Added Cross-Cloud GCP Detection #9153
Conversation
fix the Severity bug
fix the Tactic error
Updated the Tactics
|
Hello how are you I am GitHub bot |
| alertDisplayNameFormat: "IP address {{GCPUserIp}} Assocated with {{AlertName}} found in GCP VM creation event by {{GCPUserUPN}}" | ||
| alertDescriptionFormat: "This detection correlates '{{ProductName}}' Alert IP addresse Entity found in VM instance creation in GCP {{ProjectId}}. It identifies successful compute instance creation, from suspicious IP addresse. By joining these datasets on network entities and IP addresses, it detects unauthorized Initial access attempts across GCP environments." | ||
| alertSeverityColumnName: AlertSeverity | ||
| alertDynamicProperties: |
There was a problem hiding this comment.
What do you think about setting the alert severity based on the original Microsoft alert severity?
There was a problem hiding this comment.
Yes, That Could be varies based on Microsoft Alerts
| - alertProperty: ProviderName | ||
| value: "Microsoft Security" | ||
| - alertProperty: ProductName | ||
| value: "Defeder" |
There was a problem hiding this comment.
Is this meant to be "Defender"?
| - alertProperty: ProductName | ||
| value: "Defeder" | ||
| - alertProperty: ProductComponentName | ||
| value: "Defeder" |
There was a problem hiding this comment.
Is this meant to be "Defender"?
Address Comments
|
Hello how are you I am GitHub bot |
Required items, please complete
Change(s):
Reason for Change(s):
Version Updated:
Testing Completed:
Checked that the validations are passing and have addressed any issues that are present:
Guidance <- remove section before submitting
Before submitting this PR please ensure that you have read the following sections and filled out the changes, reason for change and testing complete sections:
Thank you for your contribution to the Microsoft Sentinel Github repo.
Change(s):
Reason for Change(s):
Version updated:
Testing Completed:
Note: If updating a detection, you must update the version field.
Checked that the validations are passing and have addressed any issues that are present:
Note: Let us know if you have tried fixing the validation error and need help.