CONTROL: Security must be alerted on every new Owner or Editor grant on production GCP projects, whenever it happens.
detections/gcp-owner-grant.yml 1 │ title: Owner/Editor role granted on production project 2 │ source: gcp.audit.activity 3 │ detection: 4 │ selection: 5 │ methodName: SetIamPolicy 6 │ delta.role|in: [roles/owner, roles/editor] 7 │ resource.project|startswith: "prod-" 8 │ known_change: 9 │ request_metadata.ticket_ref|exists: true10 │ after_hours:11 │ event_hour|lt: 712 │ condition: selection and not known_change13 │ level: high
grc@ctrl-f:~$