Skip to content

Commit 4be2290

Browse files
Priyanka-Chatterjee-2000cbruno10misraved
authored
Hub query updates (#7)
Co-authored-by: Cody Bruno <cody@turbot.com> Co-authored-by: Ved misra <47312748+misraved@users.noreply.github.com>
1 parent 58297ad commit 4be2290

17 files changed

+141
-11
lines changed

‎dashboards/activity_dashboard.pp

Lines changed: 42 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -68,18 +68,24 @@
6868
# -----------------------------
6969

7070
query "activity_dashboard_total_logs" {
71-
title = "Log Count"
71+
title = "Log Count"
72+
description = "Count the total log entries."
7273

7374
sql = <<-EOQ
7475
select
7576
count(*) as "Total Logs"
7677
from
7778
gcp_audit_log;
7879
EOQ
80+
81+
tags = {
82+
folder = "Project"
83+
}
7984
}
8085

8186
query "activity_dashboard_logs_by_project" {
82-
title = "Logs by Project"
87+
title = "Logs by Project"
88+
description = "Count the total log entries grouped by project."
8389

8490
sql = <<-EOQ
8591
select
@@ -95,10 +101,15 @@
95101
count(*) desc
96102
limit 10;
97103
EOQ
104+
105+
tags = {
106+
folder = "Project"
107+
}
98108
}
99109

100110
query "activity_dashboard_logs_by_type" {
101-
title = "Logs by Type"
111+
title = "Logs by Type"
112+
description = "Count the total log entries grouped by type."
102113

103114
sql = <<-EOQ
104115
select
@@ -114,10 +125,15 @@
114125
count(*) desc
115126
limit 10;
116127
EOQ
128+
129+
tags = {
130+
folder = "Project"
131+
}
117132
}
118133

119134
query "activity_dashboard_logs_by_service" {
120-
title = "Logs by Service"
135+
title = "Top 10 Services"
136+
description = "List the top 10 services by frequency."
121137

122138
sql = <<-EOQ
123139
select
@@ -133,10 +149,15 @@
133149
count(*) desc
134150
limit 10;
135151
EOQ
152+
153+
tags = {
154+
folder = "Project"
155+
}
136156
}
137157

138158
query "activity_dashboard_logs_by_event" {
139-
title = "Top 10 Events"
159+
title = "Top 10 Events"
160+
description = "List the 10 most frequently called events."
140161

141162
sql = <<-EOQ
142163
select
@@ -152,10 +173,15 @@
152173
count(*) desc
153174
limit 10;
154175
EOQ
176+
177+
tags = {
178+
folder = "Project"
179+
}
155180
}
156181

157182
query "activity_dashboard_logs_by_actor" {
158-
title = "Top 10 Actors"
183+
title = "Top 10 Actors"
184+
description = "List the 10 most active actors."
159185

160186
sql = <<-EOQ
161187
select
@@ -171,10 +197,15 @@
171197
count(*) desc
172198
limit 10;
173199
EOQ
200+
201+
tags = {
202+
folder = "Project"
203+
}
174204
}
175205

176206
query "activity_dashboard_logs_by_source_ip" {
177-
title = "Top 10 Source IPs"
207+
title = "Top 10 Source IPs (Excluding GCP Internal)"
208+
description = "List the 10 most active source IPs, excluding events from GCP internal."
178209

179210
sql = <<-EOQ
180211
select
@@ -191,4 +222,8 @@
191222
count(*) desc
192223
limit 10;
193224
EOQ
225+
226+
tags = {
227+
folder = "Project"
228+
}
194229
}

‎detections/access_context_manager.pp

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
locals {
22
access_context_manager_common_tags = merge(local.gcp_audit_log_detections_common_tags, {
3+
folder = "Access Context Manager"
34
service = "GCP/AccessContextManager"
45
})
56

@@ -57,6 +58,8 @@
5758
order by
5859
timestamp desc;
5960
EOQ
61+
62+
tags = local.access_context_manager_common_tags
6063
}
6164

6265
query "access_context_manager_access_level_deleted" {
@@ -71,4 +74,6 @@
7174
order by
7275
timestamp desc;
7376
EOQ
77+
78+
tags = local.access_context_manager_common_tags
7479
}

‎detections/apigee.pp

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
locals {
22
apigee_common_tags = merge(local.gcp_audit_log_detections_common_tags, {
3+
folder = "Apigee"
34
service = "GCP/Apigee"
45
})
56
}
@@ -42,4 +43,6 @@
4243
order by
4344
timestamp desc;
4445
EOQ
46+
47+
tags = local.apigee_common_tags
4548
}

‎detections/app_engine.pp

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
locals {
22
app_engine_common_tags = merge(local.gcp_audit_log_detections_common_tags, {
3+
folder = "App Engine"
34
service = "GCP/AppEngine"
45
})
56
}
@@ -70,6 +71,8 @@
7071
order by
7172
timestamp desc;
7273
EOQ
74+
75+
tags = local.app_engine_common_tags
7376
}
7477

