Anvilogic medium experimental spl

GCP: API Key Created [splunk-gcpaudit]

This use case detects when an API key has been created for a GCP project.

View Source

Detection Logic

`get_cloud_data` `get_cloud_data_gcp` "google.api.apikeys.v1.ApiKeys.CreateApiKey" "ALLOW"
| table _time, host, user event_name account resource_id action acl_permission user_type src_ip http_user_agent bucket_name msg region vendor_product`group_events("src_ip", 1)``hec_collect`

Field Validations

Loading…

Comments (0)

Loading comments...