Google Cloud Storage Buckets Modified or Deleted

 1title: Google Cloud Storage Buckets Modified or Deleted
 2id: 4d9f2ee2-c903-48ab-b9c1-8c0f474913d0
 3status: test
 4description: Detects when storage bucket is modified or deleted in Google Cloud.
 5references:
 6    - https://cloud.google.com/storage/docs/json_api/v1/buckets
 7author: Austin Songer @austinsonger
 8date: 2021/08/14
 9modified: 2022/10/09
10tags:
11    - attack.impact
12logsource:
13    product: gcp
14    service: gcp.audit
15detection:
16    selection:
17        gcp.audit.method_name:
18            - storage.buckets.delete
19            - storage.buckets.insert
20            - storage.buckets.update
21            - storage.buckets.patch
22    condition: selection
23falsepositives:
24    - Storage Buckets being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
25    - Storage Buckets modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
26level: medium