Query: cloud_run_function_deleted

select 
  tp_timestamp as timestamp,
method_name as operation,
resource_name as resource,
authentication_info.principal_email as actor,
tp_source_ip as source_ip,
tp_index as project,
tp_id as source_id,
-- Create new aliases to preserve original row data
operation as operation_src,
resource as resource_src,
*
exclude operation, resource

from 
  gcp_audit_log
where
  method_name ilike 'google.cloud.functions.v%.functionservice.deletefunction'
  and severity != 'Error'

order by
  timestamp desc;