Anvilogic high experimental other

GCP: New Service Account [snowflake-gcpaudit]

New GCP service account created

View Source

Detection Logic

select * from gcpaudit where event_time > dateadd(hour, -2, sysdate()) and event_name = 'CreateServiceAccount'

Field Validations

Loading…

Comments (0)

Loading comments...