7578
query "app_engine_firewall_ingress_rule_updated" {
@@ -84,6 +87,8 @@
8487
order by
8588
timestamp desc;
8689
EOQ
90+
91+
tags = local.app_engine_common_tags
8792
}
8893

8994
query "app_engine_firewall_ingress_rule_deleted" {
@@ -98,4 +103,6 @@
98103
order by
99104
timestamp desc;
100105
EOQ
106+
107+
tags = local.app_engine_common_tags
101108
}

‎detections/artifact_registry.pp

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
locals {
22
artifact_registry_common_tags = merge(local.gcp_audit_log_detections_common_tags, {
3+
folder = "Artifact Registry"
34
service = "GCP/ArtifactRegistry"
45
})
56
}
@@ -55,6 +56,8 @@
5556
order by
5657
timestamp desc;
5758
EOQ
59+
60+
tags = local.artifact_registry_common_tags
5861
}
5962

6063
query "artifact_registry_repository_deleted" {
@@ -69,4 +72,6 @@
6972
order by
7073
timestamp desc;
7174
EOQ
75+
76+
tags = local.artifact_registry_common_tags
7277
}

‎detections/cloud_run.pp

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
locals {
22
cloud_run_function_common_tags = merge(local.gcp_audit_log_detections_common_tags, {
3+
folder = "Cloud Run Function"
34
service = "GCP/CloudRunFunction"
45
})
56
}
@@ -42,4 +43,6 @@
4243
order by
4344
timestamp desc;
4445
EOQ
46+
47+
tags = local.cloud_run_function_common_tags
4548
}

‎detections/compute.pp

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
locals {
22
compute_common_tags = merge(local.gcp_audit_log_detections_common_tags, {
3+
folder = "Compute"
34
service = "GCP/Compute"
45
})
56

@@ -127,6 +128,8 @@
127128
order by
128129
timestamp desc;
129130
EOQ
131+
132+
tags = local.compute_common_tags
130133
}
131134

132135
query "compute_vpn_tunnel_deleted" {
@@ -141,6 +144,8 @@
141144
order by
142145
timestamp desc;
143146
EOQ
147+
148+
tags = local.compute_common_tags
144149
}
145150

146151
query "compute_image_iam_policy_set" {
@@ -155,6 +160,8 @@
155160
order by
156161
timestamp desc;
157162
EOQ
163+
164+
tags = local.compute_common_tags
158165
}
159166

160167
query "compute_disk_iam_policy_set" {
@@ -169,6 +176,8 @@
169176
order by
170177
timestamp desc;
171178
EOQ
179+
180+
tags = local.compute_common_tags
172181
}
173182

174183
query "compute_snapshot_iam_policy_set" {
@@ -183,6 +192,8 @@
183192
order by
184193
timestamp desc;
185194
EOQ
195+
196+
tags = local.compute_common_tags
186197
}
187198

188199
query "compute_instance_with_public_network_interface" {
@@ -219,6 +230,8 @@
219230
order by
220231
timestamp desc;
221232
EOQ
233+
234+
tags = local.compute_common_tags
222235
}
223236

224237
query "compute_subnetwork_flow_logs_disabled" {
@@ -234,4 +247,6 @@
234247
order by
235248
timestamp desc;
236249
EOQ
250+
251+
tags = local.compute_common_tags
237252
}

‎detections/dlp.pp

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
locals {
22
dlp_common_tags = merge(local.gcp_audit_log_detections_common_tags, {
3+
folder = "DLP"
34
service = "GCP/DLP"
45
})
56
}
@@ -42,4 +43,6 @@
4243
order by
4344
timestamp desc;
4445
EOQ
46+
47+
tags = local.dlp_common_tags
4548
}

‎detections/dns.pp

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
locals {
22
dns_common_tags = merge(local.gcp_audit_log_detections_common_tags, {
3+
folder = "DNS"
34
service = "GCP/DNS"
45
})
56

@@ -86,6 +87,8 @@
8687
order by
8788
timestamp desc;
8889
EOQ
90+
91+
tags = local.dns_common_tags
8992
}
9093

9194
query "dns_managed_zone_updated" {
@@ -100,6 +103,8 @@
100103
order by
101104
timestamp desc;
102105
EOQ
106+
107+
tags = local.dns_common_tags
103108
}
104109

105110
query "dns_record_set_updated" {
@@ -114,6 +119,8 @@
114119
order by
115120
timestamp desc;
116121
EOQ
122+
123+
tags = local.dns_common_tags
117124
}
118125

119126
query "dns_record_set_deleted" {
@@ -128,4 +135,6 @@
128135
order by
129136
timestamp desc;
130137
EOQ
138+
139+
tags = local.dns_common_tags
131140
}

0 commit comments

Comments
 (0)