Elastic low stable eql
Rare GCP Audit Failure Event Code
A machine learning job detected an unusual failure in a GCP Audit message. These can be byproducts of attempted or successful persistence, privilege escalation, defense evasion, discovery, lateral movement, or collection.
Detection Logic
False Positives
- ⚠ Rare and unusual failures may indicate an impending service failure state. Rare and unusual user failure activity can also be due to manual troubleshooting or reconfiguration attempts by insufficiently privileged users, bugs in cloud automation scripts or workflows, or changes to IAM privileges.
Field Validations
Loading…
Comments (0)
Loading comments...