Google Cloud Firewall Modified or Deleted

Title: Google Cloud Firewall Modified or Deleted
Status: test
Description:Detects when a firewall rule is modified or deleted in Google Cloud Platform (GCP).
References:
  -https://cloud.google.com/kubernetes-engine/docs/how-to/audit-logging
  -https://developers.google.com/resources/api-libraries/documentation/compute/v1/java/latest/com/google/api/services/compute/Compute.Firewalls.html
Author: Austin Songer @austinsonger
Date: 2021-08-13
modified:2022-10-09
Tags:

• -'attack.defense-impairment'
• -'attack.t1685'

Logsource:

• product: gcp
• service: gcp.audit

Detection:
  selection:
    gcp.audit.method_name:
      -'v*.Compute.Firewalls.Delete'
      -'v*.Compute.Firewalls.Patch'
      -'v*.Compute.Firewalls.Update'
      -'v*.Compute.Firewalls.Insert'

  condition:selection
Falsepositives:
  -Firewall rules being modified or deleted may be performed by a system administrator. Verify that the firewall configuration change was expected.
  -Exceptions can be added to this rule to filter expected behavior.
Level: medium