Google Cloud Platform

[JorgeCR]

We are seeing lot of traffic to Google Cloud Platform in our network.  Its primary category is Computers/Internet, but we are wondering what this traffic is since, as I said, it is a lot.

[PhoneBoy]

As Google Cloud Platform is an Infrastructure as a Service offering that can host anything, it could be...anything.

[JorgeCR]

Thanks a lot Phone Boy. 

The fact that it is under Computers / Internet does not really help to set right permissions to users.

[PhoneBoy]

I'm guessing the fairly generic classification here is because you're not using HTTPS Inspection.
Without that, you can only see what the TLS certificate indicates, which, again, could be anything, particularly if the certificate is wildcard (i.e. used for many different sites).
With HTTPS Inspection enabled, you can see exactly what URLs are being accessed and might get a different classification.

[JorgeCR]

We have HTTPS Inspection enabled.  We double checked and we are not doing HTTPS Bypass to any of the IP addresses associated with Google Cloud Platform in the logs.

[PhoneBoy]

If you can provide a few sample log entries (full log card), it might provide some clues.
There may not be enough cues in the traffic to classify the traffic further than what it already is.