search

google / cloud-forensics-utils

Python library to carry out DFIR analysis on the Cloud
Apache License 2.0
452 stars 89 forks source link

Print the log lines for querylogs instead of logging them #475

Closed Fryyyyy closed 1 year ago

Fryyyyy commented 1 year ago

Fixes #465

Before:

[2023-05-18 14:58:15,465] [tools.gcp_cli       ] INFO     {"protoPayload": {"@type": "type.googleapis.com/google.cloud.audit.AuditLog", "authenticationInfo": {"principalEmail": "system@google.com"}, "serviceName": "compute.googleapis.com", "methodName": "NotifySubnetworkCreationLocation", "request": {"@type": "type.googleapis.com/NotifySubnetworkCreationLocation"}, "metadata": {"currentLocations": ["europe-west9"], "@type": "type.googleapis.com/google.cloud.audit.ResourceLocation"}}, "insertId": "4l2", "resource": {"type": "gce_subnetwork", "labels": {"subnetwork_name": "default", "project_id": "xxxx", "subnetwork_id": "1234", "location": "europe-west9"}}, "timestamp": "2022-04-23T01:20:54.750103Z", "severity": "INFO", "logName": "projects/xxxx/logs/cloudaudit.googleapis.com%2Fsystem_event", "receiveTimestamp": "2022-04-23T01:20:55.422920649Z"}

After:

{"protoPayload": {"@type": "type.googleapis.com/google.cloud.audit.AuditLog", "authenticationInfo": {"principalEmail": "system@google.com"}, "serviceName": "compute.googleapis.com", "methodName": "NotifySubnetworkCreationLocation", "request": {"@type": "type.googleapis.com/NotifySubnetworkCreationLocation"}, "metadata": {"currentLocations": ["europe-west9"], "@type": "type.googleapis.com/google.cloud.audit.ResourceLocation"}}, "insertId": "4l2", "resource": {"type": "gce_subnetwork", "labels": {"subnetwork_name": "default", "subnetwork_id": "1234", "location": "europe-west9", "project_id": "xxxx"}}, "timestamp": "2022-04-23T01:20:54.750103Z", "severity": "INFO", "logName": "projects/xxxx/logs/cloudaudit.googleapis.com%2Fsystem_event", "receiveTimestamp": "2022-04-23T01:20:55.422920649Z"}