Skip to content

Adjusted rule [GCP] Google Login From Bluedot Flagged IP #707

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
CGoggins56 merged 1 commit into from
Aug 28, 2026
Merged

Adjusted rule [GCP] Google Login From Bluedot Flagged IP #707

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion gcp-cloud-audit.rules
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -179,7 +179,7 @@ alert any $HOME_NET any -> $HOME_NET any (msg:"[GCP] Google Passkey Enrollment D
# [truncated for JSON_MAX_KEY_SIZE=32 engine limit -- legacy engine stores keys clipped to 31 chars, full path never matches] .protoPayload.requestMetadata.callerIp -> .protoPayload.requestMetadata.c
alert any $HOME_NET any -> $HOME_NET any (msg:"[GCP] Multiple SecretManager Secrets Deleted"; program:gcp; content:"secretmanager.googleapis.com"; meta_content:"%sagan%",DestroySecretVersion,DeleteSecret; meta_nocase; json_map:"src_ip",".protoPayload.requestMetadata.c"; parse_src_ip:1; after:track by_src, count 10, seconds 3600; threshold:type suppress,track by_src, count 1, seconds 3600; classtype:system-event; reference:url,attack.mitre.org/techniques/T1485; sid:5017819; rev:1;)
#alert any $HOME_NET any -> $HOME_NET any (msg:"[GCP] Google Suspicious Login Detected"; program:gcp; json_content:".protoPayload.methodName","google.login.LoginService.loginSuccess"; content:"|22|boolValue|22 3a|true,|22|label|22 3a 22|LABEL_OPTIONAL|22|,|22|name|22 3a 22|is_suspicious|22|"; parse_src_ip:1; classtype:system-event; sid:5017820; rev:2;)
alert any $HOME_NET any -> $HOME_NET any (msg:"[GCP] Google Login From Bluedot Flagged IP"; program:gcp; json_content:".protoPayload.methodName","google.login.LoginService.loginSuccess"; parse_src_ip:1; bluedot:type ip_reputation, track by_src,none,Malicious,Tor,Proxy; classtype:system-event; sid:5017821; rev:2;)
alert any $HOME_NET any -> $HOME_NET any (msg:"[GCP] Google Login From Bluedot Flagged IP"; program:gcp; json_content:".protoPayload.methodName","google.login.LoginService.loginSuccess"; parse_src_ip:1; bluedot:type ip_reputation, cdate_effective_period 3 months, track by_src,none,Malicious,Tor,Proxy; classtype:system-event; sid:5017821; rev:3;)
alert any $HOME_NET any -> $HOME_NET any (msg:"[GCP] Google Login Challenge Failed"; program:gcp; content:"login_challenge_status"; content:"failed"; parse_src_ip:1; classtype:system-event; sid:5017822; rev:2;)
alert any $HOME_NET any -> $HOME_NET any (msg:"[GCP] Google Download User List"; program:gcp; json_content:".protoPayload.methodName","google.admin.AdminService.downloadUserlistCsv"; parse_src_ip:1; classtype:system-event; sid:5017823; rev:2;)
alert any $HOME_NET any -> $HOME_NET any (msg:"[GCP] User Unenrolled from Strong Auth"; program:gcp; json_content:".protoPayload.methodName","google.admin.AdminService.unenrollUserFromStrongAuth"; parse_src_ip:1; classtype:system-event; sid:5017824; rev:2;)
Expand Down
Loading