turbot/tailpipe-mod-gcp-audit-log-detections

Query: Top 10 Source IPs

Usage

powerpipe query gcp_audit_log_detections.query.activity_dashboard_logs_by_source_ip

Tailpipe Tables

SQL

select
tp_source_ip as "Source ip",
count(*) as "Logs"
from
gcp_audit_log
where
tp_source_ip is not null
and tp_source_ip != 'gce-internal-ip'
group by
tp_source_ip
order by
count(*) desc
limit 10;

Dashboards

The query is used in the dashboards: