Dt Obs Gcp

GCP Cloud Infrastructure

Monitor and analyze GCP resources using Dynatrace Smartscape and DQL. Query GCP services, manage organizational hierarchy, audit security posture, and track resource ownership across your GCP infrastructure.

When to Use This Skill

Use this skill when the user needs to work with GCP resources in Dynatrace. Load the reference file for the task type:

---

Core Concepts

Entity Types

GCP resources use the GCP_* prefix and can be queried using the smartscapeNodes function. All GCP entities are automatically discovered and modeled in Dynatrace Smartscape.

Compute: GCP_COMPUTE_GOOGLEAPIS_COM_INSTANCE, GCP_COMPUTE_GOOGLEAPIS_COM_ADDRESS Networking: GCP_COMPUTE_GOOGLEAPIS_COM_NETWORK, GCP_COMPUTE_GOOGLEAPIS_COM_SUBNETWORK, GCP_COMPUTE_GOOGLEAPIS_COM_ROUTE, GCP_DNS_GOOGLEAPIS_COM_RESOURCERECORDSET Kubernetes (GKE): GCP_K8S_IO_POD, GCP_K8S_IO_NODE, GCP_K8S_IO_SERVICE, GCP_K8S_IO_SERVICEACCOUNT, GCP_K8S_IO_PERSISTENTVOLUMECLAIM, GCP_APPS_K8S_IO_DEPLOYMENT, GCP_APPS_K8S_IO_STATEFULSET, GCP_CONTAINER_GOOGLEAPIS_COM_NODEPOOL, GCP_RBAC_AUTHORIZATION_K8S_IO_CLUSTERROLEBINDING, GCP_RBAC_AUTHORIZATION_K8S_IO_ROLEBINDING Serverless: GCP_RUN_GOOGLEAPIS_COM_SERVICE, GCP_RUN_GOOGLEAPIS_COM_REVISION, GCP_RUN_GOOGLEAPIS_COM_EXECUTION IAM & Security: GCP_IAM_GOOGLEAPIS_COM_SERVICEACCOUNT, GCP_IAM_GOOGLEAPIS_COM_ROLE, GCP_SECRETMANAGER_GOOGLEAPIS_COM_SECRETVERSION Messaging: GCP_PUBSUB_GOOGLEAPIS_COM_TOPIC Monitoring: GCP_MONITORING_GOOGLEAPIS_COM_DASHBOARD, GCP_LOGGING_GOOGLEAPIS_COM_SAVEDQUERY Infrastructure: GCP_REGION

Common GCP Fields

All GCP entities include:

• gcp.project.id — GCP project identifier
• gcp.region — GCP region (e.g., us-central1)
• gcp.zone — GCP zone (e.g., us-central1-a)
• gcp.organization.id — GCP organization identifier
• gcp.resource.name — Resource name
• gcp.resource.type — Resource type identifier
• gcp.asset.type — GCP asset type
• gcp.object — JSON blob containing full resource configuration

GCP Organizational Hierarchy

GCP resources are organized in a hierarchy:

• Organization — Top-level container (gcp.organization.id)
• Folder — Logical grouping within an organization
• Project — Resource container (gcp.project.id)
• Region/Zone — Physical location (gcp.region, gcp.zone)

Entity Naming Convention

GCP entity types follow the pattern GCP_<SERVICE_API>_<RESOURCE>:

• Service API maps to the Google API domain (e.g., compute.googleapis.com → COMPUTE_GOOGLEAPIS_COM)
• Resource is the specific resource type (e.g., INSTANCE, NETWORK)

Examples:

• GCP_COMPUTE_GOOGLEAPIS_COM_INSTANCE — Compute Engine VM
• GCP_K8S_IO_POD — GKE pod
• GCP_RUN_GOOGLEAPIS_COM_SERVICE — Cloud Run service

---

Query Patterns

All GCP queries build on four core patterns. Master these and adapt them to any entity type.

Pattern 1: Resource Discovery

List resources by type, filter by project/region/zone, summarize counts:

smartscapeNodes "GCP_COMPUTE_GOOGLEAPIS_COM_INSTANCE"
| fields name, gcp.project.id, gcp.region, gcp.zone, gcp.resource.name

To list all GCP resource types, replace with "GCP_*" and add | summarize count = count(), by: {type} | sort count desc. Add filters like | filter gcp.project.id == "<PROJECT_ID>" or | filter gcp.region == "<REGION>" to scope results.

Pattern 2: Configuration Parsing

Parse gcp.object JSON for detailed configuration fields:

smartscapeNodes "GCP_COMPUTE_GOOGLEAPIS_COM_INSTANCE"
| parse gcp.object, "JSON:gcpjson"
| fieldsAdd machineType = gcpjson[configuration][resource][machineType],
            status = gcpjson[configuration][resource][status]
| fields name, gcp.project.id, machineType, status

GCP configuration fields are nested under gcpjson[configuration][resource][...] for primary resource attributes and gcpjson[configuration][additionalAttributes][...] for extended properties.

Pattern 3: Relationship Traversal

Follow relationships between resources:

smartscapeNodes "GCP_COMPUTE_GOOGLEAPIS_COM_INSTANCE"
| traverse "*", "GCP_COMPUTE_GOOGLEAPIS_COM_SUBNETWORK"
| fields name, gcp.project.id

GCP entities use "*" as the relationship name in traversals because GCP entities do not have named relationship types. Use fieldsKeep to carry fields through traversals and dt.traverse.history[-N] to access ancestor fields.

Pattern 4: Label-Based Ownership

Group resources by GCP labels for ownership and organizational tracking:

smartscapeNodes "GCP_*"
| filter isNotNull(`tags:gcp_labels`)
| fields name, gcp.project.id, `tags:gcp_labels`

GCP labels are exposed via the tags:gcp_labels field and must be accessed using backtick syntax. Replace "GCP_*" with a specific type to scope to one service.

---

Reference Guide

Load reference files for detailed queries when the core patterns above need service-specific adaptation.

---

Best Practices

Configuration Parsing

1. Always parse gcp.object with JSON parser: parse gcp.object, "JSON:gcpjson" 2. Access primary resource attributes via gcpjson[configuration][resource][...] 3. Access extended properties via gcpjson[configuration][additionalAttributes][...] 4. Check for null values after parsing with isNotNull()

GCP Hierarchy

1. Organization → Folder → Project → Region/Zone 2. Use gcp.project.id as the primary scoping filter 3. Use gcp.organization.id for cross-project queries 4. Use gcp.region and gcp.zone for location-based analysis

Entity Naming

1. Entity types follow the GCP_<SERVICE_API>_<RESOURCE> format 2. Service API maps to the Google API domain with underscores replacing dots and hyphens 3. Use specific entity types (avoid "GCP_*" wildcards when possible)

Labels

1. GCP labels must be accessed via backtick syntax: ` tags:gcp_labels 2. Use isNotNull(tags:gcp_labels)` for label-based filtering 3. Track label coverage with summarize operations

Relationship Traversal

1. Use "*" as the relationship name — GCP entities do not have named relationship types 2. Use fieldsKeep to maintain important fields through traversal 3. Access traversal history with dt.traverse.history[-N] 4. Complex topologies may require multiple traverse operations

---

Limitations and Notes

Smartscape Limitations

• Smartscape data reflects the most recent scan; there may be a delay between GCP changes and Dynatrace visibility
• Not all GCP services are represented as entity types
• Some configuration fields may be null depending on resource setup
• Resource discovery depends on GCP integration configuration

GCP-Specific Notes

• GCP labels must be accessed via backtick syntax: ` tags:gcp_labels `
• GCP entities use "*" for relationship traversal (no named relationship types)
• GCP object configuration requires parsing with parse gcp.object, "JSON:gcpjson"
• Configuration fields nest under gcpjson[configuration][resource][...] (differs from AWS pattern)

General Tips

• Filter early by project and region for better performance
• Use isNotNull() and isNull() for graceful null handling
• Combine project and region filters for large environments
• Use countDistinct() for unique resource counts
• Limit results with | limit N during exploration

GCP Compute Engine Instances

Monitor and analyze GCP Compute Engine virtual machine instances, configurations, and static IP addresses.

Table of Contents

• Compute Entity Types
• Instance Discovery and Inventory
• Instance Configuration Analysis
• Security Analysis
• Relationship Traversal
• IP Address Management

Compute Entity Types

All these types support the standard discovery pattern: smartscapeNodes "<TYPE>" | fields name, gcp.project.id, gcp.region, gcp.zone, gcp.resource.name

Instance Discovery and Inventory

List all Compute Engine instances:

smartscapeNodes "GCP_COMPUTE_GOOGLEAPIS_COM_INSTANCE"
| fields name, gcp.project.id, gcp.region, gcp.zone, gcp.resource.name

Count instances by project:

smartscapeNodes "GCP_COMPUTE_GOOGLEAPIS_COM_INSTANCE"
| summarize count(), by: {gcp.project.id}

Find instances in a specific project:

smartscapeNodes "GCP_COMPUTE_GOOGLEAPIS_COM_INSTANCE"
| filter gcp.project.id == "<GCP_PROJECT_ID>"
| fields name, gcp.region, gcp.zone

Instance Configuration Analysis

Get machine type and status for all instances:

smartscapeNodes "GCP_COMPUTE_GOOGLEAPIS_COM_INSTANCE"
| parse gcp.object, "JSON:gcpjson"
| fieldsAdd machineType = gcpjson[configuration][additionalAttributes][machineType],
            status = gcpjson[configuration][resource][status]
| fields name, gcp.project.id, machineType, status

Retrieve instance labels:

smartscapeNodes "GCP_COMPUTE_GOOGLEAPIS_COM_INSTANCE"
| parse gcp.object, "JSON:gcpjson"
| fieldsAdd labels = gcpjson[configuration][resource][labels]
| fields name, labels

Security Analysis

Check deletion protection and external IP exposure:

smartscapeNodes "GCP_COMPUTE_GOOGLEAPIS_COM_INSTANCE"
| parse gcp.object, "JSON:gcpjson"
| fieldsAdd deletionProtection = gcpjson[configuration][additionalAttributes][deletionProtection],
            externalIPs = gcpjson[configuration][additionalAttributes][externalIPs]
| fields name, deletionProtection, externalIPs

Audit network interface details — internal and external IPs with machine type:

smartscapeNodes "GCP_COMPUTE_GOOGLEAPIS_COM_INSTANCE"
| parse gcp.object, "JSON:gcpjson"
| fieldsAdd internalIPs = gcpjson[configuration][additionalAttributes][internalIPs],
            externalIPs = gcpjson[configuration][additionalAttributes][externalIPs],
            machineType = gcpjson[configuration][additionalAttributes][machineType]
| fields name, gcp.project.id, machineType, internalIPs, externalIPs

Relationship Traversal

Traverse from instances to their subnetworks:

smartscapeNodes "GCP_COMPUTE_GOOGLEAPIS_COM_INSTANCE"
| traverse "*", "GCP_COMPUTE_GOOGLEAPIS_COM_SUBNETWORK"
| fields name, gcp.project.id

IP Address Management

List all static IP addresses:

smartscapeNodes "GCP_COMPUTE_GOOGLEAPIS_COM_ADDRESS"
| fields name, gcp.project.id, gcp.region

GCP IAM & Security

Monitor IAM service accounts, roles, and Secret Manager secrets for security auditing across GCP projects.

Table of Contents

• IAM & Security Entity Types
• Service Account Inventory
• Service Account Security Audit
• IAM Role Analysis
• Secret Management

IAM & Security Entity Types

All these types support the standard discovery pattern: smartscapeNodes "<TYPE>" | fields name, gcp.project.id

Service Account Inventory

List all service accounts with email and status:

smartscapeNodes "GCP_IAM_GOOGLEAPIS_COM_SERVICEACCOUNT"
| parse gcp.object, "JSON:gcpjson"
| fieldsAdd email = gcpjson[configuration][resource][email],
            disabled = gcpjson[configuration][resource][disabled]
| fields name, gcp.project.id, email, disabled

Count service accounts by project:

smartscapeNodes "GCP_IAM_GOOGLEAPIS_COM_SERVICEACCOUNT"
| summarize count(), by: {gcp.project.id}

Find service accounts in a specific project:

smartscapeNodes "GCP_IAM_GOOGLEAPIS_COM_SERVICEACCOUNT"
| filter gcp.project.id == "<GCP_PROJECT_ID>"
| parse gcp.object, "JSON:gcpjson"
| fieldsAdd email = gcpjson[configuration][resource][email],
            disabled = gcpjson[configuration][resource][disabled]
| fields name, email, disabled

