> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/gcp-audit-log.md).

# Gcp Audit Log

Alerts related to data source "Gcp Audit Log".

| Alert                                                                                                                                                                                                                              |
| ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| [A Cloud DB instance was exported to an unknown destination](/analytics-alerts/alerts-by-name/a-cloud-db-instance-was-exported-to-an-unknown-destination.md)                                                                       |
| [A cloud function was created with an unusual runtime](/analytics-alerts/alerts-by-name/a-cloud-function-was-created-with-an-unusual-runtime.md)                                                                                   |
| [A cloud identity created or modified a security group](/analytics-alerts/alerts-by-name/a-cloud-identity-created-or-modified-a-security-group.md)                                                                                 |
| [A cloud identity executed an API call from an unusual country](/analytics-alerts/alerts-by-name/a-cloud-identity-executed-an-api-call-from-an-unusual-country.md)                                                                 |
| [A cloud identity had escalated its permissions](/analytics-alerts/alerts-by-name/a-cloud-identity-had-escalated-its-permissions.md)                                                                                               |
| [A cloud identity invoked IAM related persistence operations](/analytics-alerts/alerts-by-name/a-cloud-identity-invoked-iam-related-persistence-operations.md)                                                                     |
| [A cloud identity performed multiple unusual activities](/analytics-alerts/alerts-by-name/a-cloud-identity-performed-multiple-unusual-activities.md)                                                                               |
| [A cloud instance was stopped](/analytics-alerts/alerts-by-name/a-cloud-instance-was-stopped.md)                                                                                                                                   |
| [A cloud storage configuration was modified](/analytics-alerts/alerts-by-name/a-cloud-storage-configuration-was-modified.md)                                                                                                       |
| [A Command Line Interface (CLI) command was executed from a GCP serverless compute service](/analytics-alerts/alerts-by-name/a-command-line-interface-cli-command-was-executed-from-a-gcp-serverless-compute-service.md)           |
| [A container registry was created or deleted](/analytics-alerts/alerts-by-name/a-container-registry-was-created-or-deleted.md)                                                                                                     |
| [A GCP Cloud SQL DB instance was exported from a production account](/analytics-alerts/alerts-by-name/a-gcp-cloud-sql-db-instance-was-exported-from-a-production-account.md)                                                       |
| [A Kubernetes API operation was successfully invoked by an anonymous user](/analytics-alerts/alerts-by-name/a-kubernetes-api-operation-was-successfully-invoked-by-an-anonymous-user.md)                                           |
| [A Kubernetes cluster role binding was created or deleted](/analytics-alerts/alerts-by-name/a-kubernetes-cluster-role-binding-was-created-or-deleted.md)                                                                           |
| [A Kubernetes cluster role was created](/analytics-alerts/alerts-by-name/a-kubernetes-cluster-role-was-created.md)                                                                                                                 |
| [A Kubernetes cluster was created or deleted](/analytics-alerts/alerts-by-name/a-kubernetes-cluster-was-created-or-deleted.md)                                                                                                     |
| [A Kubernetes ConfigMap was created or deleted](/analytics-alerts/alerts-by-name/a-kubernetes-configmap-was-created-or-deleted.md)                                                                                                 |
| [A Kubernetes Cronjob was created](/analytics-alerts/alerts-by-name/a-kubernetes-cronjob-was-created.md)                                                                                                                           |
| [A Kubernetes DaemonSet was created](/analytics-alerts/alerts-by-name/a-kubernetes-daemonset-was-created.md)                                                                                                                       |
| [A Kubernetes dashboard service account was used outside the cluster](/analytics-alerts/alerts-by-name/a-kubernetes-dashboard-service-account-was-used-outside-the-cluster.md)                                                     |
| [A Kubernetes deployment was created](/analytics-alerts/alerts-by-name/a-kubernetes-deployment-was-created.md)                                                                                                                     |
| [A Kubernetes ephemeral container was created](/analytics-alerts/alerts-by-name/a-kubernetes-ephemeral-container-was-created.md)                                                                                                   |
| [A Kubernetes namespace was created or deleted](/analytics-alerts/alerts-by-name/a-kubernetes-namespace-was-created-or-deleted.md)                                                                                                 |
| [A Kubernetes node service account activity from external IP](/analytics-alerts/alerts-by-name/a-kubernetes-node-service-account-activity-from-external-ip.md)                                                                     |
