Anvilogic high experimental spl

GCP: New Service Account [splunk-gcpaudit]

New GCP service account created

View Source

Detection Logic

`get_cloud_data` `get_cloud_data_gcp` TERM(CreateServiceAccount)
| table _time, host, user event_name account resource_id action acl_permission user_type src_ip http_user_agent bucket_name msg region vendor_product`group_events("src_ip", 1)``hec_collect`

Field Validations

Loading…

Comments (0)

Loading comments...