66 Detection engineering on exported logs

Caveats

• Untested rules are worse than no rules¹
• Export latency (activity log events land in BigQuery within about 10 minutes) makes this a…²
• BigQuery export requires Enterprise Standard+, Education Standard+, Frontline Standard+ or…³

Setup steps

1. open ↗

   

   https://admin.google.com/ac/reporting/bigqueryexport · captured 2026-07-15

   Reporting › Data integrations › BigQuery Export ↗

   Confirm the audit-log export to BigQuery is on and the dataset is complete (this control consumes what audit-log-export №31 produces).

   BigQuery export

   On

   dataset

   the one your rules query

   Set up service log exports to BigQuery ↗

2. Write detections as code: Sigma rules or scheduled BigQuery SQL over the exported activity tables — OAuth grant to a new client id, DWD change, mass Drive download, admin role grant, forwarding rule added.

   One rule

   one hypothesis, version-controlled, with a documented false-positive rate

   Example queries for reporting logs in BigQuery ↗

3. Schedule the queries and route hits into the same alert pipeline that alert-pipeline-heartbeat (№52) proves is alive.

   Scheduled query cadence

   15min–1h depending on the rule

   Scheduling queries ↗

4. Test each rule against a replayed or synthesised event before it goes live, and keep the test as a regression.

Ongoing maintenance

• automatable: script Per schedule: the detection queries run against the exported logs.
• automatable: AI agent Monthly: tune rules against false-positive/negative feedback and new TTPs.

How to verify

1. Replay a known-bad event pattern (e.g. a mass-download simulation from a test account) into the pipeline and confirm the detection fires end to end — the query alone proves nothing.