GCP coverage
268 GCP detection rules across 6 vendors covering 123 (serviceName, methodName) pairs.
Attributed to a specific API method
96 rules that name (or pattern-match) one GCP API method, mapped to that method's catalog event.admin
google.admin.AdminService.inboundSsoProfileCreated 1 rule
google.admin.AdminService.inboundSsoProfileUpdated 1 rule
API Keys
google.api.apikeys.ApiKeys.CreateKey 1 rule
google.api.apikeys.ApiKeys.GetKeyString 1 rule
App Engine
google.appengine.Firewall.CreateIngressRule 2 rules
google.appengine.Firewall.DeleteIngressRule 2 rules
google.appengine.Firewall.UpdateIngressRule 2 rules
BigQuery
jobservice.getqueryresults 1 rule
Cloud Build
google.devtools.cloudbuild.CloudBuild.CreateBuild 1 rule
Cloud KMS
Decrypt 1 rule
DestroyCryptoKeyVersion 2 rules
Encrypt 2 rules
UpdateCryptoKeyVersion 2 rules
Resource Manager
InsertProjectOwnershipInvite 1 rule
Compute Engine
compute.disks.setIamPolicy 1 rule
compute.firewalls.delete 3 rules
compute.firewalls.insert 4 rules
compute.firewalls.patch 3 rules
compute.firewalls.update 2 rules
compute.images.setIamPolicy 2 rules
compute.instances.insert 1 rule
compute.instances.setMetadata 1 rule
compute.networks.delete 1 rule
compute.packetMirrorings.aggregatedList 1 rule
compute.packetMirrorings.delete 1 rule
compute.packetMirrorings.get 1 rule
compute.packetMirrorings.insert 1 rule
compute.packetMirrorings.list 1 rule
compute.packetMirrorings.patch 1 rule
compute.projects.setCommonInstanceMetadata 1 rule
compute.routes.delete 1 rule
compute.routes.insert 1 rule
compute.snapshots.delete 1 rule
compute.snapshots.insert 1 rule
compute.snapshots.setIamPolicy 1 rule
compute.subnetworks.patch 1 rule
compute.vpnTunnels.delete 1 rule
compute.vpnTunnels.insert 1 rule
Cloud DLP
projects.content.reidentify 1 rule
Cloud DNS
dns.changes.create 1 rule
dns.managedZones.delete 2 rules
dns.managedZones.patch 3 rules
dns.managedZones.update 3 rules
IAM
google.iam.admin.CreateRole 2 rules
google.iam.admin.CreateServiceAccount 4 rules
google.iam.admin.CreateServiceAccountKey 4 rules
google.iam.admin.DeleteRole 2 rules
google.iam.admin.DeleteServiceAccount 2 rules
google.iam.admin.DeleteServiceAccountKey 1 rule
google.iam.admin.DisableServiceAccount 2 rules
google.iam.admin.EnableServiceAccount 1 rule
google.iam.admin.ListRoles 1 rule
google.iam.admin.ListServiceAccountKeys 1 rule
google.iam.admin.ListServiceAccounts 1 rule
google.iam.admin.PatchServiceAccount 1 rule
google.iam.admin.SetIamPolicy 1 rule
google.iam.admin.UndeleteServiceAccount 1 rule
google.iam.admin.UpdateRole 1 rule
google.iam.admin.UpdateServiceAccount 1 rule
google.iam.admin.UploadServiceAccountKey 1 rule
google.iam.admin.WorkforcePools.CreateWorkforcePool 1 rule
google.iam.admin.WorkforcePools.UpdateWorkforcePool 1 rule
google.iam.IAMPolicy.SetIamPolicy 2 rules
google.iam.WorkloadIdentityPools.CreateWorkloadIdentityPoolProvider 1 rule
google.iam.WorkloadIdentityPools.DeleteWorkloadIdentityPool 1 rule
google.iam.WorkloadIdentityPools.UpdateWorkloadIdentityPool 1 rule
google.iam.WorkloadIdentityPools.UpdateWorkloadIdentityPoolProvider 1 rule
IAM Credentials
GenerateAccessToken 1 rule
SignJwt 1 rule
iap
AuthorizeUser 1 rule
google.cloud.iap.IdentityAwareProxyAdminService.SetIamPolicy 1 rule
Cloud Logging
google.logging.ConfigServiceV2.DeleteBucket 1 rule
google.logging.ConfigServiceV2.DeleteSink 1 rule
google.logging.ConfigServiceV2.UpdateSink 1 rule
Network Management
google.cloud.networkmanagement.VpcFlowLogsService.DeleteVpcFlowLogsConfig 1 rule
Organization Policy
google.cloud.orgpolicy.OrgPolicy.DeletePolicy 1 rule
google.cloud.orgpolicy.OrgPolicy.UpdatePolicy 1 rule
oslogin
google.cloud.oslogin.dataplane.OsLoginDataPlaneService.CheckPolicy 1 rule
google.cloud.oslogin.dataplane.OsLoginDataPlaneService.ContinueSession 1 rule
