LoFP LoFP / approved batch evaluation clients or shared nat egress. raise the threshold or exclude known source ip prefixes.

Techniques

Sample rules

GCP Vertex AI High GenerateContent Volume From Single IP

Description

Detects a single source IP making a high number of Vertex AI GenerateContent (or StreamGenerateContent) audit calls against the same model resource in the lookback window. That pattern fits model extraction, automated scraping, or a compromised caller burning prediction quota.

Detection logic

from logs-gcp_vertexai.auditlogs-*
| where
    data_stream.dataset == "gcp_vertexai.auditlogs" and
    source.ip is not null and
    (
        event.action like "*PredictionService.GenerateContent*" or
        event.action like "*PredictionService.StreamGenerateContent*"
    ) and
    (gcp.vertexai.audit.status.code is null or gcp.vertexai.audit.status.code == 0)
| stats
    Esql.event_count = count(*),
    Esql.timestamp_first_seen = min(@timestamp),
    Esql.timestamp_last_seen = max(@timestamp),
    Esql.event_action_values = values(event.action)
  by
    source.ip,
    gcp.vertexai.audit.resource_name,
    cloud.project.id
| where Esql.event_count >= 100
| keep
    source.ip,
    gcp.vertexai.audit.resource_name,
    cloud.project.id,
    Esql.event_count,
    Esql.timestamp_first_seen,
    Esql.timestamp_last_seen,
    Esql.event_action_values