Sagan informational stable other

[GCP] Google Identity Oauth2 Deny event detected [10/5]

[GCP] Google Identity Oauth2 Deny event detected [10/5]

View Source

Detection Logic

alert any $HOME_NET any -> $HOME_NET any (msg:"[GCP] Google Identity Oauth2 Deny event detected [10/5]"; program:gcp; json_content:".protoPayload.methodName","google.identity.oauth2.Deny"; after:track by_src, count 10, seconds 300; threshold:type suppress,track by_src, count 1, seconds 3600; parse_src_ip:1; classtype:system-event; reference:url,https://www.datadoghq.com/blog/monitoring-gcp-audit-logs/; sid:991070; rev:3;)

Field Validations

Loading…

Comments (0)

Loading comments...