Turbot Guardrails Hub 
Hub
Mods
GCP
39
Mods
141
Resource Types
2,435
Policies
1,191
Controls
118
Quick Actions
84
IAM

Policy: GCP > Turbot > Organization Event Poller > Filter

A GCP logs advanced filter used to specify a subset of log entries that will be used by the Event Poller to process real-time events.

This is a read-only policy that is used internally by Guardrails.

Targets

This policy targets the following resource types:

Primary Policy

This policy is used with the following primary policy:

Controls

Setting this policy configures this control:

Policy Specification

Schema Type
string
Default
((resource.type = "project" OR resource.type = "folder" OR resource.type = "audited_resource") AND (protoPayload.authorizationInfo.permission = "resourcemanager.projects.delete" OR protoPayload.authorizationInfo.permission = "resourcemanager.projects.undelete" OR protoPayload.authorizationInfo.permission = "resourcemanager.projects.create" OR protoPayload.authorizationInfo.permission = "resourcemanager.folders.create" OR protoPayload.authorizationInfo.permission = "resourcemanager.folders.delete" OR protoPayload.authorizationInfo.permission = "resourcemanager.folders.undelete" OR protoPayload.authorizationInfo.permission = "orgpolicy.policy.set" OR protoPayload.authorizationInfo.permission = "orgpolicy.policies.create" OR protoPayload.authorizationInfo.permission = "orgpolicy.policies.delete" OR protoPayload.authorizationInfo.permission = "orgpolicy.policies.update" OR protoPayload.authorizationInfo.permission = "orgpolicy.customConstraints.create" OR protoPayload.authorizationInfo.permission = "orgpolicy.customConstraints.delete" OR protoPayload.authorizationInfo.permission = "orgpolicy.customConstraints.update") AND severity >= INFO AND severity < ERROR)

Category

In Your Workspace

Developers