Service Account Security Audit

Find disabled service accounts — useful for identifying decommissioned accounts that may still have role bindings:

smartscapeNodes "GCP_IAM_GOOGLEAPIS_COM_SERVICEACCOUNT"
| parse gcp.object, "JSON:gcpjson"
| fieldsAdd email = gcpjson[configuration][resource][email],
            disabled = gcpjson[configuration][resource][disabled]
| filter disabled == true
| fields name, gcp.project.id, email

Find active (enabled) service accounts:

smartscapeNodes "GCP_IAM_GOOGLEAPIS_COM_SERVICEACCOUNT"
| parse gcp.object, "JSON:gcpjson"
| fieldsAdd email = gcpjson[configuration][resource][email],
            disabled = gcpjson[configuration][resource][disabled]
| filter isNull(disabled) or disabled != true
| fields name, gcp.project.id, email

IAM Role Analysis

List all IAM roles:

smartscapeNodes "GCP_IAM_GOOGLEAPIS_COM_ROLE"
| fields name, gcp.project.id

Count IAM roles by project:

smartscapeNodes "GCP_IAM_GOOGLEAPIS_COM_ROLE"
| summarize count(), by: {gcp.project.id}

Secret Management

List Secret Manager secret versions with their state:

smartscapeNodes "GCP_SECRETMANAGER_GOOGLEAPIS_COM_SECRETVERSION"
| parse gcp.object, "JSON:gcpjson"
| fieldsAdd state = gcpjson[configuration][resource][state]
| fields name, gcp.project.id, state

Find enabled (active) secret versions:

smartscapeNodes "GCP_SECRETMANAGER_GOOGLEAPIS_COM_SECRETVERSION"
| parse gcp.object, "JSON:gcpjson"
| fieldsAdd state = gcpjson[configuration][resource][state]
| filter state == "ENABLED"
| fields name, gcp.project.id

Find destroyed or disabled secret versions — useful for lifecycle auditing:

smartscapeNodes "GCP_SECRETMANAGER_GOOGLEAPIS_COM_SECRETVERSION"
| parse gcp.object, "JSON:gcpjson"
| fieldsAdd state = gcpjson[configuration][resource][state]
| filter state != "ENABLED"
| fields name, gcp.project.id, state

Summarize secret versions by state:

smartscapeNodes "GCP_SECRETMANAGER_GOOGLEAPIS_COM_SECRETVERSION"
| parse gcp.object, "JSON:gcpjson"
| fieldsAdd state = gcpjson[configuration][resource][state]
| summarize count(), by: {state}

GCP Kubernetes / GKE

Monitor GKE clusters, workloads, nodes, RBAC, and storage via Dynatrace Smartscape.

Table of Contents

• Kubernetes Entity Types
• Pod Discovery and Status
• Deployment and StatefulSet Management
• Node and Node Pool Configuration
• Service Discovery
• RBAC Analysis
• Storage
• Cross-Resource Summarization

Kubernetes Entity Types

All these types support the standard discovery pattern: smartscapeNodes "<TYPE>" | fields name, gcp.project.id, gcp.region, ...

Config parsing pattern: parse gcp.object, "JSON:gcpjson" then access gcpjson[configuration][resource][...]

Pod Discovery and Status

List all pods with project and region:

smartscapeNodes "GCP_K8S_IO_POD"
| fields name, gcp.project.id, gcp.region

Extract pod phase and assigned node from the GCP object configuration:

smartscapeNodes "GCP_K8S_IO_POD"
| parse gcp.object, "JSON:gcpjson"
| fieldsAdd phase = gcpjson[configuration][resource][status][phase],
            nodeName = gcpjson[configuration][resource][spec][nodeName]
| fields name, gcp.project.id, phase, nodeName

Find all pods scheduled on a specific node:

smartscapeNodes "GCP_K8S_IO_POD"
| parse gcp.object, "JSON:gcpjson"
| fieldsAdd nodeName = gcpjson[configuration][resource][spec][nodeName]
| filter nodeName == "<NODE_NAME>"
| fields name, gcp.project.id, nodeName

Deployment and StatefulSet Management

List all deployments:

smartscapeNodes "GCP_APPS_K8S_IO_DEPLOYMENT"
| fields name, gcp.project.id, gcp.region

List all stateful sets:

smartscapeNodes "GCP_APPS_K8S_IO_STATEFULSET"
| fields name, gcp.project.id, gcp.region

