Gus Carlock 03ce151b82 Add rules for Azure Activity Logs/GCP Audit ML jobs (#5191) ...

* rules for Azure/GCP jobs

* Add GCP Audit Logs tag

* add `min_stack_version`

* add `min_stack_comments`

* Add mitre tactics

---------

Co-authored-by: shashank-elastic <91139415+shashank-elastic@users.noreply.github.com>
Co-authored-by: susan <shuhsuan.chang@elastic.co>
Co-authored-by: Susan <23287722+susan-shu-c@users.noreply.github.com>

2025-11-26 13:15:23 -05:00

..

collection_gcp_pub_sub_subscription_creation.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

collection_gcp_pub_sub_topic_creation.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

defense_evasion_gcp_firewall_rule_created.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

defense_evasion_gcp_firewall_rule_deleted.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

defense_evasion_gcp_firewall_rule_modified.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

defense_evasion_gcp_logging_bucket_deletion.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

defense_evasion_gcp_logging_sink_deletion.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

defense_evasion_gcp_pub_sub_subscription_deletion.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

defense_evasion_gcp_pub_sub_topic_deletion.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

defense_evasion_gcp_storage_bucket_configuration_modified.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

defense_evasion_gcp_storage_bucket_permissions_modified.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

defense_evasion_gcp_virtual_private_cloud_network_deleted.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

defense_evasion_gcp_virtual_private_cloud_route_created.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

defense_evasion_gcp_virtual_private_cloud_route_deleted.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

exfiltration_gcp_logging_sink_modification.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

impact_gcp_iam_role_deletion.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

impact_gcp_service_account_deleted.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

impact_gcp_service_account_disabled.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

impact_gcp_storage_bucket_deleted.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

initial_access_gcp_iam_custom_role_creation.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

ml_gcp_error_message_spike.toml

Add rules for Azure Activity Logs/GCP Audit ML jobs (#5191)

2025-11-26 13:15:23 -05:00

ml_gcp_rare_error_code.toml

Add rules for Azure Activity Logs/GCP Audit ML jobs (#5191)

2025-11-26 13:15:23 -05:00

ml_gcp_rare_method_by_city.toml

Add rules for Azure Activity Logs/GCP Audit ML jobs (#5191)

2025-11-26 13:15:23 -05:00

ml_gcp_rare_method_by_country.toml

Add rules for Azure Activity Logs/GCP Audit ML jobs (#5191)

2025-11-26 13:15:23 -05:00

ml_gcp_rare_method_by_user.toml

Add rules for Azure Activity Logs/GCP Audit ML jobs (#5191)

2025-11-26 13:15:23 -05:00

persistence_gcp_iam_service_account_key_deletion.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

persistence_gcp_key_created_for_service_account.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00

persistence_gcp_service_account_created.toml

[FR] Generate investigation guides (#4358)

2025-01-22 11:17:38 -06:00