google. | Creates a new read session. A read session divides the contents of a BigQuery table into one or more streams, which can then be used to read data from the table. | data_access | N | N |
| datasetservice. | Create a BigQuery dataset (legacy DatasetService.insert log form). | activity | Y | N |
| google. | Create a BigQuery dataset. | activity | Y | N |
| google. | Submit a BigQuery job (query, load, extract, or copy). | data_access | Y | N |
| jobservice. | Submit a BigQuery job (legacy JobService.insert log form). | data_access | Y | N |
| jobservice. | BigQuery job completion event (legacy JobService.jobcompleted log form). | data_access | Y | N |
any: bigquery.googleapis.com (any method)
#Description
Catch-all entry for bigquery.googleapis.com. Source-only rules that attribute to the service without a specific method attribute here. Not a distinct audit log operation.
jobservice.getqueryresults: Get query results
#Description
Retrieves the results of a query job. This method appears in BigQuery Data Access audit logs.
Data Access audit logs are disabled by default. Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema. Full rule details for this event, including ATT&CK technique mappings and native queries →Detection Fields #
Name Rules Vendors metadata.log_type1 detection rule YARA-L security_result.action1 detection rule YARA-L Example Audit Log Entry #
{
"insertId": "sljzioex5vkt",
"logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Fdata_access",
"protoPayload": {
"@type": "type.googleapis.com/google.cloud.audit.AuditLog",
"authenticationInfo": {
"oauthInfo": {
"oauthClientId": "32555940559.apps.googleusercontent.com"
},
"principalEmail": "user@example.com"
},
"authorizationInfo": [
{
"granted": true,
"permission": "bigquery.jobs.create",
"permissionType": "ADMIN_WRITE",
"resource": "projects/example-project-id",
"resourceAttributes": {}
},
{
"granted": true,
"permission": "bigquery.jobs.create",
"permissionType": "ADMIN_WRITE",
"resource": "projects/example-project-id",
"resourceAttributes": {}
}
],
"methodName": "jobservice.getqueryresults",
"requestMetadata": {
"callerIp": "203.0.113.10",
"callerSuppliedUserAgent": "google-cloud-sdk574.0.0 agent-name/claude_code google-api-python-client bq.query.jobs (gzip),gzip(gfe)",
"destinationAttributes": {},
"requestAttributes": {}
},
"resourceName": "projects/example-project-id/queries/bqjob_r234ea277378a8f90_0000019f138abbe2_1",
"serviceData": {
"@type": "type.googleapis.com/google.cloud.bigquery.logging.v1.AuditData",
"jobGetQueryResultsRequest": {
"maxResults": 100
},
"jobGetQueryResultsResponse": {
"job": {
"jobConfiguration": {
"query": {
"createDisposition": "CREATE_IF_NEEDED",
"defaultDataset": {},
"destinationTable": {
"datasetId": "_db976a08af735dea4debf05dedd688b2b7119cfd",
"projectId": "example-project-id",
"tableId": "anonff777d344a7af8ca8f87c2ac39603eb84746d2e263f0af1608cf3c73f1cdcc11"
},
"query": "SELECT 1 AS dw_audit_sample",
"queryPriority": "QUERY_INTERACTIVE",
"statementType": "SELECT",
"writeDisposition": "WRITE_TRUNCATE"
}
},
"jobName": {
"jobId": "bqjob_r234ea277378a8f90_0000019f138abbe2_1",
"location": "US",
"projectId": "example-project-id"
},
"jobStatistics": {
"createTime": "2026-06-29T13:21:27.411Z",
"endTime": "2026-06-29T13:21:27.920Z",
"queryOutputRowCount": "1",
"reservation": "unreserved",
"startTime": "2026-06-29T13:21:27.755Z",
"totalSlotMs": "7"
},
"jobStatus": {
"error": {},
"state": "DONE"
}
},
"totalResults": "1"
}
},
"serviceName": "bigquery.googleapis.com",
"status": {}
},
"receiveTimestamp": "2026-06-29T13:21:28.534165673Z",
"resource": {
"labels": {
"project_id": "example-project-id"
},
"type": "bigquery_resource"
},
"severity": "INFO",
"timestamp": "2026-06-29T13:21:28.307686Z"
}
Detection Rules #
YARA-L #
T1567
google.cloud.bigquery.BigQueryRead.CreateReadSession: Create read session
#Description
Creates a new read session. A read session divides the contents of a BigQuery table into one or more streams, which can then be used to read data from the table.
Data Access audit logs are disabled by default.
datasetservice.insert: DatasetService.insert (legacy)
#Description
Create a BigQuery dataset (legacy DatasetService.insert log form).