Node and Node Pool Configuration

List all Kubernetes nodes:

smartscapeNodes "GCP_K8S_IO_NODE"
| fields name, gcp.project.id, gcp.region

Inspect GKE node pool sizing and machine types — use for capacity planning and cost analysis:

smartscapeNodes "GCP_CONTAINER_GOOGLEAPIS_COM_NODEPOOL"
| parse gcp.object, "JSON:gcpjson"
| fieldsAdd initialNodeCount = gcpjson[configuration][resource][initialNodeCount],
            diskSizeGb = gcpjson[configuration][resource][config][diskSizeGb],
            machineType = gcpjson[configuration][resource][config][machineType]
| fields name, gcp.project.id, gcp.region, initialNodeCount, diskSizeGb, machineType

List node pool configurations for a specific project:

smartscapeNodes "GCP_CONTAINER_GOOGLEAPIS_COM_NODEPOOL"
| filter gcp.project.id == "<GCP_PROJECT_ID>"
| parse gcp.object, "JSON:gcpjson"
| fieldsAdd initialNodeCount = gcpjson[configuration][resource][initialNodeCount],
            diskSizeGb = gcpjson[configuration][resource][config][diskSizeGb],
            machineType = gcpjson[configuration][resource][config][machineType]
| fields name, gcp.region, initialNodeCount, diskSizeGb, machineType

Service Discovery

List all Kubernetes services:

smartscapeNodes "GCP_K8S_IO_SERVICE"
| fields name, gcp.project.id, gcp.region

List all service accounts:

smartscapeNodes "GCP_K8S_IO_SERVICEACCOUNT"
| fields name, gcp.project.id, gcp.region

RBAC Analysis

List cluster-wide role bindings — use for auditing cluster-level permissions:

smartscapeNodes "GCP_RBAC_AUTHORIZATION_K8S_IO_CLUSTERROLEBINDING"
| fields name, gcp.project.id, gcp.region

List namespace-scoped role bindings:

smartscapeNodes "GCP_RBAC_AUTHORIZATION_K8S_IO_ROLEBINDING"
| fields name, gcp.project.id, gcp.region

Storage

List all persistent volume claims:

smartscapeNodes "GCP_K8S_IO_PERSISTENTVOLUMECLAIM"
| fields name, gcp.project.id, gcp.region

Cross-Resource Summarization

Count pods by GCP project:

smartscapeNodes "GCP_K8S_IO_POD"
| summarize count(), by: {gcp.project.id}

GCP Messaging (Pub/Sub)

Monitor Pub/Sub topics and messaging infrastructure across GCP projects.

Table of Contents

• Messaging Entity Types
• Topic Discovery
• Topic Distribution by Project

Messaging Entity Types

All these types support the standard discovery pattern: smartscapeNodes "<TYPE>" | fields name, gcp.project.id, gcp.region

Topic Discovery

List all Pub/Sub topics:

smartscapeNodes "GCP_PUBSUB_GOOGLEAPIS_COM_TOPIC"
| fields name, gcp.project.id, gcp.region

Find topics in a specific project:

smartscapeNodes "GCP_PUBSUB_GOOGLEAPIS_COM_TOPIC"
| filter gcp.project.id == "<GCP_PROJECT_ID>"
| fields name, gcp.region

Find topics by name pattern:

smartscapeNodes "GCP_PUBSUB_GOOGLEAPIS_COM_TOPIC"
| filter contains(name, "<TOPIC_NAME_PATTERN>")
| fields name, gcp.project.id, gcp.region

Topic Distribution by Project

Count Pub/Sub topics per project:

smartscapeNodes "GCP_PUBSUB_GOOGLEAPIS_COM_TOPIC"
| summarize count(), by: {gcp.project.id}

Count topics by project and region:

smartscapeNodes "GCP_PUBSUB_GOOGLEAPIS_COM_TOPIC"
| summarize count(), by: {gcp.project.id, gcp.region}

GCP Monitoring & Logging

Monitor Cloud Monitoring dashboards and Cloud Logging saved queries across GCP projects.

