4.31 - Usage of LLM models over time

Analyze LLM model usage over time, grouping by specific LLM model. Use this to detect any usage spikes or anomalies.

Category: Data Usage
Use Cases: Audit, Detect
Data Sources: Audit Logs - Data Access

Queries or Rules

BigQuery	Log Analytics	Google SecOps
SQL	SQL	Contribute rule

Event Generation

No event generation steps provided. Contribute emulation test to this use case.

Sample Event

google.cloud.aiplatform.v1.PredictionService.Predict

{
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "principalEmail": "test-user@example.com",
      "principalSubject": "user:test-user@example.com"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.255",
      "callerSuppliedUserAgent": "<redacted>",
      "requestAttributes": {
        "time": "2024-02-22T14:33:29.284843427Z",
        "auth": {
        }
      },
      "destinationAttributes": {
      }
    },
    "serviceName": "aiplatform.googleapis.com",
    "methodName": "google.cloud.aiplatform.v1.PredictionService.Predict",
    "authorizationInfo": [
      {
        "resource": "projects/my-project/locations/us-central1/publishers/google/models/code-bison@002",
        "permission": "aiplatform.endpoints.predict",
        "granted": true,
        "resourceAttributes": {
        }
      }
    ],
    "resourceName": "projects/my-project/locations/us-central1/publishers/google/models/code-bison@002",
    "request": {
      "endpoint": "projects/my-project/locations/us-central1/publishers/google/models/code-bison@002",
      "@type": "type.googleapis.com/google.cloud.aiplatform.v1.PredictRequest"
    },
    "response": {
      "@type": "type.googleapis.com/google.cloud.aiplatform.v1.PredictResponse"
    }
  },
  "insertId": "1pbm5dbe1oqug",
  "resource": {
    "type": "audited_resource",
    "labels": {
      "service": "aiplatform.googleapis.com",
      "project_id": "my-project",
      "method": "google.cloud.aiplatform.v1.PredictionService.Predict"
    }
  },
  "timestamp": "2024-02-22T14:33:29.284416639Z",
  "severity": "INFO",
  "logName": "projects/my-project/logs/cloudaudit.googleapis.com%2Fdata_access",
  "receiveTimestamp": "2024-02-22T14:33:31.245712026Z"
}

google.cloud.aiplatform.v1beta1.PredictionService.GenerateContent

{
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "principalEmail": "test-user@example.com",
      "principalSubject": "user:test-user@example.com"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.255",
      "callerSuppliedUserAgent": "<redacted>",
      "requestAttributes": {
        "time": "2024-02-22T04:55:11.117617705Z",
        "auth": {
        }
      },
      "destinationAttributes": {
      }
    },
    "serviceName": "aiplatform.googleapis.com",
    "methodName": "google.cloud.aiplatform.v1beta1.PredictionService.GenerateContent",
    "authorizationInfo": [
      {
        "resource": "projects/my-project/locations/us-central1/publishers/google/models/gemini-1.0-pro-001",
        "permission": "aiplatform.endpoints.predict",
        "granted": true,
        "resourceAttributes": {
        }
      }
    ],
    "resourceName": "projects/my-project/locations/us-central1/publishers/google/models/gemini-1.0-pro-001",
    "request": {
      "@type": "type.googleapis.com/google.cloud.aiplatform.v1beta1.GenerateContentRequest",
      "model": "projects/my-project/locations/us-central1/publishers/google/models/gemini-1.0-pro-001"
    },
    "response": {
      "@type": "type.googleapis.com/google.cloud.aiplatform.v1beta1.GenerateContentResponse"
    }
  },
  "insertId": "a9mqkae614f2",
  "resource": {
    "type": "audited_resource",
    "labels": {
      "service": "aiplatform.googleapis.com",
      "method": "google.cloud.aiplatform.v1beta1.PredictionService.GenerateContent",
      "project_id": "my-project"
    }
  },
  "timestamp": "2024-02-22T04:55:11.116811865Z",
  "severity": "INFO",
  "logName": "projects/my-project/logs/cloudaudit.googleapis.com%2Fdata_access",
  "receiveTimestamp": "2024-02-22T04:55:14.371010794Z"
}

References

https://cloud.google.com/vertex-ai/docs/general/audit-logging#audited_operations

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!