Sagan informational stable other

[GCP] Instance - Access Configuration Added

[GCP] Instance - Access Configuration Added

View Source

Detection Logic

alert any $HOME_NET any -> $EXTERNAL_NET any (msg: "[GCP] Instance - Access Configuration Added"; content: "cloudaudit.googleapis.com"; content: "
| 22
| method
| 22
| :
| 22
| compute.instances.addAccessConfig
| 22
| "; flexbits:set,GCP_Event,10; classtype: system-event; sid: 5005994; rev:2;)

Field Validations

Loading…

Comments (0)

Loading comments...