Google Cloud Audit App for Sumo Logic

The Sumo Logic App for Google Cloud Audit empowers your audit and compliance needs by monitoring activities to track administrator actions in your Google Cloud Platform. This provides a real-time analysis of all audit streams from GCP detailing user activity, administrative actions and authentication activity. Pre-configured dashboards provide insight across the network, security, operations and users of your Google Cloud Platform and applications provided.

By integrating directly with Google Stackdriver, Sumo Logic provides real-time observability for your Google App Engine data with real-time insights and analytics through interactive, customizable dashboards. This also allows you to look for unusual traffic patterns and suspicious activity with outlier detection.

• Operational Readiness - Continually monitor GCP platform and audit trails in real-time to troubleshoot issues before they affect users.
• Deeper Security Insights - Create visual dashboards to report on network and security issues and updates to identify impact of change on user activity.
• Enhanced User Admin - Provide visibility into security administrative issues relating to user access, activity and resource management.

The Google Cloud Audit Overview Dashboard provides deep insights into audit activities including resource creation and deletion, operations, users and authorization failures.

Gain confidence to scale with your application for Google Cloud Audit and monitor statistics like:

• Count and location of all audit activities logged in a given period on a world map.
• Count of resources created in any given time period.
• Count of operations by resources (e.g. in the last 24 hours).
• Trend authorization failures count.

The Google Cloud Audit Network and Security Dashboard shows details of network and security operations that include authorization failures and firewall changes.

Monitor statistics like:

• Count of network and security operations over a given period (e.g. last 24 hours).
• Authorization failure trends in a given period.
• Recent firewall changes at any time including: timestamp, user, method, ranges, direction, action, protocol and ports.
• Recent authorization failure in a given period including timestamp, user, action, project, country name, city and caller IP addresses on world map.
• Firewall rules with all allowed in last 24 hours, all protocols reported including timestamp, user, method, ranges, direction and ports.
• Short lived network resources over time including the creator, terminator and resource name.

The Google Cloud Audit Operations Dashboard shows all operational activity including the actions, requested services, and creation and deletion of resources.

Monitor statistics like:

• Count of all actions in the last hour
• Count of requested GCP service over time.
• Operations by GCP project count over time.
• Insights into operations including the timestamp, user, action, granted, project, and IP address.
• Created resources over time in the last 24 hours.
• Deleted resources over time in the last 24 hours.

The Google Cloud Audit Users Dashboard visualizes all user activities including the location, top users, creations and deletions.

Monitor statistics like:

• Count and location of users in real-time in a world map.
• Visualize user activities counts over time.
• Top 10 activities by users in the last day.
• Top 10 users last 24 hours.
• Creations and deletions by user for a given period.