PubSub
google.pubsub.Publisher.CreateTopic 1 rule
google.pubsub.Publisher.DeleteTopic 1 rule
google.pubsub.Subscriber.CreateSubscription 1 rule
google.pubsub.Subscriber.DeleteSubscription 1 rule
Cloud Run
google.cloud.run.Services.CreateService 1 rule
Secret Manager
google.cloud.secretmanager.SecretManagerService.AccessSecretVersion 1 rule
google.cloud.secretmanager.SecretManagerService.DeleteSecret 1 rule
google.cloud.secretmanager.SecretManagerService.DestroySecretVersion 1 rule
Service Usage
google.api.serviceusage.ServiceUsage.DisableService 1 rule
Cloud SQL
cloudsql.instances.create 1 rule
cloudsql.instances.delete 1 rule
cloudsql.instances.update 1 rule
cloudsql.users.delete 1 rule
cloudsql.users.update 1 rule
ssh-serialport
google.ssh-serialport.connect 1 rule
Cloud Storage
storage.buckets.delete 3 rules
storage.buckets.insert 1 rule
storage.buckets.list 1 rule
storage.buckets.listChannels 1 rule
storage.buckets.patch 1 rule
storage.buckets.update 3 rules
storage.hmacKeys.create 1 rule
storage.hmacKeys.delete 1 rule
storage.objects.create 2 rules
storage.objects.delete 1 rule
storage.objects.get 1 rule
storage.setIamPermissions 7 rules
T1530T1078, T1078.004, T1530, T1567, T1567.002T1530T1685T1098, T1098.003, T1222T1530
Attributed to a service, not a specific method
17 rules that name a GCP service (or an IAM permission) but no single API method, mapped to that service's catch-all event.Access Context Manager
(any) 1 rule
cloudfunctions
Cloud KMS
(any) 1 rule
Compute Engine
deploymentmanager
(any) 1 rule
IAM
Cloud Logging
(any) 1 rule
Organization Policy
Cloud Run
(any) 1 rule
Security Command Center
(any) 1 rule
Cloud Storage
(any) 1 rule
Not attributed to a GCP catalog event
155 rules that resolve to no GCP catalog event. Each group names why.(unattributed): behavioral / no single API method
(any) 46 rules
T1078T1046, T1059, T1069, T1078, T1547, T1548T1530T1078, T1078.004, T1586, T1586.003, T1621T1548T1136T1078T1685T1550T1078T1556, T1556.006, T1586, T1586.003T1078, T1078.004, T1586, T1586.003, T1621T1110, T1110.003, T1110.004, T1586, T1586.003T1556.009T1548T1535T1078, T1078.004, T1586, T1586.003T1110, T1110.003, T1110.004, T1586, T1586.003T1078.004, T1484.001T1068T1068T1068T1187, T1566T1095T1195T1095T1095T1567T1095T1095T1595.001T1595.001T1595.001T1204, T1204.003T1190(unattributed): Elastic ML (no query)
(unattributed): Google Workspace
(unattributed): Kubernetes audit
(any) 89 rules
T1548T1053.003T1573.002T1610T1611T1041, T1611T1610, T1611T1548T1190T1526T1546, T1685T1595, T1595.003, T1613T1610T1078, T1078.001T1613T1134T1550, T1550.001, T1611, T1613T1098, T1098.006T1098, T1098.006T1098, T1098.006T1098, T1098.006T1098, T1098.006T1610, T1611T1565, T1565.001T1098, T1098.006T1098, T1098.006T1613T1609, T1611T1133T1613T1613T1610, T1611T1610, T1611T1610, T1611T1610, T1611T1552, T1552.005, T1609T1059, T1095, T1609T1552, T1552.001, T1552.007, T1609T1105, T1609T1610, T1611T1552, T1552.007T1098, T1098.006T1552, T1552.007T1552, T1552.007T1552, T1552.007T1552, T1552.007, T1613T1098, T1098.006T1098, T1098.006T1552, T1552.007T1078, T1078.001, T1610T1069, T1069.003, T1613T1098, T1098.006T1552, T1552.007T1609T1078, T1552, T1552.007T1530, T1546, T1552T1530, T1552.007T1190T1573.002T1613T1098, T1552T1078.004, T1098T1053.003T1543, T1610T1530, T1552T1040, T1552.004T1190T1611T1525, T1578.002, T1611T1611, T1685T1610, T1611T1068, T1611T1041, T1611T1548.003T1078.004, T1685T1021, T1078.004T1078.004T1222T1552.007, T1613T1552.007T1078.004, T1550.001, T1552.007T1021.007, T1190, T1528T1078.004, T1098, T1222(unattributed): Security Command Center / posture
(any) 11 rules
T1098, T1098.003T1580T1136, T1136.003T1071, T1071.004, T1557, T1685T1021, T1046, T1133T1190, T1552T1552T1685T1552, T1552.004T1204