✄𐘗
text code block:
✄𐘗from logs-gcp.audit-* metadata _id, _version, _index
| where data_stream.dataset == "gcp.audit"
    and event.action == "google.cloud.secretmanager.v1.SecretManagerService.ListSecrets"
    and cloud.project.id is not null
    and client.user.email is not null
    and source.ip is not null
| stats
    Esql.cloud_project_id_count_distinct = count_distinct(cloud.project.id),
    Esql.cloud_project_id_values = values(cloud.project.id),
    Esql.event_count = count(*),
    Esql.event_outcome_values = values(event.outcome),
    Esql.client_user_id_values = values(client.user.id),
    Esql.user_agent_original_values = values(user_agent.original),
    Esql.earliest_timestamp = min(@timestamp),
    Esql.latest_timestamp = max(@timestamp)
  by client.user.email, source.ip, data_stream.namespace
| where Esql.cloud_project_id_count_distinct >= 10
| keep
    client.user.email,
    source.ip,
    Esql.cloud_project_id_count_distinct,
    Esql.cloud_project_id_values,
    Esql.event_count,
    Esql.event_outcome_values,
    Esql.client_user_id_values,
    Esql.user_agent_original_values,
    Esql.earliest_timestamp,
    Esql.latest_timestamp, 
    data_stream.namespace