Sagan informational stable other

[GCP] Instance - Access Configuration Deleted

[GCP] Instance - Access Configuration Deleted

View Source

Detection Logic

alert any $HOME_NET any -> $EXTERNAL_NET any (msg: "[GCP] Instance - Access Configuration Deleted"; content: "cloudaudit.googleapis.com"; content: "
| 22
| method
| 22
| :
| 22
| compute.instances.deleteAccessConfig
| 22
| "; flexbits:set,GCP_Event,10; classtype: system-event; sid: 5006009; rev:2;)

Field Validations

Loading…

Comments (0)

Loading comments...