Google Cloud Firewall Modified or Deleted

{
  "selection": {
    "gcp.audit.method_name": [
      "v*.Compute.Firewalls.Delete",
      "v*.Compute.Firewalls.Patch",
      "v*.Compute.Firewalls.Update",
      "v*.Compute.Firewalls.Insert"
    ]
  },
  "condition": "selection"
}

False Positives

• ⚠ Firewall rules being modified or deleted may be performed by a system administrator. Verify that the firewall configuration change was expected.
• ⚠ Exceptions can be added to this rule to filter expected behavior.