| elastic |
GCP Storage Bucket Configuration Modification |
production |
2026-09-18 |
| elastic |
GCP Storage Bucket Permissions Modification |
production |
2026-09-18 |
| elastic |
GCP Virtual Private Cloud Network Deletion |
production |
2026-09-18 |
| elastic |
GCP Virtual Private Cloud Route Creation |
production |
2026-09-18 |
| elastic |
GCP Virtual Private Cloud Route Deletion |
production |
2026-09-18 |
| elastic |
GKE Anonymous Endpoint Permission Enumeration |
production |
2026-09-18 |
| elastic |
GKE Endpoint Permission Enumeration |
production |
2026-09-18 |
| elastic |
GKE Multi-Resource Discovery |
production |
2026-09-18 |
| elastic |
GKE Suspicious Self-Subject Review via Service Account |
production |
2026-09-18 |
| elastic |
GCP Secret Manager ListSecrets Across Multiple Projects |
production |
2026-09-18 |
| elastic |
GKE Anonymous Pod Create/Update/Patch |
production |
2026-09-18 |
| elastic |
GKE Forbidden Creation Request |
production |
2026-09-18 |
| elastic |
GKE Forbidden Request from Unusual User Agent |
production |
2026-09-18 |
| elastic |
GKE Pod Exec with Curl or Wget to HTTPS |
production |
2026-09-18 |
| elastic |
GKE Pod Exec Potential Reverse Shell |
production |
2026-09-18 |
| elastic |
GKE User Exec into Pod |
production |
2026-09-18 |
| elastic |
GCP Logging Sink Modification |
production |
2026-09-18 |
| elastic |
GKE CoreDNS or Kube-DNS Configuration Modified |
production |
2026-09-18 |
| elastic |
GCP IAM Role Deletion |
production |
2026-09-18 |
| elastic |
GCP Service Account Deletion |
production |
2026-09-18 |
| elastic |
GCP Service Account Disabled |
production |
2026-09-18 |
| elastic |
GCP Storage Bucket Deletion |
production |
2026-09-18 |
| elastic |
GKE Anonymous Request Authorized by Unusual User Agent |
production |
2026-09-18 |
| elastic |
GCP IAM Custom Role Creation |
production |
2026-09-18 |
| elastic |
Spike in GCP Audit Failed Messages |
production |
2026-09-18 |
| elastic |
Rare GCP Audit Failure Event Code |
production |
2026-09-18 |
| elastic |
Unusual City For a GCP Event |
production |
2026-09-18 |
| elastic |
Unusual Country For a GCP Event |
production |
2026-09-18 |
| elastic |
Unusual GCP Event for a User |
production |
2026-09-18 |
| elastic |
GKE Admission Webhook Created or Modified |
production |
2026-09-18 |
| elastic |
GKE Certificate Signing Request Self-Approved |
production |
2026-09-18 |
| elastic |
GKE Client Certificate Signing Request Created or Approved |
production |
2026-09-18 |
| elastic |
GKE Cluster-Admin Role Binding Created or Modified |
production |
2026-09-18 |
| elastic |
GKE Exposed Service Created With Type NodePort |
production |
2026-09-18 |
| elastic |
GKE Creation of a RoleBinding Referencing a ServiceAccount |
production |
2026-09-18 |
| elastic |
GKE Creation or Modification of Sensitive Role |
production |
2026-09-18 |
| elastic |
GCP IAM Service Account Key Deletion |
production |
2026-09-18 |
| elastic |
GCP Service Account Key Creation |
production |
2026-09-18 |
| elastic |
GCP Service Account Creation |
production |
2026-09-18 |
| elastic |
GCP IAM Service Account Impersonation Role Granted |
production |
2026-09-18 |