title: Google Cloud DNS Zone Modified or Deleted
id: 28268a8f-191f-4c17-85b2-f5aa4fa829c3
description: Identifies when a DNS Zone is modified or deleted in Google Cloud. 
author: Austin Songer @austinsonger
status: experimental
date: 2021/08/15
references:
    - https://cloud.google.com/dns/docs/reference/v1/managedZones
logsource:
  product: gcp
  service: gcp.audit
detection:
    selection:
        gcp.audit.method_name: 
            - Dns.ManagedZones.Delete
            - Dns.ManagedZones.Update
            - Dns.ManagedZones.Patch
    condition: selection
level: medium
tags:
    - attack.impact
falsepositives:
 - Unknown
