Panther low experimental python

GCP GCS IAM Permission Changes

Monitoring changes to Cloud Storage bucket permissions may reduce time to detect and correct permissions on sensitive Cloud Storage bucket and objects inside the bucket.

View Source

Detection Logic

def rule(event):
    return (
        event.deep_get("resource", "type") == "gcs_bucket"
        and event.deep_get("protoPayload", "methodName") == "storage.setIamPermissions"
    )


def dedup(event):
    return event.deep_get("resource", "labels", "project_id", default="<UNKNOWN_PROJECT>")

Field Validations

Loading…

Comments (0)

Loading comments...