Example Audit Log Entry #
{
"insertId": "nm0dymd2m72",
"logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Factivity",
"protoPayload": {
"@type": "type.googleapis.com/google.cloud.audit.AuditLog",
"authenticationInfo": {
"oauthInfo": {
"oauthClientId": "32555940559.apps.googleusercontent.com"
},
"principalEmail": "user@example.com"
},
"authorizationInfo": [
{
"granted": true,
"permission": "bigquery.datasets.create",
"permissionType": "ADMIN_WRITE",
"resource": "projects/example-project-id",
"resourceAttributes": {}
}
],
"methodName": "datasetservice.insert",
"requestMetadata": {
"callerIp": "203.0.113.10",
"callerSuppliedUserAgent": "google-cloud-sdk574.0.0 agent-name/claude_code google-api-python-client bq.mk.datasets (gzip),gzip(gfe)",
"destinationAttributes": {},
"requestAttributes": {}
},
"resourceLocation": {
"currentLocations": [
"us-central1"
]
},
"resourceName": "projects/example-project-id/datasets",
"serviceData": {
"@type": "type.googleapis.com/google.cloud.bigquery.logging.v1.AuditData",
"datasetInsertRequest": {
"resource": {
"acl": {},
"datasetName": {
"datasetId": "dwgen_dw739065",
"projectId": "example-project-id"
},
"info": {}
}
},
"datasetInsertResponse": {
"resource": {
"acl": {
"entries": [
{
"role": "WRITER",
"specialGroup": "PROJECT_WRITERS",
"viewName": {}
},
{
"role": "OWNER",
"specialGroup": "PROJECT_OWNERS",
"viewName": {}
},
{
"role": "OWNER",
"specialGroup": "PROJECT_OWNERS",
"userEmail": "user@example.com",
"viewName": {}
},
{
"role": "READER",
"specialGroup": "PROJECT_READERS",
"viewName": {}
}
]
},
"createTime": "2026-06-29T13:21:25.033Z",
"datasetName": {
"datasetId": "dwgen_dw739065",
"projectId": "example-project-id"
},
"info": {},
"updateTime": "2026-06-29T13:21:25.033Z"
}
}
},
"serviceName": "bigquery.googleapis.com",
"status": {}
},
"receiveTimestamp": "2026-06-29T13:21:26.137823527Z",
"resource": {
"labels": {
"project_id": "example-project-id"
},
"type": "bigquery_resource"
},
"severity": "NOTICE",
"timestamp": "2026-06-29T13:21:25.148654Z"
}
google.cloud.bigquery.DatasetService.InsertDataset: InsertDataset
#Description
Create a BigQuery dataset.
Example Audit Log Entry #
{
"insertId": "nm0dymd2m74",
"logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Factivity",
"protoPayload": {
"@type": "type.googleapis.com/google.cloud.audit.AuditLog",
"authenticationInfo": {
"oauthInfo": {
"oauthClientId": "32555940559.apps.googleusercontent.com"
},
"principalEmail": "user@example.com"
},
"authorizationInfo": [
{
"granted": true,
"permission": "bigquery.datasets.create",
"permissionType": "ADMIN_WRITE",
"resource": "projects/example-project-id",
"resourceAttributes": {}
}
],
"metadata": {
"@type": "type.googleapis.com/google.cloud.audit.BigQueryAuditMetadata",
"datasetCreation": {
"dataset": {
"acl": {
"policy": {
"bindings": [
{
"members": [
"projectEditor:example-project-id"
],
"role": "roles/bigquery.dataEditor"
},
{
"members": [
"projectOwner:example-project-id",
"user:user@example.com"
],
"role": "roles/bigquery.dataOwner"
},
{
"members": [
"projectViewer:example-project-id"
],
"role": "roles/bigquery.dataViewer"
}
]
}
},
"createTime": "2026-06-29T13:21:25.033Z",
"datasetName": "projects/example-project-id/datasets/dwgen_dw739065",
"updateTime": "2026-06-29T13:21:25.033Z"
},
"reason": "CREATE"
}
},
"methodName": "google.cloud.bigquery.v2.DatasetService.InsertDataset",
"requestMetadata": {
"callerIp": "203.0.113.10",
"callerSuppliedUserAgent": "google-cloud-sdk574.0.0 agent-name/claude_code google-api-python-client bq.mk.datasets (gzip),gzip(gfe)",
"destinationAttributes": {},
"requestAttributes": {}
},
"resourceName": "projects/example-project-id/datasets/dwgen_dw739065",
"serviceName": "bigquery.googleapis.com",
"status": {}
},
"receiveTimestamp": "2026-06-29T13:21:26.137823527Z",
"resource": {
"labels": {
"dataset_id": "dwgen_dw739065",
"project_id": "example-project-id"
},
"type": "bigquery_dataset"
},
"severity": "NOTICE",
"timestamp": "2026-06-29T13:21:25.150242Z"
}
google.cloud.bigquery.JobService.InsertJob: InsertJob
#Description
Submit a BigQuery job (query, load, extract, or copy).