Table of Contents

• Monitoring & Logging Entity Types
• Monitoring Dashboard Inventory
• Logging Configuration

Monitoring & Logging Entity Types

All these types support the standard discovery pattern: smartscapeNodes "<TYPE>" | fields name, gcp.project.id

Monitoring Dashboard Inventory

List all Cloud Monitoring dashboards:

smartscapeNodes "GCP_MONITORING_GOOGLEAPIS_COM_DASHBOARD"
| fields name, gcp.project.id

Count dashboards by project:

smartscapeNodes "GCP_MONITORING_GOOGLEAPIS_COM_DASHBOARD"
| summarize count(), by: {gcp.project.id}

Find dashboards in a specific project:

smartscapeNodes "GCP_MONITORING_GOOGLEAPIS_COM_DASHBOARD"
| filter gcp.project.id == "<GCP_PROJECT_ID>"
| fields name

Logging Configuration

List all Cloud Logging saved queries:

smartscapeNodes "GCP_LOGGING_GOOGLEAPIS_COM_SAVEDQUERY"
| fields name, gcp.project.id

Count saved queries by project:

smartscapeNodes "GCP_LOGGING_GOOGLEAPIS_COM_SAVEDQUERY"
| summarize count(), by: {gcp.project.id}

Count all monitoring and logging resources by type:

smartscapeNodes "GCP_MONITORING_GOOGLEAPIS_COM_DASHBOARD", "GCP_LOGGING_GOOGLEAPIS_COM_SAVEDQUERY"
| summarize count(), by: {type, gcp.project.id}

GCP Networking & DNS

Monitor VPC networks, subnets, routes, and Cloud DNS record sets across GCP projects.

Table of Contents

• Networking Entity Types
• VPC Network Configuration
• Subnet Management
• Route Analysis
• DNS Records
• Network Topology

Networking Entity Types

All these types support the standard discovery pattern: smartscapeNodes "<TYPE>" | fields name, gcp.project.id, gcp.region

VPC Network Configuration

List VPC networks with auto-subnet mode and routing configuration:

smartscapeNodes "GCP_COMPUTE_GOOGLEAPIS_COM_NETWORK"
| parse gcp.object, "JSON:gcpjson"
| fieldsAdd autoCreateSubnetworks = gcpjson[configuration][resource][autoCreateSubnetworks],
            routingMode = gcpjson[configuration][resource][routingConfig][routingMode]
| fields name, gcp.project.id, autoCreateSubnetworks, routingMode

Find VPC networks in a specific project:

smartscapeNodes "GCP_COMPUTE_GOOGLEAPIS_COM_NETWORK"
| filter gcp.project.id == "<GCP_PROJECT_ID>"
| fields name, autoCreateSubnetworks

Subnet Management

List all subnets with CIDR ranges and purpose:

smartscapeNodes "GCP_COMPUTE_GOOGLEAPIS_COM_SUBNETWORK"
| parse gcp.object, "JSON:gcpjson"
| fieldsAdd ipCidrRange = gcpjson[configuration][resource][ipCidrRange],
            purpose = gcpjson[configuration][resource][purpose]
| fields name, gcp.project.id, gcp.region, ipCidrRange, purpose

Count subnets by project and region:

smartscapeNodes "GCP_COMPUTE_GOOGLEAPIS_COM_SUBNETWORK"
| summarize count(), by: {gcp.project.id, gcp.region}

Find subnets in a specific project:

smartscapeNodes "GCP_COMPUTE_GOOGLEAPIS_COM_SUBNETWORK"
| filter gcp.project.id == "<GCP_PROJECT_ID>"
| fields name, gcp.region, ipCidrRange, purpose

Route Analysis

List routes with destination ranges and next-hop gateways:

smartscapeNodes "GCP_COMPUTE_GOOGLEAPIS_COM_ROUTE"
| parse gcp.object, "JSON:gcpjson"
| fieldsAdd destRange = gcpjson[configuration][resource][destRange],
            nextHopGateway = gcpjson[configuration][resource][nextHopGateway]
| fields name, gcp.project.id, destRange, nextHopGateway

Find routes targeting the default internet gateway:

smartscapeNodes "GCP_COMPUTE_GOOGLEAPIS_COM_ROUTE"
| parse gcp.object, "JSON:gcpjson"
| fieldsAdd destRange = gcpjson[configuration][resource][destRange],
            nextHopGateway = gcpjson[configuration][resource][nextHopGateway]
| filter contains(toString(nextHopGateway), "default-internet-gateway")
| fields name, gcp.project.id, destRange

