[metadata]
creation_date = "2020/09/22"
maturity = "production"
updated_date = "2020/12/16"

[rule]
author = ["Elastic"]
description = """
Identifies when a Virtual Private Cloud (VPC) route is created in Google Cloud Platform (GCP). Google Cloud routes
define the paths that network traffic takes from a virtual machine (VM) instance to other destinations. These
destinations can be inside a Google VPC network or outside it. An adversary may create a route in order to impact the
flow of network traffic in their target's cloud environment.
"""
false_positives = [
    """
    Virtual Private Cloud routes may be created by system administrators. Verify that the configuration change was
    expected. Exceptions can be added to this rule to filter expected behavior.
    """,
]
index = ["filebeat-*", "logs-gcp*"]
language = "kuery"
license = "Elastic License"
name = "GCP Virtual Private Cloud Route Creation"
note = "The GCP Filebeat module must be enabled to use this rule."
references = ["https://cloud.google.com/vpc/docs/routes", "https://cloud.google.com/vpc/docs/using-routes"]
risk_score = 21
rule_id = "9180ffdf-f3d0-4db3-bf66-7a14bcff71b8"
severity = "low"
tags = ["Elastic", "Cloud", "GCP", "Continuous Monitoring", "SecOps", "Configuration Audit"]
type = "query"

query = '''
event.dataset:(googlecloud.audit or gcp.audit) and event.action:(v*.compute.routes.insert or beta.compute.routes.insert)
'''

