Searching for Yandex Cloud events in Cloud Logging
Written by
Updated at November 6, 2025
Who deleted a folder
Searching by ID:
json_payload.event_type="yandex.cloud.audit.resourcemanager.DeleteFolder" and json_payload.details.folder_id="<folder_ID>"
Searching by name:
json_payload.event_type="yandex.cloud.audit.resourcemanager.DeleteFolder" and json_payload.details.folder_name="<folder_name>"
Who created/stopped/restarted/deleted a VM
Searching by VM ID:
json_payload.details.instance_id="<VM_ID>" and (json_payload.event_type="yandex.cloud.audit.compute.CreateInstance" or json_payload.event_type="yandex.cloud.audit.compute.UpdateInstance" or json_payload.event_type="yandex.cloud.audit.compute.DeleteInstance" or json_payload.event_type="yandex.cloud.audit.compute.StartInstance" or json_payload.event_type="yandex.cloud.audit.compute.StopInstance" or json_payload.event_type="yandex.cloud.audit.compute.RestartInstance")
What actions a specific user performed over a period of time
Searching by user ID:
json_payload.authentication.subject_id="<user_ID>" and json_payload.event_time>"2021-03-01" and json_payload.event_time<"2021-04-01"
Searching by username:
json_payload.authentication.subject_name="<username>" and json_payload.event_time>"2021-03-01" and json_payload.event_time<"2021-04-01"
Searching for events that occurred to objects in a given folder
Searching by folder ID:
json_payload.resource_metadata.path[1].resource_type="resource-manager.folder" and json_payload.resource_metadata.path[1].resource_id="<folder_ID>") or (json_payload.resource_metadata.path[2].resource_type="resource-manager.folder" and json_payload.resource_metadata.path[2].resource_id="<folder_ID>"
Searching by folder name:
json_payload.resource_metadata.path[1].resource_type="resource-manager.folder" and json_payload.resource_metadata.path[1].resource_name="<folder_name>") or (json_payload.resource_metadata.path[2].resource_type="resource-manager.folder" and json_payload.resource_metadata.path[2].resource_name="<folder_name>"
Searching for events with errors
Searching for permission denied errors:
json_payload.event_status = ERROR and json_payload.error.code = 7
What's next
Check event examples in the Yandex Cloud Security Solution Library.
Note
Yandex Cloud Security Solution Library is a public repo on GitHub with a set of examples and recommendations on how to build a secure infrastructure in Yandex Cloud.