DNS Records

List all Cloud DNS resource record sets:

smartscapeNodes "GCP_DNS_GOOGLEAPIS_COM_RESOURCERECORDSET"
| fields name, gcp.project.id

Count DNS records by project:

smartscapeNodes "GCP_DNS_GOOGLEAPIS_COM_RESOURCERECORDSET"
| summarize count(), by: {gcp.project.id}

Network Topology

Count all networking resources by type and project:

smartscapeNodes "GCP_COMPUTE_GOOGLEAPIS_COM_NETWORK", "GCP_COMPUTE_GOOGLEAPIS_COM_SUBNETWORK", "GCP_COMPUTE_GOOGLEAPIS_COM_ROUTE", "GCP_DNS_GOOGLEAPIS_COM_RESOURCERECORDSET"
| summarize count(), by: {type, gcp.project.id}

dt-obs-gcp Reference Files

GCP Resource Management

Analyze GCP resource distribution across regions, projects, and organizational hierarchy.

Table of Contents

• Resource Management Entity Types
• Region Inventory
• Resource Distribution by Project
• Resource Distribution by Region

Resource Management Entity Types

Region Inventory

List all GCP regions with monitored resources:

smartscapeNodes "GCP_REGION"
| fields name, id

Resource Distribution by Project

Count all GCP resources by project — use for understanding project-level resource sprawl:

smartscapeNodes "GCP_*"
| summarize count(), by: {gcp.project.id}
| sort `count()`, direction: "descending"

Break down resources by type within a specific project:

smartscapeNodes "GCP_*"
| filter gcp.project.id == "<GCP_PROJECT_ID>"
| summarize count(), by: {type}
| sort `count()`, direction: "descending"

Count distinct resource types per project:

smartscapeNodes "GCP_*"
| summarize
    type_count = countDistinct(type),
    total_resources = count(),
    by: {gcp.project.id}
| sort total_resources, direction: "descending"

Resource Distribution by Region

Count all GCP resources by region:

smartscapeNodes "GCP_*"
| summarize count(), by: {gcp.region}
| sort `count()`, direction: "descending"

Find resource types spanning multiple regions:

smartscapeNodes "GCP_*"
| summarize
    region_count = countDistinct(gcp.region),
    total_resources = count(),
    by: {type}
| filter region_count > 1
| sort region_count, direction: "descending"

View resource distribution across projects and regions:

smartscapeNodes "GCP_*"
| summarize count(), by: {gcp.project.id, gcp.region}
| sort `count()`, direction: "descending"

GCP Resource Ownership

Track resource ownership using GCP labels and organizational structure across all GCP entity types.

Table of Contents

• Label-Based Resource Ownership
• Organization-Level Overview
• Label Discovery

Label-Based Resource Ownership

GCP uses labels (key-value pairs) for resource organization and ownership tracking. Labels are exposed via the tags:gcp_labels attribute on smartscape nodes.

Find all GCP resources that have labels assigned:

smartscapeNodes "GCP_*"
| filter isNotNull(`tags:gcp_labels`)
| fields name, gcp.project.id, `tags:gcp_labels`

Filter resources by a specific label:

smartscapeNodes "GCP_*"
| filter isNotNull(`tags:gcp_labels`)
| filter contains(toString(`tags:gcp_labels`), "<LABEL_KEY>")
| fields name, gcp.project.id, `tags:gcp_labels`

Summarize resources by label for ownership reporting:

smartscapeNodes "GCP_*"
| filter isNotNull(`tags:gcp_labels`)
| filter contains(toString(`tags:gcp_labels`), "<LABEL_KEY>")
| summarize count(), by: {gcp.project.id, type}

Common Ownership Labels

Instance-Level Label Extraction

For Compute Engine instances, labels are also available inside gcp.object:

smartscapeNodes "GCP_COMPUTE_GOOGLEAPIS_COM_INSTANCE"
| parse gcp.object, "JSON:gcpjson"
| fieldsAdd labels = gcpjson[configuration][resource][labels]
| fields name, labels

Organization-Level Overview

Summarize resources by GCP organization — use for multi-org visibility:

smartscapeNodes "GCP_*"
| summarize count(), by: {gcp.organization.id}

Break down organization resources by project:

smartscapeNodes "GCP_*"
| summarize count(), by: {gcp.organization.id, gcp.project.id}
| sort `count()`, direction: "descending"

