Sagan informational stable other

[GCP] Suspicious Login Blocked

[GCP] Suspicious Login Blocked

View Source

Detection Logic

alert any $HOME_NET any -> $EXTERNAL_NET any (msg: "[GCP] Suspicious Login Blocked"; content: "cloudaudit.googleapis.com"; content: "google.login.LoginService.suspiciousLogin"; content:!"sid
| 3a
| "; flexbits:set,GCP_Event,10; classtype: system-event; parse_src_ip: 1; sid: 5006022; rev:3; metadata: updatedOn 2026_04_08;)

Field Validations

Loading…

Comments (0)

Loading comments...