LoFP LoFP / approved platform engineering changes that update publisher logging destinations. confirm the actor and change ticket.

Techniques

Sample rules

GCP Vertex AI Publisher Model Config Modified

Description

Detects changes to Vertex AI publisher model configuration via SetPublisherModelConfig (for example enabling or retargeting prompt/response BigQuery logging). Unexpected config changes can disable security-relevant logging or redirect logs.

Detection logic

from logs-gcp_vertexai.auditlogs-* metadata _id, _version, _index
| where
    data_stream.dataset == "gcp_vertexai.auditlogs" and
    event.action like "*SetPublisherModelConfig*" and
    (gcp.vertexai.audit.status.code is null or gcp.vertexai.audit.status.code == 0)
| keep
    _id,
    _version,
    _index,
    @timestamp,
    event.action,
    cloud.project.id,
    source.ip,
    gcp.vertexai.audit.service_name,
    gcp.vertexai.audit.resource_name,
    client.user.email,
    user_agent.original