Anvilogic critical experimental spl

GCP: Many Compute Instances created [splunk-gcpaudit]

Looks for many GCP compute instances being created

View Source

Detection Logic

`get_cloud_data` `get_cloud_data_gcp` TERM(compute.instances.insert)
| table _time, host, user event_name account resource_id action acl_permission user_type src_ip http_user_agent bucket_name msg region vendor_product`group_events("account", 300)`
| where event_count > 10`hec_collect`

Field Validations

Loading…

Comments (0)

Loading comments...