"gcp.audit.method_name":storage.buckets.list OR "gcp.audit.method_name":storage.buckets.listChannels