Google Cloud Service Account Modified

{
  "selection": {
    "gcp.audit.method_name
| endswith": [
      ".serviceAccounts.patch",
      ".serviceAccounts.create",
      ".serviceAccounts.update",
      ".serviceAccounts.enable",
      ".serviceAccounts.undelete"
    ]
  },
  "condition": "selection"
}

False Positives

• ⚠ Service Account being modified may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
• ⚠ Service Account modified from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.