| [A Kubernetes Pod was created with a sidecar container](/analytics-alerts/alerts-by-name/a-kubernetes-pod-was-created-with-a-sidecar-container.md)                                                                                 |
| [A Kubernetes Pod was deleted](/analytics-alerts/alerts-by-name/a-kubernetes-pod-was-deleted.md)                                                                                                                                   |
| [A Kubernetes ReplicaSet was created](/analytics-alerts/alerts-by-name/a-kubernetes-replicaset-was-created.md)                                                                                                                     |
| [A Kubernetes role binding was created or deleted](/analytics-alerts/alerts-by-name/a-kubernetes-role-binding-was-created-or-deleted.md)                                                                                           |
| [A Kubernetes secret was created or deleted](/analytics-alerts/alerts-by-name/a-kubernetes-secret-was-created-or-deleted.md)                                                                                                       |
| [A Kubernetes service account executed an unusual API call](/analytics-alerts/alerts-by-name/a-kubernetes-service-account-executed-an-unusual-api-call.md)                                                                         |
| [A Kubernetes service account has enumerated its permissions](/analytics-alerts/alerts-by-name/a-kubernetes-service-account-has-enumerated-its-permissions.md)                                                                     |
| [A Kubernetes service account was created or deleted](/analytics-alerts/alerts-by-name/a-kubernetes-service-account-was-created-or-deleted.md)                                                                                     |
| [A Kubernetes service was created or deleted](/analytics-alerts/alerts-by-name/a-kubernetes-service-was-created-or-deleted.md)                                                                                                     |
| [A Kubernetes StatefulSet was created](/analytics-alerts/alerts-by-name/a-kubernetes-statefulset-was-created.md)                                                                                                                   |
| [Abnormal Allocation of compute resources in multiple regions](/analytics-alerts/alerts-by-name/abnormal-allocation-of-compute-resources-in-multiple-regions.md)                                                                   |
| [AI model discovery](/analytics-alerts/alerts-by-name/ai-model-discovery.md)                                                                                                                                                       |
| [Allocation of multiple cloud compute resources](/analytics-alerts/alerts-by-name/allocation-of-multiple-cloud-compute-resources.md)                                                                                               |
| [An identity accessed a backup cloud storage](/analytics-alerts/alerts-by-name/an-identity-accessed-a-backup-cloud-storage.md)                                                                                                     |
| [An identity accessed a cloud storage for the first time](/analytics-alerts/alerts-by-name/an-identity-accessed-a-cloud-storage-for-the-first-time.md)                                                                             |
| [An identity initiated a download of multiple cloud objects](/analytics-alerts/alerts-by-name/an-identity-initiated-a-download-of-multiple-cloud-objects.md)                                                                       |
| [An identity performed a suspicious download of multiple cloud storage objects](/analytics-alerts/alerts-by-name/an-identity-performed-a-suspicious-download-of-multiple-cloud-storage-objects.md)                                 |
| [An operation was performed by an identity from a domain that was not seen in the organization](/analytics-alerts/alerts-by-name/an-operation-was-performed-by-an-identity-from-a-domain-that-was-not-seen-in-the-organization.md) |
| [An unusual cloud identity was granted permissions to a BigQuery resource](/analytics-alerts/alerts-by-name/an-unusual-cloud-identity-was-granted-permissions-to-a-bigquery-resource.md)                                           |
| [An unusual read activity of cloud object](/analytics-alerts/alerts-by-name/an-unusual-read-activity-of-cloud-object.md)                                                                                                           |
| [BigQuery table or query results exfiltrated to a foreign project](/analytics-alerts/alerts-by-name/bigquery-table-or-query-results-exfiltrated-to-a-foreign-project.md)                                                           |
| [Billing admin role was removed](/analytics-alerts/alerts-by-name/billing-admin-role-was-removed.md)                                                                                                                               |
| [Cloud access key creation](/analytics-alerts/alerts-by-name/cloud-access-key-creation.md)                                                                                                                                         |
| [Cloud activity from a high-risk IP address](/analytics-alerts/alerts-by-name/cloud-activity-from-a-high-risk-ip-address.md)                                                                                                       |
| [Cloud AI agent was modified](/analytics-alerts/alerts-by-name/cloud-ai-agent-was-modified.md)                                                                                                                                     |
| [Cloud compute instance user data script modification](/analytics-alerts/alerts-by-name/cloud-compute-instance-user-data-script-modification.md)                                                                                   |
