I am in need to get Audit logs for events related to user sign ins to Google cloud platform. I have searched the documentation and even after enabling all audit data sources in the IAM I can't seen any logs related to user authentication in the Logging Explorer.
Does anybody know which steps I am missing?
There are different types of audit logs that you can view for GCP. Most of them are triggered only once you do an API call (use the service). If you want the full list of services that writes a log, you can see here.
If you want to expand visibility with your resources you may use the following services:
For admin access logs and approval control: Access Transparency and Access Approval
For SIEM purposes: Security Command Center