[metadata]
creation_date = "2020/09/22"
maturity = "production"
updated_date = "2020/12/16"

[rule]
author = ["Elastic"]
description = """
Identifies when the configuration is modified for a storage bucket in Google Cloud Platform (GCP). An adversary may
modify the configuration of a storage bucket in order to weaken the security controls of their target's environment.
"""
false_positives = [
    """
    Storage bucket configuration may be modified by system administrators. Verify that the configuration change was
    expected. Exceptions can be added to this rule to filter expected behavior.
    """,
]
index = ["filebeat-*", "logs-gcp*"]
language = "kuery"
license = "Elastic License"
name = "GCP Storage Bucket Configuration Modification"
note = "The GCP Filebeat module must be enabled to use this rule."
references = ["https://cloud.google.com/storage/docs/key-terms#buckets"]
risk_score = 47
rule_id = "97359fd8-757d-4b1d-9af1-ef29e4a8680e"
severity = "medium"
tags = ["Elastic", "Cloud", "GCP", "Continuous Monitoring", "SecOps", "Identity and Access"]
type = "query"

query = '''
event.dataset:(googlecloud.audit or gcp.audit) and event.action:storage.buckets.update and event.outcome:success
'''