| [Cloud compute serial console access](/analytics-alerts/alerts-by-name/cloud-compute-serial-console-access.md)                                                                                                                     |
| [Cloud identity reached a throttling API rate](/analytics-alerts/alerts-by-name/cloud-identity-reached-a-throttling-api-rate.md)                                                                                                   |
| [Cloud impersonation attempt by unusual identity type](/analytics-alerts/alerts-by-name/cloud-impersonation-attempt-by-unusual-identity-type.md)                                                                                   |
| [Cloud infrastructure enumeration activity](/analytics-alerts/alerts-by-name/cloud-infrastructure-enumeration-activity.md)                                                                                                         |
| [Cloud instance creation attempt](/analytics-alerts/alerts-by-name/cloud-instance-creation-attempt.md)                                                                                                                             |
| [Cloud instance deletion attempt](/analytics-alerts/alerts-by-name/cloud-instance-deletion-attempt.md)                                                                                                                             |
| [Cloud Organizational policy was created or modified](/analytics-alerts/alerts-by-name/cloud-organizational-policy-was-created-or-modified.md)                                                                                     |
| [Cloud penetration testing tool activity](/analytics-alerts/alerts-by-name/cloud-penetration-testing-tool-activity.md)                                                                                                             |
| [Cloud resource logging was disabled](/analytics-alerts/alerts-by-name/cloud-resource-logging-was-disabled.md)                                                                                                                     |
| [Cloud snapshot created or modified](/analytics-alerts/alerts-by-name/cloud-snapshot-created-or-modified.md)                                                                                                                       |
| [Cloud storage automatic backup disabled](/analytics-alerts/alerts-by-name/cloud-storage-automatic-backup-disabled.md)                                                                                                             |
| [Cloud storage delete protection disabled](/analytics-alerts/alerts-by-name/cloud-storage-delete-protection-disabled.md)                                                                                                           |
| [Cloud user performed multiple actions that were denied](/analytics-alerts/alerts-by-name/cloud-user-performed-multiple-actions-that-were-denied.md)                                                                               |
| [Compute activity in dormant cloud region](/analytics-alerts/alerts-by-name/compute-activity-in-dormant-cloud-region.md)                                                                                                           |
| [Data exfiltration from cloud database](/analytics-alerts/alerts-by-name/data-exfiltration-from-cloud-database.md)                                                                                                                 |
| [Deletion of multiple cloud resources](/analytics-alerts/alerts-by-name/deletion-of-multiple-cloud-resources.md)                                                                                                                   |
| [Denied API call by a Kubernetes service account](/analytics-alerts/alerts-by-name/denied-api-call-by-a-kubernetes-service-account.md)                                                                                             |
| [GCP administrative role granted to a cloud identity](/analytics-alerts/alerts-by-name/gcp-administrative-role-granted-to-a-cloud-identity.md)                                                                                     |
| [GCP data asset shared public](/analytics-alerts/alerts-by-name/gcp-data-asset-shared-public.md)                                                                                                                                   |
| [GCP Firewall Rule creation](/analytics-alerts/alerts-by-name/gcp-firewall-rule-creation.md)                                                                                                                                       |
| [GCP Firewall Rule Modification](/analytics-alerts/alerts-by-name/gcp-firewall-rule-modification.md)                                                                                                                               |
| [GCP IAM deny policy creation](/analytics-alerts/alerts-by-name/gcp-iam-deny-policy-creation.md)                                                                                                                                   |
| [GCP IAM Role Deletion](/analytics-alerts/alerts-by-name/gcp-iam-role-deletion.md)                                                                                                                                                 |
| [GCP IAM Service Account Key Deletion](/analytics-alerts/alerts-by-name/gcp-iam-service-account-key-deletion.md)                                                                                                                   |
| [GCP Logging Bucket Deletion](/analytics-alerts/alerts-by-name/gcp-logging-bucket-deletion.md)                                                                                                                                     |
| [GCP logging sink deletion](/analytics-alerts/alerts-by-name/gcp-logging-sink-deletion.md)                                                                                                                                         |