Data Access audit logs are disabled by default.Example Audit Log Entry #
{
"insertId": "n1f23het6yk2",
"logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Fdata_access",
"operation": {
"id": "1782739287411-example-project-id:bqjob_r234ea277378a8f90_0000019f138abbe2_1",
"last": true,
"producer": "bigquery.googleapis.com"
},
"protoPayload": {
"@type": "type.googleapis.com/google.cloud.audit.AuditLog",
"authenticationInfo": {
"oauthInfo": {
"oauthClientId": "32555940559.apps.googleusercontent.com"
},
"principalEmail": "user@example.com"
},
"authorizationInfo": [
{
"granted": true,
"permission": "bigquery.jobs.create",
"permissionType": "ADMIN_WRITE",
"resource": "projects/example-project-id",
"resourceAttributes": {}
}
],
"metadata": {
"@type": "type.googleapis.com/google.cloud.audit.BigQueryAuditMetadata",
"jobChange": {
"after": "DONE",
"job": {
"jobConfig": {
"queryConfig": {
"createDisposition": "CREATE_IF_NEEDED",
"destinationTable": "projects/example-project-id/datasets/_db976a08af735dea4debf05dedd688b2b7119cfd/tables/anonff777d344a7af8ca8f87c2ac39603eb84746d2e263f0af1608cf3c73f1cdcc11",
"priority": "QUERY_INTERACTIVE",
"query": "SELECT 1 AS dw_audit_sample",
"statementType": "SELECT",
"writeDisposition": "WRITE_TRUNCATE"
},
"type": "QUERY"
},
"jobName": "projects/example-project-id/jobs/bqjob_r234ea277378a8f90_0000019f138abbe2_1",
"jobStats": {
"createTime": "2026-06-29T13:21:27.411Z",
"endTime": "2026-06-29T13:21:27.920Z",
"queryStats": {
"outputRowCount": "1"
},
"reservation": "unreserved",
"startTime": "2026-06-29T13:21:27.755Z",
"totalSlotMs": "7"
},
"jobStatus": {
"jobState": "DONE"
}
}
}
},
"methodName": "google.cloud.bigquery.v2.JobService.InsertJob",
"requestMetadata": {
"callerIp": "203.0.113.10",
"callerSuppliedUserAgent": "google-cloud-sdk574.0.0 agent-name/claude_code google-api-python-client bq.query.jobs (gzip),gzip(gfe)",
"destinationAttributes": {},
"requestAttributes": {}
},
"resourceName": "projects/example-project-id/jobs/bqjob_r234ea277378a8f90_0000019f138abbe2_1",
"serviceName": "bigquery.googleapis.com",
"status": {}
},
"receiveTimestamp": "2026-06-29T13:21:28.847396827Z",
"resource": {
"labels": {
"location": "US",
"project_id": "example-project-id"
},
"type": "bigquery_project"
},
"severity": "INFO",
"timestamp": "2026-06-29T13:21:27.974022Z"
}
jobservice.insert: JobService.insert (legacy)
#Description
Submit a BigQuery job (legacy JobService.insert log form).
