security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions 3 Packages Projects Releases Wiki Activity
Files
83406d8ce10ce477de61e381a9bbe727efe76fd7
sigma-rules/rules/integrations/gcp
T
History
Terrance DeJesus deab1c0161 [Rule Tuning] Change event.dataset to data_stream.dataset (#5943) 
* [Rule Tuning] Change event.dataset to data_stream.dataset

* updating ESQL field names
2026-04-10 12:27:52 -04:00
..
collection_gcp_pub_sub_subscription_creation.toml
[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)
2026-04-10 12:27:52 -04:00
collection_gcp_pub_sub_topic_creation.toml
[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)
2026-04-10 12:27:52 -04:00
defense_evasion_gcp_firewall_rule_created.toml
[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)
2026-04-10 12:27:52 -04:00
defense_evasion_gcp_firewall_rule_deleted.toml
[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)
2026-04-10 12:27:52 -04:00
defense_evasion_gcp_firewall_rule_modified.toml
[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)
2026-04-10 12:27:52 -04:00
defense_evasion_gcp_logging_bucket_deletion.toml
[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)
2026-04-10 12:27:52 -04:00
defense_evasion_gcp_logging_sink_deletion.toml
[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)
2026-04-10 12:27:52 -04:00
defense_evasion_gcp_pub_sub_subscription_deletion.toml
[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)
2026-04-10 12:27:52 -04:00
defense_evasion_gcp_pub_sub_topic_deletion.toml
[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)
2026-04-10 12:27:52 -04:00
defense_evasion_gcp_storage_bucket_configuration_modified.toml
[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)
2026-04-10 12:27:52 -04:00
defense_evasion_gcp_storage_bucket_permissions_modified.toml
[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)
2026-04-10 12:27:52 -04:00
defense_evasion_gcp_virtual_private_cloud_network_deleted.toml
[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)
2026-04-10 12:27:52 -04:00
defense_evasion_gcp_virtual_private_cloud_route_created.toml
[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)
2026-04-10 12:27:52 -04:00
defense_evasion_gcp_virtual_private_cloud_route_deleted.toml
[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)
2026-04-10 12:27:52 -04:00
exfiltration_gcp_logging_sink_modification.toml
[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)
2026-04-10 12:27:52 -04:00
impact_gcp_iam_role_deletion.toml
[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)
2026-04-10 12:27:52 -04:00
impact_gcp_service_account_deleted.toml
[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)
2026-04-10 12:27:52 -04:00
impact_gcp_service_account_disabled.toml
[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)
2026-04-10 12:27:52 -04:00
impact_gcp_storage_bucket_deleted.toml
[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)
2026-04-10 12:27:52 -04:00
initial_access_gcp_iam_custom_role_creation.toml
[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)
2026-04-10 12:27:52 -04:00
ml_gcp_error_message_spike.toml
Update Entity related Kibana prebuilt ML rules with new _ea ML job ID and update minimum stack versions (#5794)
2026-04-02 09:25:14 -04:00
ml_gcp_rare_error_code.toml
Update Entity related Kibana prebuilt ML rules with new _ea ML job ID and update minimum stack versions (#5794)
2026-04-02 09:25:14 -04:00
ml_gcp_rare_method_by_city.toml
Update Entity related Kibana prebuilt ML rules with new _ea ML job ID and update minimum stack versions (#5794)
2026-04-02 09:25:14 -04:00
ml_gcp_rare_method_by_country.toml
Update Entity related Kibana prebuilt ML rules with new _ea ML job ID and update minimum stack versions (#5794)
2026-04-02 09:25:14 -04:00
ml_gcp_rare_method_by_user.toml
Update Entity related Kibana prebuilt ML rules with new _ea ML job ID and update minimum stack versions (#5794)
2026-04-02 09:25:14 -04:00
persistence_gcp_iam_service_account_key_deletion.toml
[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)
2026-04-10 12:27:52 -04:00
persistence_gcp_key_created_for_service_account.toml
[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)
2026-04-10 12:27:52 -04:00
persistence_gcp_service_account_created.toml
[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)
2026-04-10 12:27:52 -04:00