| [GCP logging sink modification](/analytics-alerts/alerts-by-name/gcp-logging-sink-modification.md)                                                                                                                                 |
| [GCP Pub/Sub Subscription Deletion](/analytics-alerts/alerts-by-name/gcp-pub-sub-subscription-deletion.md)                                                                                                                         |
| [GCP Pub/Sub Topic Deletion](/analytics-alerts/alerts-by-name/gcp-pub-sub-topic-deletion.md)                                                                                                                                       |
| [GCP sensitive Cloud Run role granted](/analytics-alerts/alerts-by-name/gcp-sensitive-cloud-run-role-granted.md)                                                                                                                   |
| [GCP sensitive compute role granted](/analytics-alerts/alerts-by-name/gcp-sensitive-compute-role-granted.md)                                                                                                                       |
| [GCP sensitive Deployment Manager role granted](/analytics-alerts/alerts-by-name/gcp-sensitive-deployment-manager-role-granted.md)                                                                                                 |
| [GCP sensitive Functions role granted](/analytics-alerts/alerts-by-name/gcp-sensitive-functions-role-granted.md)                                                                                                                   |
| [GCP sensitive IAM role granted](/analytics-alerts/alerts-by-name/gcp-sensitive-iam-role-granted.md)                                                                                                                               |
| [GCP sensitive role granted to group](/analytics-alerts/alerts-by-name/gcp-sensitive-role-granted-to-group.md)                                                                                                                     |
| [GCP sensitive Secret Manager role granted](/analytics-alerts/alerts-by-name/gcp-sensitive-secret-manager-role-granted.md)                                                                                                         |
| [GCP sensitive storage role granted](/analytics-alerts/alerts-by-name/gcp-sensitive-storage-role-granted.md)                                                                                                                       |
| [GCP Service Account creation](/analytics-alerts/alerts-by-name/gcp-service-account-creation.md)                                                                                                                                   |
| [GCP Service Account Deletion](/analytics-alerts/alerts-by-name/gcp-service-account-deletion.md)                                                                                                                                   |
| [GCP Service Account Disable](/analytics-alerts/alerts-by-name/gcp-service-account-disable.md)                                                                                                                                     |
| [GCP service account impersonation attempt](/analytics-alerts/alerts-by-name/gcp-service-account-impersonation-attempt.md)                                                                                                         |
| [GCP Service Account key creation](/analytics-alerts/alerts-by-name/gcp-service-account-key-creation.md)                                                                                                                           |
| [GCP set IAM policy activity](/analytics-alerts/alerts-by-name/gcp-set-iam-policy-activity.md)                                                                                                                                     |
| [GCP Storage Bucket Configuration Modification](/analytics-alerts/alerts-by-name/gcp-storage-bucket-configuration-modification.md)                                                                                                 |
| [GCP Storage Bucket deletion](/analytics-alerts/alerts-by-name/gcp-storage-bucket-deletion.md)                                                                                                                                     |
| [GCP Storage Bucket Permissions Modification](/analytics-alerts/alerts-by-name/gcp-storage-bucket-permissions-modification.md)                                                                                                     |
| [GCP Virtual Private Cloud (VPC) Network Deletion](/analytics-alerts/alerts-by-name/gcp-virtual-private-cloud-vpc-network-deletion.md)                                                                                             |
| [GCP Virtual Private Network Route Creation](/analytics-alerts/alerts-by-name/gcp-virtual-private-network-route-creation.md)                                                                                                       |
| [GCP Virtual Private Network Route Deletion](/analytics-alerts/alerts-by-name/gcp-virtual-private-network-route-deletion.md)                                                                                                       |
| [GCP VPC Firewall Rule Deletion](/analytics-alerts/alerts-by-name/gcp-vpc-firewall-rule-deletion.md)                                                                                                                               |
| [IAM Enumeration sequence](/analytics-alerts/alerts-by-name/iam-enumeration-sequence.md)                                                                                                                                           |
| [IAM role was created](/analytics-alerts/alerts-by-name/iam-role-was-created.md)                                                                                                                                                   |
