Mind the Gap: GCP serviceData in Logs Explorer vs. Exported Logs (opens in new tab)
GCP's deprecated serviceData field gets silently stripped when audit logs reach your SIEM, leaving detection rules blind to disabled logging. Here's the gap.
Read the original article