Google Cloud findingView consolidated app →
← Findings by source

Vertex AI Search and Agent Builder

Google Cloud · organizations/123456789012 Google · Agent platform · audit serviceName discoveryengine.googleapis.com

Policy · none set
Policy changes re-score this app on the next sync, which starts right away.
Finding · Open
Risk score
52
High
People
2
Principals in Cloud Audit Logs
Audit entries
32
30 invocations · 0 denied · 30 days
First seen
Aug 15, 2026
Last seen 18 h ago
gcpbuildersinvocationsservice-account-heavyagents
Next steps

Recommended actions

  1. 01Data stores, engines, or agents are configured. Review which buckets, sites, and databases they index; an indexed data store is a standing grant of that content to whoever can query the agent.
Billing · Google Cloud

What it costs

Last 30 days
$560
Previous 30
$592
Change
-5%
2026-06-16: 262026-06-17: 222026-06-18: 242026-06-19: 222026-06-20: 82026-06-21: 82026-06-22: 232026-06-23: 222026-06-24: 222026-06-25: 262026-06-26: 222026-06-27: 82026-06-28: 92026-06-29: 262026-06-30: 262026-07-01: 262026-07-02: 252026-07-03: 232026-07-04: 92026-07-05: 82026-07-06: 262026-07-07: 252026-07-08: 252026-07-09: 222026-07-10: 232026-07-11: 82026-07-12: 92026-07-13: 222026-07-14: 222026-07-15: 242026-07-16: 242026-07-17: 232026-07-18: 92026-07-19: 92026-07-20: 262026-07-21: 232026-07-22: 262026-07-23: 252026-07-24: 242026-07-25: 82026-07-26: 82026-07-27: 222026-07-28: 222026-07-29: 242026-07-30: 242026-07-31: 252026-08-01: 82026-08-02: 82026-08-03: 242026-08-04: 252026-08-05: 232026-08-06: 262026-08-07: 242026-08-08: 82026-08-09: 82026-08-10: 242026-08-11: 252026-08-12: 222026-08-13: 232026-08-14: 242026-08-15: 92026-08-16: 82026-08-17: 232026-08-18: 222026-08-19: 252026-08-20: 222026-08-21: 222026-08-22: 82026-08-23: 92026-08-24: 232026-08-25: 252026-08-26: 242026-08-27: 242026-08-28: 232026-08-29: 92026-08-30: 92026-08-31: 222026-09-01: 232026-09-02: 262026-09-03: 252026-09-04: 222026-09-05: 92026-09-06: 82026-09-07: 242026-09-08: 262026-09-09: 242026-09-10: 222026-09-11: 252026-09-12: 92026-09-13: 8
06-1609-13
Google Cloud (demo) · organizations/123456789012

In Google Cloud

2026-08-16: 12026-08-17: 12026-08-18: 12026-08-19: 12026-08-20: 12026-08-21: 12026-08-22: 12026-08-23: 22026-08-24: 22026-08-25: 12026-08-26: 12026-08-27: 12026-08-28: 12026-08-29: 12026-08-30: 12026-08-31: 12026-09-01: 12026-09-02: 12026-09-03: 12026-09-04: 12026-09-05: 12026-09-06: 12026-09-07: 12026-09-08: 12026-09-09: 12026-09-10: 12026-09-11: 12026-09-12: 12026-09-13: 12026-09-14: 0
08-1609-14
data access logs on30 invocations1 service account
Principals
PrincipalTypeEntriesDenied
[email protected]service account300
[email protected]user20
Top methods
SearchService.Search30
DataStoreService.CreateDataStore1
DocumentService.ImportDocuments1
Projects
contoso-knowledge32 entries
Resources
TypeNameProject
DataStoreintranet-drive-exportcontoso-knowledge
EngineAsk Contosocontoso-knowledge
Who

People

Identifiers come from device telemetry and proxy logs, so they may be account names rather than full directory entries.

PersonDepartmentSourceSign-ins · 30 dGranted
[email protected]
[email protected]
n/aGoogle Cloud principal0No direct grant
intranet-search (service account)
[email protected]
n/aGoogle Cloud principal0No direct grant
Why

Evidence

  1. audit_activity · Sep 13, 2026
    Google Cloud (demo): Vertex AI Search and Agent Builder, 32 audit entries by 2 principals, 2 write, 30 invocations, 2 resources, API enabled in 1 project in 30 days across 1 project
    Detail
    {
  "scopes": [
    "organizations/123456789012"
  ],
  "services": [
    "discoveryengine.googleapis.com"
  ],
  "topMethods": [
    {
      "name": "SearchService.Search",
      "count": 30
    },
    {
      "name": "DataStoreService.CreateDataStore",
      "count": 1
    },
    {
      "name": "DocumentService.ImportDocuments",
      "count": 1
    }
  ],
  "dataAccessLogging": true
}
  2. datastore
    DataStore 'intranet-drive-export' in contoso-knowledge (global)
    Detail
    {
  "name": "//discoveryengine.googleapis.com/projects/contoso-knowledge/locations/global/collections/default_collection/dataStores/intranet",
  "contentConfig": "CONTENT_REQUIRED"
}
  3. engine
    Engine 'Ask Contoso' in contoso-knowledge (global)
    Detail
    {
  "name": "//discoveryengine.googleapis.com/projects/contoso-knowledge/locations/global/collections/default_collection/engines/askcontoso",
  "solutionType": "SOLUTION_TYPE_CHAT"
}
  4. api_enabled
    discoveryengine.googleapis.com enabled in contoso-knowledge
    Detail
    {
  "project": "contoso-knowledge"
}