| [Impossible travel by a cloud identity](/analytics-alerts/alerts-by-name/impossible-travel-by-a-cloud-identity.md)                                                                                                                 |
| [Kubernetes admission controller activity](/analytics-alerts/alerts-by-name/kubernetes-admission-controller-activity.md)                                                                                                           |
| [Kubernetes cluster events deletion](/analytics-alerts/alerts-by-name/kubernetes-cluster-events-deletion.md)                                                                                                                       |
| [Kubernetes enumeration activity](/analytics-alerts/alerts-by-name/kubernetes-enumeration-activity.md)                                                                                                                             |
| [Kubernetes network policy modification](/analytics-alerts/alerts-by-name/kubernetes-network-policy-modification.md)                                                                                                               |
| [Kubernetes Pod Created with host Inter Process Communications (IPC) namespace](/analytics-alerts/alerts-by-name/kubernetes-pod-created-with-host-inter-process-communications-ipc-namespace.md)                                   |
| [Kubernetes Pod created with host process ID (PID) namespace](/analytics-alerts/alerts-by-name/kubernetes-pod-created-with-host-process-id-pid-namespace.md)                                                                       |
| [Kubernetes Pod Created With Sensitive Volume](/analytics-alerts/alerts-by-name/kubernetes-pod-created-with-sensitive-volume.md)                                                                                                   |
| [Kubernetes pod creation from unknown container image registry](/analytics-alerts/alerts-by-name/kubernetes-pod-creation-from-unknown-container-image-registry.md)                                                                 |
| [Kubernetes pod creation with host network](/analytics-alerts/alerts-by-name/kubernetes-pod-creation-with-host-network.md)                                                                                                         |
| [Kubernetes Privileged Pod Creation](/analytics-alerts/alerts-by-name/kubernetes-privileged-pod-creation.md)                                                                                                                       |
| [Kubernetes secrets enumeration for the first time](/analytics-alerts/alerts-by-name/kubernetes-secrets-enumeration-for-the-first-time.md)                                                                                         |
| [Kubernetes service account activity outside the cluster](/analytics-alerts/alerts-by-name/kubernetes-service-account-activity-outside-the-cluster.md)                                                                             |
| [Kubernetes vulnerability scanning tool usage](/analytics-alerts/alerts-by-name/kubernetes-vulnerability-scanning-tool-usage.md)                                                                                                   |
| [Logging was impaired via external encryption key](/analytics-alerts/alerts-by-name/logging-was-impaired-via-external-encryption-key.md)                                                                                           |
| [ML artifacts destruction](/analytics-alerts/alerts-by-name/ml-artifacts-destruction.md)                                                                                                                                           |
| [Multi region enumeration activity](/analytics-alerts/alerts-by-name/multi-region-enumeration-activity.md)                                                                                                                         |
| [Multiple cloud snapshots export](/analytics-alerts/alerts-by-name/multiple-cloud-snapshots-export.md)                                                                                                                             |
| [Multiple failed logins from a single IP](/analytics-alerts/alerts-by-name/multiple-failed-logins-from-a-single-ip.md)                                                                                                             |
| [Multiple risk indicators for a cloud identity](/analytics-alerts/alerts-by-name/multiple-risk-indicators-for-a-cloud-identity.md)                                                                                                 |
| [Network sniffing detected in Cloud environment](/analytics-alerts/alerts-by-name/network-sniffing-detected-in-cloud-environment.md)                                                                                               |
| [New cloud identity created with administrative policy](/analytics-alerts/alerts-by-name/new-cloud-identity-created-with-administrative-policy.md)                                                                                 |
| [Potential denial of wallet abusing AI services](/analytics-alerts/alerts-by-name/potential-denial-of-wallet-abusing-ai-services.md)                                                                                               |
| [Remote usage of an App engine Service Account token](/analytics-alerts/alerts-by-name/remote-usage-of-an-app-engine-service-account-token.md)                                                                                     |
| [Remote usage of VM Service Account token](/analytics-alerts/alerts-by-name/remote-usage-of-vm-service-account-token.md)                                                                                                           |
| [Storage enumeration activity](/analytics-alerts/alerts-by-name/storage-enumeration-activity.md)                                                                                                                                   |
