GCP Vertex AI Publisher Model Config Modified

  1[metadata]
  2creation_date = "2026/10/02"
  3integration = ["gcp_vertexai"]
  4maturity = "production"
  5updated_date = "2026/10/02"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects changes to Vertex AI publisher model configuration via SetPublisherModelConfig (for example enabling or
 11retargeting prompt/response BigQuery logging). Unexpected config changes can disable security-relevant logging or
 12redirect logs.
 13"""
 14false_positives = [
 15    """
 16    Approved platform engineering changes that update publisher logging destinations. Confirm the actor and change
 17    ticket.
 18    """,
 19]
 20from = "now-60m"
 21interval = "10m"
 22language = "esql"
 23license = "Elastic License v2"
 24name = "GCP Vertex AI Publisher Model Config Modified"
 25note = """## Triage and analysis
 26
 27### Investigating GCP Vertex AI Publisher Model Config Modified
 28
 29Someone called `SetPublisherModelConfig` on a publisher model. That API can enable, disable, or
 30retarget prompt/response BigQuery logging and related publisher settings. Unexpected changes can
 31blind detection (logging off or redirected) or move sensitive prompt data to an unapproved sink.
 32
 33#### Possible investigation steps
 34
 35- Note `@timestamp`, `event.action`, `source.ip`, `client.user.email`,
 36  `gcp.vertexai.audit.resource_name`, and `user_agent.original` on the alert.
 37- Confirm the actor is an approved platform owner. Check change tickets / IaC pipelines for a
 38  matching change.
 39- In GCP, verify the publisher model config still points at the expected BigQuery dataset/table and
 40  sampling rate.
 41- Compare `prompt_response_logs` volume before and after the change for gaps or a sudden destination
 42  shift.
 43- Hunt for other privilege or config changes by the same principal around the same time.
 44
 45### False positive analysis
 46
 47- Approved platform engineering work that enables or retargets logging. Validate with the change
 48  ticket and expected actor/IP before escalating.
 49
 50### Response and remediation
 51
 52- Revert unauthorized config to the last known-good logging destination and sampling settings.
 53- Restrict IAM who can call `SetPublisherModelConfig`; rotate credentials for the actor if
 54  compromise is suspected.
 55"""
 56references = [
 57    "https://www.elastic.co/docs/reference/integrations/gcp_vertexai",
 58    "https://cloud.google.com/vertex-ai/generative-ai/docs/multimodal/request-response-logging",
 59]
 60risk_score = 47
 61rule_id = "6987cc9a-1f4c-47ae-9bfe-50190a2c5683"
 62setup = """## Setup
 63
 64Requires GCP Vertex AI `auditlogs` via Pub/Sub sink for `aiplatform.googleapis.com`.
 65"""
 66severity = "medium"
 67tags = [
 68    "Domain: GenAI",
 69    "Domain: Cloud",
 70    "Data Source: GCP Vertex AI",
 71    "Data Source: GCP",
 72    "Data Source: Google Cloud Platform",
 73    "Platform: GCP",
 74    "Service: GCP Vertex AI",
 75    "Use Case: Threat Detection",
 76    "Tactic: Defense Evasion",
 77    "Threat: Unauthorized AI Usage",
 78    "Mitre Atlas: AML.T0015",
 79    "Resources: Investigation Guide",
 80    "Rule Type: ES|QL",
 81]
 82timestamp_override = "event.ingested"
 83type = "esql"
 84
 85query = '''
 86from logs-gcp_vertexai.auditlogs-* metadata _id, _version, _index
 87| where
 88    data_stream.dataset == "gcp_vertexai.auditlogs" and
 89    event.action like "*SetPublisherModelConfig*" and
 90    (gcp.vertexai.audit.status.code is null or gcp.vertexai.audit.status.code == 0)
 91| keep
 92    _id,
 93    _version,
 94    _index,
 95    @timestamp,
 96    event.action,
 97    cloud.project.id,
 98    source.ip,
 99    gcp.vertexai.audit.service_name,
100    gcp.vertexai.audit.resource_name,
101    client.user.email,
102    user_agent.original
103'''
104
105
106[[rule.threat]]
107framework = "MITRE ATT&CK"
108[[rule.threat.technique]]
109id = "T1562"
110name = "Impair Defenses"
111reference = "https://attack.mitre.org/techniques/T1562/"
112[[rule.threat.technique.subtechnique]]
113id = "T1562.008"
114name = "Disable or Modify Cloud Logs"
115reference = "https://attack.mitre.org/techniques/T1562/008/"
116
117
118
119[rule.threat.tactic]
120id = "TA0005"
121name = "Defense Evasion"
122reference = "https://attack.mitre.org/tactics/TA0005/"
123[[rule.threat_mappings]]
124framework = "MITRE ATLAS"
125version = "2026.08"
126[[rule.threat_mappings.threat]]
127framework = "MITRE ATLAS"
128[[rule.threat_mappings.threat.technique]]
129id = "AML.T0015"
130name = "Evade AI Model"
131reference = "https://atlas.mitre.org/techniques/AML.T0015/"
132
133
134[rule.threat_mappings.threat.tactic]
135id = "AML.TA0007"
136name = "Defense Evasion"
137reference = "https://atlas.mitre.org/tactics/AML.TA0007/"
138
139[rule.investigation_fields]
140field_names = [
141    "event.action",
142    "cloud.project.id",
143    "source.ip",
144    "gcp.vertexai.audit.service_name",
145    "gcp.vertexai.audit.resource_name",
146    "client.user.email",
147    "user_agent.original",
148]