[GCP] Multiple SecretManager Secrets Deleted

alert any $HOME_NET any -> $HOME_NET any (msg:"[GCP] Multiple SecretManager Secrets Deleted"; program:gcp; content:"secretmanager.googleapis.com"; meta_content:"%sagan%",DestroySecretVersion,DeleteSecret; meta_nocase; json_map:"src_ip",".protoPayload.requestMetadata.c"; parse_src_ip:1; after:track by_src, count 10, seconds 3600; threshold:type suppress,track by_src, count 1, seconds 3600; classtype:system-event; reference:url,attack.mitre.org/techniques/T1485; sid:5017819; rev:1;)