| [Suspicious AI Dataset Download](/analytics-alerts/alerts-by-name/suspicious-ai-dataset-download.md)                                                                                                                               |
| [Suspicious AI Dataset Label Modification](/analytics-alerts/alerts-by-name/suspicious-ai-dataset-label-modification.md)                                                                                                           |
| [Suspicious AI model usage from a Tor exit node](/analytics-alerts/alerts-by-name/suspicious-ai-model-usage-from-a-tor-exit-node.md)                                                                                               |
| [Suspicious API call from a Tor exit node](/analytics-alerts/alerts-by-name/suspicious-api-call-from-a-tor-exit-node.md)                                                                                                           |
| [Suspicious cloud compute instance SSH keys modification attempt](/analytics-alerts/alerts-by-name/suspicious-cloud-compute-instance-ssh-keys-modification-attempt.md)                                                             |
| [Suspicious cloud user data modification attempt followed by VM restart](/analytics-alerts/alerts-by-name/suspicious-cloud-user-data-modification-attempt-followed-by-vm-restart.md)                                               |
| [Suspicious heavy allocation of compute resources - possible mining activity](/analytics-alerts/alerts-by-name/suspicious-heavy-allocation-of-compute-resources-possible-mining-activity.md)                                       |
| [Suspicious identity downloaded multiple objects from a bucket](/analytics-alerts/alerts-by-name/suspicious-identity-downloaded-multiple-objects-from-a-bucket.md)                                                                 |
| [Suspicious ML Model Download](/analytics-alerts/alerts-by-name/suspicious-ml-model-download.md)                                                                                                                                   |
| [Suspicious secrets dump activity](/analytics-alerts/alerts-by-name/suspicious-secrets-dump-activity.md)                                                                                                                           |
| [Unusual AI dataset modification](/analytics-alerts/alerts-by-name/unusual-ai-dataset-modification.md)                                                                                                                             |
| [Unusual AI Knowledge Base Modification](/analytics-alerts/alerts-by-name/unusual-ai-knowledge-base-modification.md)                                                                                                               |
| [Unusual AI model invocation](/analytics-alerts/alerts-by-name/unusual-ai-model-invocation.md)                                                                                                                                     |
| [Unusual AI RAG Knowledge Base Modification](/analytics-alerts/alerts-by-name/unusual-ai-rag-knowledge-base-modification.md)                                                                                                       |
| [Unusual certificate management activity](/analytics-alerts/alerts-by-name/unusual-certificate-management-activity.md)                                                                                                             |
| [Unusual cloud identity impersonation](/analytics-alerts/alerts-by-name/unusual-cloud-identity-impersonation.md)                                                                                                                   |
| [Unusual cross projects activity](/analytics-alerts/alerts-by-name/unusual-cross-projects-activity.md)                                                                                                                             |
| [Unusual exec into a Kubernetes Pod](/analytics-alerts/alerts-by-name/unusual-exec-into-a-kubernetes-pod.md)                                                                                                                       |
| [Unusual IAM enumeration activity by a non-user Identity](/analytics-alerts/alerts-by-name/unusual-iam-enumeration-activity-by-a-non-user-identity.md)                                                                             |
| [Unusual Identity and Access Management (IAM) activity](/analytics-alerts/alerts-by-name/unusual-identity-and-access-management-iam-activity.md)                                                                                   |
| [Unusual key management activity](/analytics-alerts/alerts-by-name/unusual-key-management-activity.md)                                                                                                                             |
| [Unusual Kubernetes secret access](/analytics-alerts/alerts-by-name/unusual-kubernetes-secret-access.md)                                                                                                                           |
| [Unusual resource modification by newly seen IAM user](/analytics-alerts/alerts-by-name/unusual-resource-modification-by-newly-seen-iam-user.md)                                                                                   |
| [Unusual secret management activity](/analytics-alerts/alerts-by-name/unusual-secret-management-activity.md)                                                                                                                       |
| [Unusual user-agent for a cloud identity](/analytics-alerts/alerts-by-name/unusual-user-agent-for-a-cloud-identity.md)                                                                                                             |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/gcp-audit-log.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.