Label Discovery

Find resources with no labels — useful for label compliance auditing:

smartscapeNodes "GCP_*"
| filter isNull(`tags:gcp_labels`)
| summarize count(), by: {type, gcp.project.id}

Calculate label coverage across resource types:

smartscapeNodes "GCP_*"
| fieldsAdd has_labels = if(isNotNull(`tags:gcp_labels`), 1)
| summarize
    total = count(),
    with_labels = sum(has_labels),
    by: {type}
| fieldsAdd label_coverage_pct = (with_labels * 100.0) / total
| sort label_coverage_pct asc

GCP Serverless Containers (Cloud Run)

Monitor Cloud Run services, revisions, and job executions across GCP projects.

Table of Contents

• Serverless Container Entity Types
• Service Discovery
• Revision Tracking
• Execution Monitoring
• Service Distribution

Serverless Container Entity Types

All these types support the standard discovery pattern: smartscapeNodes "<TYPE>" | fields name, gcp.project.id, gcp.region

Service Discovery

Cloud Run services exist in two schema versions with different field layouts:

• v1 (serving.knative.dev/v1): Knative-compatible format — runtime state is nested under status
• v2 (run.googleapis.com/v2): Native Cloud Run v2 format — fields are top-level

List all Cloud Run services with their API version — use this to identify which schema version applies:

smartscapeNodes "GCP_RUN_GOOGLEAPIS_COM_SERVICE"
| parse gcp.object, "JSON:gcpjson"
| fieldsAdd apiVersion = gcpjson[configuration][resource][apiVersion]
| fields name, gcp.project.id, gcp.region, apiVersion

List Cloud Run v1 services with their public URL and latest serving revision:

smartscapeNodes "GCP_RUN_GOOGLEAPIS_COM_SERVICE"
| parse gcp.object, "JSON:gcpjson"
| fieldsAdd apiVersion = gcpjson[configuration][resource][apiVersion]
| filter apiVersion == "serving.knative.dev/v1"
| fieldsAdd url = gcpjson[configuration][resource][status][url],
            latestReadyRevision = gcpjson[configuration][resource][status][latestReadyRevisionName]
| fields name, gcp.project.id, gcp.region, url, latestReadyRevision

List Cloud Run v2 services with launch stage, URI, and latest revision — field paths follow the Cloud Run v2 API spec:

smartscapeNodes "GCP_RUN_GOOGLEAPIS_COM_SERVICE"
| parse gcp.object, "JSON:gcpjson"
| fieldsAdd apiVersion = gcpjson[configuration][resource][apiVersion]
| filter apiVersion != "serving.knative.dev/v1"
| fieldsAdd launchStage = gcpjson[configuration][resource][launchStage],
            uri = gcpjson[configuration][resource][uri],
            latestReadyRevision = gcpjson[configuration][resource][latestReadyRevision]
| fields name, gcp.project.id, gcp.region, launchStage, uri, latestReadyRevision

Find Cloud Run services in a specific project:

smartscapeNodes "GCP_RUN_GOOGLEAPIS_COM_SERVICE"
| filter gcp.project.id == "<GCP_PROJECT_ID>"
| fields name, gcp.region

Revision Tracking

List all Cloud Run revisions to track deployment history:

smartscapeNodes "GCP_RUN_GOOGLEAPIS_COM_REVISION"
| fields name, gcp.project.id, gcp.region

Find revisions in a specific project:

smartscapeNodes "GCP_RUN_GOOGLEAPIS_COM_REVISION"
| filter gcp.project.id == "<GCP_PROJECT_ID>"
| fields name, gcp.region

Execution Monitoring

List Cloud Run job executions:

smartscapeNodes "GCP_RUN_GOOGLEAPIS_COM_EXECUTION"
| fields name, gcp.project.id, gcp.region

Service Distribution

Count Cloud Run services by project and region:

smartscapeNodes "GCP_RUN_GOOGLEAPIS_COM_SERVICE"
| summarize count(), by: {gcp.project.id, gcp.region}

Count all Cloud Run resources by type:

smartscapeNodes "GCP_RUN_GOOGLEAPIS_COM_SERVICE", "GCP_RUN_GOOGLEAPIS_COM_REVISION", "GCP_RUN_GOOGLEAPIS_COM_EXECUTION"
| summarize count(), by: {type}