Data Access audit logs are disabled by default.Example Audit Log Entry #
{
"insertId": "n1f23het6yk4",
"logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Fdata_access",
"protoPayload": {
"@type": "type.googleapis.com/google.cloud.audit.AuditLog",
"authenticationInfo": {
"oauthInfo": {
"oauthClientId": "32555940559.apps.googleusercontent.com"
},
"principalEmail": "user@example.com"
},
"authorizationInfo": [
{
"granted": true,
"permission": "bigquery.jobs.create",
"permissionType": "ADMIN_WRITE",
"resource": "projects/example-project-id",
"resourceAttributes": {}
}
],
"methodName": "jobservice.insert",
"requestMetadata": {
"callerIp": "203.0.113.10",
"callerSuppliedUserAgent": "google-cloud-sdk574.0.0 agent-name/claude_code google-api-python-client bq.query.jobs (gzip),gzip(gfe)",
"destinationAttributes": {},
"requestAttributes": {}
},
"resourceName": "projects/example-project-id/jobs",
"serviceData": {
"@type": "type.googleapis.com/google.cloud.bigquery.logging.v1.AuditData",
"jobInsertRequest": {
"resource": {
"jobConfiguration": {
"query": {
"createDisposition": "CREATE_IF_NEEDED",
"defaultDataset": {},
"destinationTable": {},
"query": "SELECT 1 AS dw_audit_sample",
"queryPriority": "QUERY_INTERACTIVE",
"writeDisposition": "WRITE_EMPTY"
}
},
"jobName": {
"jobId": "bqjob_r234ea277378a8f90_0000019f138abbe2_1",
"projectId": "example-project-id"
}
}
},
"jobInsertResponse": {
"resource": {
"jobConfiguration": {
"query": {
"createDisposition": "CREATE_IF_NEEDED",
"defaultDataset": {},
"destinationTable": {
"datasetId": "_db976a08af735dea4debf05dedd688b2b7119cfd",
"projectId": "example-project-id",
"tableId": "anonff777d344a7af8ca8f87c2ac39603eb84746d2e263f0af1608cf3c73f1cdcc11"
},
"query": "SELECT 1 AS dw_audit_sample",
"queryPriority": "QUERY_INTERACTIVE",
"statementType": "SELECT",
"writeDisposition": "WRITE_TRUNCATE"
}
},
"jobName": {
"jobId": "bqjob_r234ea277378a8f90_0000019f138abbe2_1",
"location": "US",
"projectId": "example-project-id"
},
"jobStatistics": {
"createTime": "2026-06-29T13:21:27.411Z",
"endTime": "2026-06-29T13:21:27.920Z",
"queryOutputRowCount": "1",
"reservation": "unreserved",
"startTime": "2026-06-29T13:21:27.755Z",
"totalSlotMs": "7"
},
"jobStatus": {
"error": {},
"state": "DONE"
}
}
}
},
"serviceName": "bigquery.googleapis.com",
"status": {}
},
"receiveTimestamp": "2026-06-29T13:21:28.847396827Z",
"resource": {
"labels": {
"project_id": "example-project-id"
},
"type": "bigquery_resource"
},
"severity": "INFO",
"timestamp": "2026-06-29T13:21:27.977231Z"
}
jobservice.jobcompleted: JobService.jobcompleted (legacy)
#Description
BigQuery job completion event (legacy JobService.jobcompleted log form).
Data Access audit logs are disabled by default.Example Audit Log Entry #
{
"insertId": "n1f23het6yk0",
"logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Fdata_access",
"protoPayload": {
"@type": "type.googleapis.com/google.cloud.audit.AuditLog",
"authenticationInfo": {
"oauthInfo": {
"oauthClientId": "32555940559.apps.googleusercontent.com"
},
"principalEmail": "user@example.com"
},
"methodName": "jobservice.jobcompleted",
"requestMetadata": {
"callerIp": "203.0.113.10",
"callerSuppliedUserAgent": "google-cloud-sdk574.0.0 agent-name/claude_code google-api-python-client bq.query.jobs (gzip),gzip(gfe)",
"destinationAttributes": {},
"requestAttributes": {}
},
"resourceName": "projects/example-project-id/jobs/bqjob_r234ea277378a8f90_0000019f138abbe2_1",
"serviceData": {
"@type": "type.googleapis.com/google.cloud.bigquery.logging.v1.AuditData",
"jobCompletedEvent": {
"eventName": "query_job_completed",
"job": {
"jobConfiguration": {
"query": {
"createDisposition": "CREATE_IF_NEEDED",
"defaultDataset": {},
"destinationTable": {
"datasetId": "_db976a08af735dea4debf05dedd688b2b7119cfd",
"projectId": "example-project-id",
"tableId": "anonff777d344a7af8ca8f87c2ac39603eb84746d2e263f0af1608cf3c73f1cdcc11"
},
"query": "SELECT 1 AS dw_audit_sample",
"queryPriority": "QUERY_INTERACTIVE",
"statementType": "SELECT",
"writeDisposition": "WRITE_TRUNCATE"
}
},
"jobName": {
"jobId": "bqjob_r234ea277378a8f90_0000019f138abbe2_1",
"location": "US",
"projectId": "example-project-id"
},
"jobStatistics": {
"createTime": "2026-06-29T13:21:27.411Z",
"endTime": "2026-06-29T13:21:27.920Z",
"queryOutputRowCount": "1",
"reservation": "unreserved",
"startTime": "2026-06-29T13:21:27.755Z",
"totalSlotMs": "7"
},
"jobStatus": {
"error": {},
"state": "DONE"
}
}
}
},
"serviceName": "bigquery.googleapis.com",
"status": {}
},
"receiveTimestamp": "2026-06-29T13:21:28.847396827Z",
"resource": {
"labels": {
"project_id": "example-project-id"
},
"type": "bigquery_resource"
},
"severity": "INFO",
"timestamp": "2026-06-29T13:21:27.973468Z"
}