Detection Logic
alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[GCP-SCC] IAM: Anomalous Grant"; content:"iam_anomalous_grant"; nocase; classtype:suspicious-traffic; reference: url,cloud.google.com/security-command-center/docs/concepts-event-threat-detection-overview; sid:5005618; rev:1)Field Validations
Loading…
Comments (0)
Loading comments...