create gcp logging to detect who last access identity email contains @domain in the last 90 days

To create a GCP logging to detect who last accessed identity email containing "@bagussa.com" in the last 90 days, you can follow the steps below:

1. Open the GCP console and navigate to the Logging section.
2. Click on "Logs Explorer" and select the project where you want to create the logging.
3. In the query bar, enter the following query:

resource.type="audited_resource" logName:"logs/cloudaudit.googleapis.com%2Factivity" protoPayload.authenticationInfo.principalEmail:"@bagussa.com" timestamp>="`date -d '-90 days' -u +%FT%TZ`"

1. This query will filter the logs of audited resources in the past 90 days that contain the email address "@bagussa.com" in the authentication information.
2. Click on "Create Metric" and fill in the required information to create a new metric for this query.
3. Once the metric is created, you can set up an alert policy to notify you when a user accesses an identity email containing "@bagussa.com" in the last 90 days.

By following the above steps, you can create a GCP logging to detect who last accessed identity email containing "@bagussa" in the last 90 days.