Anvilogic critical experimental other

GCP: Many Compute Instances created [snowflake-gcpaudit]

Looks for many GCP compute instances being created

View Source

Detection Logic

select * from gcpaudit where event_time > dateadd(hour, -2, sysdate()) and event_name = 'compute.instances.insert'

Field Validations

Loading…

Comments (0)

Loading comments...