A data exfiltration investigation of a GCP storage bucket is limited to the information logged by default in the Cost Table of Google's Cloud Billing. What information will investigators be able to gather?

The Google Cloud Billing Cost Table provides detailed information on resource consumption for billing purposes. For a data exfiltration event from a Cloud Storage bucket, this would manifest as a charge for "Network Egress." The cost table explicitly includes usagestarttime and usageendtime columns, which record the timeframe during which the resource (in this case, network bandwidth for downloads) was consumed. Investigators can analyze this data to identify unusual spikes in egress costs, thereby pinpointing the timeframe of the potential exfiltration. Information such as specific IP addresses, filenames, or user identities is not captured in billing data, as its purpose is to track cost and usage, not to perform detailed security auditing.

A. IP addresses associated with file downloads are recorded in Cloud Audit Logs (specifically, Data Access logs), not in billing data.
C. Filenames of downloaded files are object-level details found within Data Access audit logs, which are separate from billing information.
D. Usernames associated with file downloads are captured as principal identities in Cloud Audit Logs, not in the usage cost data. ---

1. Google Cloud Documentation, "Standard usage cost data schema": This official documentation details the columns available in the standard billing export table. It lists usagestarttime and usageendtime as standard fields. It does not include fields for source IP, resource names (filenames), or user principals.

Reference: Google Cloud. (n.d.). Standard usage cost data schema. Google Cloud Documentation. Retrieved from https://cloud.google.com/billing/docs/understanding-your-invoice#standard-usage-cost-data-schema (Refer to the table listing schema fields like usagestarttime).

2. Google Cloud Documentation, "Cloud Storage audit logging": This document specifies the information captured in Cloud Audit Logs for storage operations. It explicitly states that Data Access logs, when enabled, record the caller's identity (principalEmail), the IP address (callerIp), and the resource name (resourceName), which includes the bucket and object name. This confirms such data is in audit logs, not billing.

Reference: Google Cloud. (n.d.). Cloud Storage audit logging. Google Cloud Documentation. Retrieved from https://cloud.google.com/storage/docs/audit-logging (See the "Log entry contents" section for details on protoPayload fields).

3. Google Cloud Documentation, "Viewing logs": This page provides examples of log entries, including the protoPayload structure which contains fields like authenticationInfo.principalEmail and requestMetadata.callerIp, reinforcing that this level of detail is exclusive to Cloud Logging and not billing reports.

Reference: Google Cloud. (n.d.). Viewing logs. Google Cloud Documentation. Retrieved from https://cloud.google.com/logging/docs/view/viewing-logs (Refer to the section on "Log entry structure").